The use of Smart Cards for user authentication is considered to be the strongest form of authentication and combines something physical (Smart Card) with confidential information (PIN) to provide what is known as “two-factor authentication.” Rohos Logon Key along with MiFare is a perfect solution for companies with environment that requires many employees to log into just one or only a few PCs. It will help thousands of organizations balance user convenience with strong security to create a competitive advantage and maintain trust within the enterprise.

The solution provides one of the most advanced authentication solutions available, using RFID smart card technology with the following benefits:

• Avoid constant friction wears away the interface between token and PC
• Possibility to use Mifare token with Rohos Logon Key as an Access Card used in the community, company
• Supports Remote Desktop login using Microsoft Remote Desktop Control utility

“We present a highly secure, tamper-resistant and mobile solution to provide access to specific Windows environment. Our task was to add the additional layers of security without negatively affecting the way people are used to work,” said Alexander Silonosov, General Manager, Tesline-Service. “Not only does the smart card authentication solution from Tesline-Service make the physical transition trouble-free, but it also allows your IT department to spend far less time with administration of both local and remote network access.”

“At each workstation Rohos Logon is used for secure two-factor authentication to gain access to a single PC or network. By consolidating physical and network access into a single solution users are able to ensure a high level of compliance internally and fewer calls for support,” said Hugo Yeh, the CEO, FUTAKO CO., LTD. “Bottom line is, this version of the software has worked flawlessly for us even with our strict requirements.   We are not aware of any similar product that meets all these requirements.”

Requirements & Important Notes:
A Smart Card reader is required: ACS ACR122 and SCM SCL010 RFID readers on Windows XP - Seven (x86-x64). The program is easily integrated into any existing RFID devices used in a company.

About FUTAKO
Futako is the software company from 2003 in Taiwan specializing in providing clients business consulting, systems integration and development services.
Our knowledge of banking systems helps our client to generate revenue, reduce costs and access the information necessary to operate their business on a timely basis. Due to a business chance, Futako start to offer the Smart Card SDK product in 2006, and offer the related products for Taiwan market. The product can help the developer to easily complete smart card solution. For more information, please visit http://www.futako.net

About Tesline-Service
Tesline-Service S.R.L. (former Teslain ltd.) was founded in 2000 to meet a growing need for IT services in Eastern Europe. In 2003 we started developing product line of Rohos - Computer Data Security and Access Control software. Our motto is IT security with the Key in hand! For more information, please visit http://www.rohos.com

All product and company names herein may be trademarks of their respective owners.

Press contact:
Natalia Culaeva
Business Development Manager
(+37322) 74-02-42
soft2@rohos.com
http://www.rohos.com

Rohos Logon Key for Mac is two-factor authentication solution that allows secure Mac login, keychain access and desktop unlock with a USB key.

Thanks to  useful and plenty of users’ feedback Rohos Logon Key for Mac has undergone some improvements. Today we publish version 2.3.

Download and install over Rohos Logon Key for Mac v.2.3

What’s new:

• Improved Spanish localization
• Now Rohos Logon does not automatically unlock System Keychain. It just fills in user name, password then user needs to click OK to confirm the privileged operation.
• Rohos Logon Icon in the status bar is hidden by default.
• Fixed Yubikey support that leads to system hang in some cases.

Rohos Support team had been receiving multiple requests from users to add Windows Seven x64 support to Rohos Face Logon - solution that helps you easily and securely log into Windows by using a web camera as a face recognition device.

Download v.2.7

Rohos Face Logon v.2.7 has undergone several updates:

• Added Windows Seven x64 support
• Added Simplified Chinese language UI

Now all these are available in Chinese language.

欢迎访问Rohos中文网站 -  http://rohos-cn.com/

Are you looking for a special offer? Check out our Special Offers from Rohos page.

We love to share. So we regularly update this page with our newest promotions. It’s the best place to find the right deal for you.  Start saving now. ->

Take advantage of these special offers!

