
TrueCrypt Encryption and RawFS

For internal use only.

   1. Encryption Ways
   2. Information Leakage (Partition Table)
   3. TrueCrypt Rescue Disk does not fix corrupt MBR boot signature [bug]
   4. RawFS (Raw File System)
   5. Detecting TrueCrypt Encryption
   6. TrueCrypt Software

Peter Kleissner


1. Encryption Ways

For TrueCrypt boot volume encryption you have 2 cases:

  Case 1: You encrypt only the system partition
  Case 2: You encrypt the whole hard disk
  
In both cases the MBR stays unencrypted and contains the TrueCrypt boot loader (that asks for a password).

    Place                         Case 1          Case 2
    ----------------------------------------------------------------------
    Master Boot Record            unencrypted     unencrypted
    System Partition              encrypted       encrypted
    Other Partitions              unencrypted     encrypted
    Unpartitioned Space           unencrypted     encrypted
    Gaps                          unencrypted     encrypted
    Hidden Protected Area         unencrypted     depends (TrueCrypt asks)

This table shows what is encrypted of a hard disk on encryption. Note that other encryption software handle that similar.


2. Information Leakage (Partition Table)

When encrypting the whole hard disk you would think your data is protected and the hard disk data and hard disk meta data are secured. However, for full volume encryption the master boot record stays unencrypted and unprotected so this is a software runtime attacking vector (you can replace the MBR with your own).

Sensitive hard disk meta data, the partition table, is available even you fully encrypt the hard disk with TrueCrypt!
That means an attacker knows where the partitions are laying - and where not. The attacker can use this knowledge, where unpartitioned space is, and put its files in there. The attacker can then "link" them to the MBR and voila, you can stored your entire remote software (the MBR is limited to 31.5 KB).

It is save for an attacker to write its files to unpartitioned space because then there will not be any data corruption or loss. Overwriting the unused encrypted unpartitioned space will not result in damage of the entire hard disk, because TrueCrypt encrypts every sector (512 bytes) for its own. To access files on unpartitioned space you need:

 a) a kind of file system, I invent a new one called RawFS (see below)
 b) to prevent TrueCrypt from decrypting the unpartitioned space (because you store your file unencrypted)

For second reason you have to develop your own filter driver in Windows that intercepts disk communication before TrueCrypt gets it.


3. TrueCrypt Rescue Disk does not fix corrupt MBR boot signature [bug]

There exists a TrueCrypt Rescue Disk from which you can boot and which provides rescue operations (booting, restoration, permanent decryption etc.):

  TrueCrypt Rescue Disk 6.2a
  =================================================

  Available Repair Options:
  -------------------------
  [1]    Permanently decrypt system partition/drive
  [2]    Restore TrueCrypt Boot Loader
  [3]    Restore key data (volume header)
  [4]    Restore original system loader
  [Esc]  Cancel
  
  To select, press 1-9:

So the issue: I overwrite the boot signature (55 AA, the last 2 bytes of the bootloader) with zeroes, you would think option [2] would restore them.
 No! It will not, this is a bug.

The boot signature is available in every boot loader (independent if hard disk, on the partition, on floppies etc.) and tells the BIOS that the device is bootable. If this signature does not exist the BIOS will not boot from it and will say "No operating system found". If you restore the boot loader (a boot software) it would be of course clear to mark it bootable.

Even when booting from the rescue disk it will display:

  Keyboard Controls:
  [Esc]  Skip Authentication (Boot Manager)
  [F8]   Repair Options
  
  Error: No bootable partition found

Which is another bug, because the hard disk is not marked as bootable, not the partition. To bring that to a point, your hard disk is fucked when overwriting the magic number in the bootloader, you will be never able to access your data or boot from it again! (when using the rescue disk)

Kind as I am, I reported it on the TrueCrypt Forum, and believe it or not I got a response! Well, the response was "Bogus bug report removed". They should get a pwnie for the lamest vendor responses. Their (lame) statement is Windows would "consider the drive uninitialized" and "me the MBR signature cannot be restored when the user restores only the TrueCrypt boot loader" and they wrongly think that the signature 55 AA validates the partition table and the MBR (it only tells the BIOS if it is bootable or not).
  

