Author Topic: Tinfoil USB stick of glory  (Read 4549 times)

andygates

  • Peroxide Viking
Tinfoil USB stick of glory
« on: May 01, 2008, 10:05:57 am »
(hiving this off from the Hardy Heron thread to avoid threadjacking)

I'm keen to make a USB Everything Stick that will have the following:

* A free and bootable OS (probably Hardy).
* An encrypted data partition.
* Platform-independent PIM tools.
* Brainless backup.

First guess at this would be something like:

An 8gb stick with two partitions.  One 4Gb Hardy install, which ought to be pretty vanilla.  The other for data, formatted in FAT32.

The data partition to contain appropriate Linux and Windows mount-me-baby encryption software and a virtual encrypted disk.  Any idea what product to try?

Now, PIM-wise I use a Wiki Onna Stick and Sunbird Onna Stick.  The wiki is platform independent so as long as it's in the encrypted virtual filesystem and that's mounted, all is golden.

Where does Sunbird keep its data?  And can the same Sunbird file be used by a Windows executable version and the Linux boot once it has mounted the encrypted drive?

Oh and backup, um.  That's not going to be just xcopy *.* is it? :-[
It takes blood and guts to be this cool but I'm still just a cliché.
OpenStreetMap UK & IRL Streetmap & Topo: ravenfamily.org/andyg/maps updates weekly.

andygates

  • Peroxide Viking
Re: Tinfoil USB stick of glory
« Reply #1 on: May 16, 2008, 08:10:23 pm »
Update: I've found TrueCrypt, which fulfills all of my needs for an encryption package.  It has Windows EXE, Linux RPM and DEB installers and for Mac.  It's open-source with a commitment to stay open forever, and allows you to encrypt entire volumes or chunks of volumes. 

Cunningly it also lets you mount a hidden encrypted volume inside a regular encrypted volume.  Since the 'empty' space in any encrypted volume is random-seeming noise, the hidden encrypted volume is invisible unless you know the password.  So, you can create some chaff in the regular volume, and if the Bad Guys force you to disclose a password, give them that one.  They'll never know any better.

Quote
The regular volume:  Contains Truecrypt 'Traveller' executables and the installation files for various OS's and the visible encrypted-volume file.
Quote
The visible encrypted volume contains some convincing chaff to deter the bad guys and an invisible encrypted volume.
Quote
The invisible encrypted volume contains your sensitive data - passwords and bank details and copies of ID on your keyring.

The Windows executables can even autorun on insertion.   :thumbsup:
It takes blood and guts to be this cool but I'm still just a cliché.
OpenStreetMap UK & IRL Streetmap & Topo: ravenfamily.org/andyg/maps updates weekly.

folkdevil

  • Francis
  • I've only got one bike, and it's only got one gear
Re: Tinfoil USB stick of glory
« Reply #2 on: May 19, 2008, 11:37:53 am »
Sounds great Andy, thanks for posting your ideas and research.
I might do this as well.

Re: Tinfoil USB stick of glory
« Reply #3 on: May 19, 2008, 12:02:23 pm »
When I did this I went for Damn Small Linux.  It's really fast, cause it can run entirely from the RAM if you want it to.  But then I had a 128mb flash drive to play with, and no USB 2.0.

sas

  • Penguin power
    • My Flickr Photos
Re: Tinfoil USB stick of glory
« Reply #4 on: May 19, 2008, 12:39:55 pm »
The latest version of Fedora has a LiveCD that can be installed to a USB stick. Takes up around 700MB, and the filesystem is compressed. Fedora also have some tools for making customs spins of distributions- if Ubuntu has something like this you could create your own customised LiveCD/LiveUSB.
I am nothing and should be everything

Re: Tinfoil USB stick of glory
« Reply #5 on: May 21, 2008, 05:38:30 pm »
Cunningly it also lets you mount a hidden encrypted volume inside a regular encrypted volume.  Since the 'empty' space in any encrypted volume is random-seeming noise, the hidden encrypted volume is invisible unless you know the password.

I'd be interested in a proper cryptanalysis of the hidden volume.

