Dude. Veracrypt. Hidden volumes. This is an old and well-solved problem set.
Hidden volumes aren’t that hidden if Veracrypt can find them.
My USB Drive Has a Hidden Encrypted Vault
91–100 of 175 posts
Re: My USB Drive Has a Hidden Encrypted Vault
#92Encrypted USB drives, there are definite legal uses, but like others have said, it raises suspicion.
The whole point is you are unable to detect that the drive is encrypted because it is only visible to USB once the password is written.
The whole point is asking what is so sensitive.
Re: My USB Drive Has a Hidden Encrypted Vault
#93Encrypted USB drives, there are definite legal uses, but like others have said, it raises suspicion.
The whole point is you are unable to detect that the drive is encrypted because it is only visible to USB once the password is written.
In this case you can just crack it open and see that the SD card inside is larger than the 8 GB block device exposed.
Re: My USB Drive Has a Hidden Encrypted Vault
#94Earlier quoted context omitted.
He's saying they just plug your USB stick into some gizmo sold to the state, and it's going to find enough to escalate it. If the idea is that there's no point in encrypting anything on a USB stick, and you just hope they don't look at it at all, sure. But there is no threat model here that includes "check the USB stick" and does not automatically lead to finding and breaking "hidden" content.
Try to explain how the hidden content would be found? It effectively doesn’t exist until the password is in place. It isn’t hidden, it isn’t connected at all.
I’m no expert but I can imagine a scenario where an x-ray scan can notice an SD card embedded into the controller and flag that for follow-up
SD card the author says was added to offset the cost of eMMC but would presumably stand out as anomalous with whatever AI is classifying the scan
Re: My USB Drive Has a Hidden Encrypted Vault
#95Earlier quoted context omitted.
>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…
Anyone using forensic software can dump an image of your entire drive including all partitions, byte for byte copy. Just because you got away with being careless once doesn't mean this will work every time. If you don't want your files to be copied in encrypted or plain unencrypted form, don't bring them with you. You're better off re-downloading them over the web at that point.
Unless they disassemble this drive, a forensic dump will only show the open partition.
Re: My USB Drive Has a Hidden Encrypted Vault
#96Earlier quoted context omitted.
We're talking about exactly the same threat. What I'm pointing out is that state adversaries won't have to "notice" this; all they'll have to do is plug the device into a standard commercial forensics scanner product --- and we're stipulating that they're plugging the device in already (else what does it matter what bits are on it). They pay other people to notice this stuff for them!
I think part of the entire design is that it's quite hard to detect. 1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure. The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake…
> The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay,
- Have the first check be a simple 8bit hash that filters out most passwords in microseconds, or use a customizable prefix instead of “password:”.
- have your password checking thread run in background at idle priority
- when you get an async password match, force usb disconnect and reconnect and the system will rescan the bus and mount your real drive.
Short of adversary dumping drive firmware (or them figuring out your hn account t, having a LLM scan the messages and finding this conversation) it’s not really easily detectable..
Re: My USB Drive Has a Hidden Encrypted Vault
#97A very interesting solution! If you can do without Windows, I would say formatting a USB with a first partition as an 8 gig DOS partition and a 2nd partition as Linux LUKS may work just a good. But a few people may know about Linux. So if on OpenBSD, you can create a second OpenBSD encrypted partition. I think that will probably look like garbage to 99.999% of the people you may be hiding from. Be aware, if dealing w…
But this partition would be visible.
The OP had a version that is invisible.
Re: My USB Drive Has a Hidden Encrypted Vault
#98If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…
Someone should write a disk formatting utility that randomizes the bits on your drive. Now you can claim that any encrypted drive (which just looks like pure noise if done correctly) is a drive that was just formatted.
This is what GNU shred does. It has a high speed PRNG meant to avoid performance issues from directly using /dev/[u]random. Point it at your preferred block device or partition and let it fill your drive with entropy. With modern flash devices there is still the issue of hidden reserved space for block replacement but you will cover most of the drive. Reduce iterations to 1 since the default is meant for legacy hard drives and will needlessly add erase cycles to flash.
Re: My USB Drive Has a Hidden Encrypted Vault
#99Earlier quoted context omitted.
We're talking about exactly the same threat. What I'm pointing out is that state adversaries won't have to "notice" this; all they'll have to do is plug the device into a standard commercial forensics scanner product --- and we're stipulating that they're plugging the device in already (else what does it matter what bits are on it). They pay other people to notice this stuff for them!
I think part of the entire design is that it's quite hard to detect. 1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure. The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake…
If I was building a black box to detect hidden data on a USB stick, I'd include a feature whereby it measures power consumption and flags USB drives that don't consume the expected power for that type of drive.
Re: My USB Drive Has a Hidden Encrypted Vault
#100Can this be done on boards with the same layouts as known commercial USB keys i.e will imaging just show this to be what it is?