4. RawFS (Raw File System)

When storing multiple files on unpartitioned space there must be a specification how they are stored. For dedicated attacks (if only 1 file need to be stored) then only the file could be stored raw, however, I want to have a flexible solution where I can store multiple files and acces them via file names. An advantage of this is the better abstraction of hiding and accessing files which can be done via a driver in Windows.

RawFS structures the file system into sectors (512 byte blocks). It is intended to be easy and most flexible with less efforts in reading and writing.
The first sector contains the File Table which tells the location of files and the position of the next File Table.

Every file table is structured as:
  - 512 bytes of size
  - contains 16 entries with each 32 byte of size
  - each entry has following format

        + 0   8 bytes     Sector number of the file
        + 8   8 bytes     Size (in bytes) of the file
        + 16  16 bytes    MD5 hash of the file name
        ---------------------------------------------
              32 bytes per entry

  - special entries (md5 of the names)

        D41D8CD98F00B204E9800998ECF8427E    File Table

The next File Table is pointed to by the file "". There is only one (the first found) next File Table valid. If a file name is requested, the md5 must be generated and compared against all md5 hashes of the file table. Only the file name without any slashes and paths may be used for generating the md5.


5. Detecting TrueCrypt Encryption

It may become interesting in detecting a possible encryption of TrueCrypt when installing bootkits. For this, the bootloader can simple be checked if it contains the string "TrueCrypt Boot Loader". The bootloader of the current version (6.2a) looks like:

  00000000  EA 1E 7C 00 00 20 54 72 75 65 43 72 79 70 74 20  ê.|.. TrueCrypt 
  00000010  42 6F 6F 74 20 4C 6F 61 64 65 72 0D 0A 00 FA 33  Boot Loader...ú3
  00000020  C0 8E D8 8E D0 BC 00 7C FB F6 06 B6 7D 01 75 07  ÀŽØŽÐ¼.|ûö.¶}.u.
     ...                          ...  
  00000140  D1 C3 E2 F7 1F C3 00 44 69 73 6B 20 65 72 72 6F  ÑÃâ÷.Ã.Disk erro
  00000150  72 0D 0A 07 00 07 4C 6F 61 64 65 72 20 64 61 6D  r.....Loader dam
  00000160  61 67 65 64 21 20 55 73 65 20 52 65 73 63 75 65  aged! Use Rescue
  00000170  20 44 69 73 6B 3A 20 52 65 70 61 69 72 20 4F 70   Disk: Repair Op
  00000180  74 69 6F 6E 73 20 3E 20 52 65 73 74 6F 72 65 00  tions > Restore.
     ...                          ...  
  000001F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  ..............Uª

As you can clearly see there is the string TrueCrypt Boot Loader which will be always displayed on startup, however it will be so fast replaced by the TrueCrypt menu that you won't see it. This MBR is written for both cases of the boot volume encryption.


6. TrueCrypt Software

The TrueCrypt software consists of

  - Master Boot Record            Responsible for the decryption on-the-fly when booting

      Sector 0    1 Sector    Bootloader
      Sector 1    4 Sectors   Decompressor software (from Decompressor.c)
      Sector 5    57 Sectors  Compressed TrueCrypt Boot Loader (file BootLoader.com)
      Sector 62   1 Sector    Volume header information

  - Windows driver                Decrypts the drive on-the-fly in Windows, it is a boot driver
  - GUI application interface     It interacts with the Windows driver to do actions on the drives
  - Rescue Disk                   You can boot from it and do some rescue actions

The volume header information tells metadata about the encrypted partition. The master boot record is unsecured, not prevented from being overwritten, unencrypted and will be loaded as first software after the BIOS. Pwned!

