One of Rohos Logon Key for Mac users, Alex, has volunteered to make a video about the program. Looks like it turned out to be a success for a young Mac user. From his video you will learn that “Rohos Logon Key turns any USB into a key to unlock your computer.” So whenever you do not want to type in your password just like Alex has confessed, plug in your USB.

Rohos Logon Key for Mac benefits:

1. To unlock your computer just plug in your USB
2. Going for a break or lunch just pull the USB key out and the program will do whatever you want to (preliminary setup is required):
   1. Shut down
   2. Goes to sleep, etc.

Alex demonstrates how Rohos Logon Key looks and works on Mac:

• Showing Rohos Preferences window
• Setting actions upon USB key removal
• Possibility to turn Rohos Logon Key OFF in case your USB key is stolen
• Possibility to add new USB keys to access your computer is amazingly fast!

Thank you Alex and success to you in all your undertakings.

In brief, BioSlimDisk is a USB flash drive with hardware level encryption (AES 256 bit key length) and hardware level Biometric authentication.

On the Manufacturer web site (RiTech Inc.) you may learn the features listed below with our comments:

• Protection using Biometric Area Sensor
  Your fingers are the only authentication means to access the USB flash drive data. There is no backup password to access the device in emergency case.
• 2 Admin and 4 User fingerprints
  This is the obligatory configuration: Administrator should enroll (register) 2 fingers. Users should enroll 4 fingers. Without this enrollment the device is not working. And even more - these 2 or 4 fingers should NOT be the same fingers.
  BioSlimDisk’s hardware-level Biometric Authentication module controls this enrollment and doesn’t allow using it without complete enrollment been done.
• Dual-fingerprint authentication
  In order to access the USB drive data user needs to enroll 2 fingers. This should be 2 different fingers from those 4 fingers that were enrolled by the user during setup.
• Uses Dual authentication methodology
  Again, the hardware level Biometric Authentication module is designed to authenticate user or admin by 2 fingers (from 2 or 4 fingers enrolled on setup). It requires user to touch biometric sensor by 2 fingers, one by one. If user fails to authenticate by one of the fingers 3 times in a row, the device power-off itself so you need to reconnect it to USB port.
• Self-Destruct, Tamper protection and Chip-based Hardware AES 128 Encryption
  The device self-destructs itself after 7 unsuccessful verifications and automatically turns off (i.e. 7 * 3 failed fingers). Also the chip itself has a tamper protection, i.e. when it detects a hardware protocol malfunction or intervention it destroys itself immediately. So in order to re-engineer the hardware you need to have a dozen of sticks for experiments.
• True Driverless zero footprint technology (runs on all platforms e.g. Linux, Mac OS X, All Microsoft Windows, Solaris, etc.)
  That is the almost amazing feature of this device. When you connect BioSlimDisk into USB port it gets the electrical power and turns-on the hardware-level Biometric Authentication module. After successful fingerprints authentication BioSlimDisk turns-on the USB flash drive with AES encryption.
• Hardware level data encryption.
  All data are encrypted/decrypted on-the-fly when you work with the token. AES key is generated after token Administrator enrollment.

The illustrations below show how it works and how it differs from other Secure USB flash drives with fingerprint authentication:

BioSlimDisk device authentication work-flow contains 2 steps:

On the picture:

1. Only hardware-level Biometric Authentication module is activated upon plugging the device into USB port. It performs fingerprint authentication before goes to step 2.
2. Biometric Authentication module turns on the USB flash drive. The device appears as a regular USB removable drive in computer.

The important part is that authentication is proceeded inside the device.

