Vista, Word and Google Desktop circumvent TrueCrypt function - heise... http://www.heise-online.co.uk/news/Vista-Word-and-Google-Desktop-...
Today on heise online
17 July 2008, 14:36 « previous | next »
First look at the iPhone 3G
Vista, Word and Google Desktop circumvent TrueCrypt
function
Cryptography expert Bruce Schneier, in conjunction with a research group, has studied
the security of TrueCrypt, to see whether it meets the specifications for a 'Deniable File
System' (DFS) – implemented in TrueCrypt as hidden volumes – and is really able to
conceal the existence of a volume within a standard system environment.
Hidden volumes are intended to conceal even the existence of encrypted files. It allows a
We've already had our hands on the new
PC owner to deny having specific encrypted data on his PC. Even where a suspect in a iPhone. With UMTS support, extended
police investigation reveals the key to an outer container in order to avoid a jail term, he business functions and lower entry-level
or she can still deny the existence of a concealed inner container. This is known as price, this much desired mobile phone is
deniable encryption. For the authorities, the only solution to this would be to make the also aimed at conquering the mass
market.
private use of encryption itself illegal.
Intel: speculation about new
Whilst TrueCrypt 5.1a itself appears to offer few points of attack, Windows Vista, Word processor versions and price
and Google Desktop all undermine the principle of deniability. As soon as a user opens a reductions
On July 20, Intel reportedly plans to
hidden volume, traces, such as a unique volume ID, are left in the Windows registry. In
reduce prices for some CPUs. Soon, it
addition, an edited file may subsequently appear in the list of recently opened documents. will also extend its Core 2 Quad and
Pentium Dual Core processor series.
According to Schneier, Word can torpedo both encryption and deniability if auto-save is
activated. Using simple Word auto-recovery tools, he succeeded in recovering a Word
file edited in a hidden folder. Google Desktop, which indexes many data types as soon
as a volume is opened, can have similarly fatal consequences.
Free tool from Heise to protect
Some of these problems have already been addressed in TrueCrypt 6.0. This allows the online shopping
entire operating system to be hidden in an inner container. Depending on the password
entered by the user when booting, either the encrypted system alone or both the
encrypted system and the hidden system will start. It is then irrelevant whether or not the
operating system or another application leaves traces of the hidden system.
Schneier's group intend to present their results at USENIX HotSec '08 at the end of this
month. The seven-page paper is already available as a PDF.
See also:
Defeating Encrypted and Deniable File Systems: TrueCrypt v5.1a and the Case of the Numerous SSL certificates with weak
Tattling OS and Applications, paper by A. Czeskis, D. J. St. Hilaire, K. Koscher, S. D. keys are in use that are child's play to
Gribble, T. Kohno and B. Schneier crack. These pose potential security
risks to many people making secure
online transactions. The new heise SSL
(trk) Guardian warns you when it detects one.
Read comments (1 comment) USB stick with PIN code
Can running as a "limited" user avoid these problems?
Print version | Send by email « previous | next »
Bookmark & Share
heise online heise Security heise open source heise networks We review and crack Corsair's Padlock -
News News News Features a USB stick that provides PIN code
News Archive News Archive News Archive Layer 1 & 2 protection against unauthorised access.
Features Features Features Wireless Networks
Features Archive Recommended Case Studies Protocols
Reading Market Routing & Internet
Forums Access
Know-how Software
Comments Background Network management
Hands-on Features Archive Storage & Services
Products Messaging & VoIP
Forums Features Archive
Features Archive UK Business lags in open source
Forums Forums
adoption
Anti-Virus Tools
UK Business lags in open source
Browsercheck
Emailcheck
adoption, but leads in evaluating Open
Source
Polish and add-ons; the latest
updates in Linux 2.6.26
Find out what's new in the latest version
of the Linux kernel, 2.6.26.
2 of 3 7/19/2008 9:27 AM