Research Into TrueCrypt Encryption Start Soon

The investigation into the cryptographic operation of the encryption program TrueCrypt has been somewhat delayed, but will soon really begin, as the initiators announced. The end of 2013 decided cryptography professor Matthew Green and White a scientist Kenn Crowdfunding Initiative to start. The two wanted the website IsTrueCryptAuditedYet? fetch $ 25,000 to verify the cryptographic functionality of TrueCrypt and to have an audit. In total there were collected 62 104 dollars and 32.6 Bitcoins.

Despite the popularity of TrueCrypt, which makes it possible to encrypt files and hard drives, the source code and cryptographic software operation had never been audited. January last year decided security iSEC Partners to conduct the audit of the TrueCrypt boot loader and Windows kernel driver. In April it was audit report presented. Although there are several problems were found, the researchers found no backdoors. The second part of the audit would focus on the cryptographic operation of the encryption program.

Six weeks after the appearance of the first audit report, the TrueCrypt developers pulled the plug on the project. A day later showed Green and White, however, know that the crypto-audit they would still be, but then it jealously kept quiet. According to Green threw the sudden disappearance of TrueCrypt plans somewhat confused. As was given to whether the money could be better spent on different TrueCrypt successors.

Eventually there was a "Plan B" drawn up within budget and also makes sense. As part of this plan was a few weeks ago a contract with the just-launched Cryptography Services of NCC Group closed. Here the original TrueCrypt 7.1a will be audited.This version also forms the basis for various successors.

Green now reports that the audit will take place soon. In addition, let the promoters of the audit plan that they also look at parts of the code, including the Random Number Generator (RNG) TrueCrypt and other parts of the cryptographic implementation. "This will hopefully complement the work of NCC / iSEC and give a little more confidence in the implementation," said Green. He notes that it took a little longer than planned, but the results really come. Results of which he hopes she " really boring "will be.

Research: Weak Encryption In Popular Android Apps

Many of the popular free Android apps in the Google Play store use weak encryption to protect sensitive information. Which claims that the US security firm FireEye 9339 apps with more than 1 million downloads analyzed . Of these, 8261 were found to use a cryptographic functionality of the Android platform. 8261 of these apps again proved 5147 apps (62%) contain one or more cryptographic vulnerabilities.

It involves, for example using static keys for encryption. These keys can be removed from the app and then to decrypt the data. This was 21% of the apps the case. Furthermore, 58% had to use a weak encryption algorithm that the apps are vulnerable to certain attacks. For a handful of apps was also developed an attack. One of these apps accepted all dished SSL certificates, allowing attackers to perform a man-in-the-middle attack.

According to the researchers cryptographic vulnerabilities are a serious threat because they enhance the effectiveness of other attacks. Through the misuse of SSL could intercept an attacker instance sensitive information. "This problem is compounded by root exploits in which an attacker rooting a device can determine which apps are installed to send random data for offline decryption" concludes researcher Adrian Mettler.