News for hackers. Stuff that matters.

A comment on TrueCrypt suggesting migration to BitLocker?.

Re:TrueCrypt suggesting migration to BitLocker? by david_shaw on Wednesday May 28, 2014 @03:30PM (#7812270)
Well - this comes as a pretty big surprise.

Is this real? Is there a known vulnerability that catalyzed this? Money from Microsoft? Threats?

I'm not buying into conspiracy theories, but it does seem pretty out of place.

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by pearjuice on Wednesday May 28, 2014 @03:41PM (#7812349)
The binaries are properly GPG-signed with the same key as the previous binaries, check for yourself. [They] either compromised their private key too or the actual developer(s) did this. Be it voluntarily or by force of secret three-character agencies / a massive pay check.
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by this_user on Wednesday May 28, 2014 @03:46PM (#7812384)
Maybe something like the Lavabit scenario where they rather close the shop than sell their users out. On the other hand, proposing Bitlocker as an alternative would be rather suspect in that case.
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by mikelat on Wednesday May 28, 2014 @06:54PM (#7813506)
IF THIS IS THE CASE and that's an IF then it seriously brings into suspect backdoors in larger proprietary software. Because really if they're going after trucrypt then they have to already have gone after the big players.

I'm not going to jump the gun just yet but after snowden it's not out of the question.

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by grrowl on Thursday May 29, 2014 @02:49AM (#7815074)
Not "backdoors" but it seems Microsoft stores the BitLocker decryption key, based on this leaked slide (just found on twitter): https://twitter.com/TheBlogPirate/status/471759810644283392/...

edit: Confirmed Microsoft stores your recovery key on their servers if you're not connected to a domain: http://windows.microsoft.com/en-AU/windows-8/bitlocker-recov...

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by cradle on Thursday May 29, 2014 @05:10AM (#7815396)
Microsoft storing your key is opt-in and optional.

Whether or not they superstitiously store it anyway is a different question.

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by unsignedint on Wednesday May 28, 2014 @03:51PM (#7812408)
Well, the thing is though, it's not that they were hosting users' data. It's not like they would be forced to provide the contents of users' communication.

I suppose they could be approached by someone to plant backdoor into the software, but I wonder if that can be done without someone noticing it...

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by marcosdumay on Wednesday May 28, 2014 @07:04PM (#7813546)
If they put a backdor on the binaries, but not source, lots of people will be compromissed, and for a really long time nobody may notice.

EDIT: I normaly don't care. But this time I'd be glad if who downmoded this post explained why.

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by iondream on Wednesday May 28, 2014 @04:58PM (#7812889)
Yeah it could be a gag order from a secret court. maybe they folded because they were forced to compromise the code...
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by y4mi on Wednesday May 28, 2014 @04:51PM (#7812820)
considering heartbleed... yes
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by CodeMage on Wednesday May 28, 2014 @04:52PM (#7812832)
Same key as the previous binaries? I doubt it, given that the keys were replaced mere 3 hours before the new binaries were published:

http://sourceforge.net/p/truecrypt/activity/?page=0&limit=10...

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by verytrivial on Wednesday May 28, 2014 @05:00PM (#7812905)
Anyone have key fingerprints for pub keys used for the 7.1a vs 7.2 signing? Preferably pub key from a while ago I guess.
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by GoodOlClint on Wednesday May 28, 2014 @05:18PM (#7813027)
This looks like the previous key: https://github.com/DrWhax/truecrypt-archive/blob/master/True...

Besides the different file name, the contents of the files match: http://www.diffchecker.com/szpb500v

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by eric_bullington on Wednesday May 28, 2014 @08:16PM (#7813862)
Yes, I can confirm that F0D6B1E0 was on the Truecrypt web site about a year or two ago, since it's been on my keyring for at least that long. I've installed Truecrypt multiple times over the past few years, and have always used this key to verify (or its signing subkey, I suppose).
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by LeoPanthera on Wednesday May 28, 2014 @05:20PM (#7813042)
There's a "TrueCrypt Foundation" key on the keyservers from 2004, the ID is E3BA73CAF0D6B1E0.
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by throwaway8889 on Wednesday May 28, 2014 @07:41PM (#7813733)
The time stamp on key servers can not be trusted. Anyone can spoof keys in anyone elses name, with any timestamp they want.

The only way to verify is if you have the previous key stored somewhere, or can find a trustpath to it.

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by adrianN on Wednesday May 28, 2014 @08:02PM (#7813808)
I have the key stored in my local keychain:

E3BA73CAF0D6B1E0 C5F4 BAC4 A7B2 2DB8 B8F8 5538 E3BA 73CA F0D6 B1E0

Checks out.