The problem is that unused/free disk space isn't normally filled with seemingly random data. It's filled with bits and bobs of old files that have been deleted, entirely blank sectors, etc.

A large section of high entropy data would look suspicious.
"Yes please" said Squirrel "biscuits are our favourite things."

andygates

  • Peroxide Viking
Re: Tinfoil USB stick of glory
« Reply #6 on: May 21, 2008, 09:08:16 pm »
The entire wrapper volume is encrypted as one monolitic file, so it is already a large section of high-entropy data.
It takes blood and guts to be this cool but I'm still just a cliché.
OpenStreetMap UK & IRL Streetmap & Topo: ravenfamily.org/andyg/maps updates weekly.

Re: Tinfoil USB stick of glory
« Reply #7 on: May 21, 2008, 11:03:00 pm »
But don't you think that any decent security person, or even USA TSA folk, would know about publicly available software such as truecrypt, and have an easy to use software that would detect its fingerprints in some way?   Having detected the fingerprint the alarms would go off and alert the operator to the potential for a secondary embedded drive - or even be able to detect that.

andygates

  • Peroxide Viking
Re: Tinfoil USB stick of glory
« Reply #8 on: May 21, 2008, 11:23:11 pm »
I agree with the question, but as I understand it, the current answer is "nope, they can't".  There's a detailed explanation of how it works on the truecrypt site - I'm not a crypto boffin.

Of course what they might do is look at an encrypted volume with plenty of empty space, and torture you for the hidden-volume password they think you might have.  But we're just talking about Americans here, not Nazis.  Clearly to avoid this, structure your hidden volume and bait sensibly.
It takes blood and guts to be this cool but I'm still just a cliché.
OpenStreetMap UK & IRL Streetmap & Topo: ravenfamily.org/andyg/maps updates weekly.

Re: Tinfoil USB stick of glory
« Reply #9 on: May 22, 2008, 12:37:55 am »
If you are really paranoid, then stego a file into a large AVI file, and then have a hidden truecrypt section inside that (as well as the "overt" truecrypt part).  Encrypt the files inside that truecrypt drive as well, using a different encyption algorithm, and you've got something which would be difficult to spot, and even then relatively difficult to decrypt.  Put the data onto something like an SD Card, and physically the media will be pretty small and easier to hide as well.
Actually, it is rocket science.
 

Re: Tinfoil USB stick of glory
« Reply #10 on: May 22, 2008, 10:13:37 am »
The entire wrapper volume is encrypted as one monolitic file, so it is already a large section of high-entropy data.

I'm assuming that they are looking inside the encrypted volume as they're analysing a copy of it and you've divulged the password to the sacrificial encrypted volume.

In an analysis of the remaining free space in that volume I would hope that the area used by the encrypted volume does not stand out compared to the other free space.

I would assume Truecrypt has thought of this, but it's funny how often I've seen encryption thrown into a product with no real thought but just blind faith that "it's encrypted" means "it's safe".

That's why I'd like to see a proper cryptanalysis of the product, and not some FAQ entry saying "Of course it's secure, it uses encryption." (not that I'm accusing truecrypt of this!)
"Yes please" said Squirrel "biscuits are our favourite things."

andygates

  • Peroxide Viking
Re: Tinfoil USB stick of glory
« Reply #11 on: May 22, 2008, 11:40:53 am »
In an analysis of the remaining free space in that volume I would hope that the area used by the encrypted volume does not stand out compared to the other free space.  I would assume Truecrypt has thought of this

Yup.

With the Power of Open Source to mean that disclosure-and-fixing is better than hide-the-vulnerability.
It takes blood and guts to be this cool but I'm still just a cliché.
OpenStreetMap UK & IRL Streetmap & Topo: ravenfamily.org/andyg/maps updates weekly.

Re: Tinfoil USB stick of glory
« Reply #12 on: May 22, 2008, 11:49:41 am »
In an analysis of the remaining free space in that volume I would hope that the area used by the encrypted volume does not stand out compared to the other free space.  I would assume Truecrypt has thought of this

Yup.

With the Power of Open Source to mean that disclosure-and-fixing is better than hide-the-vulnerability.

Even with Open Source and hundreds/thousands of pairs of eyes vulnerabilities and weaknesses can remain undetected for years.

