Dude. Veracrypt. Hidden volumes. This is an old and well-solved problem set.
Hidden volumes aren’t that hidden if Veracrypt can find them.
They are hidden if one of the "sources" to find them is only known to the user.
My USB Drive Has a Hidden Encrypted Vault
141–150 of 175 posts
Re: My USB Drive Has a Hidden Encrypted Vault
#142Re: My USB Drive Has a Hidden Encrypted Vault
#143Earlier quoted context omitted.
Someone should write a disk formatting utility that randomizes the bits on your drive. Now you can claim that any encrypted drive (which just looks like pure noise if done correctly) is a drive that was just formatted.
Be careful in countries like UK which have laws requiring the decryption of any data they find. There are people sitting in jail because they couldn't decrypt the "random noise" on their computers.
> There are people sitting in jail because they couldn't decrypt the "random noise" on their computers.
Sources or names?
Re: My USB Drive Has a Hidden Encrypted Vault
#144If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; if you can find these projects and conveniently use them, state vendors can and will write scanners that find them. They're paid to do it; new detections are how they get to charge for maintenance and new versions. Then you're down to two issues: (1) Concealing an encrypted volume jacks suspicion w…
At the risk of being dumb, wouldn't an easier solution be physical? ie have a usb stick with two actual "disks" and a an appropriately obscured physical switch to define what plugging it in actually does?
Again, this isn't going to beat someone who knows you've got something to hide, they can physically deconstruct/analyse the drive, but at least it's not going to be found by automatic scanning/software etc?
Re: My USB Drive Has a Hidden Encrypted Vault
#145Earlier quoted context omitted.
Fair warning; any links to specific cases (not the law itself)?
This lists two unnamed individuals. https://edri.org/our-work/edri-gramnumber7-16decrypt-data-ca...
They don't mention anything about data being claimed as random noise nor the sentences.
Re: My USB Drive Has a Hidden Encrypted Vault
#146Earlier quoted context omitted.
It does, but it's extremely unusual for the feature to be in use on modern hardware. I thought of a much simpler approach though. Personally, it's completely normal for my USB drives to contain some OS installer dd'd to the first few GB, and to be wiped with urandom between uses. The installer .iso is typically immutable and will never expand beyond its initial size. Rather than mess around with block mappings, I can…
>It does, but it's extremely unusual for the feature to be in use on modern hardware. FAT is a filesystem, it isn't hardware. They're talking about the table storing numbers of bad sectors/blocks. The system you just described is exactly what TrueCrypt did, where if you overwrote the capacity and into the "hidden" data, you'd end up killing the hidden partition.
Modern hardware tries not expose bad sectors to the filesystem layer at all, they are managed by the drive firmware (transparently remapped, until the drive runs out of spare sectors). Thus, you will ~never see bad sectors marked in the FAT on modern hardware.
Re: My USB Drive Has a Hidden Encrypted Vault
#147Earlier quoted context omitted.
I think part of the entire design is that it's quite hard to detect. 1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure. The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake…
> The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, - Have the first check be a simple 8bit hash that filters out most passwords in microseconds, or use a customizable prefix instead of “password:”. - have your password checking thread run in background at idle priority - when you get an async password match, force usb discon…
It's even easier to detect from that. From the project writeup Q&As: 'The firmware snoops for the string "password:xyz" and inhibits the write of "xyz". Otherwise, yes this would be very insecure.'
So detecting this drive is just a matter of writing "password:anything" to the drive, unmounting, remounting and checking the file you just wrote. If it's not what you wrote, then you have detected the existence of this drive.
The parent comment was correct that if this was mitigated by testing if the key is valid then you can detect it by checking for timing differences between writing a sector that starts "password:" and one that doesn't. Moving the password check async just means that you run the risk of having the real password written to the SD card before it was detected.
If you buffer that sector from being written, then you might be able to detect it because the write was faster than expected, or if you write the modified version and go back and overwrite it with the original if the check fails, then you will slow down a different subsequent access, again which would be detectable. This would also invalidate one of the design goals of never keeping the password in memory, only the derived key.
Having a customizable prefix is possible, as the project is open source. Personally, I'd be tempted to make this possible on the base build by storing the prefix in the hidden area of the SD card.
Re: My USB Drive Has a Hidden Encrypted Vault
#148Earlier quoted context omitted.
> But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days?? What is the problem? I have promotional flash drives from 1 Gb up to 8 Gb, that I use to store music for my car, or to carry pdfs to print in shared printers. I don't care if they break or get lost. I know people that carry similar promotional items with similar capacities. What is suspicious about 8 Gb drives? Maybe the lack…
I found a 8GB USB drive in my pocket after doing the washing the other day (RIP). I'd been using it to boot the debian installer from.
You should check to see if it still works. My favorite thumb drive went through the washing machine several times and still works.
Re: My USB Drive Has a Hidden Encrypted Vault
#149Earlier quoted context omitted.
>If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; This would evade 99% of them. Most "state-level" adversaries are just high school dropouts working border jobs told to "investigate suspicious things". I once had a police officer literally raid my room for drugs during a massive party we were throwing in university, for example. They took everyth…
This is self-soothing, not a real security plan. It doesn't matter how competent a security agency is, because there's a whole ecosystem of vendors selling into that space; knowledge of how to attack encrypted disks like this is outsourced, and, importantly, those firms have incentives to mop up even random stuff like this, because vendors will be selected in part based on lists of how many different circumvention an…
You are right in a laboratory way of let's-assume-perfect-adversary, and you're not in a how-it-really-works way. I simply have my own RL exp in a bad repressive country on this topic, and my claim that e.g. hidden volume works most of the time. Like any tech it will stop being useful eventually, but it has been saving people for quite some time.
Why is that is a long story. And it includes both general inefficiency of state apparatus, but also the fact that repressive systems aren't optimized for getting evidence (or just correct information) in most cases.
Re: My USB Drive Has a Hidden Encrypted Vault
#150Earlier quoted context omitted.
> It didn't look like anything they had seen before so they didn't think anything of it. You will miss your government's incompetence when they start rectifying these failures. I know I do. They are the tyrants who oppress us with a clean conscience. They never rest and have infinite money. Their occasional episodes of bumbling incompetence is the only respite, but those won't last. Especially now with AI to think fo…
Ya. Especially when were at the point they know you know about hidden encrypted disks because they have your full internet history for the last 10 years. I guess it's human nature to build the Torment Nexus.
Actually I’ve found some flaws in the Torment Nexus and have a PR to improve it.