While browsing PasteBin today, I noticed a new Paste that outlined approaches to compromising TrueCrypt protected data, as well as full Keys, Encryption Schemes, Plain-text Files, and Volume Names (and metadata). It was terribly un-nerving.

Appears this Pastebin was copied from this blog post, "TrueCrypt Master Key Extraction And Volume Identification."

My question is, what are the options to mitigate these attack vectors, barring Live-Boot/Read-Only OS's. Or are there any methods?

The Vectors outlined fall into two major categories:

  • Keys in Memory - Or keys left in swap-files.
  • Cached Data on Disk - Including data in swap-files, file history (some OS's cache files in plain-text), and TrueCrypt metadata (that can identify encryption schemes, volume use history, and identify the volume it's self [a USB drive with certain characteristics, or a specific file]).

Due to OS caching, my initial expectation is that there is no way to mitigate these attack vectors without a Read-Only OS, but I thought this was a good place to double-check.


Keys in Memory

Unfortunately, the OS needs to store the key somewhere in order to encrypt/decrypt data as requested. There are "workarounds" such as TRESOR which stores the key in CPU registers instead of main memory. This comes with some advantages but the underlying attack vector cannot be closed.

Cached Data on Disk

One solution to this is encrypt the whole disk with full disk encryption (FDE).

A more elegant solution is to use a live system which runs entirely in RAM so that such data leaks are unrecoverable after a system shutdown.

|improve this answer|||||
  • I was afraid of that, however, keeping track of and managing a live-boot CD is something I wished to avoid. Would a live-boot USB with write protection and a memory based temporary file-system be a viable solution? Or is it possible to reliably write-protect or emulate Live-CD behavior using a USB drive? – Mike May 15 '14 at 15:34
  • Yes you can. The ISO images intended to be burned to CDs/DVDs can also be installed on USB flash drives. Many people like to take advantage of being able to write to flash drives and add "persistence" to their live systems which defeats the point from an anti forensics point of view so watch out for guides that offer persistence as a bonus. – user2675345 May 15 '14 at 15:57
  • So it is possible to make a USB drive that is NON-persistent? Would it be conceivably possible to make a boot-able USB drive that is both fully encrypted and NON-persistent? – Mike May 15 '14 at 16:05
  • 1
    This is a popular tool for installing OS ISOs on flash drives. unetbootin.sourceforge.net (Note that persistence is an optional extra which can be specified during the installation). Encrypting it as well is not something many people want. You will probably have to set that up manually. – user2675345 May 15 '14 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.