The Kanguru Defender is a highly secure hardware encryption device that might meet or even exceed your security pretensions. Comparing it to previously reviewed IronKey we should emphasize that it’s easy to use and quite affordable - $49 USD.

Kanguru takes two-step approach to securing sensitive data:

1. At the device level Kanguru starts with military grade hardware based AES encryption.
2. Adds the ability to remotely manage your Kanguru Defender from a central location. The Kanguru Defender does not come with KRMC enabled by default. (for more information about KRMC, visit: http://shop.kanguru.com/index.php/flash-management/krmc)

Main features:

• Password protected and encrypted data partition for your secure files
• Does NOT require Admin privileges on any PC to open secure partition.
• Write protect switch (actually this may safe you from viruses on guest PC)
• Has only 1 secret drive. There is no Open and Secret partition options.
• Password reset allow to turn USB drive configuration into factory defaults and create new password once again.

Secure 2-factor authentication for your Windows PC

At this point it’s important to remember that Kanguru KDF  should be properly set up before being used with Rohos Logon Key. It’ll take you not more than a few minutes. You’ll be asked to set up password and complete Setup Wizard. There is not much information about Kanguru Defender in Internet though to my mind it’s an easily managed and usable device that requires not any additional complicated User Guide. You may find all necessary information in Quick Start Guide that’s provided along with the device. The important part in correct setting of the flash drive plays manual write protect side switcher - if it’s set to lock (switched away from the USB connector) it must be set to the open position in order to set up Kanguru Defender Manager.

Authentication solution: with Rohos Logon Key + Kanguru

If you are a lazy user who doesn’t want to remember PIN code and PIN is a must if you wish to have strong two-factor authentication, you may as well use Kanguru Defender as a secure USB key for login into the Windows.

Plug in the device - in “My Computer” you will see two drives: virtual CD-ROM (F:) and empty removable drive (H:). One of the drives, namely Removable Disk (H:), is the Secure Partition. In order to open secure partition H: you should run KDM.exe file from CD-ROM (F:).

Click on KDM.exe twice and Kanguru Login window will pop up.  Type in your Kanguru password and secure part of the flash drive is open now.

Only after the device is plugged in and mounted, the protected part appears in the system as a removable drive (SECURITY (H:)) and the setup is possible.

• Download  and install Rohos Logon Key

• Open the program’s main window
• Click on “Set up USB Key”. The program will automatically detect the device.
• Enter your Windows password. If you do not have it, you should create one beforehand. Click on “Setup USB Key” and then OK.
• Now in Rohos Options window you should click on “Choose start-up program” link, choose KDM.exe and click Open. And then you may choose the action upon the USB key removal (e.g. Lock computer, Turn off, etc.) Click on OK. The reboot is needed.

How it works

Upon system startup plug in your Kanguru Defender. And you’ll be prompted to enter your password (see screen shot)

Type in your Kanguru’s password and click Login button. The secure part mounting process is initiated and your Windows login is done fast and smoothly.

Summary and the device review:

I really enjoyed the simplicity yet safety Kanguru Defender provides. The device is easily set up and used yet strong Hardware based AES encryption makes it a reliable USB drive and data storage device.

A handy thing that really makes the device utilization convenient is Kanguru KDF icon that appears right after you have successfully logged into KDM. You may find the icon in the system tray near the clock. Right mouse click on it and you may open the secure partition by clicking on Explore Security Drive, change Security Settings, choose Language (whether English or Deutsch) and the last but not the least Unmount Kanguru Defender:

The manufacturer warns “Do not disconnect the Kanguru Defender without first properly unmounting your device. Doing so may result in file damage or corruption.” Then they suggest using the “Safely Remove Hardware” option from system tray otherwise there is risk corrupting the data. I must say that I had unmounted the device improperly a dozens times and it did not influence my files at all. Guys, just remember that I said it just for your information but not as a guide to follow.

One more thing that should be mentioned. While running tests for a period of several weeks I had an issue with using Kanguru + Rohos Logon. If you set up in Rohos Logon options window “Lock computer“  as the action upon the USB key removal and remove the drive without first unmounting it the desktop gets locked. And after plugging Kanguru back and entering the password the program gives error message:

And as I have mentioned earlier it did not influence my data on Kanguru KDF.

Unfortunately, we couln’t test the ability to remotely manage Kanguru Defender from a central location. Thus no comments about it.

Сitation:

“In our office the CPUs are under the tables, but USB cords are out on the tables for USB plugging convenience. When you need to plug in another USB device (for example your camera) the USB key should be temporarily unplugged (there is such option in Natural Login, it’s called keyless mode). It helps to prevent immediate access lock but in return it locks the machine let’s say after 3 minutes”

Now Rohos Logon Key has the same option - for the time being it’s available only through registry (USB_Key_remove_behaviour, see UserGuide).

How it works:

• Upon USB key removal nothing happens.
• In ## seconds (see USB_Key_remove_behaviour) the program locks computer and right away tries to unlock it with USB key.
• If there is no key plugged in, the computer stays locked.

The Yubikey is a One-Time-Password token that works via the USB keyboard interface. New generation of Yubikeys also combines 2 devices in 1 Yubikey: OTP + RFID or OTP + 1 static password generator. OTP + OATH OTP (Firmware 2.1). Also Yubikey has many changes on backed.

What’s new in Yubikey 2.0:

• Improved security. Here you can find out what were discovered and fixed.
• Yubikey allows to have 2 configurations. Many YubiKey users wanted to have possibility to use YubiKey as static password generator + OTP token. Here it is.
• Beautiful and easy to use Configuration Utility.
• Dual-device: Yubikey + RFID (Classic Mifare 1k) or OATH 6 or 8 digit code identity.
• New Yubico validation server:
  + allows uploading custom AES keys.
  + allows revoking Yubikeys
  + Validation protocol 2.0
• Yubikey solutions Wiki - the list of the vendors, integrators and software that work with Yubikey.

Configuration Utility

allows reprograming Yubikey Configuration #1 or  Configuration #2.

Second Configuration

YubiKey 2.0 works in the press-and-hold fashion.  First off, the presses are time based. Where in v.1 you held it down until it started printing out the characters, with v.2.0 you make short press for the first config and long press (2.5 - 5 seconds technically) to generate second config OTP. Please note Yubikey configuration #2 has a feature allowing use to update static password if you press and hold the key for 8-15 seconds.

By default, Rohos Logon Key works with v.2 as usual but one customer was sent raw YubiKeys (version 2.1.1 not being configured) . So he asked us to give a step-by-step guide on how to set up YubiKey with Rohos Logon if Yubikey is not configured with OTP.

Here you may download the Guide - Yubikey 2.0 Setup Dynamic configuration for Rohos Logon with static AES

More photos

Security Features that are worth to be mentioned:

• Self-Destruct Sequence
  We believe it will self-destruct if any hardware reverse-engineer will try to hack it (or even disassemble it). Similarly, after 10 consecutive incorrect password attempts your IronKey will self-destruct using flash-trash technology.
  We didn’t test this feature
• Anti-Malware and Autorun Protection
  IronKey has 2 useful options to protect your information against viruses and unauthorized access: 1) It detects and prevents autorun.inf execution from IronKey.  2) User can unlock IronKey partition in a Read-Only Mode. 3) IronKey is automatically locked after inactivity period.
• Portable Cross-Platform Data Access
  We have used IronKey on Windows and Mac OS X and certainly confirm easy file access on both of these platforms. But  we have noticed that ‘Lost and Found‘ text was lost. Somehow it gets erased and disappear. Maybe this is the S200 issue.
• Secure Data Backup and Recovery
  It has several levels of back-up that makes IronKey’s user life a bit complicated. In all cases user should remember additional passwords and keep in mind some rules, the main is - you do not get your data from backup till you buy new Ironkey.
  
• Self-Learning Password Management
  Securely store and back up all your on-line passwords as well as Applications passwords (Windows Only) as you go with the IronKey Identity Manager.
  If you already use Password Manager you can place it on IronKey and use it.
• IronKey forces you to keep in mind (or paper) one more Password
  During IronKey setup it prompts you to create an Online Security Vault account for backup purposes. Users could not ignore this invitation - and here you are, there is one more account/password in your mind. And there is no sense to store this password in IK.
• If you lost your IronKey device IronKey Inc. would force you to buy another one in order to get your backup data back.
• IronKey Forum!
  We saw people ask IronKey team about new feature or improvements and they implement it.  On the forum you may also have a discussion with IronKey developers. This is cool.
• Virtual Keyboard.
  It designed to be universal for all Applications and Web forms thus it doesn’t save from Password steal, it just saves your password from being transformed into Key - Strokes that are generated by the keyboard (and then recorded by keyloggers).
• Lost & Found text.
  We discovered that it may disappear time from time, as you connect IronKey for the 1st time to a guest PC (bug or feature?).
• PKCS11module
  It is half implemented that is why it cannot be used in Rohos Logon Key as PKCS11 token.
  

To see this kind of features list and say that this flash drive is highly secure is an understatement - neurotically secure is probably closer to the truth.

Here is our IronKey info before upgrade:

After upgrade:

IronKey Preferences:

IronKey S200: Security Notes.

Though you might be impressed by the features but even such uncrackable USB flash drive has its glitches. And we have come across several ones.

There are many Ironkey reviews across the web resembling each other, listing IK features, and you can easily find one of them. We would like to discuss a few issues that we have noticed.

Big software part

This is the most “software preloaded” USB flash drive we have ever seen. It has many Windows, Linux and Mac OS modules and files. It has also firmware upgrade feature. Most of the files are for Windows. What does it mean for us: As it extensively uses software part it means there is a chance that the solution could be vulnerable. At least the probability of vulnerability could be the same as for software based encryption solutions.

Backup is complicated

IronKey has 3 levels of backup.

1. Personal account on my.ironkey.com. You need it if you don’t have any other place to write down your IronKey password. This will also allow you to keep IronKey Identity Manager backup (that keep your passwords from web sites and other apps).
2. Backup your User Name and password for my.ironkey.com. Write down this information somewhere but not on IronKey or my.ironkey.com. You must remember User Name from this account, don’t rely on your email because Password-Reset works by user name and not by email.
3. Secure backup of your IronKey files on your PC. It has some issues and main issue - you should remember or write down your current IronKey password. Because later if you change IK password then you will not be able to restore files. my.ironkey.com doesn’t keep your IronKey passwords history (but it would be nice to have it).
4. In order to access your IronKey back that you have from step 3. you need to have IronKey device. So if you lost it, you will not get access to your back up immediately! (You will need to order new ironkey).

IronKey has a secure Files BackUp tool that copies selected files from IronKey into a Windows folder:

• During backup only the file content is encrypted. Each file/folder name is open
• Encryption is performed by using current IronKey password.
• IronKey backup can be easily identified on your PC by the special files inside the Backup folder.
• It is possible to perform brute force attack to IronKey BackUp to find real password (BackUp Encryption key is encrypted by the current Ironkey password)
• Warning: If you lose your Ironkey you will not be able to access backup files without new IronKey device.

IronKey hardware has a brute force attack prevention by limited number of password entry attempts (only 10). Thus making users think they could use short and easy-to-remember password for it. Read IronKey CEO interview where this feature is discussed. So if you are using not a very strong password it could be easily recovered using brute-force attack to IronKey Secure Backup stored on your PC (unlimited number of attempts for password guessing is possible).

The possible solution for these issues:

• my.ironkey.com account could be easily replaced with your .gmail account where you can also securely store IK password backup. + a few most important files in case IK is lost.
• Any disk encryption software can be used to backup IK files on your notebook. You will be able to access them immediately in case of IronKey lost or failure.

Virtual Keyboard

IronKey has a virtual Keyboard, its primary goal is to avoid Key Loggers steal your passwords (from IronKey, web forms, Windows Apps). But this is a myth.

How it works:

• You can run it for any window where there is a password field
• When you click on any button on Virtual Keyboard it sends a EM_REPLACESEL message to EDIT control.

This looks good because no Keystokes are generated (WM_CHAR, or WM_KEYDOWN messages). Ok, let’s  look further - how application get this password

• Application (IronKey including) sends WM_GETTEXT to this EDIT control and copies Plain Password text into its memory.

Many Trojans, Viruses and RootKits injects into processes and steal your password by sending WM_GETTEXT to the password based EDIT controls.

Look at Inside the Password-Stealing Business report by McAfee , they told: “…  Passwords, TANs, or PINs are then retrieved by sending the dialog a WM_GETTEXT window message. That works with the password character (asterisk) being set, since the Trojan disables this kind of visual obfuscation before reading the password and then re-enabling it using WM_SETPASSWORDCHAR…”.

IronKey reports that their Virtual Keyboard  prevents even from Screen Loggers (screen capture logger) by special features:

• It allows to randomize buttons
• It allows to hide button text when you press it.

Ok suppose you have keylogger that also captures screen, this is what you see:

And now guess my password.

In Rohos products we designed Virtual Keyboard that works only for Rohos, it transfers password directly to Rohos internals without storing it in EDIT control. It will save your password from any malware, but it will not save from detailed screen capture application.

So IronKey Virtual Keyboard saves you from keystroke loggers but doesn’t save from password stealers that are mentioned in McAfee report.

Essencial security features

IronKey protects your data against malware and unauthorized access with additional features:

1) It Prevents modifying Autorun.inf on IronKey. So the USB flash drive virus will be able to store its body on IronKey but it will never be executed. Look at the screenshot:

2) User can unlock and use IronKey in read-only mode. This option can be used on untrusted computer/Mac if you need to access your files, but without worries that a kind of Malware will affect your data.

3) You can set up IronKey to lock automatically after inactivity period.

4) IronKey hardware requires user to re-insert IronKey into USB port after 3 unsuccessful password entry. I think this feature will prevent any malware from password guessing.

Lost & Found text

IronKey has a beautiful feature that allows to set a text notice that will be visible to everyone who connects IronKey to USB port. We think users may relay on this feature also to set a password reminder here.

However we discovered that this Text Notice could unexpectedly disappear, the most obvious reason of this bug or feature - you connect IronKey to a fresh PC (where you connect IK for the 1st time). This is one of supposed behavior of IronKey - portable device. It means there is hardware or software bug. For some reason IronKey internals can be changed without authorization first.

We were able to reproduce this bug many times.

Summary:

• If you are an average user and are not paranoid about you data security 90% of the IK’s “software”  features are  useless and time consuming for you - this flash drive is definitely not your everyday “buddy”.
• On the other hand if you are worried about data protection, IronKey is very secure but you have to do many moves and remember some info&rules to “become friends” with the drive.
• IronKey Backup and Restore is complicated: the main issue - you need to buy another IronKey device in order to get your BackUp back.
• Bugs: Please note “Lost & Found” message may disappear from time to time.

Take a look at our comparison matrix of Encrypted USB flash drives.

Recently three hardware encryption devices have been delivered  - IronKey Personal S200 1Gb, Kanguru Defender 1Gb and DataTraveler Vault Kingston 2Gb. This time we’d like to present you the review of  IronKey that arrived at our lab to everyone’s joy. Long -awaited possibility to play around with this highly praised flash drive and set it up for secure Windows login with Rohos Logon Key is now available. Let’s start with getting to know more about the flash drive itself.

Core Features:

• Hardware-Encrypted Flash Drive
• Self-Destruct Sequence
• Anti-Malware Autorun Protection
• Portable Cross-Platform Data Access
• Simple Device Management
• Secure Data Recovery

Learn more about these and other IronKey’s features in part 2 of the review.

Wow. Just, wow. This kind of IronKey’s features list may make you wonder if it’s just a flash drive and not one of  those Agent 007 stuffs. Oh, people. People, people, people. It’s a very good device but has its own glitches that will talk about in the next part – part 2.

