{"action":"created","issue":{"url":"https://api.github.com/repos/utkusen/hidden-tear/issues/10","labels_url":"https://api.github.com/repos/utkusen/hidden-tear/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/utkusen/hidden-tear/issues/10/comments","events_url":"https://api.github.com/repos/utkusen/hidden-tear/issues/10/events","html_url":"https://github.com/utkusen/hidden-tear/issues/10","id":102261483,"number":10,"title":"Weak encryption implementation","user":{"login":"yorickdewid","id":7712841,"avatar_url":"https://avatars.githubusercontent.com/u/7712841?v=3","gravatar_id":"","url":"https://api.github.com/users/yorickdewid","html_url":"https://github.com/yorickdewid","followers_url":"https://api.github.com/users/yorickdewid/followers","following_url":"https://api.github.com/users/yorickdewid/following{/other_user}","gists_url":"https://api.github.com/users/yorickdewid/gists{/gist_id}","starred_url":"https://api.github.com/users/yorickdewid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yorickdewid/subscriptions","organizations_url":"https://api.github.com/users/yorickdewid/orgs","repos_url":"https://api.github.com/users/yorickdewid/repos","events_url":"https://api.github.com/users/yorickdewid/events{/privacy}","received_events_url":"https://api.github.com/users/yorickdewid/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-20T23:44:07Z","updated_at":"2015-08-21T05:52:56Z","closed_at":null,"body":"Encrypting using the symmetric codeschema is weak since the program is vulnerable to all kinds of injections and attacks. Since the entire encryption occurs on the client side a virusscanner (of sorts) could easily hook in, even after the event.\r\n* The generated password is way too short and can be tried within a reasonable (69^15) amount of time.\r\n* Because you trust on a symmetric codeschema the password must me present somewhere and can (especially with a language like C#) be retrieved quite easily from a memory dump.\r\n* Moving (encrypted) files around only changes the file descriptor towards the modifications, but does not actually alter the entire datablock which makes it easy to recover the original files by walking over the physical pages.\r\n* Since C# relies for the most part on the .NET framework, basically all operations can be monitored or reverted with little effort (opcodes have some degree of transparency).\r\n\r\nRandsomeware like CrytoLocker (one of the most successful crytopvirusses we know so far) take on an entire different approach. They trust on asymmetric encryption, specifically RSA, in which the private key never reaches the client system. This is much more secure since it's only the public key that needs to be exchanged between the parties. Also, you should write directly against the system libraries where needed to prevent hooks from listening in on communication. Supply your own crypto functions or use a open library instead. This all usually leads to a language with a lower abstraction level, for example C/C++.\r\n\r\nThere is the argument of complexity for these measures, but 'keeping things simple' is something you cannot afford in these areas where basically everything revolves around security. As for the education; this could barely pass as an encryption tool, never less malicious software."},"comment":{"url":"https://api.github.com/repos/utkusen/hidden-tear/issues/comments/133296108","html_url":"https://github.com/utkusen/hidden-tear/issues/10#issuecomment-133296108","issue_url":"https://api.github.com/repos/utkusen/hidden-tear/issues/10","id":133296108,"user":{"login":"utkusen","id":3511458,"avatar_url":"https://avatars.githubusercontent.com/u/3511458?v=3","gravatar_id":"","url":"https://api.github.com/users/utkusen","html_url":"https://github.com/utkusen","followers_url":"https://api.github.com/users/utkusen/followers","following_url":"https://api.github.com/users/utkusen/following{/other_user}","gists_url":"https://api.github.com/users/utkusen/gists{/gist_id}","starred_url":"https://api.github.com/users/utkusen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/utkusen/subscriptions","organizations_url":"https://api.github.com/users/utkusen/orgs","repos_url":"https://api.github.com/users/utkusen/repos","events_url":"https://api.github.com/users/utkusen/events{/privacy}","received_events_url":"https://api.github.com/users/utkusen/received_events","type":"User","site_admin":false},"created_at":"2015-08-21T05:52:56Z","updated_at":"2015-08-21T05:52:56Z","body":"Thank you for your comment. But I answered it before here https://github.com/utkusen/hidden-tear/issues/7"}}