Categories
security

TrueCrypt

The fate of TrueCrypt hangs in the balance, now that the main site has been shut down and redirects to its SourceForge page, which displays the following ominous notice.

WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues

Many conspiracy theories abound for the reasons behind the abrupt ending of the popular project. Among them:

  • the site has been hacked, and the signing key stolen
  • the secret authors are under duress, and this is a warrant canary
  • it’s a form of Dead-man’s-switch
  • the authors are plain tired of the project after 10 years and want out
  • the authors are disheartened about the crowdfunded effort to pick apart their work

TrueCrypt was started in 2004 to fulfill a basic but critical need for secure storage of on-disk files. Why use encrypted containers when you could have used encrypted zip files? Well, for one, you will have to remember to keep unzipping and zipping up files whereas TrueCrypt was designed to make all that transparent by mounting the encrypted contents as another drive. That makes it easy to work with and inter-operate with practically any application.

TrueCrypt is certainly not the only encryption solution, though many of them are platform-specific, do not integrate as nicely into the OS, isn’t as feature-rich, or are just plain proprietary. The problem with proprietary solutions is that you never know just what went into the encryption, whether there are deliberate or undiscovered vulnerabilities or weaknesses in the algorithm used for encryption etc. This is especially important with the recent disclosure on NSA’s effort to weaken encryption.

There has been competing open-source solutions such as PGPDisk, FreeOFTE, and so on, but none of them are as polished and feature complete as TrueCrypt. For many users who require an easy to use encryption solution, TrueCrypt is a no-brainer over other existing non-paid choices.

Another plus point of TrueCrypt is that it works on multiple platforms. That makes it convenient as you could store an encrypted volume in say Dropbox, and be able to work on the files on your Mac OS, Windows or Linux.

Although TrueCrypt is open-source, there are worries that its binaries may be tampered with – that is, it is not compiled result of its published source. The secret identity of its creators does nothing to relieve this concern. Some even speculate that it may be a FBI honeypot. This point has always been a pain point of its users and especially critics. One particularly staunch critic even started a crowd-funding effort to audit the source code to discover if there are unintended or deliberate security loopholes. A recent effort to match the source against its binaries helped to alleviate some fears, though it will still require a full audit to know if there are loopholes in the software.

For now, before the dust settles, existing users of TrueCrypt might want to start looking at alternative solutions for their encryption needs.

Categories
security

Hackers raid eBay in historic breach, access 145 million records | Reuters

Hackers raid eBay in historic breach, access 145 million records | Reuters.

Categories
sysadmin

Migrating a failing hard disk

hard-disk-failure

It happened. Or should I say, almost happened.

As we all know, the hard disk (mechanical ones, that is) is the component that has the highest chance of failure in any computer system. One day I was doing a routine backup of my notebook. My backup solution is rather simple, consisting of no more than rsync. I had left it running a full backup in the background before I went out, expecting it to complete before I return, since only differences are copied. To my surprise when I returned, it was still running and my notebook felt very hot. Much hotter than usual, and that says something, as my notebook reaches uncomfortably heaty temperature after long usage. I blame it on the GPU/hard disk. The copying appears to be stuck at 76% on a particular large file. After terminating it and manually copying the file to my backup hard disk, it remained stuck at 76%. First sign that something is wrong. To be sure that it wasn’t my backup hard disk that’s having problem, I made a copy of the file on the same drive. Yup same thing happened. I immediately stopped any attempts to access the file to avoid aggravating the problem. Conventional wisdom in hard disk recovery says that when a hard disk is showing signs of failure, do not access the “bad” parts ‘cos it could cause the problem to get worse.

A hard disk replacement is imminent, which is not a big deal. Except that it could mean reinstalling everything from scratch. Or not. I’m really not looking forward to spending days fighting with a new OS. So cloning the existing hard disk is my plan.

Step 1: research

Before doing anything that could lead to further data loss, it is always good to read up. My concerns were 1) data integrity 2) preservation of Windows license. As the Windows license that came with the notebook is an OEM license, I wasn’t sure if it could survive the cloning process – with a retail Windows license you could activate on up to X times I think. The recommended way to backup a Windows machine is to use Windows System Image Backup. Unfortunately it can’t be used in my case. My second idea was to use dd. However I’m aware that dd could run into trouble with reading bad parts. Finally I decided on ddrescue, as it appears to be addressing what I need from dd, but with more features targetted towards hard disk recovery.

Step 2: execute

I got a larger hard disk as recommended by most articles. I also needed a way to attach the new hard disk to my notebook. Here’s where my trusty SATA to USB adapter comes in handy. For the benefit of others who may want to do the same, the steps are:

IMG_0207

  • download Knoppix Linux ISO
  • burn to CD, or if you’re lazy like me, create a bootable USB thumbdrive with it using Rufus
  • boot up to Knoppix
  • select shell
  • lsusb to see what USB devices are attached
  • insert SATA to USB adapter
  • lsusb to see what’s added
  • dmesg to see the newly added device. note the new device name
  • (assuming old hard disk is /dev/sda and new hard disk is /dev/sdc) take a deep breath and type:
    ddrescue -f -n /dev/sda /dev/sdc /root/rescue.log
  • if there are no errors, hurray! you can stop here. Otherwise, type:
    ddrescue -d -f -r3 /dev/sda /dev/sdc /root/rescue.log

In my case there was 1 x 8192 bytes of error after the first command. After running the second command, it was reduced to 1024 bytes. Ok, it wasn’t as bad as I thought 🙂

Step 3: verify

  • Unscrew the hard disk compartment and replace the old hard disk with the new one. Replace cover.
  • Boot up.