Let’s take a look at authentication work-flow of other USB flash drives equipped with biometric access control. Those that we have tested before: Apacer, Transcend JetFlash, TakeMS Scanline, Silicon Power:

There are 3 steps on the picture:

1. Upon plugging the device into USB port the device turns-on Drive D:\ - CD-ROM drive with an authentication and enrollment software. And also it gives access to the Drive Y:\, this is an open-part of the entire drive (user defines this open-part during setup).
   In order to access secure Drive X:\ user starts the Authentication software from D:\
2. Authentication software uses a Fingerprint scanner from the device.  The Software (or Hardware part) identifies fingerprints. Or there is a back-up password in case you don’t want to use fingers.
3. The Authentication software (or Hardware depending on the model) makes a decision to turn-on the secured drive X:\.

As we see this authentication work-flow may have some vulnerabilities depending on the implementation:

• Software-level biometric authentication. It’s possible to sniff the USB-traffic and re-engineer security protocol to find security holes or issues that maybe used to access Secured Drive X:\ or change internal configuration of the device.
• It’s possible to recover a Back-up password by using a brute-force attack. As there are no attempts limit.  And looks like hardware-part doesn’t control it.

After this comparison we see why BioSlimDisk doesn’t require drivers and is compatible with any OS - it doesn’t use any software-component. The second important thing is that internal configuration of the BioSlimDisk cannot be changed other way except the Authentication Module interface.

How strong Hardware Authentication could be?

From our experience with Biometric technology we know that it is not possible to use fingerprint or any other biometric material to generate AES encryption key and to use it then in encryption process. So it looks like encryption keys are stored somewhere on the BioSlimDisk chip.  Therefore BioSlimDisk’s authentication hardware just compare biometric materials to make a decision to begin decryption process by using a stored AES key.  This is not an ideal security protocol.

Depending on hardware implementation getting the AES key may be a trivial job for a smart hardware engineer. Then the flash drive chip could be connected to regular USB flash drive board and decrypted by software. But new generation of BioslimDisk uses a chip based tamper protection makes chip hacking harder.
Read here the interesting story about hardware level security system of the 1st generation BioSlimDisk and other devices.

BioSlimDisk Administration

The BioSlimDisk is designed to have an Administrator and Regular User.  I should mention here again that the device Authentication module checks the configuration and forces to make all necessary enrollments before normal use.

In order to run BioSlimDisk in Administration mode you should use side switcher as shown on this picture (on the picture switcher is in user-mode):

BioSlimDisk has side switcher on its case that controls whether it’s a regular use or administration use (re-enrollment). In Administration use the device also requires biometric authentication and then allows to re-enroll user or admin.

Normal usage

In normal usage when you plug the device into USB port the small LED lights show the status.

Flashing blue indicator - the device waits for a valid fingers:

The green indicator flashed - the finger gets successfully authenticated, go on with the second finger:

after all 2 fingers authenticated successfully the LED lights are off and USB flash drive letter appears in Windows or Mac OS X.

You have only 3 attempts for each finger to be recognized successfully. If you make 7 failed attempts (with the device reconnection) the device can be blocked forever (all indicators are flashing).

On the photos you may have noticed how I place my finger -

• As I connected my BioSlimDisk right into my MacBook it’s very comfortable for me to place fingers as you see on photos - across the device.
• Manufacturer advise to use USB extension cable with the BioSlimDisk and put fingers along the device.
• In my tests I found that you may put fingers both ways, and even mix the way how you put the fingers (along or across).
• It’s very important to remember which fingers and which way were enrolled during setup. The fingerprint scanner uses  plain logic and doesn’t rotate thumbnails in the memory before verification

In order to close access to the BioSlimDisk memory you need to unplug the device. Please note: even if you restart\sleep your PC or Mac the device may stay as authenticated/open.

Windows Seven reported data transfer speed as 2-15 mb/sec.

Resume:

We found BioSlimDisk very secure and comfortable USB flash drive. The dual-authentication principle enforces users to keep high level of security thus leaving no chances for bad guys.  The Administration mode makes this device suitable even for small corporates that need protected portable storage with a central Administration features.

The regular users may enjoy the portable security offered by BioSlimDisk that doesn’t require administration privileges to be used on public PCs. The Admin/User feature may be reused here to share the device between family members.