Now back to the core task -

Strong two-factor authentication for Windows and Mac with Rohos Logon Key + IronKey

Please, note that before setting up IronKey for logging into Windows and/or Mac you should initialize it. The initialization of the drive takes less than a minute, at which time you’re asked to set up an on-line account with IronKey, which enables certain features included with the drive, such as device and software updates and access to IronKey’s encrypted web surfing service. By activating the online account, a secure web browser already installed on the drive opens, taking you to my.ironkey.com. You may learn more in IronKey Personal User Guide (.pdf format) reading  - “Initializing and Activating Your IronKey on Windows/Mac/Linux”.

In our case the first initialization had been performed on Mac system and then Ironkey was used in Windows.

Easily set up IronKey for secure Windows login

We were repeatedly asked by the users if it’s possible to use IronKey as a login key for Windows/Mac. The answer to the question is YES. Please, note that Rohos Developers have issued Rohos Logon Key release update fixing compatibility issues with IronKey and Bluetooth enabled devices.

NB! Preliminary IronKey activation is required.  Upon plugging the device in - “My Computer” window will show two drives virtual CD-ROM (F:) and virtual disk (H:). One of the drives, namely Removable Disk (H:), is the Secure Partition, and CD-ROM (F:) is the Open (read-only) one. In order to open secure part of the device you should run IronKey.exe file.

Once IronKey.exe is started, enter your password to unlock the protected part and activation will start up

Only after the device is plugged in and activated, the protected part appears in the system as a removable drive (IronKey Secure Files (H:)) and the setup is possible.

• Download  and install Rohos Logon Key
• Open the program’s main window
• Click on “Set up USB Key”. The program will automatically detect the device.
• Enter your Windows password. If you do not have it, you should create one beforehand. Click on “Setup USB Key” and then OK.
• Now in Rohos Options window you should click on “Choose start-up program” link, choose IronKey.exe and click Open. And then you may choose the action upon the USB key removal (e.g. Lock computer, Turn off, etc.) Click on OK. The reboot is needed.

How it works

Upon system startup plug in your IronKey. The launch pad will appear (see screen shot)

Type in your IronKey’s password and click Unlock button. Windows login is done fast and smoothly.

Ultimate protection of your Mac with Rohos Logon Key + IronKey

Turn IronKey into Mac security key 

NB! When it comes to setting up IronKey with Rohos Logon Key for Mac there is no need to activate the device because Rohos Logon uses just IronKey’s serial number.

• Download and install Rohos Logon Key for Mac
• Click on Rohos icon in status bar and then “Add USB Key…”. The system automatically detects the plugged IronKey (with its serial number).
• Click on the device serial number and then press “Choose USB”. Authorization window will pop up. Insert your Password. Press OK. The USB Key has been configured.
• Now you may set up Action upon USB Key removal. Click on Rohos icon in the status bar and choose “Open Rohos Logon…”.
• In the main program’s window click on drop-down box and choose one of the USB Key removal actions (e.g. Lock the desktop, Log out, Sleep, etc.)

To add one more security layer for your Mac’s login you may set up a PIN code. By setting up PIN code you protect USB Key from somebody who can use it for logon into your Mac without your permission. After you plug in USB Key - Rohos Logon will ask user to enter PIN in order to log in or unlock your Mac.

• PIN code works for USB flash drives, Bluetooth enabled mobile phones and Touchatag
• Security benefits: After 3 wrong attempts to enter PIN (it can be a short one, e.g. 1234) the USB Key will be blocked. It will not be possible to use it as an access key till next “Change PIN”.

Setting up PIN code for your IronKey flash drive

• In the main program’s window click on “Change PIN”.
• Type in your Old PIN (if there was one before, if not leave the field blank), then New PIN and once again new PIN. Press Change PIN. Now the PIN code is set.

Summary:

IronKey together with Rohos Logon Key makes a good impenetrable security shield for your PC. It’s not only that your Windows login is fast and smooth but now your machine’s password is undoubtedly secrete and totally inaccessible for an alien.