At this point, if it works it should be pretty obvious. I’m glad to report that everything works as planned. wmic diskdrive shows the new hard disk details. Oh, and Windows didn’t complain. An unexpected good news is after the upgrade, things are speedier and my notebook doesn’t feel as hot as before. Hurray! 😀

Categories
programming

WinJS landing page Windows dev center

JavaScript is winning the race.

WinJS landing page Windows dev center.

Categories
security

NSA Has Been Hijacking the Botnets of Other Hackers | Threat Level | WIRED

NSA Has Been Hijacking the Botnets of Other Hackers | Threat Level | WIRED.

Plausible deniability, plus why not take advantage of someone else’s work? 🙂

Categories
programming

“Easter egg” on Mozilla Developer website

Not sure if it qualifies as an easter egg, but visiting Mozilla developer website like this with your console open and you’ll get the following message:

             _.-~-.
           7''  Q..\
        _7         (_
      _7  _/    _q.  /
    _7 . ___  /VVvv-'_                                            .
   7/ / /~- \_\\      '-._     .-'                      /       //
  ./ ( /-~-/||'=.__  '::. '-~'' {             ___   /  //     ./{
 V   V-~-~| ||   __''_   ':::.   ''~-~.___.-'' _/  // / {_   /  {  /
  VV/-~-~-|/ \ .'__'. '.    '::                     _ _ _        ''.
  / /~~~~||VVV/ /  \ )  \        _ __ ___   ___ ___(_) | | __ _   .::'
 / (~-~-~\\.-' /    \'   \::::. | '_ ` _ \ / _ \_  / | | |/ _` | :::'
/..\    /..\__/      '     '::: | | | | | | (_) / /| | | | (_| | ::'
vVVv    vVVv                 ': |_| |_| |_|\___/___|_|_|_|\__,_| ''

Hi there, nice to meet you!

Interested in having a direct impact on hundreds of millions of users? Join
Mozilla, and become part of a global community that’s helping to build a
brighter future for the Web.

Visit https://careers.mozilla.org to learn about our current job openings.
Visit https://www.mozilla.org/contribute for more ways to get involved and
help support Mozilla.

Nice.

Categories
security

Research shows how MacBook Webcams can spy on their users without warning

Another spying using webcam article. That’s why it’s always a good practice to place a sticky note in front of your webcam and only remove it when you need to.

Research shows how MacBook Webcams can spy on their users without warning.

Categories
security

Acoustic cryptanalysis

Seems almost too bizarre to be real, but it’s real.

Acoustic cryptanalysis.

Categories
security

Meet “badBIOS,” the mysterious Mac and PC malware that jumps airgaps | Ars Technica

Meet “badBIOS,” the mysterious Mac and PC malware that jumps airgaps | Ars Technica.

Let’s see:

  • multi-staged payload
  • airgap infection mechanism
  • targets multiple OSes
  • no one knows how it works yet

This is serious stuff. Fascinating. Let’s see if this is another state-sponsored Stuxnet-like malware.

Categories
3D

A Brief History of COLLADA


Some of you might know that COLLADA was not supposed to be used as an end-format in itself (like say OBJ) but more as a interchange format. To quote Wikipedia,

COLLADA was originally intended as an intermediate format for transporting data from one digital content creation (DCC) tool to another application.

It was meant to solve the difficulty of using digital assets across different tools. For example, if I scanned a 3D point cloud and processed it in Geomagic, I want to be able to use the result in say, 3DS Max for further work. 3DS Max obviously cannot open Geomagic files, so most of the time, the DCC artist have to figure out the intermediate format that’s supported by both software, and use that as a mid-point to bridge the gap. That is, instead of A->B, you go through an intermediary X, via A->X->B.

While it sounds logical, it usually doesn’t work in practice. First of all, 3D formats are not like image formats, which are fairly standard except for headers, compression etc. You can get pretty good results in image format conversions. Even though you might get some loss in image quality, the result is usually fairly acceptable.

Once you go into 3D, lo and behold, the problem size explodes. There are many types of mathematical models for 3D representation – polygonal, point cloud, parametric, volumetric, etc. Even within one representation you have tons of parameters. Each software chooses how it wants to use and interprets those parameters, and it varies widely from software to software. The result is that moving digital assets across software is a pain. In fact companies exist to sooth those pain (Right Hemisphere, Okino).

Sony Computer Entertainment, being a game company, must have faced a lot of such issues. The solution it created was COLLADA, to fill the missing X that plagues the industry. In 2004, it generously donated COLLADA to the community. The competing format back in the days was X3D, the successor to VRML. X3D was mainly driven by the academia, and did not have the kind of backing COLLADA has. It happens that Google Earth was looking to introduce support for 3D models around that time. Previously, it could only support imagery and terrain data. By a stroke of luck COLLADA was adopted as the native 3D format – even though it’s actually an interchange format. SketchUp soon followed, in a somewhat clever move – it was acquired by Google shortly after. By then, Autodesk and the rest of the big boys were on-board and the rest, as they say, is history.