MD5 was created in 1991.
It took 5 years before the first weakness was found, although it was considered minor.
In 2004 serious flaws were found.
In 2007 is was blown wide open.

It's still used all over the place (such as UNIX shadow password files).
"Yes please" said Squirrel "biscuits are our favourite things."

andygates

  • Peroxide Viking
Re: Tinfoil USB stick of glory
« Reply #13 on: May 22, 2008, 12:22:43 pm »
I'm not saying it's perfect, I'm just saying that the mechanism is more trustworthy than a commercial interest who might fear loss of market share or share value or legal action if they disclosed a vuln.  And this is an old tired debate that we don't need to go over again ;)
It takes blood and guts to be this cool but I'm still just a cliché.
OpenStreetMap UK & IRL Streetmap & Topo: ravenfamily.org/andyg/maps updates weekly.

Zipperhead

  • The cyclist formerly known as Big Helga
Re: Tinfoil USB stick of glory
« Reply #14 on: May 22, 2008, 01:00:18 pm »
If you are really paranoid, then stego a file into a large AVI file, and then have a hidden truecrypt section inside that (as well as the "overt" truecrypt part).  Encrypt the files inside that truecrypt drive as well, using a different encyption algorithm, and you've got something which would be difficult to spot, and even then relatively difficult to decrypt.  Put the data onto something like an SD Card, and physically the media will be pretty small and easier to hide as well.

What about, put the encrypted data onto an SD card, then put the card into a camera. My camera doesn't care what else is on the card. Should someone get suspicious, a couple of button pushes will format the card (ok, not low level)
Our son does know who Boz Scaggs is, we've done ok as parents.

Re: Tinfoil USB stick of glory
« Reply #15 on: May 22, 2008, 01:30:34 pm »
What about, put the encrypted data onto an SD card, then put the card into a camera. My camera doesn't care what else is on the card. Should someone get suspicious, a couple of button pushes will format the card (ok, not low level)

If I was a security bod, tasked with this sort of thing, I'd search for and copy all media, using something dumb, so it just took an image of whatever media was inserted.  In fact, this would be a pain, since you would have to copy data off of things like iPods at USB rates, which would take a while.

This pretty much means that they are only going to do this sort of thing in a targeted manner, if they just copied all data off everyone who passed through their system, they would be sat there for hours, copying files off of laptops and iPods.  The data transfer rates, and size of modern memory devices would make copying everyone's data impractical.
Actually, it is rocket science.
 

Charlotte

  • Dissolute libertine
  • Here's to ol' D.H. Lawrence...
    • charlottebarnes.co.uk
Re: Tinfoil USB stick of glory
« Reply #16 on: May 22, 2008, 01:34:04 pm »
So what you're saying is that you should store your (plausibly deniable, encrypted) data on something with slooooooow transfer rates?  Preferably something with a primary purpose which is not bulk data storage?
Commercial, Editorial and PR Photographer - www.charlottebarnes.co.uk

andygates

  • Peroxide Viking
Re: Tinfoil USB stick of glory
« Reply #17 on: May 22, 2008, 03:29:35 pm »
What about, put the encrypted data onto an SD card, then put the card into a camera. My camera doesn't care what else is on the card. Should someone get suspicious, a couple of button pushes will format the card (ok, not low level)

Because that's rather obvious hiding.  There's psychology at work here...

"Here is my stick, here is my password, here is my collection of failboat lols" beats, "Hey buddy, what's this doing on your camera?"

Charlotte, you bad girl, you'd turn up with a zip disk labeled "Seekrit plans"
It takes blood and guts to be this cool but I'm still just a cliché.
OpenStreetMap UK & IRL Streetmap & Topo: ravenfamily.org/andyg/maps updates weekly.

Charlotte

  • Dissolute libertine
  • Here's to ol' D.H. Lawrence...
    • charlottebarnes.co.uk
Re: Tinfoil USB stick of glory
« Reply #18 on: May 22, 2008, 03:34:16 pm »
Charlotte's filez:

1. Seekrit planz for overthrowin ov guvernment an stuff
2. Lolcatz an motivational posterz
3. Bangin choonz
4. Georgian goat grumble

Innit?