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by panarky on Thursday May 29, 2014 @12:54AM (#7814816)
I have 7.1a binaries, source, sigs and pub key from September 2013.

  pub   1024D/F0D6B1E0 2004-06-06
        Key fingerprint = C5F4 BAC4 A7B2 2DB8 B8F8  5538 E3BA 73CA F0D6 B1E0
  uid                  TrueCrypt Foundation <[email protected]>
  sub   4077g/6B136ECF 2004-06-06
My version from September is identical to the pub key at http://sourceforge.net/projects/truecrypt/files/TrueCrypt/Ot... .
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by voltagex_ on Thursday May 29, 2014 @01:00AM (#7814825)
Could you post the SHA1s of those? I'm failing to use GPG properly.
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by panarky on Thursday May 29, 2014 @09:33AM (#7816109) 

  tc/linux$ sha1sum *
  c2a8c78a23f97ffb17bf47448c9f2daa3c8f80cd  truecrypt-7.1a-linux-console-x64.tar.gz
  078cdd4a58f0342cb872d7456c0ba49e310fcad9  truecrypt-7.1a-linux-console-x64.tar.gz.sig
  a53a7a609a25d9a1e33f720ce5c0265ddd4e8b25  truecrypt-7.1a-linux-console-x86.tar.gz
  66060f9444d5df70b4fcdeb655dc60131fce5ad1  truecrypt-7.1a-linux-console-x86.tar.gz.sig
  086cf24fad36c2c99a6ac32774833c74091acc4d  truecrypt-7.1a-linux-x64.tar.gz
  45f65bf755d9481d8afa0d17de6a034062b7a7bd  truecrypt-7.1a-linux-x64.tar.gz.sig
  0e77b220dbbc6f14101f3f913966f2c818b0f588  truecrypt-7.1a-linux-x86.tar.gz
  9efcd79e963126d6d8ef242857b4fafb06eb8ff0  truecrypt-7.1a-linux-x86.tar.gz.sig
  d43e0dbe05c04e316447d87413c4f74c68f5de24  TrueCrypt 7.1a Source.tar.gz
  caeb2bb1d5605d1fc960e936a06e52611033788c  TrueCrypt 7.1a Source.tar.gz.sig
  c871f833d6c115f4b4861eed859ff512e994b9fc  TrueCrypt-Foundation-Public-Key.asc

  tc/windows$ sha1sum *
  06961d83e39c7248df09c132cb6e9b9f528ce69a  Configuration.xml
  88b323b416290924621901a10da3f4f7482e3f77  License.txt
  4c4891f5eafcf9b96be01e31031992d9e98d39c3  TrueCrypt.exe
  34442e400e6cb2534f33a0b1599defe36eefef2a  TrueCrypt Format.exe
  7689d038c76bd1df695d295c026961e50e4a62ea  TrueCrypt Setup 7.1a.exe
  e1e3efaeac2fbcdbff0c2c62ac33233bd356edfa  TrueCrypt Setup 7.1a.exe.sig
  62fc4f76540740e63c7f0a33e3a1b66411f0a303  truecrypt.sys
  17249d979b3bc52d0a33821cc7f810337ddea2b6  TrueCrypt User Guide.pdf
  17c46ebc6f4977afbcf4aa11eccee524fd95b1c8  truecrypt-x64.sys
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by gap on Thursday May 29, 2014 @03:54PM (#7818242)
Can you please make these available for download, the Linux ones at least?
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by ixwt on Thursday May 29, 2014 @10:55PM (#7819989)
All of the files available here: http://truecrypt.ch/ have the same hashes as provided by this person.
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by panarky on Thursday May 29, 2014 @11:36PM (#7820130)
Don't just trust my SHA1s, verify with the sigs and the TrueCrypt Foundation public key. Ensure the key has the fingerprint shown in the great-great-great grandparent of this comment, independently verified by others in this thread.

  gpg --import TrueCrypt-Foundation-Public-Key.asc
  gpg --fingerprint F0D6B1E0
  gpg --verify truecrypt-7.1a-linux-x64.tar.gz.sig
You should see:

  gpg: Signature made Tue 07 Feb 2012 12:45:26 PM PST using DSA key ID F0D6B1E0
  gpg: Good signature from "TrueCrypt Foundation <[email protected]>"
  gpg: WARNING: This key is not certified with a trusted signature!
  gpg:          There is no indication that the signature belongs to the owner.
  Primary key fingerprint: C5F4 BAC4 A7B2 2DB8 B8F8  5538 E3BA 73CA F0D6 B1E0
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by gap on Friday May 30, 2014 @02:11PM (#7823184)
Thanks!
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by harshreality on Wednesday May 28, 2014 @03:51PM (#7812406)
If this is a hack, then the truecrypt.org site (or dns) and sourceforge site are both compromised, suggesting a dev got hacked who would have had access to both, and perhaps the TC signing key as well (not everyone practices good signing key hygiene, like keeping it offline, even for important software projects).

