Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

The Mystery Of The TrueCrypt Encryption Software Shutdown

Developers of the open-source software call it quits, saying software "may contain unfixed security issues."

Not long after news spread that TrueCrypt was shutting down, enough theories were circulating about what happened to fill an episode of the TV show 24.

To recap: The developers of the TrueCrypt open-source, on-the-fly encryption software announced Wednesday that they were ending development of the software. In a post online, the developers state the software "is not secure as it may contain unfixed security issues." In addition, they note that the development was ended after Microsoft ended its support of Windows XP, and that later versions of the operating system "offer integrated support for encrypted disks and virtual disk images."

The post urges users to migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on their respective platforms.

"The whole situation is very odd, but there are clues to what might be happening," says Mark Bower, vice president at Voltage Security. "The TrueCrypt development team is largely anonymous, and has unclear origins. On the one hand, TrueCrypt is a product that is supposed to be transparent about its security design, yet there have always been unclear aspects to its origins. On the other hand, it was about to be put through a thorough crowd-funded technical audit. Was there something to hide? Maybe so."

Last month, iSEC Partners released a code audit of TrueCrypt and found no backdoors or serious vulnerabilities in the portion of code it reviewed, which included the Windows kernel driver and bootloader.

Tom Ritter, principal security consultant at iSEC Partners, considers the end of TrueCrypt to be a loss to the open-source community.

"They've been working on it for I think over a decade," says Ritter. "That's a very long time to work on a project, so it might be they had other commitments come up in their lives and didn't want to let the project peter out, so to speak."

The first version of TrueCrypt was released in February 2004. Since its release, it has been downloaded approximately 30 million times. While many people may have downloaded it multiple times over the years, they are still looking at millions of people who are "now stuck with a new version of the software that will only decrypt and a recommendation to move to other encryption software," blogs Steve Pate, chief architect at HyTrust:

Well, we know for sure that AES is still a rock solid encryption algorithm and is widely used across the commercial space and nation states to protect their data. As for TrueCrypt, perhaps a group of part timers just decided to call it a day and end with a cruel twist? Hopefully time will tell what really happened.

What we do know is that TrueCrypt had been put through its paces. In 2013, the Open Crypto Audit Project was funded to ensure that TrueCrypt could be analyzed from a security perspective. The first set of results were released last months and showed that there was no evidence of any backdoors. A second review is still pending and we eagerly await the results of that, but now it may be moot. Whatever the real story is, TrueCrypt's reputation has likely been fatally injured. IT managers that have been relying on TrueCrypt will rightly be concerned about their organizations data security and their own reputation, will be seeking professional alternatives. Strange days.

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/30/2014 | 1:36:46 PM
TruCrypt users
Anyone out there left high and dry by this? I'd love to hear some firsthand experience with the tool and what users plans are next.
theb0x
50%
50%
theb0x,
User Rank: Ninja
5/30/2014 | 4:14:50 PM
Re: TruCrypt users
I do recall in 2009 a bootkit was developed called Stoned which could successfully bypass TrueCrypt. Stoned injects itself into the MBR, a record which remains unencrypted even if the hard disk itself is fully encrypted. During startup, the BIOS first calls the bootkit, which in turn starts the TrueCrypt boot loader. Stoned uses a "double forward" to redirect I/O interrupt 13h, which allows it to insert itself between the Windows calls and TrueCrypt.

I would like to point out that this attack DOES require either physical access to the PC with the user already logged in with admin rights or an end user must be enticed to execute the malware. This DOES NOT actually break the encryption but rather acts as a MITM attack.

TrueCrypt is simply not designed to handle this method of attack.

This method could be applied to other software based encryption such as BitLocker and PGP.

Another flaw is that TrueCrypt stores it's keys in RAM and has been confirmed to be vulnerable to a Cold Boot Attack. This is where the booted machine is powered off and the RAM modules are quickly frozen and the keys can be extracted.

Again, this method requires physical access to the machine that is powered on or suspended.

In conclusion, as long as the attacker has physical or administrative access to the system, software based encryption will never work.

 
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
5/30/2014 | 6:26:47 PM
http://truecrypt.ch/
I've never used TrueCrypt, but have always been aware of it as a FOSS user and supporter.  I find it interesting how quickly http://truecrypt.ch/ was raised with the seeming intent to continue TrueCrypt as a forked project.  In the FOSS world there is absolutely nothing odd about this; I'm forking a codebase right now, in fact.  But because this is TrueCrypt, one wonders at the motivation for the Swiss team.  I suspect there is a money pile waiting for the right group that can support TrueCrypt as a service provider for those IT shops using the software that would rather stagnate than evolve.  I think the fork is the right thing to do, provided the new team has the needed skills to move the project forward. 

Note:  Search off the phrase "TrueCrypt Developers Association. All rights reserved." and you will find many other projects that include embedded TrueCrypt code.  Food for thought...
shakeeb
50%
50%
shakeeb,
User Rank: Apprentice
5/31/2014 | 2:42:18 AM
Re: TruCrypt users
It's scary to see how software encryption will no longer help us to protect our data. I wonder what TruCrypt users will do next to ensure their data is kept safe. 
shakeeb
50%
50%
shakeeb,
User Rank: Apprentice
5/31/2014 | 2:44:36 AM
Re: TruCrypt users
@theb0x – thanks for sharing, does this mean that hackers can't get through without having physical access to the system?
shakeeb
50%
50%
shakeeb,
User Rank: Apprentice
5/31/2014 | 2:47:07 AM
Re: http://truecrypt.ch/
@christianabryant- I feel that these encryption tools need to evolve. Some of them are still in the initial versions (no one has taken steps to upgrade them as the threats increase). 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/31/2014 | 10:47:50 PM
Re: http://truecrypt.ch/
I agree, we need to understand that though its difficult to update encryption technologies its very necessary. Think of it as patching a security safeguard. Security tools need to evolve in hopes to combat volatile emergent threats. 
gev
50%
50%
gev,
User Rank: Moderator
6/2/2014 | 2:45:44 PM
Take it at face value
Right there at the top of the page, it says:

 

The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images.

 

How come the author ignores the simplest explanation?

Because then there would be mistery, and hence no article.
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
6/2/2014 | 2:54:51 PM
Re: Take it at face value
@gev

You wrote: 

"The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images."

What does it mean? Have any idea of the number of downloads collected by TrueCrypt?

 

Do you believe that TrueCrypt users are only XP users?

I believe that there is much more.

 
AbeG
50%
50%
AbeG,
User Rank: Apprentice
6/16/2014 | 10:15:57 PM
Re: TruCrypt users
@shakeeb.  There are a number of alternatives for TrueCrypt.  I ran a search on alternative.to (http://alternativeto.net/software/truecrypt/) and looks like everyone should consider switching over to DiskCryptor.

I thought this was a compelling argument:

"The only open-source alternative to DiskCryptor that has comparable features is TrueCrypt. However, because of the restrictive license under which TrueCrypt is provided — the TrueCrypt Collective License — TrueCrypt cannot be classified as a truly free software, as it places limits on the use and modification of its source code by developers. There are other alternatives with similar functionality, but they are fully proprietary ones, which makes them unacceptable to use for protection of confidential data."
Page 1 / 2   >   >>
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Exactly
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4590
PUBLISHED: 2020-09-21
IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable to a denial of service attack conducted by an authenticated client. IBM X-Force ID: 184650.
CVE-2020-4731
PUBLISHED: 2020-09-21
IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188055.
CVE-2020-4315
PUBLISHED: 2020-09-21
IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the i...
CVE-2020-4579
PUBLISHED: 2020-09-21
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request with invalid characters. IBM X-Force ID: 184438.
CVE-2020-4580
PUBLISHED: 2020-09-21
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request with invalid characters. IBM X-Force ID: 184439.