| Title | Independent Audit: Newly Found TrueCrypt Flaw Allows Full System Compromise | |
| Date | Wednesday September 30 2015, @06:01PM | |
| Author | cmn32480 | |
| Topic | ||
| from the get-out-the-bug-spray dept. | ||
The flaws, which were apparently missed in an earlier independent audit of the TrueCrypt source code, could allow attackers to obtain elevated privileges on a system if they have access to a limited user account.
The original authors of TrueCrypt, who have remained anonymous, abruptly shut down the project in May 2014 warning that "it may contain unfixed security issues" and advised users to switch to BitLocker, Microsoft's full-disk encryption feature that's available in certain versions of Windows.
At that time a crowd-funded effort was already underway to perform a professional security audit of TrueCrypt's source code and its cryptography implementations. The first phase, which analyzed the TrueCrypt driver and other critical parts of the code, had already been completed when TrueCrypt was discontinued. The auditors found no high-severity issues or evidence of intentional backdoors in the program.
It's impossible to tell if the new flaws discovered by Forshaw were introduced intentionally or not, but they do show that despite professional code audits, serious bugs can remain undiscovered
| Links |
printed from SoylentNews, Independent Audit: Newly Found TrueCrypt Flaw Allows Full System Compromise on 2026-10-11 13:00:57