Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Encrypted hard drives may not be safe

Researchers find that encryption is not all it claims to be.

Article comments

PC users employing encryption software to keep part of a computer's hard drive private, may not be as safe as they think, according to researchers at the University of Washington and BT.

They've discovered that popular programs like Word and Google Desktop store data on unencrypted sections of a computer's hard drive - even when the programs are working with encrypted files. "Information is spilling out from the encrypted region into the unencrypted region" said Tadayoshi Kohno, an assistant professor at the University of Washington in Seattle who co-wrote the study.

He believes that there are probably many other applications and operating system components that leak out information in a similar way. "I suspect that this is a potentially huge issue. We've basically cracked the surface," he said.

The researchers say that people who are using full-disk encryption, where every piece of data on their hard drive is encrypted, do not have to worry. However the issue pops up when users create an encrypted partition or virtual disk on their hard drives, leaving part of the drives unencrypted, or even when they store data on encrypted USB devices, Kohno said.

Nobody really knows how much data can be recovered from a partially encrypted disk, but the researchers say that they were able to recover copies of most of the Word documents created for their experiment from the software's auto-recovery folder, even though the documents themselves were being saved to an encrypted part of the disk. "We just don't know how much data is leaking out but it's enough to be worried about," Kohno said.

With Google Desktop, the researchers were able to read snapshots of encrypted files when the program's Enhanced Search option was enabled.

The issue is not a bug in Word or Google Desktop, Kohno said. Rather, it's "a problem with the way these applications interact with these encrypted virtual disks," he said.

Kohno and his team, which includes noted cryptographer Bruce Schneier, made their discovery while looking at so-called deniable file systems. These are encrypted file systems require two passwords before they reveal their full contents. They give the user a way to reveal a first encryption password without necessarily divulging the full contents of the hard drive because a second hidden section is protected by the second password.

Looking at the TrueCrypt 5.1a deniable file system, they found that this same kind of data leakage occurred, exposing information that should have been protected by the system's second password. The researchers say that the most recent TrueCrypt 6.0 software does fix some of these problems, but that their work shows just how hard it is to protect a partially encrypted hard drive.

Their paper is set to be presented at the Usenix HotSec Workshop, 29 July in San Jose, California.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *