7 ms·

Newly found TrueCrypt flaws

157 points by aburan28 11y ago

striking 11y ago
...which is why you should be using VeraCrypt (https://veracrypt.codeplex.com/ https://veracrypt.codeplex.com/, the actively-developed fork of Truecrypt)
- skrowl 11y ago
  Agreed. The TrueCrypt anonymous authors themselves said to stop using it when they quit maintaining it.
- valarauca1 11y ago
  VeraCrypt is also vulnerable to this. Granted they've patched it, but they still share a very large code base.
  - mtgx 11y ago
    I wonder, does VeraCrypt plan to eventually do a major LibreSSL-style clean-up of their codebase, after most people have "converted" to their tool?
- jordigh 11y ago
  Hm, how did they fork and change the license? Or are they just hoping the TrueCrypt authors never attempt to enforce their license?
  - striking 11y ago
    According to https://en.wikipedia.org/wiki/VeraCrypt#License_and_source_model https://en.wikipedia.org/wiki/VeraCrypt#License_and_source_m...: They didn't. > VeraCrypt has been licensed under the Apache License 2.0 since 28 June 2015. > VeraCrypt inherited a substantial amount of code from its TrueCrypt predecessor and thus is also subject to the terms of version 3.0 of the "TrueCrypt License" which is unique to the TrueCrypt software.
    - jordigh 11y ago
      Oh, their CodePlex site makes it look like a license change with no mention of the original license, which they might be violating, as the original license had numerous problems: http://lists.freedesktop.org/archives/distributions/2008-October/000276.html http://lists.freedesktop.org/archives/distributions/2008-Oct...
  - imaginenore 11y ago
    If TrueCrypt authors are anonymous, can they even claim that they own that codebase?
    - kachnuv_ocasek 11y ago
      Yes, definitely. Anonymity is like pseudonimity, you don't lose any rights only because you choose to put a different name on your work of art.
    - jordigh 11y ago
      Sure, Mark Twain was able to ascertain copyright.
    - meddlepal 11y ago
      I don't think so without losing their anonymity. I'm kinda curious though? Any lawyers want to take a stab at answering?
      - DannyBee 11y ago
        IAAL: In the US, Copyright can be registered under a pseudonym, and you do not have to give your real name, ever. On the forms they have, there is a space you can fill out for claimant name, and one for author name. There is also a pseudonym checkbox. They will happily let you register it only in the name of the pseudonym. See: http://www.copyright.gov/fls/fl101.pdf http://www.copyright.gov/fls/fl101.pdf For more interesting fun, read the last sentence of that PDF, where it goes on to explain that you get different years of protection for distributing under a pseudonym vs if your identity is revealed.
    - mapt 11y ago
      In theory? Sure. In actual legal practice? Probably not if they want to retain anonymity.
      - DannyBee 11y ago
        False. See below. Even if they wanted to enforce copyright, they can register as a pseudonym. They can also enforce in court under a pseudonym, as long as they can prove it's the same person with the registration. Which may be tricky.
- doubt_me 11y ago
  why the heck is chrome telling me codeplex isn't a secure site
devit 11y ago
This is just the Windows driver enabling local privilege escalation.
- patrickmn 11y ago
  "just"
  - forgotpasswd3x 11y ago
    From the title, I assumed it allowed disk decryption.
    - wyldfire 11y ago
      Agreed, that would've been much worse.
  - TillE 11y ago
    It's a pretty unsurprising vulnerability to exist in a sloppily written Windows driver, and it's not something that most users need to worry about.
- coldpie 11y ago
  Thanks. Truecrypt can do a lot of other stuff, too. I use it to en/decrypt a binary file in user mode on Linux, and nothing more, so I was wondering WTF this article was about.
orf 11y ago
Here are the commits that fixes the issues in VeraCrypt (a fork of TrueCrypt): https://veracrypt.codeplex.com/SourceControl/changeset/cf4794372e5dea753b6310f1ca6912c6bfa86d45 https://veracrypt.codeplex.com/SourceControl/changeset/cf479... and https://veracrypt.codeplex.com/SourceControl/changeset/0d9239178bab3332d0f9c911de89f6f80b65d2d1 https://veracrypt.codeplex.com/SourceControl/changeset/0d923... They are lot shorter that I expected
deleted 11y ago
[deleted]
randyrand 11y ago
Local machine privilege escalation and "full system compromise" are SOOOOOO vastly not of the same magnitude at all. This click bait title is obnoxious. I don't even have non privileged users on my windows machine. Most end users don't. This could only really matter in some corporate environments but even my windows machine at work has full admin privileges.
- drzaiusapelord 11y ago
  Well, who is the target? Corporate and government customers are obviously important especially when we consider the various cyberwars going on and how much private and trusted data these companies have on us. Priv escalations are scary in my world. In the world of grandma's vacation photos? Not so much. This is a major, major vulnerability, no doubt about it. Shame TC has a hackey Windows driver to make its pseudo-drive features work. Anything that installs a driver is dangerous in the world of Windows as it has high level permissions. I imagine organizations with strong security policies wouldn't run this and instead just run some PGP variant that doesn't use any customized Windows drivers. >I don't even have non privileged users on my windows machine. Technically, you do if you have the UAC enabled. You're only really an admin after UAC runs, at least in most cases. From what I'm reading this should work around he UAC if the driver is running at SYSTEM level.
  - randyrand 11y ago
    >Technically, you do if you have the UAC enabled. Interesting. Makes sense.
- dang 11y ago
  > This click bait title is obnoxious Ok, we shortened it.
okasaki 11y ago
Only on Windows? If so, it should be in the title.
- ticktocktick 11y ago
  Every instance of this story omits the 'Windows only' part. It is sort of pertinent.
soggypretzels 11y ago
Can someone explain why this is not just something that Microsoft should patch in windows? i.e how is this not just a windows vulnerability that you can use TrueCrypt to take advantage of? Why are drivers able to escalate privilege at all?
- TillE 11y ago
  A driver is kernel-mode code that's written in C. It can do just about anything, and when there's a bug, you're in trouble. I'd like to see Microsoft allow more drivers to run in user-mode, but this is just the risk you take when installing drivers. Microsoft has been tightening driver signing requirements, so you can at least be sure they're from a known source.
- wglb 11y ago
  Drivers often run at kernel level.
- deleted 11y ago
  [deleted]
leppie 11y ago
Let me guess, this has something to do with SUBST.
- wyldfire 11y ago
  Wow, I hope you're joking but I can't quite tell. :/
ejcx 11y ago
Just to let people know. I did some digging into this yesterday Here are the pull requests that fix the bugs. https://veracrypt.codeplex.com/SourceControl/changeset/cf4794372e5dea753b6310f1ca6912c6bfa86d45 https://veracrypt.codeplex.com/SourceControl/changeset/0d9239178bab3332d0f9c911de89f6f80b65d2d1 The first version of truecrypt that is vulnerable to the accessToken bug was 6.1a, which is roughly 4 years ago. I didn't look into the other bug though....4 years was enough for me.... If you want to do the digging into release dates, I would check this repo. This was the only archive of truecrypt code I could find. https://github.com/DrWhax/truecrypt-archive https://github.com/DrWhax/truecrypt-archive If you ask me, a much more serious bug would be going from an encrypted hard drive to an unencrypted hard drive... Local Privilege Escalation is definitely a bad bug, but it's not anywhere as bad as it could be.
- chdir 11y ago
  > This was the only archive of truecrypt code I could find There'a also https://github.com/AuditProject/truecrypt-verified-mirror https://github.com/AuditProject/truecrypt-verified-mirror (maintained by opencryptoaudit.org)
cgtyoder 11y ago
So much for that great "audit" of the code.
- lawnchair_larry 11y ago
  I've seen this a lot in response to this bug. I did not realize how poorly the general "tech savvy" public apparently misunderstands software security. Auditing is closer to an art than a science. For any real software, no two auditors will find the same set of bugs. Think of it as similar to QA. If you write some complex software from scratch, and give it to 1 tester to do one pass on it, do you expect every bug was found and fixed? Like security audits, you'll still be finding bugs for years, or in some cases even decades, that were sitting there all along.
lovemetender 11y ago
You can set a program on Windows 10 so that all users must be an administrator to run, not sure about past Windows OS versions but probably.
- jlgaddis 11y ago
  You could technically do that using NTFS permissions.

