Encryption software VeraCrypt audit reports published, discovered multiple high risk vulnerabilities attached report download-vulnerability warning-the black bar safety net

! [](/Article/UploadPic/2016-10/2 0 1 6 1 0 2 2 1 6 3 0 9 7 1 6. jpg? www. myhack58. com)
In DuckDuckGo and VikingVPN funded by QuarksLab recent open-source encryption software VeraCrypt conducted a security audit. The audit found that the 8 high-risk vulnerabilities, and 1 0 more in the lower level of vulnerability.
About VeraCrypt
VeraCrypt is a very popular disk encryption software based on TrueCrypt 7.1 a development in 2 0 1 4 year of TrueCrypt abruptly shut down only after the start of this project, so you can think of it as a TrueCrypt branch. In TrueCrypt deactivated after the VeraCrypt took the TrueCrypt 钢枪, quickly became a very popular encryption software. Its developer is France’s Mounir Idrassi, is now by IDRIX team in charge of maintenance, compared to TrueCrypt, the VeraCryp in riot force crack aspect attainments much deeper.
VeraCrypt has a very large user base, journalists, security practitioners, as well as many other users, they are VeraCrypt loyal fans. It is because of the number of users is huge in itself there are also some vulnerability, the OSTIF, an open-source technology improvement Fund had agreed to an independent audit of VeraCrypt, and in year 8 months hire the QuarksLab researchers leading this audit.
Found several high-risk vulnerabilities
This security audit of the source code from the VeraCrypt 1.18 version and VeraCrypt DCS EFI Bootloader 1.18 version, the focus in the last review, this app introduces new features. In addition the Safety Audit only for windows version, OS X and Linux is not in the audit scope. In addition, the use of the SHA-2 value:
1.VeraCrypt_1.18_Source.zip :
12c1438a9d2467dcfa9fa1440c3e4f9bd5e886a038231d7931aa2117fef3a5c5
2.VeraCrypt-DCS-EFI-LGPL_1.18_Source.zip :
2e8655b3b14ee427320891c08cc7f52239378ee650eb28bad9531371e7c64ae3
This audit involved all aspects, both to be familiar with theoperating system, the Windows kernel, the system starts a chain, but also to the Cryptography with the solution. In short, is to participate in the quality of personnel requirements are very high. Security experts on VeraCrypt platform 1. 1 version 8 and UEFI 1.18 version a month after the analysis, concludes an up to 4 Page 2 of audit report for the download link see below at the end of.
In VeraCrypt1. 8 version, UEFI support is the most important function of this part of the code is stored in a named VeraCrypt-DCS alone in the library. But with the other features compared to, due to some features lacking, this feature still seems not Mature enough.
The researchers found that hackers can be in UEFI mode to easily get to start the password-when the user changes the password, VeraCrypt is not correctly erased.
the bootloader process of the data generally will not be erased. In General, the start time of the user’s password will be correctly cleared. But when the user modifies the password contains the new password in the password configuration will not be erased. In fact, TrueCrypt and VeraCrypt developer has to carefully check the memory whether the data is correctly cleared. But DCS module apparently has not been incorporated into the scope of the inspection.
In addition, there are some high-risk vulnerabilities can also be checked out. The remaining high-risk vulnerabilities and GOST 2 8 1 4 7-8 9 symmetric block cipher implementation process related.
! [](/Article/UploadPic/2016-10/2 0 1 6 1 0 2 2 1 6 3 0 9 7 5 6. pngl)
! [](/Article/UploadPic/2016-10/2 0 1 6 1 0 2 2 1 6 3 0 9 7 2 6. png)
! [](/Article/UploadPic/2016-10/2 0 1 6 1 0 2 2 1 6 3 0 1 0 4 2 0. png)
! [](/Article/UploadPic/2016-10/2 0 1 6 1 0 2 2 1 6 3 0 1 0 4 7 7. png)
! [](/Article/UploadPic/2016-10/2 0 1 6 1 0 2 2 1 6 3 0 1 0 6 5 6. png)
In VeraCrypt Release 1. 1 9 version, fix report disclosure of the portion of the vulnerabilities, and some vulnerabilities because of their complexity has not been repaired. Has been fixed vulnerabilities include: VeraCrypt using the old version of the zlib library, the 1.19 version to remove the old version with the new version to replace; removing the GOST 2 8 1 4 7-8 9 encryption option, because its implementation is unsafe; fix the plurality of UEFI support issues.
It is worth mentioning that, James Forshaw in a TrueCrypt drive in the discovery of a vulnerability is to fix, the vulnerability can be achieved provided the right to, and in the OCAP audit report and did not refer to the vulnerability. The need for a large number of modifications to the code or architecture of vulnerability, VeraCrypt does not yet have a fix. Includes:
TC_IOCTL_OPEN_TEST, multiple issues
EncryptDataUnits() lacks error handling
AES implementation susceptible to cache-timing attacks
In addition, related to the cryptographic mechanisms of the associated vulnerability is not repair, comprising:
Keyfile mixing is not cryptographically sound
Unauthenticated ciphertext in volume headers
Without a doubt, this type of audit not only for the user security is very important, but also speed up the bug finding and fixing process. Now we are more concerned about is that other bug when it can repair?