Even if it's a legit announcement, I wouldn't run that 7.2 binary. Anyone running truecrypt already has truecrypt, right? I don't know why they'd release a new version at the same time as such a dire and panic-inducing announcement.

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by prg318 on Wednesday May 28, 2014 @04:05PM (#7812489)
SourceForge recently forced their users to change their passwords [1] because of an attack on their infrastructure [2]. Pure speculation but I'm not sure if that had anything to do with this?

[1] http://sourceforge.net/blog/sourceforge-net-global-password-...

[2] http://sourceforge.net/blog/sourceforge-net-attack/

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by A_Non_eMouse on Wednesday May 28, 2014 @07:42PM (#7813735)
Those two SourceForge blog posts are from January 2011, a year before the release of TrueCrypt 7.1a. The recent forced change was due to infrastructure changes.

https://sourceforge.net/blog/forced-password-change/

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by derefr on Thursday May 29, 2014 @02:20AM (#7815008)
> Anyone running truecrypt already has truecrypt, right?

I frequently reformat my boot volumes—but I've had a .tc file laying around on an external HD since forever, with my websites' X.509 private keys and such inside.

I'm probably going to do exactly as this announcement says: download the export-only binary, create a loop-mounted LUKS volume, and migrate everything over.

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by slashdotaccount on Thursday May 29, 2014 @06:05AM (#7815508)
Recent versions of cryptsetup support decrypting truecrypt volumes, just use cryptsetup for both.
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by sp332 on Wednesday May 28, 2014 @04:17PM (#7812568)
Here's the source code diff https://www.alchemistowl.org/arrigo/truecrypt-7.1a-7.2.diff....
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by makmanalp on Wednesday May 28, 2014 @04:22PM (#7812599)
Time to call in the underhanded C contest (http://underhanded.xcott.com/) participants on a special bugfinding challenge :)
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by pearjuice on Wednesday May 28, 2014 @04:31PM (#7812664)
Not needed.

Just quickly scroll through the diff (better version here: https://gist.github.com/anonymous/e5791d5703325b9cf6d1) and you will immediately see that all that was done is disable/remove a majority of the functionality.

    AbortProcess ("INSECURE_APP");
    Print ("WARNING: Using TrueCrypt is not secure");
They added exceptions/rose errors/printed warnings everywhere where you could possibly encrypt and all of it reflects their intent at the Sourceforge page.
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by makmanalp on Wednesday May 28, 2014 @06:44PM (#7813444)
The whole point of the underhanded c contest is that the code looks extremely benign, and you wouldn't know that it's doing something evil by staring at it for a short time. Example: http://underhanded.xcott.com/?page_id=22

Anyway, it was a joke.

edit: But I'm not touching that binary with a 10 foot pole, thank you. There isn't even any guarantee yet that that source compiles into the given binary.

[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by eli on Wednesday May 28, 2014 @03:56PM (#7812433)
A much simpler explanation is someone defaced the site around the same time a new release was coming out. Is there anything in the signed release package to corroborate what the site says?
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by Amezarak on Wednesday May 28, 2014 @04:18PM (#7812572)
Yes. See the sibling poster's image link. I also installed 7.2 in a VM and received the same warning. It also looks like I can't encrypt anything, just decrypt.
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by bitJericho on Wednesday May 28, 2014 @03:47PM (#7812389)
If their site/dns/whatever was compromised than there's no way you can trust the GPG signature at this point. I'll await a proper press release.
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by kmfrk on Wednesday May 28, 2014 @04:10PM (#7812523)
Matthew Green (@matthew_d_green) was involved in the audit. Follow him for what's what.
[ Parent | on HN ]
Re:TrueCrypt suggesting migration to BitLocker? by kzrdude on Wednesday May 28, 2014 @04:35PM (#7812685)
> The audit did not find anything -- or rather, nothing that we haven't already published.

https://twitter.com/matthew_d_green/status/47175105467398963...

[ Parent | on HN ]