After 20 incorrect PIN entries, the drive will erase its encryption key, rendering its stored data uselessly scrambled. The drive will lock itself after 10 failed tries (with a secondary procedure that grants ten more tries).

As a continuous improvement, Apricorn is locking down the firmware on all USB controllers used in Apricorn devices to safeguard against this vulnerability.Protection from brute-force attacks is provided in three layers: After five incorrect PIN entries, you must power-cycle the drive. Apricorn's devices shipping today, including all of our USB 3.0 security products, Padlock and Padlock Pro families already have the firmware locked which prevents field updates to the USB controller.

According to SR Labs, the failsafe method to eliminate this threat is to simply disable the ability to update the controller's firmware. The attack described is very sophisticated and in the case of Apricorn's products would require advanced knowledge of our USB controller, a leaked version of our firmware, the programming tool to update our controller, the password used for our programming tool, and an in depth understanding of the device's functionality, etc. SR Labs demonstrated a vulnerability in one USB device that allowed malicious code to be programmed into the USB controller through a firmware update process. In the event that no recovery PINs were set and both the User and Admin PINs are forgotten, the drive can be reset and used again but all of the device's data will be lost as a result of the reset.īadUSB is a theoretical exploit that was presented by SR Labs at the Black Hat conference in August of 2014. Additionally the Admin can generate a new User PIN(s) from within the Admin mode. If Recovery PINs were not created at initial setup, the Admin PIN can be used to unlock the drive and recover the data. Once the new User PIN is set up, you will be able to unlock the drive and access your data. If your drive was issued by your workplace, your IT Administrator/Help Desk should be able to provide you the recovery PIN. If you forget your original user PIN, the recovery PINs will allow you to create a replacement User PIN. If your device has a “Configurable” symbol on it, up to 4 recovery PINs can be programmed onto the device (typically by the Admin during initial configuration). Follow the steps in the manual to remove the User PINs (which will also remove all recovery PINs and self-destruct PIN) and then add new User PIN(s).

Aegis padlock