Feeds

Crypto attack unveils hidden backups

Hide and seek

Choosing a cloud hosting partner with confidence

A German cryptographer has discovered a technique that discloses the presence of a hidden encrypted volume in a disc backup.

The sophisticated comparison-based technique doesn't allow the encrypted backup volumes to be read, but it does allow police or other interested parties to determine that it is there.

The approach, developed by Bernd Roellgen of PMC Ciphers, works with encryption packages that use symmetric encryption. This includes most on-the-fly encryption packages.

By comparing an encrypted backup image file with an older image, made using the same key, Roellgen discovered it was possible to unpick nuggets of information without breaking the encryption protocol itself or knowing the key.

The attack potentially reveals the presence of a second (hidden) encrypted volume in an encrypted backup. The safe-within-a-safe approach is used by people who want to bury sensitive information, so that it remains a secret even if they are obliged to hand over the keys of the first volume.

PMC Ciphers makes a disc encryption product, called TurboCrypt, which has been enhanced to withstand the attack by making sure each encrypted backup uses a different key - described as polymorphic encryption.

A demonstration of the attack from PMC Ciphers, puffing the benefits of its products, can be found here. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
State Dept shuts off unclassified email after hack. Classified mail? That's CLASSIFIED
Classified systems 'not affected' - but, is this reconnaissance?
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.