German Government: TrueCrypt Still Suitable For Encryption

The popular encryption software TrueCrypt is still suitable for encrypting files, according to the German government on the basis of study (pdf) conducted by the renowned Fraunhofer Institute. Last year the decision makers of the software to cease support.

Also, the use of the encryption software was not recommended. The German Federal Office for Security in Information Technology, part of the German Ministry of the Interior, therefore, gave the Fraunhofer Institute therefore to investigate the commission for vulnerabilities in TrueCrypt. The encryption software was in fact also recommended for encrypting confidential information.

According to the researchers TrueCrypt still suitable for encryption of data on storage media. "Especially in mobile scenarios, such as the use of laptops or USB storage, disk encryption or encrypted containers are very important for protecting critical data," said Thomas Caspers of the BSI. The researchers do say that there are several problems. For example, the use of cryptography in TrueCrypt is not optimal.

Nevertheless, the researchers do not give negative advice. Caspers according to the study provides a sound basis for determining the safety that can provide TrueCrypt and derivatives. Thus, in Germany a customized version of TrueCrypt developed called Trusted Disk. In addition, the research may help to improve these programs, according to the BSI.

Google Reveals Details Of Criticism TrueCrypt Leak

Google has published details of a critical vulnerability in TrueCrypt which allows a local attacker with access to the system can increase its privileges. Although the vulnerability does not affect the encryption TrueCrypt offers the leak was in the news.

Last year, private developers of TrueCrypt namely to stop supporting the encryption software. Nevertheless, for many users continues to be the preferred option for encrypting files as well as complete systems. Because the support is stopped are found vulnerabilities not fixed. Google researcher James Forshaw recently reported two vulnerabilities in TrueCrypt and secondary Vera Crypt, which still supported.

The first vulnerability is dangerous because someone with a limited user account system or kernel rights can get. The second vulnerability allows an unauthorized user to disconnect an active use TrueCrypt volume. To use either leak must be able to log into an attacker's computer. In addition, it is not possible to decrypt the information via vulnerabilities.

Audit

The vulnerability was also notable because TrueCrypt last year was audited, but this problem was not found. According Forshaw this can be explained because the attack vector that he used was not known to the researchers. In addition, the code of Windows Drivers usually did not exceed out by an attacker, in which this vulnerability is the case. The way Windows through the years with drivers and symbolic links' minds are changed by Microsoft. This However, Microsoft has not been well documented, says Forshaw. According to the researcher, it is therefore difficult to blame both the TrueCrypt developers and auditors that these types of vulnerabilities through slip.

Encryption Advice To Journalists After TrueCrypt Leak

Recently discovered a researcher at Google two vulnerabilities in the popular encryption program TrueCrypt will not be stopped, but journalists still have options to encrypt their data. This enables the US Committee to Protect Journalists (CPJ).

The organization works worldwide for press freedom. Last year showed the CPJ that journalists TrueCrypt still safe could use, even though the support stop put by the developers. However, journalists were advised in the medium term, software switch. Programs were not mentioned however. Because of the two leak found, the CPJ expressed themselves on how to use TrueCrypt.

According to Geoffrey King, who through the organization dedicated to the digital rights of journalists, now revealed the vulnerabilities could be used by someone who already has a user account on the computer. The first vulnerability is dangerous because someone with a limited user account can gain full administrative rights. The second vulnerability allows an unauthorized user to disconnect an active use TrueCrypt volume. To use either leak must be able to log into an attacker's computer. In addition, it is not possible to decrypt the information via vulnerabilities.

In the on TrueCrypt-based Vera Crypt Two problems have been resolved. The CPJ has not evaluated the safety and reliability of this program. In addition, according King, no solution without risk. He advises journalists to always encrypt their data as unencrypted data is one of the greatest risks. The CPJ recommends therefore to use encryption software that comes with the operating system. In the case of Mac OS X is that FileVault 2, while BitLocker for Windows and Linux LUKS is recommended. Further, a complex and to remember passphrase must be used for the encryption.

Encryption Software Crypt Vera Patches TrueCrypt Leak

There is a new version of Vera Crypt appeared on the TrueCrypt software-based encryption. A researcher at Google had in TrueCrypt two leaks discovered which were also present in Vera Crypt.Through the leak could be a local attacker who already has access to the system to increase its rights.

