FLEXid=9 usable memory

[#1]

Summary

The FLEXid=9 Aladdin USB Dongle does have some excess memory that could be feasibly written to. This may pose a problem for certain customers who wish to work in a secure enviroment.

Synopsis

The FLEXid=9 Aladdin USB Dongle does have some excess memory that could be feasibly written to. This may pose a problem for certain customers who wish to work in a secure enviroment.

Full details of this can be seen below in the Volatility Certificate received directly from Aladdin.

Discussion

Certificate of HASP Memory Volatility

This document outlines all pertinent information needed by a vendor to certify the level of volatility of the memory utilized in HASP USB keys produced by Aladdin Knowledge Systems.

Manufacturer:

Aladdin Knowledge Systems

Product Name(s):

HASP USB keys

Model(s):

HASP HL: Basic, Pro, Max, Net, Time.

HASP4: Std, M1, M4, Net, Time.

Type of memory:

Non-Volatile memory used. There is no volatile memory in HASP HL and HASP4.

Type of Non-Volatile Memory:

EEPROM

Accessibility of Non-Volatile Memory:

1) Can the memory be accessed by accidental/intentional keystroke, or software malfunction?

Yes, the non-volatile memory can be accessed by software malfunction

2) Locations of non-volatile memory along with accessibility and purpose of memory?

• User area of the memory ? is accessible by customer of Aladdin product for Read / Write
• System area of the memory ? this area of memory is not accessible and it is being used by Aladdin for Read Only purposes.

Required memory:

Is the device needed for normal operation, i.e. required for this processing period?

Yes, the HASP key is need for normal operation of software.

Device removal consequences:

If device memory chip is erased, what impact will this have on operation and normal function of the device?

If the System area of memory is erased, the device will not be accessible at all. If the user area

of the memory is erased then the device is ?alive? but is delivers wrong data to the application.

In this case the behavior depends on Aladdin customer?s implementation of the HASP product.

Method of memory access:

How is the memory accessed? Is non-volatile memory location theoretically accessible with any

system code, not just via the operating system or low level booting firmware?

The memory is accessed only via Aladdin Software (Firmware, API and drivers)

Warranty:

Does chip removal or EEPROM erasure void the warranty?

Yes

Memory Size:

How much memory is contained in the key?

Up to 16KB ? depends on the model

Memory Spacing:

Is the memory fully utilized or does it have available memory space for additional information to

be placed?

There is unused space but it can only be used by Aladdin for future purposes

Data Remanence:

Can this non-volatile memory be addressed to ensure that only authorized information is

resident? If yes, then how?

The HASP system is ensuring that the System memory area only contains authorized information. The information in the User memory area can be verified by Aladdin?s customer.

Additional Notice from Aladdin Knowledge Systems:

Aladdin Knowledge Systems reserves the right to modify the product without prior notification.