Live data from Hacker News

My USB Drive Has a Hidden Encrypted Vault

rootkitlabs.com

81–90 of 175 posts

Re: My USB Drive Has a Hidden Encrypted Vault

#81
post #3

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…

>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…

Trying to keep data on a USB drive hidden long term is a losing game is the thing.

If you're intercepted with anything of value what you want is to rapidly destroy it.

This was the big problem I found when I was trying to figure out a secure way use Yubikeys: they're both long term unreliable, and short term impossible to wipe or destroy fast enough.

Literally a printout of 1 time passwords has better security properties in an adversarial situation.

For a storage device what you want isn't a secure store, what you want is a pin pull or switch which wipes it instantly.

Re: My USB Drive Has a Hidden Encrypted Vault

#82
post #6

Earlier quoted context omitted.

> If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; I kinda assumed this was a solved problem now, up to the information-theoretic limit. Just create a FAT32 fs (for example), put some boring decoy files on it, and then unmount it. Traverse the FAT to map which blocks are in-use vs not-in-use, and use the not-in-use ones to store your encrypted da…

Instead of FAT32, use the flash drive mapping. Flash drive contain mapping from sectors to blocks. This is used to deal with flash erasure, wear leveling, and failures. Custom firmware could map the real filesystem to bad blocks. Does the forensic software read the whole physical flash drive or just the logical one? They might if they want to get deleted files. Can they detect that there are lots of failures?

You need the wear levelling system for actual wear leveling, otherwise the drive won't last very long. Competent forensic analysis can check the firmware and the physical flash contents, although most forensic analysis is not especially competent.

Re: My USB Drive Has a Hidden Encrypted Vault

#83
post #3

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…

[deleted]

Re: My USB Drive Has a Hidden Encrypted Vault

#84

Earlier quoted context omitted.

The xkcd approach worked in that case; the wrench in that case was legal, not physical, but boy would it have hurt nonetheless.

He deleted everything ultimately. He printed it out in ultra tiny font in order to comply, but it was nearly impossible for law enforcement to use it. The FBI never decrypted the files.

It's hard to tell if you're being serious here. At the end of the day, Lavabit's security came down to... the FBI's inability to read an ultra tiny font?

That's not the actual story (like, that happened, but all it did was provoke the DOJ), but it's remarkable to see someone cite that as a success for Levison.

Re: My USB Drive Has a Hidden Encrypted Vault

#86
post #3

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…

[deleted]

Re: My USB Drive Has a Hidden Encrypted Vault

#87

Earlier quoted context omitted.

> They pay other people to notice this stuff for them! Money, even at state level, is not some infinite resource (and neither is time). States put effort into what they consider worth investigating - no state strip searches every incoming traveller, and goes through every item in their possession - it's possible for them to do, and if they did they'd find a hang of a lot more contraband, but it's costly, time consumi…

He's saying they just plug your USB stick into some gizmo sold to the state, and it's going to find enough to escalate it. If the idea is that there's no point in encrypting anything on a USB stick, and you just hope they don't look at it at all, sure. But there is no threat model here that includes "check the USB stick" and does not automatically lead to finding and breaking "hidden" content.

Try to explain how the hidden content would be found? It effectively doesn’t exist until the password is in place. It isn’t hidden, it isn’t connected at all.

Re: My USB Drive Has a Hidden Encrypted Vault

#89

Earlier quoted context omitted.

>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…

> Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". The state-level threat isn't just about the direct employees' competence. They also have the funding to purchase tools made by people who really know what they are doing. Think of things like Pegasus spyware or Darksword iPhone hacking. I can believe that a keystone cop wouldn't know the differe…

A copy of this USB drive would show nothing from the encrypted portion.
Post reply on HN