TrueCrypt is no longer supported since last year, making the two vulnerabilities are not patched. Vera Crypt is based on the source code of TrueCrypt and is still actively maintained. Besides the two vulnerabilities are also fixed several other non-security related bugs. Users of Vera Crypt therefore be advised to version 1.15 upgrade.

James Forshaw, the Google researcher who vulnerabilities discovered, suggests that this is not about backdoors, but that they unwittingly came through the TrueCrypt audit. Last year it was TrueCrypt for the presence of back doors audited, whereby various problems were found. Backdoors were not found. A few weeks after the first part of the audit was completed decided to stop the TrueCrypt developers with the development of the software. The problems found were not patched as a result, which also applies to new vulnerabilities.

TrueCrypt Message Suspicious Europol Do Not Mislead

A suspect who had his laptop via TrueCrypt encrypted and a custom startup screen foresaw eventually still managed not to mislead investigators Europol, says Vice Magazine according to a confidential document that was in hands.

The document describes how researchers at the European Cyber crime Centre (EC3) Europol tried to examine an encrypted laptop from a suspect. Although she possessed the password they were denied access to the machine. After the laptop was set up which showed an error message because it lacked the operating system. Therefore, the researchers thought that there was something wrong with the laptop, according to the document. Later it appeared that the defendant had changed the startup screen TrueCrypt.

Once a machine is started TrueCrypt asks for a password. This screen can be provided with arbitrary text, such as an error message. A tactic which the Belgian security researcher Didier Stevens already explained in 2009. In the case of the accused came Europol behind the trick yet gained access to the laptop by typing the password on the screen with the error message. When the laptop was examined on is not reported. It is unknown how Europol got hold of the password.

Manual Windows Updaters Warned Patch

Microsoft has warned users and administrators to manually update computers for an important security update that was re-released and needs to be reinstalled. On August 11, Microsoft wrote poetry different vulnerabilities in Windows, .NET Framework, Office, Lync and Silverlight.

Through the vulnerabilities could take over a computer attacker completely if the user opens a specially crafted document or visit untrustworthy sites with embedded TrueType or OpenType fonts. As a solution has published Microsoft Security Bulletin  MS15-080. This update is on most Windows computers automatically installed via Windows Update. However, it is also possible to download the update from the Microsoft Download Center.

The update for Vista SP2, Windows Server 2008 (R2) SP2 and Windows 7 SP1 via the Download Center offered is updated on August 18th. Microsoft recommends that Windows users who update for August 18 have been downloaded from the Download Center to download it again and install so that they are fully protected against the vulnerabilities listed in the bulletin. This only applies to people who have downloaded the update from the Download Center. Users who update from Windows Update, Windows Update Catalog and WSUS are deployed need to take any action.

TrueCrypt Alternative Vera Crypt Now Detects Evil Maid Attack

Last week, two new versions of TrueCrypt alternative Vera Crypt appeared. Vera Crypt was late last year by a French programmer launched . It involves a fork, an offshoot that is based on the original TrueCrypt source code. Developer Mounir Idrassi however has made ​​several improvements.

The latest update for the software dated from the beginning of April, but now there appeared two updates in a short time. The first update to version 1:12 fixes a problem when updating Vera Crypt on Windows 10, adds several options, includes several bug fixes and now makes it possible to detect Evil Maid attacks. An attacker who has physical access to a machine can provide encrypted bootloader encryption software from a keylogger.

Once the user then again seated and encryption password is entered behind the machine, which is stored by the keylogger. If the attacker for the second time has physical access to the machine, the stored password can be read and the attacker can log into the system. Because of the requirement to twice gain physical access to the system was the attack " Evil Maid named "because it would fit into a scenario where a malicious cleaner in a hotel execute the attack.

TrueCrypt did not have measures to protect users from this attack. Vera Crypt is however now able to "boot loader tampering" to detect and can then offer options to rectify this. Four days after the release of version 1:12 released version 1.13 . A bug in version 1:12 led to it that Tor is no longer working as it was started from an encrypted Vera Crypt volume. This is the only bugfix containing this version.

