Attonbitus Deus <[EMAIL PROTECTED]> wrote:
>So, yes, if one did encrypt a file in this manner, AND someone breaks in and
>rips off your hard drive, AND they don't figure out your password is
>"#BrittanySpears" AND you have correctly removed the restore cert AND the
>data has not been overwritten
> -Original Message-
> From: Bugtraq List [mailto:[EMAIL PROTECTED]]On Behalf Of
> Attonbitus Deus
> Sent: Thursday, January 25, 2001 1:26 AM
> To: [EMAIL PROTECTED]
> Subject: Re: BugTraq: EFS Win 2000 flaw
>
> Running to the docs? Come on, man- all anyo
> When I got to Start-Help-"File Encryption", it does tell me that I should
> encrypt the folder and the file, but does not tell me that I should never
> have created the file in an unencrypted state to begin with. So, to get
the
> MS-recommended procedure, you do have to run to the docs (or Bugt
Scott Culp, Security Program Manager wrote :
>While EFS does indeed work as Rickard discusses, this is not new
>information. For instance, "Encrypting File System for Windows 2000"
>(http://www.microsoft.com/WINDOWS2000/library/howitworks/security/encr
>ypt.asp, p 22) notes the following:
[EMAIL PROTECTED] wrote:
>Recommended EFS procedures call for the encryption of a direcory, not
>file-by-file as the procedure indicated by Berglind suggests.
>If you copy an unencrypted file and paste it into an encrypted directory,
>the file and the temporary file are both encrypted.
This
- Original Message -
From: "Dan Kaminsky" <[EMAIL PROTECTED]>
>
> If you ask me, the user interface itself is the most important
> documentation--it's the only thing that, if it's incorrect, is
*guaranteed*
> to lead to the wrong thing being done.
You mean like the ISO software running o
Addendum to my thoughts on the apparent EFS design flaw, which is actually
less significant than originally announced. Essentially, only files that
are converted FROM plaintext TO ciphertext are temped, meaning the bug only
affects files that were plaintext on the disk in the first place. There'
> Recommended EFS procedures call for the encryption of a direcory, not
> file-by-file as the procedure indicated by Berglind suggests. If you copy
an
> unencrypted file and paste it into an encrypted directory, the file and
the
> temporary file are both encrypted.
>
> This is actually covered in
I've got a couple of question on this issue..
The concern is that a temp file of the original plaintext may be left
around for an attack to "undelete". It's understandable why this might be
neccessary for a rollback in case of machine failure at just the wrong
time. (Though one could argue that
The URL given by Dan Kaminsky in a previous message for the Peter Gutmann
paper "Secure Deletion of Data from Magnetic and Solid-State Memory" seems
to be not working. A working URL is:
http://www.cs.auckland.ac.nz/~pgut001/secure_del.html
Ben Greenbaum
Director of Site Content
SecurityFocus
htt
"Inside Windows 2000 - 3rd edition" (MS Press) has a description on how
the EFS system works, including the creation of the temporary file
described here.
It appears that the temp file is created to allow rollback on system
failure during encryption. This, however, does not excuse the failure
to
Hi Rickard,
This is why you should always enable file system encryption in
Windows 2000 at the folder level. When you turn on the encryption function
on a folder (done in the same manner as a file), any new files created in
that folder are saved directly to disk as ciphertext by the EFS d
This entire thread and problem is basic computer crypto. If you want
something to be safe, you never store it plaintext, period. Granted, EFS
doesn't have loud red warnings if you encrypt a file that was previously
plaintext, but at the end of the day, this is not an EFS flaw---pure user
error.
Dan Kaminsky <[EMAIL PROTECTED]> writes:
> That means no
> decryption keys ever get written, no passwords get saved, and most
> importantly, *no plaintext data gets stored, not even "temporarily"*.
Interestingly, when a system hibernates e
> So to suggest that your perceived EFS flaw can be resolved by over-writing
> is naive. The only solution is to encrypt in memory or use some removable
> partition as the temp space.
>
I agree with the use of 'percevied' in this case. Though the behavior is
interesting in regard to the creation
In case anyone's interested, here's a summary of the responses I received to
my incorrect assertions;
I should say that I was under the honest belief that companies, such as
OnTrack, made available services which could recover overwritten data at a
reasonable price. I called them this morning and
.
jf
-Original Message-
From: Russ
To: [EMAIL PROTECTED]
Sent: 1/19/01 2:10 PM
Subject: Re: BugTraq: EFS Win 2000 flaw
To the best of my knowledge, Peter Guttman(sp?) has demonstrated for
years
now that there is no form of over-writing which makes any substantial
difference to the ability to re
One of the advertised features of EFS was protection of data in the event of
say a stolen laptop. EFS was supposed to protect against someone throwing
the harddrive into another system that they did have admin access on, and
circumventing the NTFS permissions in that manner.
Again this issue sho
Russ,
> To the best of my knowledge, Peter Guttman(sp?) has demonstrated for years
> now that there is no form of over-writing which makes any substantial
> difference to the ability to recover previously written data from
> a computer
> hard disk.
You're correct that Peter Gutmann (note spellin
> To the best of my knowledge, Peter Guttman(sp?) has demonstrated for years
> now that there is no form of over-writing which makes any substantial
> difference to the ability to recover previously written data from a
computer
> hard disk.
Guttman's paper, "Secure Deletion of Data from Magnetic
On Fri, 19 Jan 2001, Russ wrote:
> To the best of my knowledge, Peter Guttman(sp?) has demonstrated for years
> now that there is no form of over-writing which makes any substantial
> difference to the ability to recover previously written data from a computer
> hard disk.
>
> My understanding of
To the best of my knowledge, Peter Guttman(sp?) has demonstrated for years
now that there is no form of over-writing which makes any substantial
difference to the ability to recover previously written data from a computer
hard disk.
My understanding of current "high security" standards wrt the re
Hello.
Correct me if I'm wrong, but the use of programs that utilize direct disk
access (such as DiskProbe) is restricted to the Local Administrator
account (as per
http://www.microsoft.com/windows2000/guide/professional/solutions/manageme
nt.asp). If an would be attacker has this kind of access,
23 matches
Mail list logo
