3

I am looking into VeraCrypt, a spiritual successor of TrueCrypt. This made a question pop up: As far as I understand, as long as the encrypted volume is mounted, every process can access the data. Wouldn't it be safer if only specific processes could access the files? Is there a tool that does process-based access control?

3

Process-based access control only works on data in transient memory (e.g.: RAM). Once data is stored on a semi-permanent media (e.g.: hard drive, flash drive, DVD, etc.), that media can easily be connected to a system that will not honor any access restrictions that are enforced in its native environment.

You could add process-based access control to the native environment, but that only protects against an attacker restricted to that environment who already has the ability to run code on your system. An attacker with such access pretty much has free reign on the system anyway, so it's nearly impossible to guard against such a threat. Any attempts to do so, particularly in the manner you suggest, would have to severely compromise on user experience and system usability.

At a bare minimum, I can think of three programs you'd have to whitelist for every file:

  • File Browser (e.g.: Explorer)
  • Document Viewer (e.g.: Acrobat, Word, Excel, etc.)
  • Antivirus (Take your pick)

Two of these are things that will very widely vary from system to system, file to file, and user to user, and all of them are subject to changes via software updates. And there's probably plenty of things I'm not thinking of. It would be nigh-impossible for the developer of the tool to properly build and maintain a comprehensive database of even just the most commonly-used programs to auto-whitelist them for the user.

Thus, the user would have to be prompted to add programs to the whitelist. These prompts would happen, at the very least, the first time each program needs to access the volume and again any time the program tries to access the volume after having had an update applied. Eventually, the prompting would reach Vista-era UAC noise levels and the user will end up either disabling the security or auto-approving - thereby rendering the feature useless.

All of this is rendered moot by any number of means (rootkits and keyloggers to start with) that are commonly used by attackers to compromise systems. The best way to keep processes from inappropriately accessing your encrypted data, is to not let such processes get installed and run in the first place.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.