Infected Version TrueCrypt Used For Cyber Spying

A Russian website has years of an infected version of the popular encryption program TrueCrypt offered, which in reality turned out to be a Trojan horse that has been used for cyber-espionage. That leaves the Slovak anti-virus company ESET in a report published today ( pdf ) know.

The website was a truecryptrussia.ru offered in Russian translated version of TrueCrypt. Visitors who met but were offered an infected version specific criteria. What criteria were precisely known. Once installed on the system was also installed a backdoor that allows the attackers had full control over the computer. At least since June 2012 was offered via truecryptrussia.ru malware.

As a select number of victims were attacked in this way, could also backed by long time undetected, according to ESET. The TrueCrypt website also served as Command & Control domain. Communication between the attackers and infected computers ran through the website. Researchers also think the site was managed by the attackers and that it is not a hacked website.

Apart from the TrueCrypt website spread the malware, called Potao, also via e-mail attachments and USB sticks. This was done on a simple but effective way. The malware placed himself on the USB stick and made all other files invisible. In addition, the malware got the name of the USB stick and a disk icon. Users would have thought that it was a disk or shortcut while they opened the malware in reality.

Most targets of the malware were located in the Ukraine. It was among other things the Ukrainian government, the Ukrainian army and a major Ukrainian news agency. Members of the Russian and Ukrainian popular pyramid games were spied by the malware. So were victims of infectious TrueCrypt version mainly in Russia.

SHA1 hashes: Early Potao versions: 

8839D3E213717B88A06FFC48827929891A10059E

5C52996D9F68BA6FD0DA4982F238EC1D279A7F9D 

CE7F96B400ED51F7FAB465DEA26147984F2627BD 

D88C7C1E465BEA7BF7377C08FBA3AAF77CBF485F 

81EFB422ED2631C739CC690D0A9A5EAA07897531 

18DDCD41DCCFBBD904347EA75BC9413FF6DC8786 

E400E1DD983FD94E29345AABC77FADEB3F43C219 

EB86615F539E35A8D3E4838949382D09743502BF 

52E59CD4C864FBFC9902A144ED5E68C9DED45DEB 

642BE4B2A87B47E77814744D154094392E413AB1 

Debug versions: 

BA35EDC3143AD021BB2490A3EB7B50C06F2EA40B 

9D584DE2CCE6B654E62573938C2C824D7CC7D0EB 

73A4A6864EF68C810C7C699ED51B759CF1C4ADFB 

1B3437C06CF917920688B25DA0345749AA1A4A46 

Droppers with decoy documents: 

FBB399568E0A3B2E461A4EB3268ABDF07F3D5764 

4D5E0808A03A75BFE8202E3A6D2920EDDBFC7774 

BCC5A0CE0BCDFEA2FD1D64B5529EAC7309488273 

F8BCDAD02DA2E0223F45F15DA4FBAB053E73CF6E 

2CDD6AABB71FDB244BAA313EBBA13F06BCAD2612 

9BE3800B49E84E0C014852977557F21BCDE2A775 

4AC999A1C54AE6F54803023DC0FCF126CB77C854 

59C07E5D69181E6C3AFA7593E26D33383722D6C5 

E15834263F2A6CCAE07D106A71B99FE80A5F744B 

A62E69EF1E4F4D48E2920572B9176AEDB0EEB1C6 

900AD432B4CB2F2790FFEB0590B0A8348D9E60EB 

856802E0BD4A774CFFFE5134D249508D89DCDA58 

A655020D606CA180E056A5B2C2F72F94E985E9DB 

04DE076ACF5394375B8886868448F63F7E1B4DB9 31 

Droppers from postal websites:

94BBF39FFF09B3A62A583C7D45A00B2492102DD7 

F347DA9AAD52B717641AD3DD96925AB634CEB572 

A4D685FCA8AFE9885DB75282516006F5BC56C098 

CC9BDBE37CBAF0CC634076950FD32D9A377DE650 

B0413EA5C5951C57EA7201DB8BB1D8C5EF42AA1E 

0AE4E6E6FA1B1F8161A74525D4CB5A1808ABFAF4 

EC0563CDE3FFAFF424B97D7EB692847132344127 

639560488A75A9E3D35E4C0D9C4934295072DD89 

USB-spreaders:

