Slashdot Mirror

← Back to Stories (view on slashdot.org)

Newly Found TrueCrypt Flaw Allows Full System Compromise

Posted by timothy on from the so-maybe-move-on dept.

itwbennett writes: James Forshaw, a member of Google's Project Zero team has found a pair of flaws in the discontinued encryption utility TrueCrypt that could allow attackers to obtain elevated privileges on a system if they have access to a limited user account. 'It's impossible to tell if the new flaws discovered by Forshaw were introduced intentionally or not, but they do show that despite professional code audits, serious bugs can remain undiscovered,' writes Lucian Constantin.

5 of 106 comments (clear)

  1. Veracrypt by Anonymous Coward · · Score: 5, Informative

    VeraCrypt 1.15 that was released Saturday, contains patches for the two vulnerabilities

    Time to update.

  2. Re:Clarification? by mlw4428 · · Score: 5, Informative

    It's in the driver which operates at an elevated permission level. If there's a bug in the driver code which allows code execution (buffer overflow comes to mind) that code would be running with elevated privileges. Windows can't necessarily account for all potential flaws in software. Nor can any Kernel.

  3. In case anyone is wondering by Anonymous Coward · · Score: 5, Informative

    The VeraCrypt commits fixing the 2 "undisclosed" vulnerabilities:
    https://github.com/veracrypt/V...
    https://github.com/veracrypt/V...

  4. Important Details by Anonymous Coward · · Score: 5, Insightful

    This is not a compromise of the TrueCrypt encryption!

    This is a bug in the TrueCrypt driver that is installed on Windows systems. The bug allows an account on an already running and "decrypted" system to achieve elevated credentials. This would not be very much different than a printer driver bug.

    The fact that this is not an actual compromise of TrueCrypt and its encryption, is likely why it was not found in the audit. It is not a vulnerability that they weer worried about and did not look for anything like it.

    TrueCrypt encrypted volumes remain no more or less vulnerable because of this. But, you still should not be using TrueCrypt.

  5. despite professional code audits by TsuruchiBrian · · Score: 5, Insightful

    despite professional code audits, serious bugs can remain undiscovered

    Doesn't google finding this bug count as on more professional code audit successfully discovering a bug?

    When a scientist discovers a new theory do we lament the fact that we've proven that we didn't know everything beforehand?

    Did anyone really think that we could possibly ever have a large piece of software with no bugs?