Latest in Encryption

Image credit:

TrueCrypt Windows encryption app has critical security flaws

2 Shares
Share
Tweet
Share
Save

Sponsored Links

If you're still using TrueCrypt to protect your Windows disks, even though its developers abandoned it and said it was "not secure" last year, you may want to stop that. Google Project Zero researcher James Forshaw found two "privilege elevation" holes in the popular software that would give attackers full access to your data. Worse yet, TrueCrypt was audited earlier this by a crowdfunded team of iSec security researchers and found to be error-free. Google's James Forshaw said on Twitter that the miss was understandable, though: "iSec phase 1 audit reviewed this specific code but Windows drivers are complex beasts (and) easy to miss."

Forshaw hasn't disclosed the bugs yet, saying he usually waits seven days after a patch is released. He and other researchers agree that the vulnerabilities -- which can reportedly be exploited by "abusive drive letter handling" -- weren't deliberately installed. And they won't, of course, be fixed in the original program's code.

However, if you're using TrueCrypt because "free" is a good price, there are other options --VeraCrypt and CipherShed are open source forks of TrueCrypt, and VeraCrypt has already patched the bugs. Suffice to say, you should stop using TrueCrypt within the seven day window before Forshow releases the exploitable code. Even if you do, however, we likely haven't heard the end of this type of Windows vulnerability. VeraCrypt's Mounir Idrassi gold Threatpost that "These are the kind of vulnerabilities that exist in (lots of) software on Windows," and that will be (and have been) used by hackers for years.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
2 Shares
Share
Tweet
Share
Save

Popular on Engadget

The best mobile devices for students

The best mobile devices for students

View
YouTube pulls hundreds of channels tied to Hong Kong influence campaign

YouTube pulls hundreds of channels tied to Hong Kong influence campaign

View
'Fortnite' finally nerfs the hated B.R.U.T.E. mechs

'Fortnite' finally nerfs the hated B.R.U.T.E. mechs

View
After a year of Epic Games exclusivity, ‘Hades’ heads to Steam Early Access

After a year of Epic Games exclusivity, ‘Hades’ heads to Steam Early Access

View
Porsche streamlines the Taycan EV’s infotainment system

Porsche streamlines the Taycan EV’s infotainment system

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr