Defuse Security

> 1) We should absolutely work towards allowing developers to sign their JavaScript. I've already been working on this for my own projects. It might be something that can be generalized for all Electron projects. https://github.com/soatok/libvalence https://github.com/soatok/valence-updateserver https://github.com/soatok/valence-devtools This uses Ed25519 signatures and an append-only cryptographic ledger to provide secure code delivery. The only piece it's currently missing is reproducible builds. For greater context: https://defuse.ca/triangle-of-secure-code-delivery.htm

On x86, some instructions are longer than others. Incrementing is a single byte. Setting the value 1 if you don’t assume anything is going to be 2 bytes (al, ah, bl, etc.) or 4 bytes for (ax, bx, etc.) This online x86/x64 assembler is great: https://defuse.ca/online-x86-assembler.htm

Reproducible builds are one of three components necessary to have a secure code delivery system: https://defuse.ca/triangle-of-secure-code-delivery.htm That Red Hat and Ubuntu aren't interested in delivering trustworthy software means you shouldn't trust them.

I hope we see much more of this. https://www.opentech.fund/ funds open source security audits, or did a few years ago when I worked on some of them. They focused on problems like private chat and secure drops for whistleblowers. On a smaller scale, https://defuse.ca/ set a good example with some one-person audits (under Research >> Audits on the site). Nothing's stopping anyone from learning by doing, the way most of us learned to program.

What it does: Tells you what the differences are between two .phar files. Why it's useful: Download a .phar (say, phpunuit) then separately build the .phar from source. Now you can compare the two and verify the following: a. Has this been tampered with on the download server? b. Does this .phar match the source code at the same tag? See also: https://defuse.ca/triangle-of-secure-code-delivery.htm

This is good to know. Thank you for the great work. I've been looking for alternatives, but I think I'll stick with TC for now. 1. Download it for your OS : https://www.grc.com/misc/truecrypt/truecrypt.htm 2. Verify the hash : https://defuse.ca/truecrypt-7.1a-hashes.htm

This greatly helped my understanding of how compilers work. How different would the implementation be for x64? Would it primarily be a matter of translating opcodes and calling conventions? For example, pop ecx is 59 [1], and on x64 it looks like it would be pop rcx, which is also 59 [2][3]. [1] - http://sparksandflames.com/file/x86InstructionChart.html [2] - https://defuse.ca/online-x86-assembler.htm#disassembly [3] - http://msdn.microsoft.com/en-us/library/windows/hardware/ff561499%28v=…

I've written down some general principles we should follow, but any reasonable implementation of them seems pretty far off: https://defuse.ca/triangle-of-secure-code-delivery.htm tl;dr: (1) Reproducible builds, (2) Make sure everyone is getting the same thing (to detect targeted attacks) and (3) Cryptographic signing. Package managers and appstores are the best we have right now, but they're missing (1) and (2). In the meantime, offering a pgp-signed installer file is a lot better than curl | sh.

I'd like to link to a audit of EncFS, the system that Safe is a wrapper for: https://defuse.ca/audits/encfs.htm It highlights in my opinion a old and not rigorous implementation and design. I'd not feel safe using it even if the developers of Safe did a great job choosing defaults.

Followup eCryptFS audit: https://defuse.ca/audits/ecryptfs.htm

> EAX is not available in addresses. Is this a relevant correction? If there is a point, ignore the following. You seem to like the ATT syntax, which I avoid whenever I can. However, if there isn't a specific point, and we're just being pedantic or having a pissing match, copy the following: mov rbx, [rax + 4*rax] mov rbx, [eax + 4*eax] movss xmm0, [rax + 4*rax] movss xmm0, [eax + 4*eax] into https://defuse.ca/online-x86-assembler.htm with the x64 option enabled. Your original example had float, so I included that as well. They all assemble, and the difference is in the REX prefix. I haven't looked at it in a few years, and I've forgotten a lot of details, but I wrote my own x86-64 assembler for fun. And of course, like most assemblers, I improvised my own syntax and naming convention. In particular, I didn't make a distinction between EAX and RAX (or AX or ALO). To me, it's just register A, and I gave the opcodes more descriptive names to indicate the bit width. I figure if gas can do something like ATT syntax, I can do my own my way.

I delete my chats, but it wasn't hard to recreate. This time I didn't demand it not 'waffle' and its answer was similar, though less emphatic: https://defuse.ca/b/6lsHgC1MnjGPb5tnZ43HKI

An example where auditors not having the threat model did not help the audit: https://defuse.ca/audits/gocryptfs.htm > We believe the reason these vulnerabilities exist is because gocryptfs doesn’t have a clearly spelled-out threat model. Some of the attacks seem hard to avoid given gocryptfs’s performance goals and may have been introduced “by design” to meet these goals. We suggest writing down an explicit threat model and updating the website to better communicate the security guarantees that gocryptfs provides. This way, users are less likely to rely on it in ways which would make them vulnerable. Later established: https://nuetzlich.net/gocryptfs/threat_model/

Details are described in audit that was performed for gocryptfs: https://defuse.ca/audits/gocryptfs.htm > Against a less-powerful active adversary who can modify the ciphertexts but has no access to the mounted filesystem, gocryptfs keeps file contents secret and provides imperfect integrity protection. In at least one case, imperfections in the integrity protections lead to a break of confidentiality. It is possible that the integrity imperfections lead to further confidentiality breaks depending on which applications are using the filesystem.

Old but relevant https://defuse.ca/truecrypt-plausible-deniability-useless-by-game-theo… .Be careful with plausible deniability depending on your threat model as it's only efficient against a soft "lawful" adversary. It's probably a terrible idea against an adversary willing to resort to "enhanced interrogation techniques" (not mentioning the usual 5$ xkcd).

What about javascript code on a harmfull website that does requests to localhost? It used to be possible to easily scan what sites are running locally, even if js code was from a public website. [0] [0] https://defuse.ca/in-browser-port-scanning.htm

If you find a way to prevent this in Chrome/Edge please let me know. Edit: https://defuse.ca/in-browser-port-scanning.htm There doesn't seem to be a way to access anything locally, just test for open ports. I use SSH tunneling a lot and was having a minor freak out.

Interesting, though that wouldn't work for off-site / cloud backups, unless you could upload the encrypted EncFS volume somehow, or don't mind leaking some file information to your storage provider if you're uploading the underlying encrypted filesystem as-is. I use EncFS for other purposes, but be aware of its security issues[1]. This report was influenced by the founder and CTO of Boxcryptor, so I'd take it with a grain of salt, but I'd still avoid using EncFS for any important data. [1]: https://defuse.ca/audits/encfs.htm

Ah, you're right, I had it confused with a similar analysis on EncFS which had more significantly damaging findings. https://defuse.ca/audits/encfs.htm I wasn't even aware Ext4 had native encryption support though! I'll definitely have to give that a go. Thanks for the tip.

https://defuse.ca/passgen.htm uses /dev/(u)random on Linux and CryptGenRandom() on Windows, with source code on GitHub for Linux https://github.com/defuse/passgen and https://github.com/defuse/WinPassGen Without a pile of dependencies :P

It sounds like you want some type of plausible deniability[1] or a way to hide your secure data in pain sight but often security through obscurity is a terrible idea. Beyond using FileVault and a firmware password I don't think there's much else you can do besides physically removing the disk. Unfortunately that is not a easy task on the latest MacBooks. 1: https://defuse.ca/truecrypt-plausible-deniability-useless-by-game-theo…

I believe you're talking about encfs, not ecryptfs. The specific vulnerability is in the bizarro last-block encryption that encfs 1.x uses; see: https://defuse.ca/audits/encfs.htm I use FileVault 2 with Yubikey 4-backed GPG for sensitive files. (Turn disk encryption on, but don't count on it to keep your files secret in a lot of threat models.)

VeraCrypt's on-disk format is NOT compatible with TrueCrypt's on-disk format,they are two totally different things and must be handled differently. VeraCrypt binary application can unlock TrueCrypt volumes but CAN NOT create them.The application has a setting to default to TrueCrypt volumes and hence if all you do is unlocking your TrueCrypt volumes,you can conveniently use VeraCrypt to unlock your TrueCrypt volumes. I think it will be better if you switch to VeraCrypt and set this option.Alternative "native linux" tool you could use to manage your TrueCrypt volumes in linux is zuluCrypt[3]. EncFS has its own issues[1] and there are a number of new projects that seeks to replace it and SiriKali[2] is a GUI tool to manage all these newer tools. [1] https://defuse.ca/audits/encfs.htm [2] https://mhogomchungu.github.io/sirikali/ [3] http://mhogomchungu.github.io/zuluCrypt/

‏@DefuseSec > I'll give $100 USD to anyone who can trick me into inserting the string "BackdoorPoCTwitter" into a release of any of my software projects. @Sc00bzT > @DefuseSec You should put this challenge on your website. @DefuseSec > @Sc00bzT Good idea, added it to this page: https://defuse.ca/security-contact-vulnerability-disclosure.htm ‏@Sc00bzT > @DefuseSec Did I just win? @DefuseSec > @Sc00bzT FUCK. What's your paypal/bitcoin? [See https://github.com/defuse/defuse.ca/commit/4770ad5c9d4851d40811c77b944… for commit.]

This is probably the least elaborate way to prove that I'm not totally clueless: https://defuse.ca/b/XCZtnL6Ix2F4ZuuLocy6pi That's a (easily verifiable) sample of the DB that was taken during the latest bitcointalk hack, it is not publicly available on the internet.

I also use EncFS - on Dropbox/GoogleDrive/JottaCloud - but be aware it's got known flaws, don't rely on it if your data might be of interest to a nation state or high level law enforcement: https://defuse.ca/audits/encfs.htm

as long as you do proper signing of code, reproducible builds, then your security concerns go away. https://defuse.ca/triangle-of-secure-code-delivery.htm

https://defuse.ca/audits/encfs.htm is an EncFS security audit, that didn't come out too clean. If you install encfs on debian it pops up a warning screen telling you to not use it for anything too sensitive atm.

You found the exception! Congratulations! You're using a bucket size which is a power of 2. A random byte fits on the interval of [0, 255] which is evenly distributed modulo 256, which if you reduce mod 2^N for 1 < N < 8 will still produce a uniform distribution. If you copied my JS code into your console and changed the 54 to 64 the bias evaporates. Hooray :D However, for arbitrary ranges, you should use an unbiased selection strategy to ensure a uniform distribution. http://3v4l.org/EgfPR - notice 0 is significantly more common than the other values when reduced mod 17 http://3v4l.org/LXmKq - same with mod 15 https://defuse.ca/generating-random-passwords.htm

Encfs didn't survive its security audit very well: https://defuse.ca/audits/encfs.htm (I don't know how much has it improved since then, though)