Welcome Guest [Log In] [Register]
Welcome to Pumpitout. We hope you enjoy your visit.

You're currently viewing our forum as a guest. This means you are limited to certain areas of the board and there are some features you can't use. If you join our community, you'll be able to access member-only sections, and use many member-only features such as customizing your profile, sending personal messages, and voting in polls. Registration is simple, fast, and completely free.


Join our community!


If you're already a member please log in to your account to access all of our features:

Username:   Password:
Add Reply
Data security is an Illusion
Topic Started: Jan 28 2011, 08:03 PM (1,307 Views)
A Storm is Coming

The history of Backdoored Encryption

Most of you are too young to remember PKZip 2.04G for DOS

This is the program that began my research into secure encryption claims

PKZip 2.04G claimed to be secure as long as you were using LONG passwords! How long? 12 characters or more was considered secure for the forseeable future at a time when DOS 5.0 Ruled the PC environment

To back up that claim, PKZip made the encryption scheme open to scrutiny and I still have the open cource code for it here on a few of my drives

The only problem I could see with PKZip at that time was the fact that, even though your data was encrypted, a complete directory listing was available inside that zip file

For example, if the contents of the encrypted zip file were 001.jpg, 002.jpg and 003.jpg, then you could get the filenames by looking at the contents from a windows PC even though you could not open it or view the JPG's without the password

I could easily get around this problem by double zipping the files however. First zip the files normally and then zip them with encryption

By double zipping the files, you could only read the name of the zipfile inside the encrypted zipfile but not the actual files you were trying to protect

Then pk decided to change the encryption scheme to "Closed Source" RSA if my memory still works correctly

The very act of going to a closed source encryption scheme meant you could no longer verify that..
A: The encryption method was secure
B: The encryption did not contain back doors
C: That the security could NOT be GUARANTEED!

That last one is very important because you cannot guarantee security if you are not allowed to examine the sourcecode and/or compile your own version for personal use

From that point onward, it seemed that all encryption was either closed source or really lame encryption with sourcecode

During the XP days, Securstar's Drivecrypt was supposed to be the most secure version of commercially available encryption on the free market

Early on, Securestar made the sourcecode available to "Certain Corporations" who signed non-disclosure agreements with Securstar

Things have changed since then:
1. Drivecrypt sourcecode is no longer available to anyone
2. Drivecrypt no longer works on ANY PC but rather only works on the specific PC that you register the program with
3. The registration procedure was changed to prevent keygens from supplying valid keys to unlock the full version of Drivecrypt

What is of interest to security researchers is the fact that those KEYGENS that used to work, were themselves being infected by some type of malware

Not only that, but anytime you used the keygen, the actual Drivecrypt program became infected

Here is where it gets interesting so pay attention

Since malware writers could not guarantee access to YOUR encrypted files, why did the Drivecrypt program still "SEEM" to work after being infected?

and, if the Keygen was made by malware writers, then why are they now infecting their own keygens and the drivecrypt program itself?

Maybe they diddn't

The Gov'ts want access to ALL your data, and by encrypting the password you used when you made your encrypted disk, all they then had to do was concatenate the encrypted password to the end of your encrypted disk so they could then access that data after securing a warrant

You, the end user, would never be aware of the encrypted password added to your encrypted disk and even if you were, you could not verify that it was your password because YOU did not have the encryption key for that part of the disk! You only had the key to your encrypted data!

Some researchers were smart enough to realize that they could simply let the keygen infect their computer and then write the unlock codes to a textfile
After that, they could simply repartition and reformat their disk and use the codes from the textfile to unlock drivecrypt without infecting it

Well, they could untill Vista and Windows 7 came out and prevented those versions of Drivecrypt from running on the new OS

So why not just use Bitlocker in Windows 7 then?

You haven't learned a thing!

Closed source is the problem, not the solution!

You cannot guarantee the security of your data if you cannot see what the encryption software is doing

or to put it another way;

A company that makes encryption software cannot Guarantee that your data is secure from EVERYONE ELSE (Including themselves) if they do not open up the sourcecode for examination

Hardware encryption is even worse!

By reading about the problems that Kingston had in the past year with their AES hardware encrypted thumbdrives, you can see that the hardware simply prevented anyone from accessing the data without the password by encrypting the data with a master password in hardware (Not YOUR password) and then decrypting the data with a master password once you entered YOUR correct password

The only current way that I know how to encrypt data with at least some basic assurance of security is to DOUBLE encrypt your data with SOFTWARE that is in the open source catagory

If the Govt's of the World know or can guess what some of the files are in an encrypted drive, they can EASILY compute your decryption key from that knowledge once they have access to your disk

But, by doubly encrypting your data, they can no longer "Easily" crack the password by knowing what "Some" of the files are

Just don't use closed souce encryption to do it
-------------------------------------------------------------------

Feel free to prove this information wrong at any time!

:P




Edited by A Storm is Coming, Jan 30 2011, 08:45 PM.
Offline Profile Quote Post Goto Top
 
A Storm is Coming


;)
Edited by A Storm is Coming, Jan 30 2011, 08:07 AM.
Offline Profile Quote Post Goto Top
 
A Storm is Coming

Any Debunkers out there?

:P
Edited by A Storm is Coming, Jan 30 2011, 08:49 PM.
Offline Profile Quote Post Goto Top
 
alpinemobile

Nice read. Can you please be a bit more specific about what versions of drivecrypt are you talking about? normal drivecrypt or drivecrypt plus pack? what cracked releases? I could not find any references about it yet. thanks.
Offline Profile Quote Post Goto Top
 
A Storm is Coming

alpinemobile

I Was referring to "commercial releases" of normal drivecrypt 4.0 that are not compatible with Vista or Windows 7

The only "cracked" releases of Drivecrypt or Plus Pack that I am aware of contain malware and I was not referring to those

You may find some of my other computer related "Rants" on the Internet but this is probably the only place you will find this specific topic covered
Edited by A Storm is Coming, Oct 29 2011, 04:07 AM.
Offline Profile Quote Post Goto Top
 
1 user reading this topic (1 Guest and 0 Anonymous)
ZetaBoards - Free Forum Hosting
Free Forums. Reliable service with over 8 years of experience.
Learn More · Register Now
« Previous Topic · Lates News · Next Topic »
Add Reply