157 points by aburan28 11y ago

...which is why you should be using VeraCrypt (https://veracrypt.codeplex.com/ https://veracrypt.codeplex.com/, the actively-developed fork of Truecrypt)

skrowl 11y ago
Agreed. The TrueCrypt anonymous authors themselves said to stop using it when they quit maintaining it.
valarauca1 11y ago
VeraCrypt is also vulnerable to this. Granted they've patched it, but they still share a very large code base.
- mtgx 11y ago
  I wonder, does VeraCrypt plan to eventually do a major LibreSSL-style clean-up of their codebase, after most people have "converted" to their tool?
jordigh 11y ago
Hm, how did they fork and change the license? Or are they just hoping the TrueCrypt authors never attempt to enforce their license?
- striking 11y ago
  According to https://en.wikipedia.org/wiki/VeraCrypt#License_and_source_model https://en.wikipedia.org/wiki/VeraCrypt#License_and_source_m...: They didn't. > VeraCrypt has been licensed under the Apache License 2.0 since 28 June 2015. > VeraCrypt inherited a substantial amount of code from its TrueCrypt predecessor and thus is also subject to the terms of version 3.0 of the "TrueCrypt License" which is unique to the TrueCrypt software.
  - jordigh 11y ago
    Oh, their CodePlex site makes it look like a license change with no mention of the original license, which they might be violating, as the original license had numerous problems: http://lists.freedesktop.org/archives/distributions/2008-October/000276.html http://lists.freedesktop.org/archives/distributions/2008-Oct...
- imaginenore 11y ago
  If TrueCrypt authors are anonymous, can they even claim that they own that codebase?
  - kachnuv_ocasek 11y ago
    Yes, definitely. Anonymity is like pseudonimity, you don't lose any rights only because you choose to put a different name on your work of art.
  - jordigh 11y ago
    Sure, Mark Twain was able to ascertain copyright.
  - meddlepal 11y ago
    I don't think so without losing their anonymity. I'm kinda curious though? Any lawyers want to take a stab at answering?
    - DannyBee 11y ago
      IAAL: In the US, Copyright can be registered under a pseudonym, and you do not have to give your real name, ever. On the forms they have, there is a space you can fill out for claimant name, and one for author name. There is also a pseudonym checkbox. They will happily let you register it only in the name of the pseudonym. See: http://www.copyright.gov/fls/fl101.pdf http://www.copyright.gov/fls/fl101.pdf For more interesting fun, read the last sentence of that PDF, where it goes on to explain that you get different years of protection for distributing under a pseudonym vs if your identity is revealed.
  - mapt 11y ago
    In theory? Sure. In actual legal practice? Probably not if they want to retain anonymity.
    - DannyBee 11y ago
      False. See below. Even if they wanted to enforce copyright, they can register as a pseudonym. They can also enforce in court under a pseudonym, as long as they can prove it's the same person with the registration. Which may be tricky.
doubt_me 11y ago
why the heck is chrome telling me codeplex isn't a secure site

devit 11y ago

This is just the Windows driver enabling local privilege escalation.

patrickmn 11y ago
"just"
- forgotpasswd3x 11y ago
  From the title, I assumed it allowed disk decryption.
  - wyldfire 11y ago
    Agreed, that would've been much worse.
- TillE 11y ago
  It's a pretty unsurprising vulnerability to exist in a sloppily written Windows driver, and it's not something that most users need to worry about.
coldpie 11y ago
Thanks. Truecrypt can do a lot of other stuff, too. I use it to en/decrypt a binary file in user mode on Linux, and nothing more, so I was wondering WTF this article was about.

orf 11y ago

Here are the commits that fixes the issues in VeraCrypt (a fork of TrueCrypt): https://veracrypt.codeplex.com/SourceControl/changeset/cf4794372e5dea753b6310f1ca6912c6bfa86d45 https://veracrypt.codeplex.com/SourceControl/changeset/cf479... and https://veracrypt.codeplex.com/SourceControl/changeset/0d9239178bab3332d0f9c911de89f6f80b65d2d1 https://veracrypt.codeplex.com/SourceControl/changeset/0d923... They are lot shorter that I expected

deleted 11y ago

[deleted]

randyrand 11y ago

Local machine privilege escalation and "full system compromise" are SOOOOOO vastly not of the same magnitude at all. This click bait title is obnoxious. I don't even have non privileged users on my windows machine. Most end users don't. This could only really matter in some corporate environments but even my windows machine at work has full admin privileges.

