Slashdot Mirror
Forensics Tool Finds Headerless Encrypted Files
gurps_npc writes "Forensics Innovations claims to have for sale a product that detects headerless encrypted files, such as TrueCrypt Dynamic files.
It does not decrypt the file, just tells you that it is in fact an encrypted file. It works by detecting hidden patterns that don't exist in a random file. It does not mention steganography, but if their claim is true, it seems that it should be capable of detecting stenographic information as well."
The company has "innovations" in it's name, so their product probably won't work.
If it did work against true crypt, which is a yard stick of well implemented encryption, I'm sure they'll come up with a counter measure by the next minor release.
Also: In before XKCD strip.
The fact that there's order in the encrypted information doesn't change the fact that, to an outside observer that doesn't know the original information or the key can't tell the difference between the encrypted information and true random noise. That's part of the point.
If they can tell that it's not random, that's a start on cracking the encryption and gaining the original information.
I don't read AC A human right
"That's cute, sir - now give us the other password"
- "what other password?"
"for the hidden truecrypt volume"
- "what hidden truecrypt volume??"
"the one that's being referred to by half a dozen applications' most recently used files lists"
- "oh err.. that's uh.. another drive entirely"
"very well, then hand us that other drive"
- "err uhm.. my dog ate it?"
If you're really, really serious about these things, maybe you could work super-diligently to prevent leaving any clues as to that hidden volume's existence.. odds are something's going to bite you in the behind somewhere though.
Dear mods, that's meant to be facetious. Some of you seem to be a little trigger-happy so you won't understand why I shouldn't have to explain that.
Make your joke and take the moderations like a man.
If you are going to explain that it is a joke, you might as well not bother in the first place since explaining takes away all the fun.
When information is power, privacy is freedom.
Good point. My guess is that is how this tool actually works. It relies on the assumption that any statistically psuedorandom files (or maybe even partitions) must be encrypted, since every other file will contain some sort of pattern.
encrypted information (short of a one time pad, which is the only way to get true noise) has an underlying structure in the data operated on.
The digits of pi have an underlying structure. If you have a way to distinguish an arbitrary stretch of pi from truly random data, I suspect you'll win a Fields Medal.
Give me Classic Slashdot or give me death!
[pb@localhost ~]$ tail ~/.bash_history
less GnosLoadPDFForms.pdf
file GnosLoadPDFForms.
mv GnosLoadPDFForms.pdf GnosLoadPDFForms.fdf
file GnosLoadPDFForms.fdf
evince GnosLoadPDFForms.fdf
less GnosLoadPDFForms.fdf
su
acroread GnosLoadPDFForms.fdf
top
OK, I checked it out. Here's how they "do" it:
1. No File Header.
2. (File size % 512) = 0
3. Successful X2 and Arithmetic Mean tests on certain bytes.
4. File size greater than 15 MB.
Step 2 == entropy tests.
In other words, they detect random looking files (which implicitly implies "no header") whose size is 0 mod 512 and is greater than 15MB.
Big fucking deal. It might be true that on your system, the only files that meet these characteristics are TrueCrypt volumes, but again it's trivial to create non-TrueCrypt files that meet these criteria. Simply, any true random file (whose size meets the above requirements) will be detected as a TrueCrypt file.
I stand by my assessment: BS.
If the geiger counter does not click, the coffee, she is not thick.
There is a reason that high-quality encryption was once classified as a "munition" by the US government. You cannot accidentally create it. You need a very good PRNG or an algo such as AES. Don't worry, your formats will (and cannot) be confused with encrypted data.
And your non-virtual OS's swap file? You can turn it off, but that'd raise big suspicions.
Like what? Having 4GB of RAM? I have no swap on some systems, don't need it, why should I thrash my HDD?
"The right way to do this is simply to have the encryption code silently destroy access to the data when given a special, secondary password."
Have you never heard of "dd"? Bit-for-bit copying of an entire drive renders your special booby-trapped key completely pointless. Who are you trying to defend yourself against, Inspector Clouseau?
Just another "DOJ fascist authoritarian totalitarian bootlicker" -- Zeio
Don't *all* numbers consist of just ones and zeros ? C'mon this is Slashdot!
...the future crusty old bastards are already drinking the Kool-Aid.