Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My USB Drive Has a Hidden Encrypted Vault

rootkitlabs.com

Post reply on HN
Print view View original

131–140 of 175 posts

Re: My USB Drive Has a Hidden Encrypted Vault

#131

Post by marysol5 »

ozim wrote: post #76
johnnyApplePRNG wrote: post #5

Earlier quoted context omitted.

>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…

You are conflating „state level actor” with „police level action”. There is a world of difference if you get searched by your local police and a country level agency. There are military units dealing with forensic investigations they have 100x or 1000x more budget and much smarter people. But they don’t care about some drug dealers. They don’t waste time on silly stuff.

The military really doesn’t have "much smarter people", the intelligent people are all in private industry, then LEO, THEN the military.

The military is stuffed full of grunts who are just there for the pay, and in many cases, conscription.

You can throw all the money you want at something, it doesn't make it work, just look at the US military

Re: My USB Drive Has a Hidden Encrypted Vault

#132

Post by marysol5 »

ted_dunning wrote: post #95
giancarlostoro wrote: post #55

Earlier quoted context omitted.

Anyone using forensic software can dump an image of your entire drive including all partitions, byte for byte copy. Just because you got away with being careless once doesn't mean this will work every time. If you don't want your files to be copied in encrypted or plain unencrypted form, don't bring them with you. You're better off re-downloading them over the web at that point.

Unless they disassemble this drive, a forensic dump will only show the open partition.

A cursory X-Ray would show the internal SD. This product needs a hardware re-design (which I've seen other projects do) to have onboard flash instead.

Saying that, any proper investigation would read the firmware from the flash and identify the decryption routing anyway

Re: My USB Drive Has a Hidden Encrypted Vault

#133

Post by marysol5 »

Retr0id wrote: post #64
jandrese wrote: post #47

Earlier quoted context omitted.

Doesn't FAT have the concept of "badblocks" to handle the old days when sectors could randomly fail on drives and they had to work around it? It would only be slightly more suspicious but it would allow the drive to be mounted and used as a regular drive to avoid the even more suspicious unmounted volume issue. The data in the sectors would obviously be encrypted so it looks like random noise if someone does start po…

It does, but it's extremely unusual for the feature to be in use on modern hardware. I thought of a much simpler approach though. Personally, it's completely normal for my USB drives to contain some OS installer dd'd to the first few GB, and to be wiped with urandom between uses. The installer .iso is typically immutable and will never expand beyond its initial size. Rather than mess around with block mappings, I can…

>It does, but it's extremely unusual for the feature to be in use on modern hardware.

FAT is a filesystem, it isn't hardware. They're talking about the table storing numbers of bad sectors/blocks.

The system you just described is exactly what TrueCrypt did, where if you overwrote the capacity and into the "hidden" data, you'd end up killing the hidden partition.

Re: My USB Drive Has a Hidden Encrypted Vault

#134

Post by marysol5 »

phyzome wrote: post #80
tptacek wrote: post #3

If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…

This is probably fine for evading local cops. I'll also note that anyone plugging this into a forensics machine is going to have a bit of a dilemma: Perform write tests, or not? Because if they probe it with password:... attempts to check on timing leakage, that's potentially damaging evidence.

You do not do any writes in a forensics scenario. Especially if you want to make it stand in court.

You have to always keep a clean hashed copy, and then work on copies from there.

Re: My USB Drive Has a Hidden Encrypted Vault

#135

Post by marysol5 »

fhdkweig wrote: post #12
amelius wrote: post #9

Earlier quoted context omitted.

Someone should write a disk formatting utility that randomizes the bits on your drive. Now you can claim that any encrypted drive (which just looks like pure noise if done correctly) is a drive that was just formatted.

Be careful in countries like UK which have laws requiring the decryption of any data they find. There are people sitting in jail because they couldn't decrypt the "random noise" on their computers.

Why do people just invent this absolute bullshit.

No there isn't. even people who have been prosecuted for refusing to decrypt data, it takes a lot of working by the prosecution to PROVE it's encrypted and not just "random data".

I'm from the UK and have been in court with encrypted data myself.....

Re: My USB Drive Has a Hidden Encrypted Vault

#136

Post by marysol5 »

fhdkweig wrote: post #25
NikolaNovak wrote: post #20

Earlier quoted context omitted.

Fair warning; any links to specific cases (not the law itself)?

This lists two unnamed individuals. https://edri.org/our-work/edri-gramnumber7-16decrypt-data-ca...

None of which are what OP is claiming

Re: My USB Drive Has a Hidden Encrypted Vault

#137

Post by marysol5 »

pixl97 wrote: post #37
monster_truck wrote: post #24

Earlier quoted context omitted.

There literally are not. Anyone competent enough to be an expert witness will be able to plainly explain to everyone else how statistical analysis obviously delinates the difference between truly random noise and an encrypted volume.

Loll, you have a lot of faith in the legal system that I do not. Expert witnesses are commonly full of shit.

You know that defence can bring in an expert witness too right?

Re: My USB Drive Has a Hidden Encrypted Vault

#138

Post by marysol5 »

JoeBOFH wrote: post #13
jrexilius wrote: post #2

Good stuff! If I remember correctly there was company at Defcon selling memory cards that had this feature built into them a couple years ago?

I miss TrueCrypts alt boot option. You enter a specific password it boots an alt OS so you could have an automatic alternative thing if under duress.

VeraCrypt exists

Re: My USB Drive Has a Hidden Encrypted Vault

#139

Post by marysol5 »

marysol5 wrote: post #138
JoeBOFH wrote: post #13

Earlier quoted context omitted.

I miss TrueCrypts alt boot option. You enter a specific password it boots an alt OS so you could have an automatic alternative thing if under duress.

VeraCrypt exists

Also there is patches for luksOpen that destroys the key if you give a "duress" key. Not that would work in proper forensic operations.

Re: My USB Drive Has a Hidden Encrypted Vault

#140

Post by marysol5 »

pessimizer wrote: post #100

Can this be done on boards with the same layouts as known commercial USB keys i.e will imaging just show this to be what it is?

You would need to re-engineer this to not have an SD card. And you'd also need the MCU where you can't just read off the firmware and decompile it to see the encryption routing.
Post reply on HN