"Forensics for Prosecutors" mentions backdoor in TrueCrypt (page 15) [pdf] • Hacker News Board

Re: "Forensics for Prosecutors" mentions backdoor in TrueCrypt (page 15) [pdf]

#31

Post by [deleted] » Wed, Sep 04, 2013, 4:24 AM UTC

nwh wrote: post #19

WestCoastJustin wrote: post #11

A few gems in here besides the TrueCrypt statement, mainly that Apple iCloud and Dropbox are named, and the legal framework is touched upon. All cloud stored content are automatically hash-scanned and image-analyzed by their service providers and infringing content reported to NCMEC (p16) Mobile content are automatically scanned when they are synced with cloud storage like Apple iCloud or Dropbox. Mobile devices that…

You missed a big one there. Mobile devices that are not cloud-synced can be accessed by their respective vendors Essentially; iOS and Android have a remote backdoor available to the US government.

[deleted]

Re: "Forensics for Prosecutors" mentions backdoor in TrueCrypt (page 15) [pdf]

#32

Post by unimpressive » Wed, Sep 04, 2013, 4:24 AM UTC

_bfhp wrote: post #28

unimpressive wrote: post #16

Earlier quoted context omitted.

user: xarball created: 2 minutes ago Any reason you're using a throwaway?

Israel hires pro-government internet commenters, it'll come out that the US does as well soon, just like everything Israel does "first"

The current downvotes on your comment are why I didn't say "This really doesn't sound legit." instead of what I did (that and there is a genuine possibility for the commenter to have a real reason for using a throwaway).

Re: "Forensics for Prosecutors" mentions backdoor in TrueCrypt (page 15) [pdf]

#33

Post by bilbo0s » Wed, Sep 04, 2013, 4:26 AM UTC

nwh wrote: post #19

WestCoastJustin wrote: post #11

A few gems in here besides the TrueCrypt statement, mainly that Apple iCloud and Dropbox are named, and the legal framework is touched upon. All cloud stored content are automatically hash-scanned and image-analyzed by their service providers and infringing content reported to NCMEC (p16) Mobile content are automatically scanned when they are synced with cloud storage like Apple iCloud or Dropbox. Mobile devices that…

You missed a big one there. Mobile devices that are not cloud-synced can be accessed by their respective vendors Essentially; iOS and Android have a remote backdoor available to the US government.

Yep...

I was thinking... "Wow... why is this guy worried about Dropbox?"

The Dropbox problem is solvable... just don't use Dropbox.

But how are you going to use a phone without using iOS or Android. (All of the other mobile OSes are probably backdoored as well)

Re: "Forensics for Prosecutors" mentions backdoor in TrueCrypt (page 15) [pdf]

#34

Post by NDizzle » Wed, Sep 04, 2013, 4:26 AM UTC

I was going to add that you can link directly to the page like this: http://cryptome.org/2013/09/computer-forensics-2013.pdf#page...

Works in FF and Chrome in-browser readers.

Then I realized you should really skim every single page, rather than going straight to 15.

Re: "Forensics for Prosecutors" mentions backdoor in TrueCrypt (page 15) [pdf]

#35

Post by philwebster » Wed, Sep 04, 2013, 4:26 AM UTC

nwh wrote: post #19

WestCoastJustin wrote: post #11

A few gems in here besides the TrueCrypt statement, mainly that Apple iCloud and Dropbox are named, and the legal framework is touched upon. All cloud stored content are automatically hash-scanned and image-analyzed by their service providers and infringing content reported to NCMEC (p16) Mobile content are automatically scanned when they are synced with cloud storage like Apple iCloud or Dropbox. Mobile devices that…

You missed a big one there. Mobile devices that are not cloud-synced can be accessed by their respective vendors Essentially; iOS and Android have a remote backdoor available to the US government.

With regards to FileVault for Mac, some friends who used to work as Geniuses at the Apple Store have mentioned having to request special software from corporate that would fix or recover FileVault in some way - they weren't clear and said it was not something they were supposed to talk about. Obviously I'd take the info with a grain of salt, but based on the news lately...

Re: "Forensics for Prosecutors" mentions backdoor in TrueCrypt (page 15) [pdf]

#36

Post by Karunamon » Wed, Sep 04, 2013, 4:30 AM UTC

So there's a few possible ways to interpret this..

    * There is an actual hereto-unknown flaw in TrueCrypt's algorithms or implementations of algorithms that can be exploited.

    * They are referring to the only known attack, wherein keys can be recovered from RAM if the volume isn't unmounted correctly.

    * This is FUD designed to push people away from less-breakable encryption and onto software which actually /does/ have backdoors.

    * This is a hoax (pay special attention to the detective's names on the slide)

I'm not sure what to make of it.

Re: "Forensics for Prosecutors" mentions backdoor in TrueCrypt (page 15) [pdf]

#37

Post by emhs » Wed, Sep 04, 2013, 4:32 AM UTC

EvanAnderson wrote: post #29

The reference to the names "Detective Stu Pitt" and "Detective Laughlin Foo" on the last page has me wondering about this. They both really, really sound like joke names. The similarity to the presenter's name (first slide) from the real North Dakota State Attorney's Association (NDSAA) presentation ( http://www.ndsaa.org/Computer_Forensics_for_Prosecutors.pdf ) also seems suspicious. It has the look that somebody to…

I dug a little further. Not only is there "Detective Stu Pitt", there's also "Laughlin Foo" for the next day's presentation, and the link at the bottom is for the North Dakota State Attorney's Association, though the only state mentioned (and whose seal is used) is Oregon. This is phony.

Re: "Forensics for Prosecutors" mentions backdoor in TrueCrypt (page 15) [pdf]

#38

Post by noname999_666 » Wed, Sep 04, 2013, 4:33 AM UTC

Anybody ever heard of the "zSearch" software mentioned in the pdf?

After some more digging, found this document: http://www.ndsaa.org/Computer_Forensics_for_Prosecutors.pdf

Which states:

Free product by SA Eric Zimmerman

Random Access Memory Analysis:

* FBI - Salt Lake City, UT

* Distribution - eric[at]feeble-industries.com

* Plug-in live triage via USB

* Virtualization, encryption, mass storage, P2P, Gigatribe, picture & video preview, password gathering, and MORE!

Looks LE agents can request a copy by registering for the guy's phpbb form here (judging by the registration terms, it's not open to the public):

https://feeble-industries.com/forums/ucp.php?mode=register

Re: "Forensics for Prosecutors" mentions backdoor in TrueCrypt (page 15) [pdf]

#39

Post by dchichkov » Wed, Sep 04, 2013, 4:34 AM UTC

tylerkahn wrote: post #15

http://en.wikipedia.org/wiki/Cold_boot_attack There's your backdoor.

It is a shame that the Firewire backdoor is still out there. Particularly in Ubuntu.

https://github.com/carmaa/inception

Re: "Forensics for Prosecutors" mentions backdoor in TrueCrypt (page 15) [pdf]

#40

Post by [deleted] » Wed, Sep 04, 2013, 4:34 AM UTC

WestCoastJustin wrote: post #11

A few gems in here besides the TrueCrypt statement, mainly that Apple iCloud and Dropbox are named, and the legal framework is touched upon. All cloud stored content are automatically hash-scanned and image-analyzed by their service providers and infringing content reported to NCMEC (p16) Mobile content are automatically scanned when they are synced with cloud storage like Apple iCloud or Dropbox. Mobile devices that…

[deleted]