Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My USB Drive Has a Hidden Encrypted Vault

rootkitlabs.com

Post reply on HN
Print view View original

101–110 of 175 posts

Re: My USB Drive Has a Hidden Encrypted Vault

#101

Post by [deleted] »

pixl97 wrote: post #29
matheusmoreira wrote: post #7

Earlier quoted context omitted.

> It didn't look like anything they had seen before so they didn't think anything of it. You will miss your government's incompetence when they start rectifying these failures. I know I do. They are the tyrants who oppress us with a clean conscience. They never rest and have infinite money. Their occasional episodes of bumbling incompetence is the only respite, but those won't last. Especially now with AI to think fo…

Ya. Especially when were at the point they know you know about hidden encrypted disks because they have your full internet history for the last 10 years. I guess it's human nature to build the Torment Nexus.

[deleted]

Re: My USB Drive Has a Hidden Encrypted Vault

#102

Post by jbxntuehineoh »

giancarlostoro wrote: post #57
pixl97 wrote: post #37

Earlier quoted context omitted.

Loll, you have a lot of faith in the legal system that I do not. Expert witnesses are commonly full of shit.

I heard one argue that "zooming" on an image by adding pixels with an algorithm is normal, and he's had such "evidence" used in court before. I was a little horrified as someone who has worked on digital forensic software at a former employer. Adding pixels to an image is not evidence, you're fabricating something out of thin air, especially if its drastically smaller, its even more likely to be BS.

but... how _else_ would you Enhance the image?

Re: My USB Drive Has a Hidden Encrypted Vault

#103

Post by dataflow »

giancarlostoro wrote: post #57
pixl97 wrote: post #37

Earlier quoted context omitted.

Loll, you have a lot of faith in the legal system that I do not. Expert witnesses are commonly full of shit.

I heard one argue that "zooming" on an image by adding pixels with an algorithm is normal, and he's had such "evidence" used in court before. I was a little horrified as someone who has worked on digital forensic software at a former employer. Adding pixels to an image is not evidence, you're fabricating something out of thin air, especially if its drastically smaller, its even more likely to be BS.

Are you saying any photos I take with phone that had digital zoom is automatically I admissible? Or if not, isn't that consistent with what they said?

Re: My USB Drive Has a Hidden Encrypted Vault

#104

Post by kulahan »

femto wrote: post #99
whizzter wrote: post #72

Earlier quoted context omitted.

I think part of the entire design is that it's quite hard to detect. 1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure. The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake…

If I was building a black box to detect hidden data on a USB stick, I'd include a feature whereby it measures power consumption and flags USB drives that don't consume the expected power for that type of drive.

What an unreasonably complex device to imply you’re going to make 50,000 copies of and ship out to every border agent in the nation after telling them every SINGLE flash drive crossing the border MUST be scanned. That’s so much wasted time, energy, and money. Are you building a similar device for SD cards? HDDs? SSDs? External drives? You’re going to build a database of exact charge draws for every device in existence which happens to have some form of storage on it?

Fucking up every single import and traveler on the off-chance one in seven billion scans detects one of these devices and, further, carries some data the US cares enough about to chase down to this degree?

No. Nope. Nuh uh. Insanely unreasonable. You will get ONE at a station, which you only bother to use if you can convince your $12/hr employee to even give a shit. Literally an insane proposition.

Re: My USB Drive Has a Hidden Encrypted Vault

#105

Post by monster_truck »

monocasa wrote: post #36
monster_truck wrote: post #24

Earlier quoted context omitted.

There literally are not. Anyone competent enough to be an expert witness will be able to plainly explain to everyone else how statistical analysis obviously delinates the difference between truly random noise and an encrypted volume.

If there's a difference visible, that's a weakness in the encryption algorithm. Encrypted data should be statistically indistinct from random noise. It's an information theory thing. Everything in the ciphertext should be sitting at maximum entropy.

