How easily could be truecrypt and EFS cracked in this scenario

Question

• I suspect some info was subtracted in the past months from my laptop. Therefore Im looking for methods to encrypt my data. I want to try using truecrypt for the sensitive files folder plus EFS for the files in that partition. I’m not an expert so I have doubts about how easly can this be cracked.

• The context is an office working environment, with some co workers willing (and waiting for) to copy valuable and personal information from my laptop. We usually work in the same “conference room” with only one table so the physical access to the laptop is easy. The chances of stealing the laptop is low due to security checkins . The true crypt volume with the protected data folder will be usually mounted while i'm in that room.

• A planed attack combining local and remote methods is highly likely. This is, installing a Trojan/keylogger having physical access to the laptop to later use it to steal the info.

-Weakness : Even tho I try to lock the windows screen every time I leave a shared room, some few times I’ve forgot it (for example if I need to do something outside in a hurry and ill back later). Also, even I set my screen saver to lock the windows account after 5 mins of inactivity, the attacker could move the pad mouse to keep it active after I leave the room. I have an antivirus installed but as we know that sometimes isn’t enough.

• The time that the attacker has psychically alone with the laptop to perform the attack could be around 3 -5 minutes.

• A possible attack will look like this:

  1. I leave the room, the account isn’t blocked, the attacker sees the opportunity and install the Trojan/keylogger.
  2. the windows account password is captured.
  3. the hibersys file is uploaded later to the attackers server as well as the target folders.
  4. the files are decrypted with some tool. (like elcomsoft ) http://blog.crackpassword.com/2012/12/elcomsoft-decrypts-bitlocker-pgp-and-truecrypt-containers/ it would be that easy? Am I missing something here? Should ill be worry ?

And what would you recommend to avoid this?

Thanks in advance.

PDTA: after the first incident, I formatted my hard drive and I haven't been in the office since vacations. I'm going back the next week.

Answer 1

Physical presence of an attacker is the hardest to defend against. Some products consider "physical presence" as sign of ownership and allow full rights to the person in front of the machine. For example, motherboards that allow to reset BIOS passwords so as not to lock out an user who forgot his password.

The EFS + TrueCrypt solution is good but it depends on the security of your passwords. Your data is encrypted safely but your passwords are not protected against interception. Keylogging is a simple way of intercepting your passwords but most known keyloggers will be detected by an Antivirus. The attacker can run a program on your computer that looks like TrueCrypt and will send your password to the attacker.

If you leave your computer unlocked in a hostile environment, you cannot have any expectation of privacy and security. There is no way to be 100% sure that you can detect and disrupt an intrusion after the fact. Locking your computer is very easy and you should make a habit out of doing it. Pressing Windows key + L will lock Windows and CTRL + ALT + L will lock most Linux desktop environments.

EFS in Windows Vista and later will encrypt pagafile.sys but not hyberfil.sys which can be used to extract TrueCrypt keys.

TrueCrypt Unencrypted Data in RAM:

Microsoft does not provide any appropriate API for handling hibernation and shutdown, master keys used for system encryption cannot be reliably (and are not) erased from RAM when the computer hibernates, is shut down or restarted.

Use TrueCrypt full disk encryption to encrypt all of your hard drive.

One weakness of TrueCrypt full disk encryption is when the attacker has physical access multiple times. The attack goes by the name Evil Maid and is mitigated by the use of TPM. Basically, the attacker modifies the TrueCrypt password check code to store the typed password in cleartext for later retrieval. The same goes for other full disk encryption products. Use TPM features if your laptop provide them. Take your laptop at home or lock it with a key if you want more security than Truecrypt can provide.

Update:

One ingenious solution for automatically locking your computer is using this program: http://stevetarzia.com/sonar/. It uses echoes to "see" if you are no longer in front of your computer.

There are similar solutions using the webcam. https://www.keylemon.com/product/

Answer 2

I agree with all that @CristianDobre has written, you have an extremely difficult security situation on your hands which Truecrypt isn't going to solve. If your co-workers have unrestricted access to your machine and bad intentions then you cannot protect your machine, or any information on it as your passwords could be read. Even if they weren't your attackers could hack your machine and log into it while you have truecrypt up and running with the drive mounted and access it that way. Or they could write a simple powershell script that would run on a schedule looking for the access to the drive letter and copy it all as soon as it has access.

My advice would be to set up a hardened Linux virtual machine on a USB stick or hard drive, and run that while you are present in the room. You will need to pause it, and remove the media, taking it with you every single time you leave the room. Do all your work, store all your data on it in truecrypt encrypted volumes, with truecrypt running on the virtual OS, not your machine. Use a virtual keyboard, that is a graphic where you click on the keys, to type in your passwords to defeat any key loggers installed on your physical machine. Never let that USB stick leave your physical presence, even for a minute, and change the passwords on your virtual machine every night using a different computer. It will be a royal pain to do all these measures, however if your situation is this bad and you really need to protect that data then you'll need to keep the discipline.

It would also make sense to change your password on your work computer every day as well. It may not stop them, but at least it may slow them down.