Blazing fast password recovery with new ATI cards

Source:
http://www.net-security.org/secworld.php?id=9021

Elmcosoft has once again demostrated how the GPU can be used to break incredible hard encryption such as WPA2-AES, ipod or iphone encrypted backup. They managed to archive 20x faster even when compare to i7-960, which is the state of the art 8-CPU from Intel. In fact, the result showns that it even beats the commerical super computer grid nVidia Tesla:
http://www.nvidia.com/object/tesla_computing_solutions.html

With GPU improving and new SDK opening up for sending computering to the GPU, it will only be a matter of time. But right now, breaking WPA2-AES within minutes is still a bit far fetch.

Truecrypt 6.3 is out!

Truecrypt 6.3 is release mainly with the support for Windows 7 and OSX Snow Leopard.

Grab it from the same place:
http://www.truecrypt.org/downloads

BTW, in case you wondering what is Truecrypt, I had mentioned it before here:
http://nemesisv.blogspot.com/2008/07/true-crypt-60-portable.html

Truecrypt V6.2a Release

Truecrypt is a FREE and open source encryption software for file or disk based encryption. It has been quiet for a while, but the latest release is now 6.2a. You can download it from:

http://www.truecrypt.org/downloads

Pointsec Virus Protector

Following my previous concept on how a rootkit can be protected on the HDD of a laptop, this idea can be extended thanks to another product call Pointsec Protector:

http://www.checkpoint.com/products/datasecurity/protector/

Basically, this encrypts your USB / External flashdrive, HDD etc. Which in this article, I will conceptional talk about how this can be used to protect the virus in transit. 

Imagine a virus extension of the rootkit. It can be transmitted onto an external device. So we have some USB flashdrive, which in this case is protected by the Pontsec Protector. So the virus is injected on the flashdrive. Now typically, we should be able to scan the USB flashdrive in a clean environment such as Linux, but because its protected by Pointsec Protector, this is not an option here.

So, how about when it get plug into another Windows system? Well, if that windows system does not have the Pointsec Protector software, the virus is safely protected inside. Well, in the case it is. Then doesn't the host based antivirus picks it up immediately and wipe out our virus? It depends. There can be several ways to go about it. One way is to inject itself immediately into the Pointsec address space. That makes it hard to kill and most likely the antivirus will have to take the Pointsec down with it. Then it still leaves our virus intact in the USB flashdrive. However, this technique is not easy at all. Another way is to inject the rootkit immediately so that while the antivirus spends it time cleaning the virus (if it doesn't block it first), we 0wnz the system first hiding its trace. 

As you can see, the encryption here provides it a mechanism to transport the virus straight to the target. The only defend left is the target host based anti-malware. I suppose modern day malware has easily overcome this problem. In the case where the malware does not detect the virus at all, then its game over for the system. However, if in the first scenario is possible, then a virus which is able to target the encryption mechanism, it will provide a more foolproof entry into the system or at least it will disrupt the anti-malware's attempt to clean up the virus. No decryption, no cleaning. 

Conceptional, I believe this is possible. And the impact can be much more serious than to rootkit a hypervisor because of the vector of attack. 

Truecrypt 6.1

This must be old news to many of you, but Truecrypt 6.1 is out. This is a file / disk based encryption software. I had a previous complain about the default settings (where you click next, next, next, install, oops, OS screwed up...) where they disabled the swap file. This is truly undesirable and cause a hell to troubleshoot because its hard to know where problem starts especially when you do not know what exactly happened.

Anyway, they got this right this time.

Download it at:
http://www.truecrypt.org/downloads.php

Pointsec Rootkit Protector

This is exactly how encryption can backfire in a corporate environment.

Basically, it applies to all the disk based encryption, more especially on those which cannot be reversed. But I decided to mention Pointsec because this is where I got it working. Most company will encrypt the whole disk especially in banks, military agencies.

Next, we have a concept rootkit, which should be fairly powerful to mask itself from all if not most conventional anti-malware. We can assume in a "perfect" environment where if the rootkit is loaded, it cannot be detected in the same environment. So as long as you have the OS running with the rootkit installed in Ring 0 layer, you are screwed so to speak.

Traditionally, in this case, we would attempt to remove or disable the malware by booting it up with an alternative environment such as WinPE or Linux. Then we can perform a scan on hte FAT/NTFS and wipe out the rootkit. Now, this is where it get tricky. Because disk based encryption is used, there is no way an alternative environment will be able to see the files on the infected Windows. So far I have only encounter Microsoft's Bitlocker which can be decrypted. And in this case, it is possible to remove the rootkit after decrypting it.

By now, I think you can figure out what I am trying to say. The only way to wipe out the rootkit is to destroy the whole encrypted partition. And as long as the partition is still encrypted (in my case using Pointsec), there is virtually no way to even read the partition using another OS. In a way, Pointsec protects the rootkit from being isolated and destroyed. That is in the first place if someone even figures out that there is a rootkit in place.

Where this can be applied? Well, almost everywhere where company can afford to have all their laptop encrypted and pay enough to acquire a really god rootkit. The company can effectively spy on their employee and perform logging or auditing services. And even if the employee finds out, there is nothing they can do. Well at least in countries where privacy is not protected by law.

Ok, I am not going to leave my contact here, but if you think your organization requires such a services, drop me a comment. :)