My USB Drive Has a Hidden Encrypted Vault
rootkitlabs.com
My USB Drive Has a Hidden Encrypted Vault
1–10 of 175 posts
Re: My USB Drive Has a Hidden Encrypted Vault
#2Good stuff! If I remember correctly there was company at Defcon selling memory cards that had this feature built into them a couple years ago?
Re: My USB Drive Has a Hidden Encrypted Vault
#3If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions.
Then you're down to two issues:
(1) Concealing an encrypted volume jacks suspicion way up; whatever pickle you were going to be in if you just kept an encrypted DMG on your desktop, you're trebly in now.
(2) Your actual security comes down to the strength of the encrypted volume, and this is 20-year-old encryption. He can't use a memory-hard KDF because of his BOM, which, like, fair enough, but that doesn't change the fact that this KDF is probably ~50x faster than standard bcrypt hardness and on realistic human passwords is probably crackable in minutes-to-hours on a dedicated rig.
I winced particularly at the observation that the hardness was set where it is because of how long it takes to open the encrypted volume on this hardware, because whatever scheme is being used to run the KDF now, an attacker won't bother; they'll just copy the bits and attack them on serious hardware.
Point (1) isn't meaningful if your adversaries aren't states. It might make sense to have a hidden encrypted volume for the same reason you'd want an encrypted safe. But point (2) applies to everybody.
Re: My USB Drive Has a Hidden Encrypted Vault
#4Plausible deniability requires people to believe that you don't know about any so called "hidden" volumes. That goes out the window once you buy Hidden Drive from Hidden Drive Company.
Re: My USB Drive Has a Hidden Encrypted Vault
#5If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…
>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries;
This would evade 99% of them.
Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things".
I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example.
They took everything. They found everything. Everything except for the $1,000 piece of drug paraphernalia I had sitting right out in open view in the middle of the apartment... the Volcano vaporizer.
It didn't look like anything they had seen before so they didn't think anything of it.
Same would be true with this USB drive in 99% of border crossing privacy invasions... plug in USB, ask for password, read it/copy it/whatever... they're not taking it apart and performing open heart surgery on a $5 USB drive at the border.
They might throw it out... or keep it or something... sure... but in general... this is a hell of a lot better than a regular USB drive imho.
Re: My USB Drive Has a Hidden Encrypted Vault
#6If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…
> If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries;
I kinda assumed this was a solved problem now, up to the information-theoretic limit. Just create a FAT32 fs (for example), put some boring decoy files on it, and then unmount it. Traverse the FAT to map which blocks are in-use vs not-in-use, and use the not-in-use ones to store your encrypted data in some arbitrary header-free indistinguishable-from-random format. The result should look just like someone had set up a FAT filesystem on top of a securely erased drive.
If anyone ever mounts and subsequently writes to the FAT volume they'll clobber your data - oh well.
The remaining issue is that you need some special software on the host to mount the hidden volume, which itself raises suspicions. This could be solved by bundling it with OSes by default.
Re: My USB Drive Has a Hidden Encrypted Vault
#7If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…
>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…
> It didn't look like anything they had seen before so they didn't think anything of it.
You will miss your government's incompetence when they start rectifying these failures. I know I do.
They are the tyrants who oppress us with a clean conscience. They never rest and have infinite money. Their occasional episodes of bumbling incompetence is the only respite, but those won't last. Especially now with AI to think for them.
Re: My USB Drive Has a Hidden Encrypted Vault
#8If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…
>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…
This is self-soothing, not a real security plan. It doesn't matter how competent a security agency is, because there's a whole ecosystem of vendors selling into that space; knowledge of how to attack encrypted disks like this is outsourced, and, importantly, those firms have incentives to mop up even random stuff like this, because vendors will be selected in part based on lists of how many different circumvention and privacy tools they can detect.
Re: My USB Drive Has a Hidden Encrypted Vault
#9If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…
Someone should write a disk formatting utility that randomizes the bits on your drive.
Now you can claim that any encrypted drive (which just looks like pure noise if done correctly) is a drive that was just formatted.
Re: My USB Drive Has a Hidden Encrypted Vault
#10If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…
>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…
> Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things".
The state-level threat isn't just about the direct employees' competence. They also have the funding to purchase tools made by people who really know what they are doing. Think of things like Pegasus spyware or Darksword iPhone hacking.
I can believe that a keystone cop wouldn't know the difference between a bong and a flower vase, but border crossing guards will know a USB drive when they see one and pass a copy of it to someone who knows what they are doing.