I'm having some kind of (IMHO) useless discussion on VeraCrypt being a "trojan" on Windows:
We have a product named "Checkpoint Harmony Endpoint Security" that is intended to protect Windows computers using the Internet. After the recent update, I cannot run VeraCrypt any more; it seems the product prevents start of the background process that mounts the volumes.
Basically the product classifies VeraCrypt as "Trojan" without actually explaining why. Maybe it's because it detected that VeryCrypt is reading the registry (concluding that it might steal some confidential information from there). As said, I don't really understand, but here is basically how the report looks like:
As said, I feel it's a rather useless discussion whether VeryCrypt is a trojan horse or not, but maybe let me ask:
- Assuming an official current release of VeraCrypt is installed on Windows 10, what kind of attacks could be started where VeryCrypt is participating?
- If some crafted encrypted image is activated, could it attack Windows directly, and if so, how?
- If the attack cannot be done via activating the image, could some attack be done using a specifically crafted filesystem image (FAT*, NTFS, etc.), causing Windows to misbehave (like when adding/mounting some arbitrary USB stick)?
- And if the attack cannot be done via the filesystem directly, could it be done using Windows "features" like auto-run to run some bad program located in the image or elsewhere?
Note: My use case is to open an image that I created myself on Windows.
