Tag Info

New answers tagged

3

If the decryption key is stored in plain on the very same media as the encrypted data, then the encryption is pointless. If you have a set of rules, which require data to be encrypted, but permit storing the key in plain on the very same media, then the rules are flawed. If you ever face such a flawed set of rules, you should point out the flaw. If the key ...


23

Two generic things you apparently have missed: In case of disk failure, having the data encrypted at rest solves the issue of having potentially sensitive data on a media you can't access any more. It makes disposing of faulty drives easier and cheaper (and it's one less problem) Full disk encryption also makes it harder for an attacker to retrieve data ...


1

how is such a hack tool guarded against? Prevent your computer to boot from an external media by setting appropriate options at the BIOS level and protecting this configuration using a BIOS password, Use Trusted Boot where TPM chip is available (most professional laptops have one, this Dell Latitude has one), Use full disk encryption, this ...


2

You can not securely use encrypted virtual machines without full disk encryption on the host. While the virtual machine is running, the host stores memory chunks, log data, configurations, and loads of other files on disk, leaving permanent forensic trail of a live decrypted virtual machine. File and project names will almost certainly be recoverable. If ...


0

As other answers mentioned, this issue seems very close to DRM issues, with the sole but notable exception that as per my understanding you do not need the video file to be playable by any other software than your own. To avoid any stored key, I would imagine the actual key to be deduced (like a hash) from several parameters defining your restriction (video ...


2

You have a few options, and it'd probably be best to do at least the first two: Encrypt your host operating system's drive using BitLocker or doxbox. When installing your guest operating system, do the same thing inside the guest. VirtualBox and other VM hosts provide the option to encrypt the virtual drive. All drive contents are encrypted before written ...


1

I am sorry if I am missing something simple in your question. Why not just store the image on an encrypted drive? You could store the image or the entire VirtualBox folder on the encrypted disk so that way you need the key to be able to access it.


3

TrueCrypt had a Plausible Deniabiliy feature that allowed a hidden encrypted volume inside another encrypted volume. It is not maintained anymore, but you can check CipherShed and VeraCrypt which are forks of the original project.


1

In many places I've been in departments typically have "travel laptops". These are blank laptops with standard corporate encryption, office, a web browser (for email access) and that's it nothing else! No access to corporate networks, no access to personal disk areas nout! These laptops were used whenever an employee left the country regardless of where ...


-1

This works as a security for all types of communication. It's also a kind of security by obscurity. Simply insert a number of keywords into any document / communication: Terror threat. Bomb. Nuclear. Royal family. Selection of current time important individuals by name ~ presidents, prime minsisters, etc. Do the same for events ~ Olympics, World Cup, etc. ...


2

Google has the Widevine DRM mechanism (Video DRM solution). A tool that can play with the Widevine internals (libwvcdm) can be found here -- https://github.com/EiNSTeiN-/chromecast-widevine-tools There is also the Stagefright multimedia framework to supply DRM -- https://source.android.com/devices/media.html -- Josh Drake is doing a prezo on it at BlackHat ...


2

Full-disk encryption, three-level. First level: secure boot to the OS. Normal counter-measures (two flash drives/CD for bootloader signature verification, USB-AES passthrough devices and TPM/UEFI signing where applicable). Second level: inner container with data - split it into two parts (each 128 KB of disk space, eject 1 KB of data to remote ...


0

Yes it is a realistic threat. Here is a tutorial on how this is done. The SAM file can be retrieved and cracked. Alternatively, new credentials can be injected in the SAM file. Defences include physically securing the computer, or (you've said it yourself) - encrypt the hard drive so it requires a password on boot.


11

I have two solutions. Both require Full Disk Encryption (FDE). First Solution Credit to Bruce Schneier. Just before leaving home, create a second key. Type it with your forehead, a cat or dog, just so it's random and not possible to remember. Send the second key to a trusted person, preferably someone with a privileged relationship, i.e. lawyer, ...


16

A useful and practical guide to securing information devices when crossing borders is provided by the Canadian Bar Association here. I would not say the U.S. border is the only one of concern, others such as China might eventually become similarly aggressive (though I've seen little sign of that to date). The guide echos many of the points made in other ...


2

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. (https://technet.microsoft.com/en-us/library/hh278941.aspx) This is definitely a realistic threat. The question is whether you need to worry about it. If you can't guarantee that someone will not have unfettered access to your PC then you should be ...


-1

You can hide the fact that you have heavily encrypted files by using the one time pad method. You can dump (encrypted) data from sensitive files in the form of fake high ISO noise in image files. To decrypt, you must have access to the original image files via e.g. Google Drive. If someone gains access to your Google Drive account they will only see image ...


3

The most efficient approach I can imagine is the following: Boot from a USB media Mount a hidden encrypted volume located on internal media Leave boot media at home Use a screen saver which upon seeing a secondary password will cause a system crash. Have a bootable system on the internal media using the secondary password as login password. There is a ...


72

The ANSSI, French government service in charge of IT security, has published a document providing brief advice to people having to travel abroad. Relevant here are the advisories concerning preparation before travel: Review the applicable company policy, Review destination country applicable laws, Prefer to use devices dedicated to travel (computers, ...


15

The best way to protect against that type of border search is actually not to have anything suspicious on the hardware you take through the custom. Using encryption technology will most likely raise suspicion in the first place. Refusing to provide the necessary codes can, in some places, leads to the hardware being confiscated or even to you being ...


13

Full disk encryption is the most common one used. The cost would depend on the time which needs to be implemented by the IT department ontop of normal laptop staging. However in my experience FDE is a must for any organization taking its security serious. Aside from that there are also some really anti-forensic tools, I remember a talk at Brucon where one ...


1

There is often a trad-off to be found between security and usability. Some times you consent to loose a bit of usability for the sake of security. Some times you agree to loose a bit of security for the sake of usability. All that's matter is to clearly understand the risk you are facing and whether or not you accept to cope with this. In your case: ...


0

Yes, there are problems. The problem is if that one key is compromised all of your accounts are compromised. It's much faster to crack one key to access 5 accounts than it is to crack 5 keys to access 5 accounts. Some systems also use weaker cryptographic methods. Even if your key is strong it could potentially be recovered easily on one system, defeating ...


2

You can use dropbear ssh to ssh to your machine and then unlock the LUKS volume. There's a tutorial here which can assist you with setting up.



Top 50 recent answers are included