Re: external drive help

From: Mike (kapaqs_at_hotmail.com)
Date: 10/13/04 

Date: Wed, 13 Oct 2004 02:54:14 GMT

Yes your right on all the things you said no data is really secure true,
and yes I am using crypt software now. But to demand all users to use it
is difficult with all the different skill levels of their abilities.
Typical case: boss takes work home sensitive material on it first place
not a good move but does happen! Hard drive gets stolen and recovered
but the thief's were able to just right click on the data and blew it
away thinking they just wanted to use the drive, forget about formatting
it really, it is just that easy. Where as in an internal drive you can
at least make it a little harder for the average Joe blow with the
permissions available on nt. This is the point I am trying to get at.
The problem with crypt software as well is the big guy encrypts his
machine then forgets his passwords, like I have 20 yrs to wait...lol I
mean the basic knowledge for most people isn't there and to try
explaining why they shouldn't take this information on portable drives
just don't sink in, normal response is hey that's what they are made
for! So it brings me back to the original point, I have yet see a
program that will allow you to set permissions for files or folders that
works when the drive is removed from the host. But I have been looking
at SECURE IT from Cypherix Encryption Software inc. is anyone familiar
with it or heard of it? Yes it is encryption, but I heard it was the
easiest to use, true?

"xmp" <xmp@example.com> wrote in message
news:_k0bd.2671$gy1.1484@newsread1.news.pas.earthlink.net:
> Walter Roberson wrote:
>
> >If you want to block the possibility of someone deleting files, then
> > you have to pretty much use "write once" media (especially one that
> > has some kind of fixative to prevent further writes -- something
> > like CR-R is usually considered write-once, but once you've burned
> > a particular pattern of pits, there's always the possibility of going
> > back and burning -more- pits in the same area, thus replacing the
> > data either with different data or with error conditions that
> > block access to the original data.)
>
> Yeah good point. For encryption only you could write a gpg script or
> use something like Bestcrypt. I have not used Best, but it uses some
> sort of container file. Then google "hacking whatever program" you use.
>
> That way you know that there is no way to easily break it's crypto
> scheme. Diamond CS makes some crypto software, but the passphrase is
> only 20 chars, which means you need to use a random sequence for the
> passphrase or the entropy is too low. Norton years ago, had a
> lackluster program, that only used alphanumeric lowercase for keyspace.
> Things like that suck, basically.
>
> So beware of overrated crypto programs. You also need to wipe the RAM
> and empty HD space after each time it's unloaded. THC has some articles
>
> on this. Basically there are numerous fingerprints left.
>
> Basically REAL encryption is not a kid's game, and you need an expert at
>
> implementation and design, and moreover CORRECT application of the
> fundamental ciphers. Most software engineers wouldn't know a real
> cipher if it smacked them upside the head.
>
> Also using a more obscure cipher, means John the Ripper, et al, don't
> have plugins. Assuming several million attempts per second at your
> passphrase when calculating real security.
>
> Anyway, there are programs like PrivateExe that encrypt and bind
> themselves to executables. This means that without the passphrase, you
> generally can't even run the executable. This is handy for passphrasing
>
> simple stuff on Windows ME and other OS with lackluster security. You
> can even encrypt stuff on linux with Burneye, Shiva, etc.
>
> Anyway if you want decent security, read the papers put out by THC. It
> explains hard drive and memory wiping, which are a minimum if you want
> to get into real hacking. I won't claim to be an expert, but I know
> good shit when I see it.
>
> And the old tricks of using random sequences to overwrite 3 times are
> bullcrap written by people who misconstrued the DOD guidelines, and have
>
> a woeful misunderstanding of virtual memory and modern filesystems.
>
> michael

Relevant Pages

  • Re: any usb flash-drive with write-protect and zeroize?
    ... >> Windows will NOT boot from USB. ... >internal disk drives in the main machine. ... and the encryption is enabled by information on the ... is actually a "control language" Sending passphrase "A" to the ...
    (sci.crypt)
  • Re: On the Recent PGP and Truecrypt Posting
    ... changing the passphrase would lock out prior users. ... Clearly a users with a backup copy of an encrypted disk for which they ... clear that real world users actually understand the need to re-encrypt ... You will also also see the architecture extend to some *very* cool storage encryption very soon. ...
    (Bugtraq)
  • Re: external drive help
    ... | problem around with all the thumb drives and external drives available ... You can use encryption ... |>There is no absolute security method, ... If you photocopy a paper docuement then take it ...
    (comp.security.misc)
  • Re: Are computer forensics people as stupid as they seem?
    ... that overwrites an entire drive with statistically random data (and no ... where the data of each type resides, or your data is at risk. ... available on modern drives. ... consensus is that "stenographic" drive or volume encryption is mostly ...
    (alt.privacy)
  • Re: Are computer forensics people as stupid as they seem?
    ... I said it was undetectable that it was crypto. ... Sorry, but if people were going to jail for DBAN'd drives, you should ... expressed a genuine interest, instead of kicking me in the nuts. ... standard encryption accomplishes. ...
    (alt.privacy)