TrueCrypt is hackable?

I got an email recently from Securstar.... apparently TrueCrypt and PGP are easily hacked??? Or is this some ploy to sell me new software?

Recently, a lot of noise has been made in the media about hackers and private companies who have developed "tools” to quickly break into TrueCrypt, PGP, Bitlocker, and hardware encrypted computers.

Some of those "tools” are:

Evil Maid - (Publicly available)

Passware will mit Passware Kit Forensic 9.7 - (Publicly available)

Elcomsoft - (Publicly available)

NSA-Best-Friend - (For government use only)

Customers have asked us if these and other hacks are possible with our products DriveCrypt and DriveCrypt Plus Pack. We are proud to say that since DriveCrypt was first released, there have been no successful hacks of DriveCrypt encrypted systems whatsoever!

At SecurStar we have a hacker division that tries to attack our software and researches theoretical weaknesses everyday so we can improve new releases and further protect existing users. We therefore strongly recommend that you always keep your encryption software up to date with the latest version. The latest versions will detect and defend against those attacks listed above and many others.

Case Study: Evil Maid attack.
A very nasty little hack is the Evil Maid attack. It gets its name from the example of an evil maid hacking into your computer that was left in your hotel room. She leaves a hack on your computer which memorizes your keystrokes and the next time she comes to clean she lifts the hack from your computer and has access to all your passwords.

To completely protect you against this hack, an added level of protection we offer is to use the recovery USB stick created upon encryption with DriveCrypt Plus Pack. After removing Bootauth from the disk and using the recovery USB stick to boot the system, you are protected from this type of attack. This is because the decryption keys are loaded from the USB stick and you don't only rely on your passwords. Our protection keeps the Evil Maids and others, away.

have you ever used truecrypt? Its damn good, sounds like competition emailing you to use their product. DriveCrypt may be worth looking into though. Wait, it's not free, go figure. TrueCrypt is open source so it can be trusted. I doubt DriveCrypt is.

If you use trucrypt correctly and provide a very strong password, it's highly unlikely anyone can hack it, even the government. You would have to be a MAJOR target or slip up somewhere before they would be able to hack it.

If you are really paranoid, just install trucrypt on a usb thumb drive and only view the files when needed on a "clean" computer without internet. It can even work with Linux and MAC computers if that would make you feel better.

I use it mainly to prevent local police from seeing shit in case I was ever busted or robbers, etc. I don't really have any info the FBI or NSA would want.

Read these articles, the FBI has failed to decrypt 5 hard drives protected with truecrypt

http://www.net-security.org/secworld.php?id=9506

http://techie-buzz.com/foss/fbi-fail-decrypt-hard-drive-truecrypt.html

These kinda of hacks been around forever . Anyone who knows how to install a software developing software ,can easily find source to these kind hacks. Followed by a few other tools and wallah it passes right threw a AntiV firewall mal/Spy ware protection.

Not really true. As the first article says:

"The contents of the drives - protected by a combined use of TrueCrypt (free open-source full-disk encryption software) and an unnamed algorithm though to be base on the 256-bit AES standard - are still a mystery."

So the drives were not just encrypted with Truecrypt - it was Truecrypt plus some unknown additional encryption.

watts said:

Read these articles, the FBI has failed to decrypt 5 hard drives protected with truecrypt

http://www.net-security.org/secworld.php?id=9506

http://techie-buzz.com/foss/fbi-fail-decrypt-hard-drive-truecrypt.html

Click to expand...

truecrypt is AES encrypted. You can select different algorithms. Serpent-Twofish-AES is best, and most likely what he used.

Also its best to store sensitive data on a thumb drive or only used on a computer not connected to a network.

Truecrypt encryption has not been broken.

Truecrypt stores credentials in memory when an encrypted volume is in use and what these programs do is snag that information from RAM.

What this means? Disable sleep mode, hibernation and system restore. When you are not using your computer turn it off. It currently cannot be cracked.

Truecrypt is as secure as it's going to get when used properly.

TrueCrypt is an AWESOME piece of encryption software (and when used correctly yes it is stronger than anything any government can throw at it - not actually due to TC itself, but the ciphers themselves, namely AES, but others such as Twofish and Serpent are also on offer and can even be used together), but as with most security programs it's only as strong as its weakest link, which is more often than not the USER themselves..... it doesn't matter how much cryptographic protection TrueCrypt offers when the person using it uses a weak password, or storing their password weakly, or compromised by malware etc etc.

All icmaggers... do yourself a favor and take some time to read the TrueCrypt manuals -- unlike most software helpfiles they're actually a very INTERESTING read, it's not boring (well, i enjoyed it) ... and includes concepts such as plausible deniability using hidden volumes, even hidden operating systems, both of which are actually very simple to create ... you can use plausible deniability if an adversary such as a government tries to force you to reveal your password ... and therefore even offers some protection against rubber-hose cryptanalysis

What PhenoMenal says..

Likewise PGP..

They cannot crack the encryption, so, like the Maginot line, they go round it. Someone on here [iirc] posted a security report [might have been a wikileaked one] about how the spooks were catching [IT savvy] terrorist cells.

The ones they could not get were often grabbed in flagrante, literally, so, with all your encrypted solutions opened, they simply jump you and take over...

Others, as PhenoMenal says, they can crack if you set these things up wrong. Just having and using them is no protection if you have not got it set up 100% right.

Likewise, as far as I understand it, if you have been compromised with a RAT/keylogger then they can get what they want via that.