Follow Slashdot blog updates by subscribing to our blog RSS feed


Forgot your password?
Encryption Bug Data Storage Open Source Security

VeraCrypt Security Audit Reveals Many Flaws, Some Already Patched ( 75

Orome1 quotes Help Net Security: VeraCrypt, the free, open source disk encryption software based on TrueCrypt, has been audited by experts from cybersecurity company Quarkslab. The researchers found 8 critical, 3 medium, and 15 low-severity vulnerabilities, and some of them have already been addressed in version 1.19 of the software, which was released on the same day as the audit report [which has mitigations for the still-unpatched vulnerabilities].
Anyone want to share their experiences with VeraCrypt? Two Quarkslab engineers spent more than a month on the audit, which was funded (and requested) by the non-profit Open Source Technology Improvement Fund "to evaluate the security of the features brought by VeraCrypt since the publication of the audit results on TrueCrypt 7.1a conducted by the Open Crypto Audit Project." Their report concludes that VeraCrypt's security "is improving which is a good thing for people who want to use a disk encryption software," adding that its main developer "was very positive along the audit, answering all questions, raising issues, discussing findings constructively..."
This discussion has been archived. No new comments can be posted.

VeraCrypt Security Audit Reveals Many Flaws, Some Already Patched

Comments Filter:
  • Social Holes (Score:4, Interesting)

    by Fringe ( 6096 ) on Sunday October 23, 2016 @09:44AM (#53133963)

    VeraCrypt/True were already secure -enough-. Cracking through the holes is usually more effort than local law enforcement, your boss or the local mob will care about. If you're on the radar of worse people, they can toss you in jail or threaten your family. So while I consider better security a good thing when it doesn't increase cost or inconvenience, it's not really an essential move forward.

    The bigger problem is common passwords, leaving the volume open, having open drives automatically backed up to "the cloud", emailing documents... things these security code fixes cannot address. We don't hear often that the Feds have used a security hole to extract data from a user's system.

  • by Anonymous Coward on Sunday October 23, 2016 @09:55AM (#53134001)

    Honest question. Should we be using TrueCrypt 7.1a instead? I, personally, am. We live in scary times, and it is hard to trust any authority. I feel that TrueCrypt 7.1a, the last version prior to the strange shut down of the project, is probably less likely to have backdoors than any of the newer TrueCrypt versions or forks (specifically, VeraCrypt and CipherShed). Can someone convince me otherwise?

    • I would like this answer too, please, someone...
      • by Kjella ( 173770 ) on Sunday October 23, 2016 @11:11AM (#53134269) Homepage

        I would like this answer too, please, someone...

        If you have system encryption enabled (traditional BIOS, no UEFI support) and you have a strong passphrase and you are the only user and you're not worried that anyone can physically tamper with your system boot or rescue disc - in which case they might just as well use a key logger - then there's no critical issues.

        There are several nice to haves that make weak passwords stronger by increasing iterations, close various attacks that other users/processes can do and cleaning up better if you only use containers. The ugliest is probably a privilege escalation attack, malicious software can use the TrueCrypt driver to escalate to admin but if malware is running on your machine you probably have big problems anyway.

        Probably the most interesting part about VeraCrypt is the potential for UEFI boot but apparently there's no way to secure erase the keyboard buffer, all you can do is reset it (which they didn't do, but do now) and hope the driver actually overwrites it. But if you can dump the entire UEFI memory area it might still be there. Hopefully legacy BIOS mode will be around for a while longer, in this case simpler is safer.

    • by Anonymous Coward

      Well, if you read the article you'll notice a long list of vulnerabilities which already existed in truecrypt and have been patched in veracrypt. Regardless of whether they're 'backdoors' or not truecrypt demonstrably has a large number of vulnerabilities that don't exist in veracrypt.

    • by gweihir ( 88907 ) on Sunday October 23, 2016 @10:36AM (#53134117)

      I think so. TrueCrypt 7.1a has, as far as I remember, only local exploits that matter. In the regular scenario (laptop), there is no other user and they do not matter at all. I do not trust the VeraCrypt person.

  • by RoverDaddy ( 869116 ) on Sunday October 23, 2016 @10:19AM (#53134069) Homepage
    I am not a security expert and can't tell you whether Veracrypt is 100% secure, but I've been using it and I'm reasonably convinced that at least nobody short of a 'state actor' is likely to get at my data, and they're not the people I'm securing data from. It's the petty thieves who might steal my backup drives, or somebody who finds a USB stick I accidentally drop on the ground, that I'm protecting myself from.