Commercial, Editorial and PR Photographer - www.charlottebarnes.co.uk

Re: Tinfoil USB stick of glory
« Reply #19 on: May 22, 2008, 03:43:07 pm »
If you do this, make sure that the version of Linux you put on there is set up for running off CD or USB stick. You need to make sure you don't have swap space on it or very-commonly-written-to log files, as flash memory tends to have a limited number of write cycles. As far as I understand, the number of write cycles you get is much improved nowadays, but you still don't want scratch space on there ;-)

Re: Tinfoil USB stick of glory
« Reply #20 on: May 22, 2008, 03:50:04 pm »
The main issue is going to be suspicion, the moment they find or suspect that they've found an encrypted file, they are going to switch into paranoia mode, and start (i) physically taking your luggage apart (ii) check every bit of electronic media you're carrying.  If you are a business (wo)man and have a plausible excuse, like you were carrying sensitive customer information, then you would probably be OK, but if you're only excuse is trying to hide stuff from them, they are likely to look down on you somewhat.

If you really need access to data like this in an overseas country, then transfer it across an encrypted link using the Internet when you get to your destination.  If you're going to somewhere that doesn't have good Internet links, then carry a VSAT or something in a similar vein (and pay through the nose for charges!)  Carrying encrypted information without a good (to them) excuse is likely to raise the paranoia of customs and similar bods.
Actually, it is rocket science.
 

Re: Tinfoil USB stick of glory
« Reply #21 on: July 18, 2008, 01:42:09 pm »
That's why I'd like to see a proper cryptanalysis of the product, and not some FAQ entry saying "Of course it's secure, it uses encryption." (not that I'm accusing truecrypt of this!)

And as if by magic...

Schneier, Team Hack 'Invisibility Cloak' for Files - Desktop Security News Analysis - Dark Reading

Bruce Scheiner + team show that Truecrypt's "deniability" feature is flawed and there's no guarantee that it's completely fixed in v6.
"Yes please" said Squirrel "biscuits are our favourite things."

andygates

  • Peroxide Viking
Re: Tinfoil USB stick of glory
« Reply #22 on: July 18, 2008, 01:49:39 pm »
You just beat me to it!

Yup, looks like the deniability part is flawed.  Note that the encryption part is still good - but now the bad guys can demand the password with menaces, again.

*pout*

*waits for upgrade*
It takes blood and guts to be this cool but I'm still just a cliché.
OpenStreetMap UK & IRL Streetmap & Topo: ravenfamily.org/andyg/maps updates weekly.

Charlotte

  • Dissolute libertine
  • Here's to ol' D.H. Lawrence...
    • charlottebarnes.co.uk
Re: Tinfoil USB stick of glory
« Reply #23 on: July 18, 2008, 10:40:34 pm »
You just beat me to it!

Yup, looks like the deniability part is flawed.  Note that the encryption part is still good - but now the bad guys can demand the password with menaces, again.

*pout*

*waits for upgrade*

It looks to me (an undeniable numpty) that the issues that the team found may be related to having a DFS on a hard drive, permenantly attached to your PC.  They analyse the PC itself to look to see if it's been going to files on the DFS on your hard drive, right?

Surely - if your DFS is on a USB stick and they don't have the computer that you access it with (for instance, because you only access it from your EeePC that you boot from an SD card and then shut down without saving the settings) then you might be in the clear again...?
Commercial, Editorial and PR Photographer - www.charlottebarnes.co.uk

Re: Tinfoil USB stick of glory
« Reply #24 on: July 18, 2008, 11:10:32 pm »
Surely - if your DFS is on a USB stick and they don't have the computer that you access it with (for instance, because you only access it from your EeePC that you boot from an SD card and then shut down without saving the settings) then you might be in the clear again...?

Part of the deniability plan is to have an area of the USB stick as the hidden platform. That implies a non-hidden partition on the USB stick and it's the fact you can't rely on the Operating System, or any of the applications you use, not to write data that hints at the presence of hidden files/partitions on the non-hidden partition(s).
"Yes please" said Squirrel "biscuits are our favourite things."