TrueCrypt Master Key Extraction And Volume Identification
volatility-labs.blogspot.com
TrueCrypt Master Key Extraction And Volume Identification
1–10 of 75 posts
Re: TrueCrypt Master Key Extraction And Volume Identification
#2Of course, partition-only encryption has weaknesses in that the OS may store data in another partition (i.e. you've encrypted the "D:" drive but Windows just dumps a cached file to "C:", let alone the whole pagefile challenge). So you need to trust your OS to not write the masterkey to disk, which is widely acknowledged. I personally run with no page file, so memory ought not to be written to disk by the OS itself (barring a malicious adversary), although this solution isn't the best for someone on 1GB RAM.
Full-disk encryption would block this attack, i.e. encrypted swap on Linux (crypttab makes this quite easy) or system-drive on Truecrypt. Even if it's dumped to disk, you can't get it, again barring online access to the system. Online access this is all null and void regardless as they could just issue commands to dump memory to disk no matter what you've done!
Re: TrueCrypt Master Key Extraction And Volume Identification
#3Interesting writeup and cool that Mr. Ligh has provided these plugins / tools. On the whole though, doesn't appear to contain much novel information. Of course, partition-only encryption has weaknesses in that the OS may store data in another partition (i.e. you've encrypted the "D:" drive but Windows just dumps a cached file to "C:", let alone the whole pagefile challenge). So you need to trust your OS to not write…
Re: TrueCrypt Master Key Extraction And Volume Identification
#4Re: TrueCrypt Master Key Extraction And Volume Identification
#5Re: TrueCrypt Master Key Extraction And Volume Identification
#6"Here's my data but you cannot read it" - does not runs so well with courts, high stakes competitors and deep pocketed enemies.
Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :)
If you're not possessing anything to crack (or so "they" think), you're safe :)
Re: TrueCrypt Master Key Extraction And Volume Identification
#7What does this mean for me? I have all my interal + external hard drives encrypted as well as my system drive.
Re: TrueCrypt Master Key Extraction And Volume Identification
#8So not safe?
Re: TrueCrypt Master Key Extraction And Volume Identification
#9But theres still a valuable lesson: a half-encrypted system is a not encrypted system, and it will leak information. Theres a paper on this from 2008 I think, before TrueCrypt implemented full operating system encryption:
Re: TrueCrypt Master Key Extraction And Volume Identification
#10So not safe?