3
  1. If I change the extension of a Keepass database (i.e. change the .kdbx to something like .txt), Keepass is still able to open it. Is this an effective way for hiding the databases from an adversary?! Probably no. So, what methods are there for hiding such files? What do you experts think about OpenPuff?

  2. Is there any method to truly hide a (normal) Truecrypt container, so that its existence would be undetectable? Note that I'm not talking about "Hidden Truecrypt volumes."

6
  • Generally: "security through obscurity" won't offer much protection. 1) unsafe since detectable, 2) not in a deniable way.
    – e-sushi
    Jan 18 '14 at 14:27
  • @e-sushi : You said, unsafe since detectable. Are you referring to changing the Keepass file extensions or using OpenPuff?
    – Dana
    Jan 18 '14 at 14:33
  • 1
    Actually both, and more. Remember Keepass has a specific file structure. Simply doing a binary seatrch for it's file-header might already void your efforts. And steno-solutions like OpenPuff can be detected by looking at the file data and verifying if there's any unexpected/unneeded/hidden data contained. (I'll skip several tech details as this is a comment with limited length - but one of many weaknesses of steno using images, videos, and/or audio files is that it tends to be detectable by nature since there is an "expected" file format and content that steno-files can be compared to).
    – e-sushi
    Jan 18 '14 at 14:45
  • @e-sushi : Is there any method to temporarily change/replace the header of Keepass files?
    – Dana
    Jan 20 '14 at 3:02
  • 1
    In theory yes, but it has it's limits since you can't replace the whole header without losing valuable DB info. The "safe" header parts (which are also those that are quickly detectable) could manually be replaced using a hex-editor, or you could create a program or script that does the job automatically for you. You'ld have to replace the "safe" header bytes of the DB-file with random bytes, and later replace those random bytes again with the expected header bytes so Keepass can read the database. So yes, it would be possible but you need to identify the whole header structure for that first.
    – e-sushi
    Jan 20 '14 at 5:10
4

2) In theory, yes. A Truecrypt container, considered in the abstract, is indistinguishable from random noise. In the absence of something pointing to the file and saying "this is a Truecrypt container" (eg. a recently-used files list), an attacker cannot prove that a given file is a Truecrypt container.

In practice, no. Normal people do not carry around large blocks of random data on their computers, so a large file that is statistically indistinguishable from randomness and does not have is almost certainly an encrypted file. If someone has a large random file and the Truecrypt software on their computer, it's a good bet that the file is a Truecrypt volume.

1) I'm not familiar with OpenPuff, but in general, I distrust steganograpy. The data you're trying to hide rarely has the same statistical properties as the data you're hiding it in, eg. the well-known "hide the data in the low-order bits of an image" trick fails if the image has large areas of solid color (such as a cartoon) or the low bits are biased in non-random ways (as is common with digital cameras). The best place to hide a needle is not in a haystack, but in a pile of other needles.

5
  • TCHunt and some others have claimed that they can even detect containers with sizes from 19 Kilobytes onwards and completely arbitrary file names and extensions. So It's not just about having a large random file. On the other hand, some people have claimed that they can bypass those forensic methods (like this comment on the same page). I'm hoping to find out more about the methods to keep the containers undetectable.
    – Dana
    Jan 18 '14 at 6:07
  • 2
    TCHunt defines a TrueCrypt file as a highly random file with a size that is a multiple of 512 bytes. By adding a few bytes at the end, the file no longer meets the TCHunt definition, but a program that only looks for randomness will still find it.
    – Mark
    Jan 18 '14 at 8:28
  • Ok, thanks. 1. Can Keepass databases (and any other encrypted stuff) be detected using programs that look for randomness? 2. How safe is a TrueCrypt file with a size less than 100kb to such forensic methods? 3. Do you know of any program that can be used for automatically adding some bytes at the end of a TrueCrypt file?
    – Dana
    Jan 18 '14 at 14:30
  • 1) Any encrypted file can be found by looking for randomness. 2) The smaller the file is, the more likely it is that, by chance, it will look "non-random". In practice, I doubt an encrypted file larger than a few kilobytes will look non-random.
    – Mark
    Jan 19 '14 at 23:00
  • Great thought about needles
    – Chiffa
    May 29 '14 at 23:33
1

One possible way of hiding a file is saving it, where noone will find it. May be on a flashdrive hidden in your flat or on some Server on the Internet (an anonymous Webmail maybe). Make sure to securely delete it, if you need in on your hard drive temporarily.

The fact that it's hard to hide the data is the reason why "hidden volumes" where invented. There is a Password Manager in development, that can hide stuff in your encrypted password-file. https://github.com/bwesterb/pol

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.