ano6
January 2nd, 2004, 08:27 AM
1.
"Some people for instance don't want to let others who use the computer like wives, siblings, daughters, sons, etc that they are encrypting documents. Hiding the fact you encrypt things is a common requirement for a lot of people." -- by Jason
I fully agree with Jason that it is an advantage of container solutions that encryption can be hidden.
In the meantime, I have tried CS. I have not noticed a stenographic encryption feature. It seems to me that the trial version can only produce .cse files (i.e., the fact that data is encrypted will not be hidden). Please correct me if I'm wrong. In any case, stenographic
encryption will not really help if you want to hide a lot of files or even entire directories.
2.
Sample scenario: Husband has installed a separate, stand-alone email client (like The Bat!) which is used for private e-mail correspondence. Moreover, husband uses mIRC for delicate IRC chat sessions. He also enjoys downloading pics and vids. His wife does exactly the same. Both spouses are not expected to know from each other's activities.
3.
Goal: The directories where The Bat!, the email database, mIRC and the IRC log files are located must be encrypted and hidden. The same applies to the pics and the vids.
4.
Solution: CryptoSuite Rootkit Edition
a)
Pre-condition is that CS will support "on-the-fly" en-/decryption. I know that this feature is difficult to implement. On the other hand, I understand that CS is an ambitious project.
b)
CS can be optionally installed in "stealth mode". This includes file & process cloaking plus registry key cloaking. In other words, there will be no visible CS process in the Windows Task Manager, no CS installation directory, no visible CS registry entries, no CS shell integration and no CS entries in the startmenu. The cloaking functions can be realized using rootkit technology (like Hacker Defender does). See also "Folder Guard Pro" for a less sophisticated approach.
c)
If CS is installed in "stealth mode" it can be activated via a hotkey combination. If the hotkey combination is pressed an inexpressive window will pop up. If you enter the right password, CS will be activated and shell integration will become visible. While CS is activated you can minimize it to the system tray.
d)
CS has an additional feature called "Cloak List". You can drag & drop (almost) any files or folders into the Cloak List. Alternatively, you can use the CS shell extension to add files or folders to the list. You will not be allowed to add files from the Windows directory and certain other important directories (including those directories which are referred to by autostart entries) to the Cloak List.
e)
Any files contained in the Cloak List will be automatically encrypted/decrypted "on-the-fly" (i.e., they will remain encrypted unless they are in use). The files will not be decrypted while CS is in stealth-mode which is important if file cloaking (see below) ever fails. In such case the files will get visible but cannot be read due to encryption.
f)
If CS is activated there will be a big red button called "Cloaking Disabled". If you press the button it will turn to a green "Cloaking Enabled". If Cloaking is enabled CS's rootkit functionality will be extended to any files and folders contained in the Cloak List (i.e., these files will instantly get invisible and cannot be used anymore).
5.
Summary: The above feature would allow a person, who needs to share a computer with other people, to set up a "private area" in a convenient manner.
There are already applications with similar features like Folder Guard Pro (which is relatively comfortable but which neither supports encryption nor does it have the comfy Cloak List described above), Encrypted Magic folders (which is not convenient at all), Hide Folders XP (not comfy, no encryption) and formerly (?) StealthDisk Pro (I don't know what happened to Invisicom's website). However, I believe that none of the above applications is a perfect solution for the above scenario. In addition, they do not support full rootkit functionality.
6.
Finally, it would be most interesting to see the DCS guys coding something like a stable rootkit 8)
"Some people for instance don't want to let others who use the computer like wives, siblings, daughters, sons, etc that they are encrypting documents. Hiding the fact you encrypt things is a common requirement for a lot of people." -- by Jason
I fully agree with Jason that it is an advantage of container solutions that encryption can be hidden.
In the meantime, I have tried CS. I have not noticed a stenographic encryption feature. It seems to me that the trial version can only produce .cse files (i.e., the fact that data is encrypted will not be hidden). Please correct me if I'm wrong. In any case, stenographic
encryption will not really help if you want to hide a lot of files or even entire directories.
2.
Sample scenario: Husband has installed a separate, stand-alone email client (like The Bat!) which is used for private e-mail correspondence. Moreover, husband uses mIRC for delicate IRC chat sessions. He also enjoys downloading pics and vids. His wife does exactly the same. Both spouses are not expected to know from each other's activities.
3.
Goal: The directories where The Bat!, the email database, mIRC and the IRC log files are located must be encrypted and hidden. The same applies to the pics and the vids.
4.
Solution: CryptoSuite Rootkit Edition
a)
Pre-condition is that CS will support "on-the-fly" en-/decryption. I know that this feature is difficult to implement. On the other hand, I understand that CS is an ambitious project.
b)
CS can be optionally installed in "stealth mode". This includes file & process cloaking plus registry key cloaking. In other words, there will be no visible CS process in the Windows Task Manager, no CS installation directory, no visible CS registry entries, no CS shell integration and no CS entries in the startmenu. The cloaking functions can be realized using rootkit technology (like Hacker Defender does). See also "Folder Guard Pro" for a less sophisticated approach.
c)
If CS is installed in "stealth mode" it can be activated via a hotkey combination. If the hotkey combination is pressed an inexpressive window will pop up. If you enter the right password, CS will be activated and shell integration will become visible. While CS is activated you can minimize it to the system tray.
d)
CS has an additional feature called "Cloak List". You can drag & drop (almost) any files or folders into the Cloak List. Alternatively, you can use the CS shell extension to add files or folders to the list. You will not be allowed to add files from the Windows directory and certain other important directories (including those directories which are referred to by autostart entries) to the Cloak List.
e)
Any files contained in the Cloak List will be automatically encrypted/decrypted "on-the-fly" (i.e., they will remain encrypted unless they are in use). The files will not be decrypted while CS is in stealth-mode which is important if file cloaking (see below) ever fails. In such case the files will get visible but cannot be read due to encryption.
f)
If CS is activated there will be a big red button called "Cloaking Disabled". If you press the button it will turn to a green "Cloaking Enabled". If Cloaking is enabled CS's rootkit functionality will be extended to any files and folders contained in the Cloak List (i.e., these files will instantly get invisible and cannot be used anymore).
5.
Summary: The above feature would allow a person, who needs to share a computer with other people, to set up a "private area" in a convenient manner.
There are already applications with similar features like Folder Guard Pro (which is relatively comfortable but which neither supports encryption nor does it have the comfy Cloak List described above), Encrypted Magic folders (which is not convenient at all), Hide Folders XP (not comfy, no encryption) and formerly (?) StealthDisk Pro (I don't know what happened to Invisicom's website). However, I believe that none of the above applications is a perfect solution for the above scenario. In addition, they do not support full rootkit functionality.
6.
Finally, it would be most interesting to see the DCS guys coding something like a stable rootkit 8)