Newly found TrueCrypt flaws | Hacker News Reader

Newly found TrueCrypt flaws

itworld.com

157 pointsaburan2842 comments

...which is why you should be using VeraCrypt (https://veracrypt.codeplex.com/, the actively-developed fork of Truecrypt)

Agreed. The TrueCrypt anonymous authors themselves said to stop using it when they quit maintaining it.

VeraCrypt is also vulnerable to this. Granted they've patched it, but they still share a very large code base.

I wonder, does VeraCrypt plan to eventually do a major LibreSSL-style clean-up of their codebase, after most people have "converted" to their tool?

Hm, how did they fork and change the license? Or are they just hoping the TrueCrypt authors never attempt to enforce their license?

According to https://en.wikipedia.org/wiki/VeraCrypt#License_and_source_m...:

They didn't.

> VeraCrypt has been licensed under the Apache License 2.0 since 28 June 2015.

> VeraCrypt inherited a substantial amount of code from its TrueCrypt predecessor and thus is also subject to the terms of version 3.0 of the "TrueCrypt License" which is unique to the TrueCrypt software.

Oh, their CodePlex site makes it look like a license change with no mention of the original license, which they might be violating, as the original license had numerous problems:

http://lists.freedesktop.org/archives/distributions/2008-Oct...

If TrueCrypt authors are anonymous, can they even claim that they own that codebase?

Yes, definitely. Anonymity is like pseudonimity, you don't lose any rights only because you choose to put a different name on your work of art.

Sure, Mark Twain was able to ascertain copyright.

I don't think so without losing their anonymity. I'm kinda curious though? Any lawyers want to take a stab at answering?

IAAL: In the US, Copyright can be registered under a pseudonym, and you do not have to give your real name, ever.

On the forms they have, there is a space you can fill out for claimant name, and one for author name. There is also a pseudonym checkbox.

They will happily let you register it only in the name of the pseudonym.

See: http://www.copyright.gov/fls/fl101.pdf

For more interesting fun, read the last sentence of that PDF, where it goes on to explain that you get different years of protection for distributing under a pseudonym vs if your identity is revealed.

In theory? Sure.

In actual legal practice? Probably not if they want to retain anonymity.

False. See below. Even if they wanted to enforce copyright, they can register as a pseudonym. They can also enforce in court under a pseudonym, as long as they can prove it's the same person with the registration.

Which may be tricky.

In the US Legal System, an accuser has to face the defendent. Not sure how they can do that and remain anonymous.

That's criminal, and something afforded to defendants.

In the civil system, which is where copyright resides, you can simply be represented by counsel and never appear at all :)

This happens all the time.

touche!

why the heck is chrome telling me codeplex isn't a secure site

Just to let people know. I did some digging into this yesterday

Here are the pull requests that fix the bugs.

    https://veracrypt.codeplex.com/SourceControl/changeset/cf4794372e5dea753b6310f1ca6912c6bfa86d45
    https://veracrypt.codeplex.com/SourceControl/changeset/0d9239178bab3332d0f9c911de89f6f80b65d2d1

The first version of truecrypt that is vulnerable to the accessToken bug was 6.1a, which is roughly 4 years ago. I didn't look into the other bug though....4 years was enough for me....

If you want to do the digging into release dates, I would check this repo. This was the only archive of truecrypt code I could find. https://github.com/DrWhax/truecrypt-archive

If you ask me, a much more serious bug would be going from an encrypted hard drive to an unencrypted hard drive... Local Privilege Escalation is definitely a bad bug, but it's not anywhere as bad as it could be.

> This was the only archive of truecrypt code I could find

There'a also https://github.com/AuditProject/truecrypt-verified-mirror (maintained by opencryptoaudit.org)

This is just the Windows driver enabling local privilege escalation.

"just"

From the title, I assumed it allowed disk decryption.

Agreed, that would've been much worse.

It's a pretty unsurprising vulnerability to exist in a sloppily written Windows driver, and it's not something that most users need to worry about.

Thanks. Truecrypt can do a lot of other stuff, too. I use it to en/decrypt a binary file in user mode on Linux, and nothing more, so I was wondering WTF this article was about.

Here are the commits that fixes the issues in VeraCrypt (a fork of TrueCrypt): https://veracrypt.codeplex.com/SourceControl/changeset/cf479... and https://veracrypt.codeplex.com/SourceControl/changeset/0d923...

They are lot shorter that I expected

Only on Windows? If so, it should be in the title.

Every instance of this story omits the 'Windows only' part. It is sort of pertinent.

Can someone explain why this is not just something that Microsoft should patch in windows? i.e how is this not just a windows vulnerability that you can use TrueCrypt to take advantage of? Why are drivers able to escalate privilege at all?

A driver is kernel-mode code that's written in C. It can do just about anything, and when there's a bug, you're in trouble.

I'd like to see Microsoft allow more drivers to run in user-mode, but this is just the risk you take when installing drivers. Microsoft has been tightening driver signing requirements, so you can at least be sure they're from a known source.

Drivers often run at kernel level.

You can set a program on Windows 10 so that all users must be an administrator to run, not sure about past Windows OS versions but probably.

You could technically do that using NTFS permissions.

Let me guess, this has something to do with SUBST.

Wow, I hope you're joking but I can't quite tell. :/

So much for that great "audit" of the code.

I've seen this a lot in response to this bug.

I did not realize how poorly the general "tech savvy" public apparently misunderstands software security.

Auditing is closer to an art than a science. For any real software, no two auditors will find the same set of bugs.

Think of it as similar to QA. If you write some complex software from scratch, and give it to 1 tester to do one pass on it, do you expect every bug was found and fixed?

Like security audits, you'll still be finding bugs for years, or in some cases even decades, that were sitting there all along.

Local machine privilege escalation and "full system compromise" are SOOOOOO vastly not of the same magnitude at all. This click bait title is obnoxious.

I don't even have non privileged users on my windows machine. Most end users don't. This could only really matter in some corporate environments but even my windows machine at work has full admin privileges.

Well, who is the target? Corporate and government customers are obviously important especially when we consider the various cyberwars going on and how much private and trusted data these companies have on us. Priv escalations are scary in my world. In the world of grandma's vacation photos? Not so much.

This is a major, major vulnerability, no doubt about it. Shame TC has a hackey Windows driver to make its pseudo-drive features work. Anything that installs a driver is dangerous in the world of Windows as it has high level permissions. I imagine organizations with strong security policies wouldn't run this and instead just run some PGP variant that doesn't use any customized Windows drivers.

>I don't even have non privileged users on my windows machine.

Technically, you do if you have the UAC enabled. You're only really an admin after UAC runs, at least in most cases. From what I'm reading this should work around he UAC if the driver is running at SYSTEM level.

>Technically, you do if you have the UAC enabled.

Interesting. Makes sense.

> This click bait title is obnoxious

Ok, we shortened it.

Reply on news.ycombinator.com