Slashdot Log In
Undocumented Bypass in PGP Whole Disk Encryption
Posted by
Zonk
on Thu Oct 04, 2007 12:06 PM
from the seems-to-defeat-the-purpose dept.
from the seems-to-defeat-the-purpose dept.
A non-mouse Coward writes "PGP Corporation's widely adopted Whole Disk Encryption product apparently has an encryption bypass feature that allows an encrypted drive to be accessed without the boot-up passphrase challenge dialog, leaving data in a vulnerable state if the drive is stolen when the bypass feature is enabled. The feature is also apparently not in the documentation that ships with the PGP product, nor the publicly available documentation on their website, but only mentioned briefly in the customer knowledge base. Jon Callas, CTO and CSO of PGP Corp., responded that this feature was required by unnamed customers and that competing products have similar functionality."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
unnamed customers (Score:5, Funny)
And People Wonder Why Open Source! (Score:4, Insightful)
I know what I have, and what I get, and what others cannot get... Not that I have anything to hide. Just that I like my privacy.
Parent
Re: (Score:3, Interesting)
For now anyway.
If people complete various "hard" problems on quantum computers then the non-people at the NSA can probably afford to throw two billion (or whatever) at it to crack ALL MODERN ENCRYPTION that doesn't use quantum devices for keys.
Re: (Score:3, Interesting)
Ah, but that's not necessarily a defence against the NSA! Their backdoors might not be hidden in closed source binaries, or in obfuscated source code, or in your CPU hardware, or even injected covertly by your copy of GCC when it recognises encryption code. They might be mathematical backdoors, hidden inside well-known ciphers that are generally thought to be secure. There's the old st
Re: (Score:3, Insightful)
http://en.wikipedia.org/w/index.php?title=Data_Encryption_Standard&oldid=161828931 [wikipedia.org], so the Wiki article is versioned.
I guess it all depends upon whether you think factoring large numbers is a hard problem, whether special cases might exist, whether huge amounts of investment dollars matter, etc. From there you make your own call about whether or not to go all elliptical (another
Re: (Score:3, Insightful)
Will be made illegal very soon :(
Re:unnamed customers (Score:5, Insightful)
Parent
Re: (Score:3, Interesting)
Random Example Bank or Retail would want this (Score:3, Insightful)
If you RTFA, you'll see that it's a feature that you can only turn on if you've already got access to the disk, and PGP did it so it only works once.
Huh? (Score:3, Insightful)
"encryption bypass" ?
That basically turns the entire thing into a physiological magic trick.
Re: (Score:3, Funny)
The only people to enable would know about it (Score:3, Insightful)
Did anyone read the response? (Score:5, Interesting)
Why does crap like this make it to the front page of Slashdot?
Re: (Score:3, Insightful)
I see what is possibly another. I may enable a hole of this form:
If someone gets access to the disk or its contents before the reboot, they can clone the state of the encryption software - which will do one "unlocked" reboot. Later (up to a point where the encryption key is changed) they can shut down the machine, reapply this state, and bring it up without the password, gaining access to data that has been ad
Re:Did anyone read the response? (Score:5, Informative)
They need to do unattended automated reboots of thousands of computers. These are enterprise customers.
They have the encryption key, and they want to apply security updates and reboot the computers. When the employees come to work in the morning, they expect the computers to be on and operational, as they left it.
If you don't use the feature, then it poses no risk. If you need to apply unattended updates to computers on a large scale, going to each computer and typing in the passphrase is not practical.
This is a non-issue, and a FUD article. You need to have UNLOCKED access to the encrypted volume to enable this feature.
Normal users using PGPDisk and not using this feature are at no greater risk for it existing.
Parent
Re: (Score:3, Funny)
Re:Did anyone read the response? (Score:4, Informative)
Parent
Re: (Score:3, Insightful)
Because a backdoor can just as easily be slipped into open source software, if not more easily since everyone's assuming "Oh it's open, someone else is looking for backdoors." On top of that, when things go south there's no one to point the finger at and no one to go to for support.