The only-hardware authentication makes the device security unbreakable for regular software-based hackers, but depending on the hardware authentication module there maybe chip-based vulnerabilities.

Photos

The token is manufactured in China by a startup company since 2008. They have web site in Chinese and English office in USA.

The token doesn’t require any driver because it works like USB-keyboard chip that generates and auto-types OTP string. So this OTP will appear in a currently focused input filed (On Windows/Mac/Linux etc. systems that support generic USB-keyboard device).
The same “auto-typing” technology is used by YubiKey and pcProx Sonar, AIR ID Writer/Playback devices by “RF IDeas”.

How does it Work

• When you connect it to USB Port it auto-generates a string:
  “explorer “http://umikey.com/zh_t.php?otp=eceddk….”
  that ends with an OTP value.  As you see this string auto-navigates user to umikey.com first.
  (this behavior can be disabled or changed).
• Later you can press on a small button on Umikey to generate OTP once again.
• Umikey generates  OTP based on Encryption algorithm (AES).
• UmiKey configuration can be changed with a Writer Tool (set static OTP, AES key, auto-navigation, etc.). The good sign is that internal configuration can be protected with a password.
• See detailed specs and what’s new in the latest Umikey v.3.0.

Umikey OTP is 48 characters length -

“eceddkcjfjjjncctgbtkfhrkgfetbenintekijiedrfhvfee”

It contains UmiKey version, ID and encypted part: the counter, number of button presses, also times of insertion and removal from the USB port, and the crystal ticks counter.

Security Evangelist Dr. Fredrik Björck in his blog shares security review of YubiKey OTP token.  The issues that were found are also related to Umikey. We tested the security-issue when “Generated OTP is valid regardless of time” and it doesn’t work for Umikey as well as for Yubikey right now. While some of issues maybe removed by properly configuring the token others are independent from user-side (they are on the server-side).

Authentication availability

Currently UmiKey is available to authenticate into a few Web services, Password Managers and Windows (see how Rohos Logon Key supports UmiKey).

The UmiKey web site provides a quick and detailed integration guides for web-developers and solution providers.

Umikey Price is 9.99$, a few colors as well as customization options are available. Visit site: umikey.com

Photos

We could say that Umikey better fits into USB port and doesn’t loose contact while you touch it. This is because UmiKey has a non-flat USB connection part.

• Users won’t insert it up side down to the USB port
• The button is clickable and therefore token gives user a sense of confidence.

From the Yubikey and slim-sized USB Flash drive experience we know that the Key may loose USB contact for seconds thus making user to reconnect the device.

Let’s compare it with Yubikey OTP token:

In the video is presented how you may work with encrypted partition on a PC without admin rights using free portable encryption solution, Rohos Mini Drive, that securely protects your portable data on any USB device. Portable utility Rohos Disk Browser gives you opportunity to work with your sensitive data on USB in a usual way on any PC (even on internet cafe, where you don’t have admin rights).

In the video you will see:

• Opening Encrypted part of USB drive by a password.
• Opening files (with on-the-fly decryption) with associated application.
• Saving files with on-the-fly encryption from application.
• Playing mp3 files.
• Browse all photos from a folder in thumbnail view (by using Virtual Folder command).
  
• Launch portable applications.

With this functions Rohos Mini Drive is the most wanted tool for portable data security recommended by many bloggers and magazines.

There are few different types of MiFare that Rohos can support but we have carried out tests with MIFARE Classic (Standard) 1K in smartcard factor. There are also label like tags (like touchatag).

Rohos Logon Key allows using MiFare for 2 factor authentication for Windows and Corporate Network.

How to try MiFare support:

• Update Rohos Logon Key
• Open Rohos Logon Key  main window, click on “Options”
• Choose “MiFare 1K RFID” USB Key device
• OK

Notes on Mifare support:

• Rohos uses data block #1 to store 10 byte vector. Using default Key A (”FF…”).
• Rohos uses data blocks #8 - #50 to store rohos logon profiles (528 bytes max).
• “Change PIN” command changes Key A to PIN value (6 bytes) of the #8 - #50 trailer blocks.