850C9F3B14F895AAA97A85AE147F07C9770FB4C7 

BB0500A24853E404AD6CA708813F926B90B38468 

71A5DA3CCB4347FE785C6BFFF7B741AF80B76091 

7664C490160858EC8CFC8203F88D354AEA1CFE43 

92A459E759320447E1FA7B0E48328AB2C20B2C64 

BB7A089BAE3A4AF44FB9B053BB703239E03C036E 

DB966220463DB87C2C51C19303B3A20F4577D632 

37A3E77BFA6CA1AFBD0AF7661655815FB1D3DA83 

181E9BCA23484156CAE005F421629DA56B5CC6B5 

A96B3D31888D267D7488417AFE68671EB4F568BD 

224A07F002E8DFB3F2B615B3FA71166CF1A61B6D 

5D4724FBA02965916A15A50A6937CDB6AB609FDD 

8BE74605D90ED762310241828340900D4B502358 

5BE1AC1515DA2397A7C52A8B1DF384DD938FA714 

56F6AC6197CE9CC774F72DF948B414EED576B6C3 

F6F290A95D68373DA813782EF4723E39524D048B 

48904399F7726B9ADF7F28C07B0599717F741B8B 

791ECF11C04470E9EA881549AEBD1DDED3E4A5CA 

E2B2B2C8FB1996F3A4A4E3CEE09028437A5284AE 

5B30ECFD47988A77556FE6C0C0B950510052C91E 

4EE82934F24E348696F1C813C24797618286A70C 

B80A90B39FBA705F86676C5CC3E0DECA225D57FF 

971A69547C5BC9B711A3BB6F6F2C5E3A46BF7B29 

C1D8BE765ADCF76E5CCB2CF094191C0FEC4BF085 

2531F40A1D9E50793D04D245FD6185AAEBCC54F4

32 Other droppers:

D8837002A04F4C93CC3B857F6A42CED6C9F3B882 

BA5AD566A28D7712E0A64899D4675C06139F3FF0 

FF6F6DCBEDC24D22541013D2273C63B5F0F19FE9 

76DA7B4ABC9B711AB1EF87B97C61DD895E508232 

855CA024AFBA0DC09D336A0896318D5CC47F03A6 

12240271E928979AB2347C29B5599D6AC7CD6B8E 

A9CB079EF49CEE35BF68AC80534CBFB5FA443780 

1B278A1A5E109F32B526660087AEA99FB8D89403 

4332A5AD314616D9319C248D41C7D1A709124DB2 

5BEA9423DB6D0500920578C12CB127CBAFDD125E 

Plugins: 

2341139A0BC4BB80F5EFCE63A97AA9B5E818E79D 

8BD2C45DE1BA7A7FD27E43ABD35AE30E0D5E03BC 

54FEDCDB0D0F47453DD65373378D037844E813D0 

CC3ECFB822D09CBB37916D7087EB032C1EE81AEE 

F1C9BC7B1D3FD3D9D96ECDE3A46DFC3C33BBCD2B 

9654B6EA49B7FEC4F92683863D10C045764CCA86 

526C3263F63F9470D08C6BA23E68F030E76CAAF3 

E6D2EF05CEDCD4ABF1D8E3BCAF48B768EAC598D7 

CEBAB498E6FB1A324C84BA267A7BF5D9DF1CF264 

324B65C4291696D5C6C29B299C2849261F816A08 

C96C29252E24B3EEC5A21C29F7D9D30198F89232 

CDDDE7D44EFE12B7252EA300362CF5898BDC5013 

84A70CDC24B68207F015D6308FE5AD13DDABB771 

Fake TrueCrypt setup: 

82F48D7787BDE5B7DEC046CBEF99963EEEB821A7 

9666AF44FAFC37E074B79455D347C2801218D9EA 

C02878A69EFDE20F049BC380DAE10133C32E9CC9 

7FBABEA446206991945FB4586AEE93B61AF1B341 

Fake TrueCrypt extracted exe: 

DCBD43CFE2F490A569E1C3DD6BCA6546074FD2A1 

422B350371B3666A0BD0D56AEAAD5DEC6BD7C0D0 

88D703ADDB26ACB7FBE35EC04D7B1AA6DE982241 

86E3276B03F9B92B47D441BCFBB913C6C4263BFE

Researchers Found No Backdoor In TrueCrypt

Researchers have completed the investigation into the cryptographic functionality of TrueCrypt and found no backdoors or other intentional introduced vulnerabilities in the encryption software. However, the software is not perfect and contains some errors. TrueCrypt is a popular program for encrypting files and computers. Despite the popularity of the source code and cryptographic functionality of the software has never been audited.