Look at all the security flaws that have popped up in Firefox over the past two years that co
to put out some of the flames (Score:5, Insightful)
"We call it a passphrase bypass because that is what it is. It is a dangerous, but needed feature. If you run a business where you remotely manage computers, you need to remotely reboot them."
and
"You cannot enable the feature without cryptographic access to the volume. If you do not have it enabled, you are not affected, either. I think this is an important thing to remember. Anyone who can enable the feature can mount the volume. It is a feature for manageability, and that's often as important as security, because without manageability, you can't use a security feature."
makes pretty good sense to me
Re:to put out some of the flames (Score:5, Interesting)
Parent
Re:to put out some of the flames (Score:5, Insightful)
Yes, it is a nice(TM) feature and might be useful, but that is not the problem.
The problem is that the feature is fricking undocumented. There is absolutely no way to know it is there and how to look out for it. It also means that you can't just know how many of these backdoors are in there. Is it only the first undocumented backdoor ? How many more of the convenience features are in there by customer demand ? How do they affect me ?
When it comes to security software or hardware any and all undocumented features are BUGS! It's a principle, not a convenience!
Parent
Re: (Score:3, Insightful)
Heh (Score:3, Funny)
Re: (Score:3, Funny)
Many products allow disabling preboot auth (Score:5, Informative)
The software has a feature called "Pre-boot Authentication", by which the encryption software is loaded after the bios, but before the (generally Windows) operating system. The user's password is used to generate the decryption key, so theorhetically not even the NSA could decrypt the laptop without the user's password.
Here's the flaw - the software has a checkbox to disable Pre-boot authentication. What this does is generate a default user with a random password, and then store this random password obfuscated but in clear-text in the same disk area decryption software. When you talk to the sales-people, they sell this as a feature, in fact about half of Utimaco's customers (so I'm told) run it in this mode because the encryption becomes transparent and it is much less intrusive on the user. (Basically the disk is automatically decrypted each time the laptop is booted, but you have to have a valid Windows login to get in.) Buried in the help documentation are warnings "For security reasons, you should Never disable pre-boot authentication". So the engineers and the company know the weakness of disabling pre-boot authentication, but they don't tell their customers when they sell the software.
Today it seems to break into these laptops with pre-boot authentication disabled you would need somewhat sophisticated tools and techniques, basically the same tools and techniques people commonly use to "crack" commercial software today. But I'm guessing that it won't be very long before someone takes the time to build this crack and releases it, rendering the laptop encryption useless to anyone who can Google for "Utimaco Crack", etc. Basically all the crack would need to do is grab the default user's password off the disk and use or duplicate the decryption algorithms that are also in clear-text on the disk.
I've talked to a number of IT security folks, and basically it seems like most people trust the sales folks and don't understand that its basically impossible to have strong encryption without having the decryption key stored off the disk (like on a smart card, or in the brain of the user.)
Re:Many products allow disabling preboot auth (Score:4, Informative)
The problem is a company may have thousands of laptops in the wild and Active Directory passwords that expire every 90 days. Because the PBA credentials aren't integrated with AD that means you have a nightmare password management situation. Utimaco does provide a server to try to alleviate this problem, but it's still a major management pain.
It's true that by default the PBA bypass key gets stored obfuscated but in plain text on the hard drive if you bypass PBA. But if you have a modern computer with a trusted platform module (TPM) you can configure SafeGuard Easy to store the key there. You can also bind the hard drive to that particular TPM chip so that it is unaccessible if attached to another computer.
http://americas.utimaco.com/safeguard_easy/manual_v430/1-245.html [utimaco.com]
Parent
Which full disk encryption to use? (Score:3, Interesting)
unnamed customers??? (Score:3, Insightful)
1. if i have a real (paying) customer who needs this, i will supply them (and only them) with a customised version.
2. or i fully document the feature.
Re:PGP or not so PGP? (Score:5, Informative)
Parent
Jon *did* call it "dangerous" (Score:3, Insightful)
Re:Fine by me.. (Score:5, Informative)
This actually DOES sound like a very good feature and I would hope other products have it, too. Wish the editors would RTFA, too...
Parent
Re:Fine by me.. (Score:4, Insightful)
Parent
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
Sheesh.
Re: (Score:3, Insightful)
You forgot the part where you descend form the ceiling suspended by a wire harness and hang upside down while typing into the console.
With that degree of access, there are a million things you could do t
Re:Fine by me.. (Score:4, Insightful)
They also just lost credibility.
Oh, I don't know. From the start, all the promised was Pretty Good Privacy. Not like Fort Knox, more like a combination padlock on an open-backed locker.
I find myself wishing more and more that Phil Zimmerman hadn't sold to NAI.