drzaiusapelord 11y ago
Well, who is the target? Corporate and government customers are obviously important especially when we consider the various cyberwars going on and how much private and trusted data these companies have on us. Priv escalations are scary in my world. In the world of grandma's vacation photos? Not so much. This is a major, major vulnerability, no doubt about it. Shame TC has a hackey Windows driver to make its pseudo-drive features work. Anything that installs a driver is dangerous in the world of Windows as it has high level permissions. I imagine organizations with strong security policies wouldn't run this and instead just run some PGP variant that doesn't use any customized Windows drivers. >I don't even have non privileged users on my windows machine. Technically, you do if you have the UAC enabled. You're only really an admin after UAC runs, at least in most cases. From what I'm reading this should work around he UAC if the driver is running at SYSTEM level.
- randyrand 11y ago
  >Technically, you do if you have the UAC enabled. Interesting. Makes sense.
dang 11y ago
> This click bait title is obnoxious Ok, we shortened it.

okasaki 11y ago

Only on Windows? If so, it should be in the title.

ticktocktick 11y ago
Every instance of this story omits the 'Windows only' part. It is sort of pertinent.

soggypretzels 11y ago

Can someone explain why this is not just something that Microsoft should patch in windows? i.e how is this not just a windows vulnerability that you can use TrueCrypt to take advantage of? Why are drivers able to escalate privilege at all?

TillE 11y ago
A driver is kernel-mode code that's written in C. It can do just about anything, and when there's a bug, you're in trouble. I'd like to see Microsoft allow more drivers to run in user-mode, but this is just the risk you take when installing drivers. Microsoft has been tightening driver signing requirements, so you can at least be sure they're from a known source.
wglb 11y ago
Drivers often run at kernel level.
deleted 11y ago
[deleted]

leppie 11y ago

Let me guess, this has something to do with SUBST.

wyldfire 11y ago
Wow, I hope you're joking but I can't quite tell. :/

ejcx 11y ago

Just to let people know. I did some digging into this yesterday Here are the pull requests that fix the bugs. https://veracrypt.codeplex.com/SourceControl/changeset/cf4794372e5dea753b6310f1ca6912c6bfa86d45 https://veracrypt.codeplex.com/SourceControl/changeset/0d9239178bab3332d0f9c911de89f6f80b65d2d1 The first version of truecrypt that is vulnerable to the accessToken bug was 6.1a, which is roughly 4 years ago. I didn't look into the other bug though....4 years was enough for me.... If you want to do the digging into release dates, I would check this repo. This was the only archive of truecrypt code I could find. https://github.com/DrWhax/truecrypt-archive https://github.com/DrWhax/truecrypt-archive If you ask me, a much more serious bug would be going from an encrypted hard drive to an unencrypted hard drive... Local Privilege Escalation is definitely a bad bug, but it's not anywhere as bad as it could be.

chdir 11y ago
> This was the only archive of truecrypt code I could find There'a also https://github.com/AuditProject/truecrypt-verified-mirror https://github.com/AuditProject/truecrypt-verified-mirror (maintained by opencryptoaudit.org)

cgtyoder 11y ago

So much for that great "audit" of the code.

lawnchair_larry 11y ago
I've seen this a lot in response to this bug. I did not realize how poorly the general "tech savvy" public apparently misunderstands software security. Auditing is closer to an art than a science. For any real software, no two auditors will find the same set of bugs. Think of it as similar to QA. If you write some complex software from scratch, and give it to 1 tester to do one pass on it, do you expect every bug was found and fixed? Like security audits, you'll still be finding bugs for years, or in some cases even decades, that were sitting there all along.

lovemetender 11y ago

You can set a program on Windows 10 so that all users must be an administrator to run, not sure about past Windows OS versions but probably.

jlgaddis 11y ago
You could technically do that using NTFS permissions.