Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Data Security Decisions In A World Without TrueCrypt
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
CAMROBERSON
50%
50%
CAMROBERSON,
User Rank: Author
6/23/2014 | 9:52:14 AM
Re: TC volumes are Plain-Text when they are open...
You're absolutely right, Darker. There is a real distinction as to why people get encryption. Many look just to check the "compliance" checkbox; to have safeharbor in the event of hardware loss. But is the data truly secure? There are many instances where the data isn't encrypted and then what? Enforcing sound authentication policy? Certainly. How about an ability to remotely reach out to that device and control access. Or kill it altogether? I believe encryption is only a (and not the only) necessary piece of true security."
theb0x
50%
50%
theb0x,
User Rank: Ninja
6/21/2014 | 1:15:13 PM
Re: TC volumes are Plain-Text when they are open...
@darkerreading Exactly, And not only that TC, PGP..etc all have plain-text MBR just waiting to be tampered with when the volume is open from the booted OS. Also, the symmetric key is stored in RAM which yes can be extracted.

With Hardware-FDE or SEDs (Self-Encrypting Drives), the symmetric key managment is contained within the hard drive controller itself eliminating memory as a potetntial attack vector. Also unlike software based encryption, the MBR is fully encrypted.

However, not all SEDs are created equal. I have in the past successfully bypassed the firmware based authentication of a drive which resulted in full access to the encrypted volume without the key.

 

 

 

 
li'l ciso
50%
50%
li'l ciso,
User Rank: Strategist
6/20/2014 | 7:43:21 PM
TC volumes are Plain-Text when they are open...
Why does everyone forget that all encrypted voiumes are PT when they are open?

That goes for BL, PGP, SED's and TC. Encryption only protects you when the volume is closed. The NSA has 1001 exploits to get on your machine when it's running, why would they waste their time trying to crack TC... You just have to wait... then bam... insert surreptitious backdoor, or just read the data at that point... why crack TC/PGP/Bitlocker/Free-otfe at all?

Speaking of Free-OTFE, it was as good if not better than TC. And as far as I can recall, written by one woman, over a number of years, but feature for feature at least on windows, it was great. I can't speak to it's cross-platform-ness, but it was a great program. I don't think Plausible Deniablity was one of her things, but other than that I can't remember any major differences.

Good Day Sir
McDaveX
100%
0%
McDaveX,
User Rank: Strategist
6/20/2014 | 12:23:01 PM
Truecrypt still going strong
While its possible the Audit might throw up a spanner, until then there is no major reason to abandon Truecrypt, so I am not seeing the point of this article?
theb0x
50%
50%
theb0x,
User Rank: Ninja
6/19/2014 | 8:05:50 PM
Re: You're overlooking something...
This brings a whole new meaning to 'Debugging'. 
kalbr88
50%
50%
kalbr88,
User Rank: Apprentice
6/19/2014 | 3:45:20 PM
TrueCrypt's step by step recommendation for Mac as well
http://truecrypt.sourceforge.net/OtherPlatforms.html

TrueCrypt's site had also posted detailed instructions for Mac.

 
gev
100%
0%
gev,
User Rank: Moderator
6/19/2014 | 2:09:29 PM
yes I do
yes I do get to argue about anything - it is my right to free speach.

fact that you can not find anything only tells you that it is not found, not that it does not exist. And this is applicable unversally to everything.

coming from a totalitarian country, I do know what i am talking about, believe me.

 
anon5472249769
100%
0%
anon5472249769,
User Rank: Apprentice
6/19/2014 | 1:52:50 PM
Re: You're overlooking something...
Sorry, my friend, but you're bluffing with a hand of deuces here. The government of the United States of America is the ONLY country that has engaged in the full gamut of these practices (can you find me ONE... ONE example of someone else soldering backdoor chips on to the motherboards of Cisco routers, for example?), and everyone outside the U.S. knows about it (whether or not you want to acknowledge it).

Over time, we are simply going to stop using U.S.-manufactured software, hardware and services, because we have to assume that it has all been compromised. MIGHT equivalent equipment, if manufactured elsewhere, have been compromised? Possibly (although this is unlikely in most cases, with some exceptions such as Huawei). But thanks to Snowden, we KNOW -- way beyond a reasonable doubt -- that virtually ALL U.S.-manufactured equipment either already has been, or very well might soon be, "backdoored" by the NSA and other U.S. spook agencies.

I'm sorry if you don't like hearing that, but you don't get to argue about it. This IS the situation and the POV outside your country, and there's NOTHING that you now can do about it. The Humpty Dumpty of implicit foreign trust in the U.S. is broken, and all of Dick Cheney's horses and all of Barack Obama's men, can't put Humpty Dumpty, together, again.

Don't like that? Call Michael Hayden, Keith Alexander and James Clapper. Don't bother taking notes, because a few other people listening on the line, are already doing that for you.
gev
100%
0%
gev,
User Rank: Moderator
6/19/2014 | 10:17:28 AM
Re: You're overlooking something...
You point finger at US only because it openly tells you about what is going on.

The lack of information about other developed and otherwise countries doing the same only tells me that they are either not caught yet, or are better able to silense the truth.
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
6/18/2014 | 4:23:10 PM
Re: You're overlooking something...
@Bulos Qoqish

At a high level, I have to agree with you.  I believe the most successful and useful security tools, whether on the pen-testing side or encryption side, are free and open source software (FOSS) for many of the reasons you note.

Time will tell, but I have high hopes for TrueCrypt.ch to do exactly what you identified, which is keep technology like this moving forward, improve upon it rather than run from it, and use the FOSS community to make it work the way we want, independent of licenses, patents and hidden functions.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-37742
PUBLISHED: 2021-07-30
app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships.
CVE-2021-37743
PUBLISHED: 2021-07-30
app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format.
CVE-2021-37746
PUBLISHED: 2021-07-30
textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.
CVE-2020-26563
PUBLISHED: 2021-07-30
ObjectPlanet Opinio before 7.13 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if input to survey/admin/*.do is accepted from untrusted users.)
CVE-2021-37606
PUBLISHED: 2021-07-30
Meow hash 0.5/calico does not sufficiently thwart key recovery by an attacker who can query whether there's a collision in the bottom bits of the hashes of two messages, as demonstrated by an attack against a long-running web service that allows the attacker to infer collisions by measuring timing d...