4 ms·

Seems to point towards compromised SF account.

zorked 12y ago
There's a new binary that recommends moving to BitLocker during install, and the signature matches. Edit: with a new, compromised key.
- Alupis 12y ago
  Is source still available? Can we check the commit tree for anything suspicious lately? Can someone compile it and check the hash against the 7.2 binary being offered?
  - Canada 12y ago
    It's not that simple. It won't match anyway. Signatures, compiler versions, SDK versions, etc.
    - guan 12y ago
      This guy managed to compile a previous version and have it match the released binaries https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/ https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie...
      - tripzilch 12y ago
        Not quite. First, it was a ton of work to do so. Second, in the end he in fact only managed to match most of the released binary. Then, for most of the unmatched parts he came up with some solid arguments why they would be different (timestamps, pathnames and such). However, in the end there were still a couple of chunks of unmatched data that he couldn't explain why it has the value it does. Finally he argues that these chunks probably can't contain any hidden backdoors. This last bit I have a bit of a problem with because it's just speculation, all the rest of the research is very solid and without guesswork, and the conclusion of the article IMO incorrectly states he "has matched the binaries". I'm chalking this up to, after all that work, having come so far, kind of wanting to say you did it, and providing a few (IMO) hand-wavy arguments why those last impossible chunks of bits probably don't matter, instead of having to admit defeat after being able to account for 99.9% of all bytes. I can understand that, I've been wanting to type "but it's probably not backdoored" three times already typing this post, and catching myself because really I have nothing to go on to make or back that statement.
- CodeMage 12y ago
  Yes, but did they sign it using the same key they were using before? edit: Apparently not, according to the link @Alupis posted.
- Alupis 12y ago
  Project on SF is still available if you have a direct link: http://sourceforge.net/projects/truecrypt/files/TrueCrypt/ http://sourceforge.net/projects/truecrypt/files/TrueCrypt/ http://sourceforge.net/projects/truecrypt/?source=navbar http://sourceforge.net/projects/truecrypt/?source=navbar http://sourceforge.net/p/truecrypt/activity/?page=0&limit=100#5386267c34309d5eeee49ec1 http://sourceforge.net/p/truecrypt/activity/?page=0&limit=10... Odd, 6 hours ago someone updated the TruCrypt-key.asc files, then 3 hours later posted all the new binaries. Also odd is whoever posted the new binaries completely yanked all the previous ones, leaving only the new and questionable binary available for download. hmm...
  - bspar 12y ago
    Looks like it's the same key as before (F0D6B1E0)
    - elmindreda 12y ago
      On a day like this, compare the entire key.
      - bspar 12y ago
        It's the same. Original key: http://pgp.mit.edu/pks/lookup?op=get&search=0xE3BA73CAF0D6B1E0 http://pgp.mit.edu/pks/lookup?op=get&search=0xE3BA73CAF0D6B1... And the new key can be found on the SF site.

There's a new binary that recommends moving to BitLocker during install, and the signature matches. Edit: with a new, compromised key.

Alupis 12y ago
Is source still available? Can we check the commit tree for anything suspicious lately? Can someone compile it and check the hash against the 7.2 binary being offered?
- Canada 12y ago
  It's not that simple. It won't match anyway. Signatures, compiler versions, SDK versions, etc.
  - guan 12y ago
    This guy managed to compile a previous version and have it match the released binaries https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/ https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie...
    - tripzilch 12y ago
      Not quite. First, it was a ton of work to do so. Second, in the end he in fact only managed to match most of the released binary. Then, for most of the unmatched parts he came up with some solid arguments why they would be different (timestamps, pathnames and such). However, in the end there were still a couple of chunks of unmatched data that he couldn't explain why it has the value it does. Finally he argues that these chunks probably can't contain any hidden backdoors. This last bit I have a bit of a problem with because it's just speculation, all the rest of the research is very solid and without guesswork, and the conclusion of the article IMO incorrectly states he "has matched the binaries". I'm chalking this up to, after all that work, having come so far, kind of wanting to say you did it, and providing a few (IMO) hand-wavy arguments why those last impossible chunks of bits probably don't matter, instead of having to admit defeat after being able to account for 99.9% of all bytes. I can understand that, I've been wanting to type "but it's probably not backdoored" three times already typing this post, and catching myself because really I have nothing to go on to make or back that statement.
CodeMage 12y ago
Yes, but did they sign it using the same key they were using before? edit: Apparently not, according to the link @Alupis posted.
Alupis 12y ago
Project on SF is still available if you have a direct link: http://sourceforge.net/projects/truecrypt/files/TrueCrypt/ http://sourceforge.net/projects/truecrypt/files/TrueCrypt/ http://sourceforge.net/projects/truecrypt/?source=navbar http://sourceforge.net/projects/truecrypt/?source=navbar http://sourceforge.net/p/truecrypt/activity/?page=0&limit=100#5386267c34309d5eeee49ec1 http://sourceforge.net/p/truecrypt/activity/?page=0&limit=10... Odd, 6 hours ago someone updated the TruCrypt-key.asc files, then 3 hours later posted all the new binaries. Also odd is whoever posted the new binaries completely yanked all the previous ones, leaving only the new and questionable binary available for download. hmm...
- bspar 12y ago
  Looks like it's the same key as before (F0D6B1E0)
  - elmindreda 12y ago
    On a day like this, compare the entire key.
    - bspar 12y ago
      It's the same. Original key: http://pgp.mit.edu/pks/lookup?op=get&search=0xE3BA73CAF0D6B1E0 http://pgp.mit.edu/pks/lookup?op=get&search=0xE3BA73CAF0D6B1... And the new key can be found on the SF site.