Earlier quoted context omitted.
Probably better just to use a veracrypt hidden volume, and preferably not a SSD.
Why not an SSD?
SSDs are hard to completely sanitize
My USB Drive Has a Hidden Encrypted Vault
161–170 of 175 posts
Re: My USB Drive Has a Hidden Encrypted Vault
#162Earlier quoted context omitted.
I'm pretty sure the meme WAS the message. What other messages are being distributed through random meme sharing, where the recipient has to know it contains some secondary hidden message and requires the means to decode it?!
It didn't matter; once I found out even the possibilities for steganography across a large catalog of JPEG images, it was game over for me. It doesn't matter if there were zero or five dozen secret messages in the files I forwarded. I didn't want to be a conduit for that possibility. The risk, of becoming a mule, an unwitting accessory to some evil cause, was just far outweighing the rewards of sharing dumb crap with…
But.. unless your mother or the people she was sharing them with were the intended target of the secret messages how would you be a mule? Do you think terrorists were depending on you to save the memes so that later they could break into your sweet meme stash and find all their evil secret plans?
Normally would not comment just to make fun of someone but this is just a wild take, how could you be sure that HN is not full of coded messages?
Re: My USB Drive Has a Hidden Encrypted Vault
#163Earlier quoted context omitted.
It didn't matter; once I found out even the possibilities for steganography across a large catalog of JPEG images, it was game over for me. It doesn't matter if there were zero or five dozen secret messages in the files I forwarded. I didn't want to be a conduit for that possibility. The risk, of becoming a mule, an unwitting accessory to some evil cause, was just far outweighing the rewards of sharing dumb crap with…
But.. unless your mother or the people she was sharing them with were the intended target of the secret messages how would you be a mule? Do you think terrorists were depending on you to save the memes so that later they could break into your sweet meme stash and find all their evil secret plans? Normally would not comment just to make fun of someone but this is just a wild take, how could you be sure that HN is not…
You're begging the question that secret messages necessarily require "targets" to work or to be passed along. That is not true.
If your pastime involved trading envelopes with other collectors of envelopes, and you started passing along a bunch of sealed envelopes with unknown contents, how would you feel? Or if you enjoyed well-constructed cartons, and you found yourself trafficking in sealed cartons with unknown contents? That would basically make you a shipping, receiving, and logistics provider. Anything at all could be in those parcels. Why do it? Why open up to risk?
The main point here is that there was no point to my trading in memes. It was recreation; it was optional; it was totally a lark with my boomer mom and her audience. I had no reason to look at these memes and I had no reason to forward them on. Sure, the risk was very, very low that anyone "evil" was encoding "secret messages" or "targeting" anyone I knew. But since I had no reason to engage in this activity in the first place, why not quit? Why not just distance myself? Thereby removing 100% of the risk.
Re: My USB Drive Has a Hidden Encrypted Vault
#164Re: My USB Drive Has a Hidden Encrypted Vault
#165Earlier quoted context omitted.
This is probably fine for evading local cops. I'll also note that anyone plugging this into a forensics machine is going to have a bit of a dilemma: Perform write tests, or not? Because if they probe it with password:... attempts to check on timing leakage, that's potentially damaging evidence.
You do not do any writes in a forensics scenario. Especially if you want to make it stand in court. You have to always keep a clean hashed copy, and then work on copies from there.
You can't make a "clean hashed copy" of hardware.
Re: My USB Drive Has a Hidden Encrypted Vault
#166Earlier quoted context omitted.
But.. unless your mother or the people she was sharing them with were the intended target of the secret messages how would you be a mule? Do you think terrorists were depending on you to save the memes so that later they could break into your sweet meme stash and find all their evil secret plans? Normally would not comment just to make fun of someone but this is just a wild take, how could you be sure that HN is not…
You're begging the question that secret messages necessarily require "targets" to work or to be passed along. That is not true. If your pastime involved trading envelopes with other collectors of envelopes, and you started passing along a bunch of sealed envelopes with unknown contents, how would you feel? Or if you enjoyed well-constructed cartons, and you found yourself trafficking in sealed cartons with unknown co…
To be honest with you, you haven't convinced me. Secret messages do in fact require "targets"... I would love to hear an example of a situation where someone might want to send a secret message with no "targets" in mind. For all you know, my replies are coded messages and you are providing the cover for it right now. And to use your example were I trying to traffic in something illicit, handing it to a random carton or envelope collector in the hopes that they will trade it again to the intended person would be an extremely risky and ineffective method of doing that, so ineffective in fact that I would never consider that to be possible. Someone attaching a package to the underside of your car and the target grabbing it when you park would be much more likely, would actually make sense, and still is not really a risk worth considering.
I don't agree with you at all, nor do I understand how your mind works, but I very much appreciate you taking the time to respond and respect your commitment not to facilitate anything nefarious even though we disagree.
Re: My USB Drive Has a Hidden Encrypted Vault
#167Earlier quoted context omitted.
> The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, - Have the first check be a simple 8bit hash that filters out most passwords in microseconds, or use a customizable prefix instead of “password:”. - have your password checking thread run in background at idle priority - when you get an async password match, force usb discon…
It's even easier to detect from that. From the project writeup Q&As: 'The firmware snoops for the string "password:xyz" and inhibits the write of "xyz". Otherwise, yes this would be very insecure.' So detecting this drive is just a matter of writing "password:anything" to the drive, unmounting, remounting and checking the file you just wrote. If it's not what you wrote, then you have detected the existence of this dr…
Simply dismounting it won't prevent the stored write. You would have to dismount and then quickly power down. The safe-to-remove indication on Windows takes at least that long.
Re: My USB Drive Has a Hidden Encrypted Vault
#168Earlier quoted context omitted.
I think part of the entire design is that it's quite hard to detect. 1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure. The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake…
If I was building a black box to detect hidden data on a USB stick, I'd include a feature whereby it measures power consumption and flags USB drives that don't consume the expected power for that type of drive.
Power use is not deterministic unless it's in a known state. The power hungry circuit is the erase and that's mostly a background thing.
Re: My USB Drive Has a Hidden Encrypted Vault
#169Earlier quoted context omitted.
This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware. But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day. But there is a big flaw I see: 8g…
> But there is a big flaw I see: 8gb. You're carting around an 8gb flash drive these days?? What is the problem? I have promotional flash drives from 1 Gb up to 8 Gb, that I use to store music for my car, or to carry pdfs to print in shared printers. I don't care if they break or get lost. I know people that carry similar promotional items with similar capacities. What is suspicious about 8 Gb drives? Maybe the lack…
Most drives are bigger. I have some around that size--but they're old.
Re: My USB Drive Has a Hidden Encrypted Vault
#170Earlier quoted context omitted.
I think part of the entire design is that it's quite hard to detect. 1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure. The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake…
Can you flesh that out? If I've missed something and oversimplified the design here, I'd want to clarify that!
The encryption/hiding is done by the firmware, hence..
1: The drive more or less looks like any boring old usb-stick, it isn't even uncommon for cheap fake Amazon sellers to sell sticks with SD-card's as faked large drives (so even with X-ray inspection it doesn't look too much out of order).
2: To a computer, since the firmware presents a regular UMASS device, there isn't anything telling the computers over-the-wire protocol that anything is amiss (since the real size is hidden by the firmware and regular accessible blocks just behave normally).
So, short of an intrusive teardown of the device to read the true size of the SD-card and even knowing the presence of a hidden volume, the only over the wire that can help discerning this from a regular drive is timing attacks (And as you notice from this thread, people are jumping on to suggest solutions to minimize or even remove that).