8 ms·
After examining all the facts, I think it's most likely they just didn't want to develop it anymore: * PGP matches * Authenticode matches * SourceF
by ultramancool 12y ago
After examining all the facts, I think it's most likely they just didn't want to develop it anymore:
* PGP matches
* Authenticode matches
* SourceForge data was modified
* DNS records were modified
And to top it off, let's put ourselves in the theoretical attacker's shoes, the binaries when run make no unexpected connection attempts or write to any unexpected places and don't appear to contain any unexpected imports, so if this was a hack, it's a very stealthy and very boring one. The most they achieved would be uninteresting to most attackers. It would only really be an effective attack against people who had TrueCrypt volumes but not a current copy of TrueCrypt as there's no compelling reason for anyone to upgrade to 7.2 and certainly they'd be skeptical after this. Any attacker with the intelligence and patience for such an attack would surely realize how poor an execution this would be. A better attack would be "here, it's TrueCrypt 8, it has loads of EFI support and mad security, everyone should install it, it's the best!". There's simply no reason to shut it down like this, unless the attack is just an elaborate practical joke.
It's quite possible this came from 1 big developer hack, but considering how the release was done, with full source and everything for every supported platform... if it was a hack, it's a very, very good one. They've also decided to modify the license terms, perhaps bringing it into compatibility with more common FOSS licenses.
I think it's far more likely at this point that the devs, who had not updated their software in years, finally decided to call the project over and have marked it insecure because the codebase is now unmaintained and should be assumed insecure.
- mandalar12 12y agoI guess the new license only applies to the release it is distributed with and this latest version removed encryption features so I doubt it will make the truecrypt project more compatible with FOSS licenses.
- ultramancool 12y agoTrue, but they likely intended it for all releases and I highly doubt the dev(s) are going to burn their anonymity to go after you even if they didn't. Though I suppose that's not the best legal rationale, now is it?
- deleted 12y ago[deleted]
- mandelbulb 12y ago>>After examining all the facts, I think it's most likely they just didn't want to develop it anymore: So they decided to end things with such an extremely juvenile behavior devaluating the years they have invested in this project even if not recently? Unless the responsible one fell into clinical depression it's a pretty strange reason.
- rasz_pl 12y agoDoes National Security Letter sound depressing enough?
- ultramancool 12y agoThey haven't updated it for years. I'd hardly call the behavior "juvenile" nor would i call it "devaluating". They've simply abandoned it and are offering alternatives.
- Nexxxeh 12y agoI think suggesting BitLocker as a viable alternative to their work is "devaluing" their work. Who would trust BitLocker not to be vastly more compromised that TrueCrypt? (Devaluating? sic? Or is that actually a word?)
- ultramancool 12y agoYou're right - few would trust it more. However, it is the closest viable alternative to TrueCrypt on the windows platform today.
- mandelbulb 12y ago>> They haven't updated it for years. As I said even if not recently they still invested many years into that project. Of course it is juvenile to senselessly ruin the code and suddenly advertising a very different commercial product, especially without proper scientific reason. Not to mention that precisely because they haven't done much work lately I don't see any reason why the developers would disfigure their project like that.
- voltagex_ 12y agoCould you post the PGP & Authenticode details? I was unable to verify the 7.1 releases.
- Lagged2Death 12y agoI think it's most likely they just didn't want to develop it anymore... It would be so easy for the person(s) in question to just say that, though. I don't know what to think.
- ultramancool 12y agoAfter the years of silence and the previously infrequent updates, I don't consider it farfetched at all.
- hifier 12y agoI agree that it appears the developers are calling it quits. If you look at the diff itself, they have replaced large chunks of logic with an abort routine, passing the message "Insecure App". This does not explicitly suggest vulnerabilities exist in older versions, but rather the latest version with these changes is very explicitly insecure and should not be used. This does leave room for issues to have been discovered in old versions - maybe rather than fix, they are throwing in the towel.