Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German BSI withholds Truecrypt security report

golem.de

Post reply on HN
Print view View original

41–50 of 86 posts

Re: German BSI withholds Truecrypt security report

#41

Post by tootahe45 »

treljherthj wrote: post #36
onetimemanytime wrote: post #26

Much safer to assume that a decent nation state can decrypt Truecrypt and a lot of other things. You can hide stuff from your wife, friends or banana Republic countries, but I wouldn't bet against NSA with 30 years in jail.

True, but not by outright cracking the encryption. They will get your password instead, by implanting your keyboard, putting a camera behind you on the wall, or grabbing you just after you've entered your password.

That sounds like effort. Intercepting your next Amazon order for anything that plugs into the pc and loading it up with malware would be better.

Re: German BSI withholds Truecrypt security report

#42

Post by jlgaddis »

aasasd wrote: post #30
bonzini wrote: post #23

Earlier quoted context omitted.

... if you have sudo.

Where does sudo come in with suid executables? Especially since afaik sudo depends on suid in the first place.

One might be granted privileges to mount the filesystem using sudo, but not privileges to run other commands.

If the filesystem just mounted has setuid executables, however, the user can then get around their lack of additional sudo privileges by running the setuid executables.

Although most people seem to use sudo to allow a user to run anything, that's really not how it was intended to be used.

Re: German BSI withholds Truecrypt security report

#43

Post by iudqnolq »

onetimemanytime wrote: post #37
treljherthj wrote: post #36

Earlier quoted context omitted.

True, but not by outright cracking the encryption. They will get your password instead, by implanting your keyboard, putting a camera behind you on the wall, or grabbing you just after you've entered your password.

Good point. Another thing: even if they can decrypt it, they'd save that for Osama types, not ruin it over a small tax case. Otherwise bad guys would stop using it. Maybe decrypt but not use in court...

One tool is parallel construction. First they find out what you did through an illegal/classified method, then they use the benefit of knowing the answer to construct a way to figure out the same information legally.

For example, an agency illegally taps your phone and find out you'll be driving with something illegal in your car along a certain route. The agency then tells some state troopers to notice $your_car driving unsafely at $location and pull you over for a routine traffic stop and search your car.

It's unlikely they'd take even that risk on a tax case, though.

Re: German BSI withholds Truecrypt security report

#45

Post by aasasd »

jlgaddis wrote: post #42
aasasd wrote: post #30

Earlier quoted context omitted.

Where does sudo come in with suid executables? Especially since afaik sudo depends on suid in the first place.

One might be granted privileges to mount the filesystem using sudo, but not privileges to run other commands. If the filesystem just mounted has setuid executables, however, the user can then get around their lack of additional sudo privileges by running the setuid executables. Although most people seem to use sudo to allow a user to run anything , that's really not how it was intended to be used.

That's somewhat different from the Veracrypt case, afaict. And it doesn't seem like this is what bonzini meant by mentioning sudo.

Re: German BSI withholds Truecrypt security report

#46

Post by johannes1234321 »

close04 wrote: post #25
perlgeek wrote: post #6

Earlier quoted context omitted.

The documents seem to be available here: https://fragdenstaat.de/anfrage/untersuchungen-zum-verschlus... They all have "geschwärzt" (blackened) in the file name, but it looks like only some author's name (and maybe working group name) have been removed -- I've scrolled through a few of these files, and didn't find anything else that might have been removed.

I'm not sure if the implication of the following is that sections of the report were withheld or that it was incomplete to begin with. > However the report hints that more such flaws exist. Another chapter in the documents mentions, that several such off-by-one-errors were found, but due to a lack of a complete code analysis only examples can be shown. However even those examples are missing in the document - the fol…

My understanding is that the auditors didn't have time to analyze all these errors, thus omitted them from the report already, but only pointing out the potential risk.

Re: German BSI withholds Truecrypt security report

#47

Post by Certhas »

usrusr wrote: post #17
hvidgaard wrote: post #4

Earlier quoted context omitted.

Either they had to do that, or they had to be ready for the barrage of incoming requests for the documents.

Which gives the "withhold" part of the story a strong push towards Hanlon's Razor, once the topic escalated to higher ranks the copyright ceased to be a hindrance. Or more precisely, towards an organizational variety of Hanlon's Razor, where stupidity takes the form of the organizational failure mode of underlings not being authorized to do what would have been the right thing. Curiously, a less colloquial formulatio…

Scheinbare Bösartigkeit kann oft durch mangelnde Kompetenz erklärt werden. ;)

Re: German BSI withholds Truecrypt security report

#48

Post by lima »

aasasd wrote: post #28
jmakov wrote: post #13

"... in the simplest case a user can mount a Truecrypt volume that contains a file with suid root permission that will open a shell. Golem.de was able to replicate this scenario in a current version of Veracrypt."

This surprised me the most―never thought about this before. Aren't all permission-supporting filesystems vulnerable to this if mounting by a user is permitted? I presume filesystems don't go through the files and downgrade root ownership.

This is also nice for breaking in/out of Docker containers with bind mounts.

Re: German BSI withholds Truecrypt security report

#49

Post by unnouinceput »

I use VeraCrypt and none of this are of my concern in my daily use of it. Can anyone tell me if my containers are still safe from prying eyes since I upload them to cloud? I need specific answers from anyone working on VeraCrypt, not general answers of "yeah, they are unsafe" that usually HN does.

Re: German BSI withholds Truecrypt security report

#50

Post by chmod775 »

michaelt wrote: post #14
Grumbledour wrote: post #3

It is sad to see the state still making freedom of information requests so difficult and using copyright as a flimsy excuse to hinder citizens to share the information when they finally manage to get it out of them. I find it especially sad to see something like this held back by an entity that claims to want to protect security in information technology and doubly so since this information would be relevant to the d…

When the developers of a product pay for a third-party security assessment, the results are usually confidential - after all, who'd pay to have their product publicly badmouthed? Perhaps BSI was merely attempting to provide such a service for free.

> Perhaps BSI was merely attempting to provide such a service for free.

Yup. That's something they do. They also do stuff like checking/scanning publicly accessible servers in Germany for outdated software/vulnerabilities and you'll get an e-mail if they find something (this is automated).

In this case there's the added dimension of the government using Truecrypt in some places at the time, so they had an interest in it being secure.

Post reply on HN