By default Rohos is able to use default Key A to read/write card without asking for a PIN code. If PIN code is changed then it will be asked each time Rohos accesses the card. PIN code 1111 could not be used.

The sample of NFC Reader ACR122 and sample of MiFare cards were provided by our partner Futako Co, LTD.

Download Rohos Logon Key 2.8 beta. (for Windows 2000, XP, Vista, Seven)

Rohos team thanks you for your interest towards Rohos products and wishes you the best in this upcoming year 2010!!! Thank you for being such a wonderful group of users.

And before leaving for a short holiday we’d like to announce our New Year Special offer. You may learn more about it here. Best regards, Rohos team

Rohos Disk Encryption creates hidden and protected virtual partitions on computer or USB flash drive and uses NIST compliant AES encryption algorithm, 256 bit encryption key length. Encryption is automatic and on-the-fly.
Robust and best portable partition encryption software has several key benefits over its competitors:

• “Оn-the-fly” encryption on PCs without administrative rights
• Connect/disconnect virtual drive by plugging in/off USB key
• Virtual keyboard - protects your encrypted disk password from a keylogger

“The solution provides unsurpassed data security and protection, enabling to exceed our customer’s information privacy expectations with a solution that is both cost effective and easily managed,” said Alexander Silonosov, General Manager, Tesline-Service. “Portable platforms and removable media remain at the heart of today’s security concerns. We are able to offer our customers the best possible solution to keep their data safe. Rohos Developers have managed to bring portable data encryption security to an exceptional performing level by implementing new technology - File Virtualization.”

“On the fly” encryption without administrative rights

Rohos Disk Encryption allows opening files from Rohos Disk Browser in associated application without first decrypting them into temporary folder. Rohos Disk virtualizes file presence for the application, thus it works with encrypted file by using “on-the-fly” encryption principle:

• Double click any file to open it immediately in associated application and work with it in a regular way.
• Open big files (for instance watch an encrypted AVI file, listen to music).
• There is no ‘un-encrypted’ data traces left behind on a Guest PC or unsecured part of USB flash drive.

For more information, please visit: http://www.rohos.com/2009/10/on-the-fly-encryption-without-admin-rights/#more-2056

About Rohos Disk Encryption

The program creates hidden and protected partitions on the computer or USB flash drive. Those who have megabytes of sensitive files and seriously concerned with data security, can not imagine their computer or USB drive without the hidden partition that is created using this wonderful tool. Protects sensitive data stored on desktops, laptops and removable media, such as USB thumb drives and CD/DVDs. Rohos Disk Encryption also supports and manages hardware-encrypted disk drives. For more information, please visit: http://www.rohos.com/products/rohos-disk-encryption/

The Personal Version costs – 35$, and PRO version – 49$. It’s 30 day trial version.
Download: http://www.rohos.com/desktop-security/rohos.exe
System requirements: Windows XP / 2000 / 2003 / Vista/ Seven
Screen shot: http://www.rohos.com/1/wp-content/uploads/2009/09/rohos-disk-main.jpg

About Tesline-Service

Tesline-Service S.R.L. (former Teslain ltd.) was founded in 2000 to meet a growing need for IT services in Eastern Europe. In 2003 we started developing a family of Rohos products - Computer Data Security and Access Control software. Our motto is IT security with the Key in hand! For more information, please visit http://www.rohos.com

All product and company names herein may be trademarks of their respective owners.

Press contact:
Natalia Culaeva
Business Development Manager
(+37322) 74-02-42
soft2@rohos.com
http://www.rohos.com

So Just How Personal Is Your Personal Computer?

The amount of information your computer stores is astonishing - your credit card information, personal and professional data can be open for grab. Protect yourself by taking measures brought to you by Rohos Logon Key Windows and Mac versions.

This time we’d like to present you a short review of a new device, BioSlimDisk Signature, that was kindly provided to us by its manufacturer RiTech International Ltd.

