• IT-Karriere:
  • Services:

Truecrypt developers suddenly end development and point to security problems

Shortly after that the story took an unexpected turn. The developers of Truecrypt suddenly ended its development and put a warning on their web page: "Using TrueCrypt is not secure as it may contain unfixed security issues." There was no further explanation, the Truecrypt developers recommended that users switch to the Bitlocker encryption on Windows.

Stellenmarkt
  1. Mentis International Human Resources GmbH, Raum westliches Nordrhein-Westfalen
  2. Allianz Deutschland AG, Stuttgart

In 2015 the final report of the Open Crypto Audit Project was published. It didn't find any larger flaws in Truecrypt's code, but some smaller issues. The experts from the company NCC found for example that the AES implementation in Truecrypt allows side-channel attacks - an information that is also contained in the BSI report. Some time later a member of Google's Project Zero found further security flaws in Truecrypt.

Followup project Veracrypt is still developed

As Truecrypt got no further releases the software is still vulnerable for all those weaknesses. However there is a fork of Truecrypt under the name Veracrypt. The found weaknesses were fixed there, also a further security audit of Veracrypt was performed.

The BSI knew all that. In reaction to the report from the Open Crypto Audit Project the BSI commissioned another security analysis of Truecrypt. This analysis can be found on the webpage of the BSI. It does not mention the older and much more detailed audit from 2010.

THe BSI explained to us that the audit in 2010 was performed as part of an IT investment program to modernize the information and communication technology of the administration. The results were communicated to the Truecrypt foundation, however the Truecrypt developers didn't consider them to be relevant. BSI furthermore says that the results were not intended to be published.

Veracrypt developer Mounir Idrassi confirmed that he had never heard of that BSI security audit. The BSI explained that the IT investment program ended in 2011, many years before Veracrypt was started in 2015.

The BSI audit from 2010 starts with a detailed analysis of the architecture of Truecrypt on Windows and Linux. It looks like the version for Mac OS X was of less interest to BSI.

Low-risk Buffer Overflow

One of the security flaws that is described in detail is a potential buffer overflow in a function to call external programs. This function named Process::Execute takes a program name and an array of command line options as parameters. Afterwards these are copied into an array with 32 elements size, at the end a null pointer is added.

The function contains a check if too many command line options are passed, however the check misses the trailing null pointer. If exactly 31 command line options are passed a buffer overflow happens. This flaw was present in the code of Veracrypt until recently. We have sent a patch to the developers of Veracrypt that has been applied.

The practical risk is probably small. It is unlikely that the Veracrypt code would call a program with so many command line options - and even then an attacker has little control over the used memory.

Bitte aktivieren Sie Javascript.
Oder nutzen Sie das Golem-pur-Angebot
und lesen Golem.de
  • ohne Werbung
  • mit ausgeschaltetem Javascript
  • mit RSS-Volltext-Feed
 Encryption software: German BSI withholds Truecrypt security reportMissing chapter about off-by-one-overflows 
  1.  
  2. 1
  3. 2
  4. 3
  5.  


Anzeige
Top-Angebote
  1. 92,99€ (Bestpreis!)
  2. (u. a. Pinnochio (4K UHD), Die Farbe aus dem All, Die Känguru-Chroniken, Robert the Bruce (4K...
  3. (u. a. Kyocera FS-1061DN Laserdrucker für 109,90€, Dell Latitude 5490 generalüberholtes...
  4. 43 Zoll: 305,89€ (Bestpreis!), 50 Zoll: 355,89€ (Bestpreis!)

danielmain 16. Dez 2019

Was für eine Leistung in den Top 10 von Hacker news zu stehen. Weiterso!


Folgen Sie uns
       


E-Book-Reader Pocketbook Color im Test

Das Pocketbook Color ist der erste E-Book-Reader mit einem Farbbildschirm. Wir haben uns das Gerät angeschaut.

E-Book-Reader Pocketbook Color im Test Video aufrufen
Vivo X51 im Test: Vivos gelungener Deutschland-Start hat eine Gimbal-Kamera
Vivo X51 im Test
Vivos gelungener Deutschland-Start hat eine Gimbal-Kamera

Das Vivo X51 hat eine gute Kamera mit starker Bildstabilisierung und eine vorbildlich zurückhaltende Android-Oberfläche. Der Startpreis in Deutschland könnte aber eine Herausforderung für den Hersteller sein.
Ein Test von Tobias Költzsch

  1. Software-Entwicklung Google veröffentlicht Android Studio 4.1
  2. Jetpack Compose Android bekommt neues UI-Framework
  3. Google Android bekommt lokale Sharing-Funktion

Philips-Leuchten-Konfigurator im Test: Die schicke Leuchte aus dem 3D-Drucker
Philips-Leuchten-Konfigurator im Test
Die schicke Leuchte aus dem 3D-Drucker

Signify bietet mit Philips My Creation die Möglichkeit, eigene Leuchten zu kreieren. Diese werden im 3D-Drucker gefertigt - und sind von überraschend guter Qualität. Golem.de hat eine güldene Leuchte entworfen.
Ein Test von Tobias Költzsch

  1. Smarte Leuchten mit Kurzschluss Netzteil-Rückruf bei Philips Hue Outdoor
  2. Signify Neue Lampen, Leuchten und Lightstrips von Philips Hue
  3. Signify Neue Philips-Hue-Produkte vorgestellt

Energiewende: Wie die Begrünung der Stahlindustrie scheiterte
Energiewende
Wie die Begrünung der Stahlindustrie scheiterte

Vor einem Jahrzehnt suchte die europäische Stahlindustrie nach Technologien, um ihren hohen Kohlendioxid-Ausstoß zu reduzieren, doch umgesetzt wurde fast nichts.
Eine Recherche von Hanno Böck

  1. Wetter Warum die Klimakrise so deprimierend ist

    •  /