Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My USB Drive Has a Hidden Encrypted Vault

rootkitlabs.com

Post reply on HN
Print view View original

71–80 of 175 posts

Re: My USB Drive Has a Hidden Encrypted Vault

#71

Post by mediaman »

awesome_dude wrote: post #67
tptacek wrote: post #59

Earlier quoted context omitted.

We're talking about exactly the same threat. What I'm pointing out is that state adversaries won't have to "notice" this; all they'll have to do is plug the device into a standard commercial forensics scanner product --- and we're stipulating that they're plugging the device in already (else what does it matter what bits are on it). They pay other people to notice this stuff for them!

> They pay other people to notice this stuff for them! Money, even at state level, is not some infinite resource (and neither is time). States put effort into what they consider worth investigating - no state strip searches every incoming traveller, and goes through every item in their possession - it's possible for them to do, and if they did they'd find a hang of a lot more contraband, but it's costly, time consumi…

He's saying they just plug your USB stick into some gizmo sold to the state, and it's going to find enough to escalate it.

If the idea is that there's no point in encrypting anything on a USB stick, and you just hope they don't look at it at all, sure.

But there is no threat model here that includes "check the USB stick" and does not automatically lead to finding and breaking "hidden" content.

Re: My USB Drive Has a Hidden Encrypted Vault

#72

Post by whizzter »

tptacek wrote: post #59
LorenPechtel wrote: post #53

Earlier quoted context omitted.

This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware. But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day. But there is a big flaw I see: 8g…

We're talking about exactly the same threat. What I'm pointing out is that state adversaries won't have to "notice" this; all they'll have to do is plug the device into a standard commercial forensics scanner product --- and we're stipulating that they're plugging the device in already (else what does it matter what bits are on it). They pay other people to notice this stuff for them!

I think part of the entire design is that it's quite hard to detect.

1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure.

The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake the SD-card measurably and some constant-time optimizations should make it more or less undetectable.

It's a clever design and I think it should be possible to optimize to become more or less unrecognizable.

Re: My USB Drive Has a Hidden Encrypted Vault

#74

Post by akerl_ »

giancarlostoro wrote: post #65
ThePowerOfFuet wrote: post #63

Earlier quoted context omitted.

The xkcd approach worked in that case; the wrench in that case was legal, not physical, but boy would it have hurt nonetheless.

He deleted everything ultimately. He printed it out in ultra tiny font in order to comply, but it was nearly impossible for law enforcement to use it. The FBI never decrypted the files.

What about the other Lavabit users whose data he had handed over previously, before deciding to say no?

Re: My USB Drive Has a Hidden Encrypted Vault

#75

Post by tptacek »

whizzter wrote: post #72
tptacek wrote: post #59

Earlier quoted context omitted.

We're talking about exactly the same threat. What I'm pointing out is that state adversaries won't have to "notice" this; all they'll have to do is plug the device into a standard commercial forensics scanner product --- and we're stipulating that they're plugging the device in already (else what does it matter what bits are on it). They pay other people to notice this stuff for them!

I think part of the entire design is that it's quite hard to detect. 1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure. The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake…

Can you flesh that out? If I've missed something and oversimplified the design here, I'd want to clarify that!

Re: My USB Drive Has a Hidden Encrypted Vault

#76

Post by ozim »

johnnyApplePRNG wrote: post #5
tptacek wrote: post #3

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…

>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…

You are conflating „state level actor” with „police level action”.

There is a world of difference if you get searched by your local police and a country level agency.

There are military units dealing with forensic investigations they have 100x or 1000x more budget and much smarter people.

But they don’t care about some drug dealers. They don’t waste time on silly stuff.

Re: My USB Drive Has a Hidden Encrypted Vault

#77

Post by tptacek »

giantg2 wrote: post #61
tptacek wrote: post #34

Earlier quoted context omitted.

The security track record of steganography is not great.

Isn't the same true of consumer grade encryption? In a perfect world, they should be used together.

Depends on what you mean, but my subtext was that a lot of steganographic designs have turned out to be detectable; it's a design-level concern, where most consumer encryption problems are implementation issues.

Re: My USB Drive Has a Hidden Encrypted Vault

#78

Post by ianburrell »

Retr0id wrote: post #6
tptacek wrote: post #3

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…

> If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; I kinda assumed this was a solved problem now, up to the information-theoretic limit. Just create a FAT32 fs (for example), put some boring decoy files on it, and then unmount it. Traverse the FAT to map which blocks are in-use vs not-in-use, and use the not-in-use ones to store your encrypted da…

Instead of FAT32, use the flash drive mapping. Flash drive contain mapping from sectors to blocks. This is used to deal with flash erasure, wear leveling, and failures. Custom firmware could map the real filesystem to bad blocks.

Does the forensic software read the whole physical flash drive or just the logical one? They might if they want to get deleted files. Can they detect that there are lots of failures?

Re: My USB Drive Has a Hidden Encrypted Vault

#79

Post by mixmastamyk »

jmclnx wrote: post #15

A very interesting solution! If you can do without Windows, I would say formatting a USB with a first partition as an 8 gig DOS partition and a 2nd partition as Linux LUKS may work just a good. But a few people may know about Linux. So if on OpenBSD, you can create a second OpenBSD encrypted partition. I think that will probably look like garbage to 99.999% of the people you may be hiding from. Be aware, if dealing w…

Hmm, a partition of any sort has mapped the territory.

Re: My USB Drive Has a Hidden Encrypted Vault

#80

Post by phyzome »

tptacek wrote: post #3

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…

This is probably fine for evading local cops.

I'll also note that anyone plugging this into a forensics machine is going to have a bit of a dilemma: Perform write tests, or not? Because if they probe it with password:... attempts to check on timing leakage, that's potentially damaging evidence.

Post reply on HN