TrueCrypt Developers Abandon ISIS's Favored Encryption Tool

An article in The New York Times in March of 2016 explained that one of the 2015 Paris Terror Attackers was shown two things when he first met up with his ISIS handlers: how to fire an assault rifle and how to use TrueCrypt encryption software. The terrorist recruit was given a USB drive with TrueCrypt installed. He was instructed to download encrypted messages from a shared cloud drive in Turkey and then use TrueCrypt to decrypt those and use it again to upload replies. The terrorist understood those instructions since he was a computer technician.

The newspaper speculated that terrorist was told not to use email as that would make it easier for spies to track the terrorist group’s physical location by giving away the IP addresses of any emails they might intercept, which are listed clearly in the email headers.

The terrorist was arrested before the attack. The police figured out after the attack that he was supposed to be part the attack team. This terrorist was not a very clever computer person since he broken one of the basic rules of security. He wrote down his passcode for TrueCrypt on paper.

The anonymous TrueCrypt developers stopped developing TrueCrypt in 2014, without giving any reason. They had been maintaining it for 10 years.

The New York Times in their article said that TrueCrypt is “an encryption program that was widely available at the time and that experts say has not yet been cracked.” But the authors of TrueCrypt want you to think otherwise.

On their website where you download TrueCrypt they updated it in 2014 to say “WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues.” They give no other information about that. This has led to lots of speculation and questions. Some say that maybe someone defaced the website, but that does not seem likely say others.

As to the timing of events The New York Times said ISIS had been using TrueCrypt since 2014 and that the captured terrorist was given a copy of it in 2015. So ISIS believes it still works. So do others.
 
 A security researcher in 2014 John Hopkins raised $70,000 to fund an analysis of TrueCrypt to see whether it was secure.

The paper has been released here. In short, they say it has some programming that could be made more secure but that the product itself is secure.

Meanwhile the researcher Matthew Green told Brian Krebs in 2014 that he is wondering what to do with the rest of the money as he only spent $40,000 on the research. On his own blog in 2015 he said that the analysis shows that TrueCrypt is still secure.  Here is what he says:

“Truecrypt appears to be a relatively well-designed piece of crypto software. The NCC audit found no evidence of deliberate backdoors, or any severe design flaws that will make the software insecure in most instances.”

The only weakness they found is in a Windows Crypto API subroutine designed to use entropy to create a key (e.g. Entropy uses mouse clicks and other random events to create a unique value.). But he says that the occasion of an error is so rare that, “This is not the end of the world, since the likelihood of such a failure is extremely low.”

At the time the researchers wrote their report the source code was available on the TrueCrypt site. It’s not there anymore, although you can find copies of it elsewhere like this Github site.
 
Mr Green says that no other developers have taken over development of the code. He adds that it would be illegal to do so since the license under which it was released was not GNU, Apache, or anything like those opensource licenses. But here is a group of developers in Switzerland looking for money to carry it forward. Obviously they should talk to Mr Green who has $30,000 to spare. Current TrueCrypt users can ask questions of others on their support forum.

So is TrueCrypt secure? Obviously ISIS thinks so if they are still using it after 2014. Mr Green  pointed to a possible error with the Windows. But he said nothing about Ubuntu or MAC and even on Windows he says the chance of an error is small. He says that error would cause TrueCrypt to continue forward even if it was not able to generate a random number. So does that mean might get a key others would know, meaning an empty or default key value? He does not explain.

▼ Show Discussion