Try it for yourself brother, there is a plainly obvious difference between the random noise of writing garbage compared to a properly encrypted binary.

There are even statistically measurable differences in the garbage written across versions of a tool or OS, which, unlike the invented scenario above, has been successfully used to place a time window on when exactly someone destroyed evidence.

Re: My USB Drive Has a Hidden Encrypted Vault

#106

Post by imglorp »

It might make more sense to embed the encrypted volume in some generic USB device. Require some condition to be true before the volume appears to the host, otherwise it's doing power or camera stuff.

A drive would draw more scrutiny than a camera or powerbank or even a cable. https://shop.hak5.org/products/omg-cable

Re: My USB Drive Has a Hidden Encrypted Vault

#107

Post by monster_truck »

pixl97 wrote: post #37
monster_truck wrote: post #24

Earlier quoted context omitted.

There literally are not. Anyone competent enough to be an expert witness will be able to plainly explain to everyone else how statistical analysis obviously delinates the difference between truly random noise and an encrypted volume.

Loll, you have a lot of faith in the legal system that I do not. Expert witnesses are commonly full of shit.

I didn't say all expert witnesses are good nor did I claim they are all used in good faith.

Merely that, unlike in the invented scenario above, statistical differences in the random garbage that gets written to a disk across different tool or OS versions has been successfully used to place a time window on when exactly someone destroyed evidence.

Re: My USB Drive Has a Hidden Encrypted Vault

#108

Post by ButlerianJihad »

ErroneousBosh wrote: post #17
tptacek wrote: post #3

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…

> Concealing an encrypted volume jacks suspicion way up; whatever pickle you were going to be in if you just kept an encrypted DMG on your desktop, you're trebly in now. Time to bust out the old "Can't tell if this MP3 is a steganographically important encrypted file or just a Nurse With Wound EP" trick then.

There once was a time when I'd be on Facebook all day, subscribed to many groups and pages that published really dank memes. And I would enjoy laughing at these memes, and the dankest memes I would duly collect and forward to my mother who is a boomer.

And my mother would duly sift through these forwarded meme images for the dankest of the dank, and then she would eagerly forward them to her friend from church, who also had a large distribution list, and so that is how I became a conduit for the dankest GenZ Facebook memes to the boomer generations in another state.

And then I became a Cybersecurity educator, and our curriculum contained a module on steganography, and we all had the students do a proof-of-concept where they cryptographically embedded secret messages in innocent-looking photograph files.

And that is where my meme-sharing came to a screeching halt, and I deleted every meme I ever collected, and I unsubbed from every possible source, and I began completely ignoring memes, and my mother's distribution dried up. Good god that was absolutely shocking. I have no idea what sort, if any, secret messages I was responsible for, and I hope that we never ever find out!

Re: My USB Drive Has a Hidden Encrypted Vault

#109

Post by loneboat »

NetMageSCW wrote: post #91
sandworm101 wrote: post #52

Dude. Veracrypt. Hidden volumes. This is an old and well-solved problem set.

Hidden volumes aren’t that hidden if Veracrypt can find them.

iirc it's even invisible to veracrypt until it has your correct password in hand. The hidden volume headers are indistinguishable from random bytes (which Veracrypt fills the volume with on creation).

Re: My USB Drive Has a Hidden Encrypted Vault

#110

Post by monster_truck »

ThePowerOfFuet wrote: post #68
monster_truck wrote: post #24

Earlier quoted context omitted.

There literally are not. Anyone competent enough to be an expert witness will be able to plainly explain to everyone else how statistical analysis obviously delinates the difference between truly random noise and an encrypted volume.

> the difference between truly random noise and an encrypted volume A LUKS volume with a detached header is indistinguishable from random data.

Have you actually compared the random data that various tools write to a disk to encrypted files? Load up binwalk and give it a rip, you will be surprised by how distinct the entropy graph is between the two
Post reply on HN