The digital storage solutions manufacturer Western Digital has patched a vulnerability within their SanDisk SecureAccess (now rebranded to SanDisk PrivateAccess) storage and security application, due to it being susceptible to a type of password brute forcing that uses a dictionary or word list. According to a spokesperson from Western Digital, “SanDisk SecureAccess 3.02 was using a one-way cryptographic hash with a predictable salt making it vulnerable to dictionary attacks by a malicious user…the software also made use of a password hash with insufficient computational effort that would allow an attacker to brute force user passwords leading to unauthorized access to user data.” To rectify this, Western Digital now will use PBKDF2-SHA256 encryption together with a randomly generated salt. SanDisk has released an advisory (attached below) on how to upgrade your vulnerable application, and migrate to the new PrivateAccess Vault. The Ankura CTAPT will continue to provide relevant information concerning flaws vulnerable to exploitation.