Does GPG have a full-disk mode? I think I could trust something with open source and reliable software freedom.
Parent
There was GPGDisk (Score:5, Interesting)
There is/was a program around that used GPG to do FDE, called GPGDisk. I'm not sure whether it used your installed copy of GPG to do the heavy lifting, or if it just included the same code, or worked using the same algorithms but had its own totally separate crypto engine. It was reasonably popular for a while, but I think a lot of people who were using it have now switched to TrueCrypt.
However, GPGDisk did offer some unique features, like the ability to encrypt a disk using a GPG key, and some fairly fine-grained access controls that you could set up for multiple users (IIRC). Every once in a while someone will mention it on the comments on Bruce Schneier's blog, so apparently it's still getting some use. But it doesn't offer some of the neater features that TrueCrypt does, like plausible deniability or containers-in-containers, I don't believe.
Parent
Re:Fine by me.. (Score:4, Interesting)
Parent
"Unnamed Customers" (Score:4, Interesting)
How much do you want to bet that "unnamed customers" are synonymous with "various federal and state police agencies, DOD, and NSA"?
Takers?
Parent
Re:"Unnamed Customers" (Score:5, Informative)
From TFA, those "unnamed customers" are companies that have the need to remotely reboot their machines. This feature is NOT a backdoor - it merely allows someone WHO ALREADY HAS WRITE ACCESS TO THE ENCRYPED DRIVE (i.e. someone who has already given the passphrase) to grant a one-time certificate that permits a reboot without asking for the passphrase again. The major risk here is that someone will rob your store during the 60 seconds it takes to reboot over the phone, a possible, but highly unlikely scenario.
Parent
Re:Fine by me.. (Score:5, Insightful)
However, the feature isn't enabled by default. It requires cryptographic access *and* knowledge of its existence to turn it on. And if you already have cryptographic access, then the whole issue is academic.
You pompously declaring it "DISHONEST" in capital letters smacks of the typical random-geek's kneejerk first post on a messageboard thread. And FWIW, I don't know how much your oh-so-important business with them is worth anyway; I suspect that the other client probably *was* worth more. (Of course, it's quite plausible that the views of *many* smaller clients who disliked the feature would be a serious counterweight. However, if you're going to act like your *individual* view carries so much weight, expect scepticism).
Parent
Re: (Score:3, Informative)
Re:Why is he modded down? (Score:5, Informative)
There isn't a backdoor. If you encrypt your hard drive, then lose it, nobody can read it.
If on the other hand, if you've encrypted your boot disk, and you want to remotely reboot your machine, you're going to need someway to feed the password to it before it can bring up the OS (and the networking layer).
This feature allows you to store a password for 1 time use. Then you reboot the machine, and when it comes up, it reads the password and erases it.
It's a useful feature. Doesn't effect you if you don't use it. Even if you do use it, you'd have to set the password then forget to reboot for it to be a problem.
Basically this whole story is a non-issue. The moderation on the grandparent is a reflection of his failure to reason through this.
Parent
Re: (Score:3, Insightful)
I keep hearing that the 2nd amendment would help in this situation but I haven't noticed any militias storming the local branch of
Why is it necessary to have two passwords? (Score:3)
The only reasons I can imagine for having two passwords are convenience for IT, when they aren't fully automated, and secret government surveillance.
An organization with 1,000 users must manage 1,000 passwords, anyway.
What happens in an organization when a member of the IT staff leaves? The IT access special passwo
PGP Does Open Source for Peer Review (Score:4, Insightful)
Parent
Re: (Score:3, Informative)
Re:closed source encryption software??!! (Score:5, Informative)
Parent
Re: (Score:3, Insightful)
This is not uncommon, though the lack of documentation is.... Most such encryption products offer the ability to specify a master encryption key across an organization. The way that works is that your individual crypto key protects a copy of the drive-specific crypto key, which then protects the drive. The company you work for has a master crypto key which is also used to encrypt the drive-specific crypto key. (Usually the latter part is done with PK crypto so the employee can only encrypt contents with
This is how it works (Score:3, Informative)
Here's a scenario:
1) Install PGP and encrypt the drive.
2) Reboot
3) Turn on the bypass for the next reboot
4) Shutdown
5) Remove the drive and stick it (or copy of the drive) in another computer as a secondary drive
6) Try to access the drive
From your posts, it appears you think you'll see all the files. The simple fact is that you