With the help of this device along with Rohos Logon Key you’ll have a truly seamless secure login solution for:  Identification, Security and  Access Control - three-factor authentication solution for Windows and Mac.

The device itself represents a pretty massive flash drive though it’s light. There are Biometric Area Sensor, LED lights (orange, red, green and blue) and side switcher on Signature case. Before plugging in the device and configuring it for authentication it’s recommended to carefully read instructions. I took this task carelessly and later had to “struggle” with the device for 3 hours to be able to use it. The specificity of BioSlimDisk Signature is that it’s not accessible till three of your fingerprints are successfully enrolled (truly ultimate protection ). Below you’d be able to find a small guide on how to set up this device in Rohos Logon Key and its review after one month of using on both Windows and Mac platforms.

BioSlimDisk Signature features:

• Protection using Biometric Area Sensor
• 2 Admin and 4 User fingerprint
• Dual-fingerprint’
• Uses Dual authentication methodology
• Unique Self-Destruct Tamper protection with Chip-based Hardware AES 128 Encryption
• True Driverless zero footprint technology (runs on all platforms e.g. Linux, Mac OSX, All Microsoft Windows, Solaris..etc)
• Preloaded with Security Software Installer:
  • Drivelock
  • Rohos Logon Key

How to set up BioSlimdisk for secure Windows login

Secure 3-factor login: Fingerprint verification + Your USB Key + PIN code

NB! Preliminary BioSlimdisk setting is required (please, see the instructions in the user manual). Only after the device is plugged in and appears in the system as a removable drive the setup is possible.

• Download  and install Rohos Logon Key
• Open the program’s main window
• Click on “Set up USB Key”. The program will automatically detect the device.
• Enter your Windows password. If you do not have it, you should create one beforehand. Click on Setup USB Key and then OK.
• Now in Rohos Options window you may choose the action upon the USB key removal (e.g. Lock computer, Turn off, etc.) Click on OK. The reboot is needed.

Protecting your BioSlimDisk with PIN code

• Click on “Set up USB Key” in program’s main window.
• In the “Setup USB Key” window click on the link Change PIN code. Enter PIN code. Press OK. Confirm PIN code. Press OK.

Using PIN code remember that it has limited number of input attempts – it’s ONLY 3 (three).

How to set up BioSlimdisk for ultimately secure Mac login

Turn BioSlimDisk into security key for your Mac

NB! Preliminary BioSlimdisk setting is required (please, see the instructions in the user manual). Only after the device is plugged in and appears in the system as a removable drive the setup is possible.

• Download and install Rohos Logon Key for Mac
• Click on Rohos icon in status bar and then “Add USB Key…”. The system automatically detects the plugged BioSlimdisk (with its serial number).
• Click on the device serial number and then press “Choose USB”. Authorization window will pop up. Insert your User name and Password. Press OK. The USB Key has been configured.
• Now you may set up Action upon USB Key removal. Click on Rohos icon in the status bar and choose “Open Rohos Logon…”.
• In the main program’s window click on drop-down box and choose one of the USB Key removal actions (e.g. Lock the desktop, Log out, Sleep, etc.)

Rohos Logon Key provides three-factor authentication for your Mac - Fingerprint verification + USB Key + PIN code

• In the main program’s window click on “Change PIN”.
• Type in your Old PIN (if there was one before, if not leave the field blank), then New PIN and once again new PIN. Press Change PIN. Now the PIN code is set.

Using PIN code remember that it has limited number of input attempts – it’s ONLY 3 (three).