Several experts therefore decided to raise money through crowdfunding for an audit. Last January, the TrueCrypt boot loader and Windows kernel driver audited, with the audit report was presented in April of the same year. There were no backdoors to be present in the software. The second part of the audit would focus on the cryptographic operation of the encryption program.

End of May 2014 decided the TrueCrypt developers suddenly stop the development of the software and advised users to stop using. This ensured that the audit of the cryptographic operation was delayed, but early this year was yet started. The results have just been published ( pdf ) showing that TrueCrypt is a well-designed encryption program.

There were no intentional backdoors or other serious design errors encountered that would infest the software. However, the software is not perfect, says cryptography professor Matthew Green . The auditors discovered "Programming imprudent" several errors and that in some cases can lead to problems that TrueCrypt guarantee less than desirable.

Biggest problem

The biggest problem was found for the "random number generator" (RNG) of the Windows version. TrueCrypt used to generate the keys that TrueCrypt volumes are encrypted. An important part, because if the RNG is predictable, this may undermine the security of the system. The RNG in TrueCrypt is based on a design from 1998 by Peter Guttman. This RNG is trying "unpredictable" values ​​from disconnecting it and used here include the Windows Crypto API.

In very special cases, the Crypto API could not be initialized. If this happens TrueCrypt would have to stop and give a warning, but the program seems to accept this quietly and continues to generate keys. According to Green, this is not the end of the world, because the probability of this happening is very small. Addition, it would TrueCrypt, in addition to the Crypto API, also retrieve values ​​from other parts of the system, such as mouse movements. This is probably good enough to protect users, notes the professor. "But it is a bad design and should definitely be resolved in divestitures of TrueCrypt."

Research Into TrueCrypt Encryption Start Soon

The investigation into the cryptographic operation of the encryption program TrueCrypt has been somewhat delayed, but will soon really begin, as the initiators announced. The end of 2013 decided cryptography professor Matthew Green and White a scientist Kenn Crowdfunding Initiative to start. The two wanted the website IsTrueCryptAuditedYet? fetch $ 25,000 to verify the cryptographic functionality of TrueCrypt and to have an audit. In total there were collected 62 104 dollars and 32.6 Bitcoins.

Despite the popularity of TrueCrypt, which makes it possible to encrypt files and hard drives, the source code and cryptographic software operation had never been audited. January last year decided security iSEC Partners to conduct the audit of the TrueCrypt boot loader and Windows kernel driver. In April it was audit report presented. Although there are several problems were found, the researchers found no backdoors. The second part of the audit would focus on the cryptographic operation of the encryption program.

Six weeks after the appearance of the first audit report, the TrueCrypt developers pulled the plug on the project. A day later showed Green and White, however, know that the crypto-audit they would still be, but then it jealously kept quiet. According to Green threw the sudden disappearance of TrueCrypt plans somewhat confused. As was given to whether the money could be better spent on different TrueCrypt successors.

Eventually there was a "Plan B" drawn up within budget and also makes sense. As part of this plan was a few weeks ago a contract with the just-launched Cryptography Services of NCC Group closed. Here the original TrueCrypt 7.1a will be audited.This version also forms the basis for various successors.

Green now reports that the audit will take place soon. In addition, let the promoters of the audit plan that they also look at parts of the code, including the Random Number Generator (RNG) TrueCrypt and other parts of the cryptographic implementation. "This will hopefully complement the work of NCC / iSEC and give a little more confidence in the implementation," said Green. He notes that it took a little longer than planned, but the results really come. Results of which he hopes she " really boring "will be.