    I've been to the support forums for Veracrypt and my impression is the developer is trying hard to be transparent and responsive and make the product as secure as possible.
    • This is exactly the problem. Security, especially encryption, is usually so far above people's heads, that there is no possibility of them self-analysis their own risk. You think you are safe using it, but you admit that you have no reasonable reason to think that.

    • by AHuxley ( 892839 )
      The problem is for travellers. Can the chat down at a crossing result in a scan of working hardware show any and all encryption?
      The user is then asked to decrypt.
    • by hodet ( 620484 )

      Sadly this is how I feel as well. Trust is a very complicated and difficult problem to solve. I always say, "At least Goober can't access my family photos". But if a powerful nation state wanted to access my hard drive (I use LUKS for full disk encryption and truecrypt 7.1a for containers) I don't feel so good about that. I lead a pretty straight life anyway, but it bothers me that there is no truly trustworthy solution, even if what we have is ultimately secure. How would you know?

      Now we have one lapt

  • VeraCrypt forces long iteration on shorter passphrases (>70 sec on my laptop, i.e. unusable), regardless of how secure that passphrase actually is. There is no way to switch this off. No response on a complaint. This and some other things lead me to not trust this person. I am back to the last TrueCrypt version that does not have this brain-dead and insulting limitation.

    • VeraCrypt forces long iteration on shorter passphrases (>70 sec on my laptop, i.e. unusable), regardless of how secure that passphrase actually is. There is no way to switch this off. No response on a complaint. This and some other things lead me to not trust this person. I am back to the last TrueCrypt version that does not have this brain-dead and insulting limitation.

      I agree with you completely, and it's the reason I'm still using TrueCrypt.

      Secure high-entropy passwords aside, what the people responding to you don't get it is that the user should be allowed to have a more convenient, but more less secure encryption solution if he chooses. I have a short, low entropy password. I could write software that would crack it and it would complete the work in a day or two. I **know** that, and I don't care. I'm not protecting state secrets with it. I'm not worried the NSA

      • by gweihir ( 88907 )

        Indeed. Advising the user is perfectly fine, but _forcing_ the user to some perceived security level (and doing it badly) is not acceptable and indicates a systematic problem on the side of the designer. And where there is one such systematic problem, there is a pretty good chance of more.

  • I'm a long time Truecrypt user who recently tried Veracrypt. It's okay, some nice new features, but as this shows the devs don't seem to be security experts or even skilled at writing secure code.

    It's also a little less stable than Truecrypt. I've had some system lockups that don't happen in Truecrypt with SSDs.

    • Re: (Score:3, Insightful)

      by ledow ( 319597 )

      I'd be MUCH more worried if said audit produced nothing at all.

      The fact that the flaws are mostly in the new bootloader code - new, untested, complicated - is EXACTLY right. You don't need to use that bootloader, and TrueCrypt NEVER had that kind of bootloader (so the choice is nothing or VeraCrypt in that instance).

      There is nothing to suggest that the people behind TrueCrypt were any better - their audit turned up stuff too, and that was YEARS and YEARS after their first releases. VeraCrypt code hasn't h

  • by ffkom ( 3519199 ) on Sunday October 23, 2016 @12:21PM (#53134555)
    Veracrypt may provide decent cryptographic functionality, but given that its main audience is Windows and Mac users, the two huge security holes they cannot fix are called "MicroSoft" and "Apple". You can make Veracrypt as secure and error-free as you want, as long as it has to expose the decrypted data to some commercial, closed-source operating system that phones home like crazy to provide its manufacturer with valuable data, there is no actual security. Not to mention the backdoors builtin for certain 3-letter-agencies.
  • air max Pas Cher [] Mais ça c’était avant. Avant que la crise de 2008 ne conduise ces mêmes constructeurs au bord de la faillite. Avant que le smartphone ne remplace la voiture dans le cur des jeunes générations. Avant que la sortie de la Tesla Model S démontre que l’on pouvait produire en moins de 10 ans non pas la meilleure voiture électrique, mais la meilleure voiture du monde tout court. Avant le développement exponentiel de start-up comme Uber, Lyft ou

God helps them that themselves. -- Benjamin Franklin, "Poor Richard's Almanac"