This site may earn affiliate commissions from the links on this page. Terms of use.

Encrypt

For several years, TrueCrypt was the gold standard in PC disk decryption suites. That inverse nearly 18 months ago, when the individuals who developed the software abruptly quit. The developers alleged that the existing software was ""not secure as it may contain unfixed security issues," provided a concluding version of the software to decrypt information, and shut the project down. This was all the more puzzling when two all-encompassing security audits establish no bugs of significance. As of today, that's inverse.

Security researcher James Forshaw found two disquisitional bugs in the program that could compromise an end-user's machine. While neither allowed an attacker backdoor access, the Register reports that both could have been used to install spyware to the host machine or record keystrokes. Either of these could've been sufficient to allow an attacker to capture the drive's encryption central, depending on how expert the end-users security practices were.

ForshawTwitter

It'southward non clear how these bugs slipped past the code audits performed over the past year, merely information technology's entirely possible that Forshaw and the original audit teams focused on different aspects of TrueCrypt. The 2d audit report, released earlier this year, states that: "the assorted AES implementations in both parallel and nonparallel XTS configurations were a particular point of focus." Forshaw's bugs, in contrast, both appear to be related to other aspects of the system. Every bit Forshaw notes above, even audits don't catch every bug.

These bugs have been patched in the fork of TrueCrypt, VeraCrypt, which patched both of them on September 26. Note that the current links to descriptions of each bug are 403'd, Forshaw typically waits a calendar week to upload descriptions.

We'll never know why TrueCrypt's authors left the project. Conspicuously these bugs, while meaning, can even so be stock-still without compromising the organization. Every bit conspicuously, VeraCrypt was able to solve them in curt order, once Forshaw drew attention to them. What we practice know, notwithstanding, is that in that location'due south at present very good reason to move away from using TrueCrypt and towards 1 of the actively maintained forks or alternate solutions. TrueCrypt itself has now proven flawed enough to no longer be trustworthy.

If yous're curious about secure software, including full disk encryption, we covered the topic extensively earlier this year. VeraCrypt is currently the about-recommended alternative to TrueCrypt, but it's far from the only choice. Both OS Ten and Windows offer back up for full-deejay encryption — if y'all demand an alternative to TrueCrypt, they do be.