Security benefits:

• Replaces weak password based login with a hardware USB key
• Uses big password, without the need for remembering it
• Your Windows/Mac desktop stays secure even when you just step away.
• Secure 3-factor login: Fingerprint verification + Your USB Key + PIN code
• Use a single USB Key to log into your Home PC/Mac, laptop and office computer

My own experience with BioSlimDisk:

The device is truly  driverless and it’s possible to run it on all platforms, in my case Windows and Mac.  I have found for myself very hard configuring the device.  One of the reason is that User manual provided with it does not cover all nuances and possible mistakes a user might make while setup. So I’d recommend preliminary to watch the video made by the manufacturer and only then to “play” with the flash drive. What exactly gave me a headache is BioSlimDisk fingerprint registration procedure. It’s written nowhere that while registering your fingerprints you should not slide your finger through but place it and keep on Area Sensor for a few seconds. Another annoying thing is that for different function 1) normal and 2) enrollment you always have to move the side switcher. Ha, and if you think that it’s an easy task you’d be surprised to find that it’s not possible to do it with your fingers. I had to use a paper clip And again I had to struggle while placing fingers - let’s say the device recognizes your first fingerprint but if it doesn’t recognize your second one from the second try, you’d have to unplug and plug back the device and start from the very beginning. So I guess all these makes it “the safest USB device available” (the quote is taken from BioSlimDisk video). I have to admit that it’s truly hard to have access to the device even for the new-owner of one and I’m sure impossible for a thief. It also important to mention that the manufacturer encourages to use a cord (they even provide one with the device) instead of just plugging Signature in right into the PC/Mac USB port.

But to my mind this device has some disadvantages:

1. If the Area Sensor is broken even the Manufacturer could not recover Signature as it is designed to have no backdoor (password).
2. If the Signature is in Self Destruct Mode and there were tamper attempts or multiple false fingerprint attempts, the device will be showing traffic lights LED sequence or 4 LEDs blinking simultaneously. This is impossible to recover, even for the Manufacturer.

Summary:

If you wish to have an unbreakable access security of your machine and you are very pedantic, BioSlimDisk would be a perfect device for you.

During the past week we were working on Rohos Logon Key for Mac improvements. And today we have published an updated release 2.1. It includes updated version of authorization plugin for Maс OX S Snow Leopard.

What’s new:

• New UI. Now Rohos Logon uses a standard authorization dialog view.
• Fixed bug with screen saver unlock dialog.
• Fixed bug when Rohos Logon did not mount FileVault encrypted home folder.

Download and install over: rohos_logon.zip v.2.1

Are you using Mac? You’d be glad to learn that we have just released new Rohos Logon Key v. 2.0 for Mac OS X to ensure safe and secure authentication. It works for both Leopard and Snow Leopard versions. We are here working hard to provide you with the very best services we can and we look forward to continuing to do so into the future.

With this completely new version Rohos Logon adds convenient authentication security for Mac OS X login and unlocking after a screen saver. But also works like a security Key for privileged operations made by the user during installing software, changing system preferences, etc. So you don’t need to enter your password manually in most cases.

What’s new:

• Re-implemented login screen. Now Rohos Logon replaces Mac OS X logon screen.
• “Screen Saver Password” dialog box is replaced by Rohos Logon.
• Rohos Logon dialog box also replaces System Keychain authentication dialog box. This dialog box authenticates almost all privileged operations made by the user (installing software, changing system preferences, etc.).

Download Rohos Logon Key for Mac 2.0: rohos_logon.zip

Other Release notes:

• We have made some minor improvements. And still working on better localization support.
• This release can be installed over existing Rohos Logon v.1.*
• Please, note that Rohos Logon Key installation script changes etc/authorization file (backup copy is named authorization_copy).
• Once you logged-in without USB key (by manual password entry) then USB Key removal actions are not working until next logon.
• If you check off the “… password protected screensaver upon usb key removal” option then Rohos Logon uses its own black-styled lock window. To unlock you need to use USB Key or hard-key-restart if you don’t have USB key.

For Snow Leopard: Rohos Logon replaces password prompt dialog box after screen saver. But in some cases the user name/password fields are read-only. In order to to unlock Maс you need to use USB Key or press “Switch user…” button and then unlock via Login Window (by a USB Key or password). This issue already has been reported to Apple support.

Rohos Logon Key System Keychain authentication dialog box: