@thegrugq aren't the latest versions supposed to look like random data?pic.twitter.com/uUnO7POy1b
@ErrataRob you’re up for writing the blog post “detecting TrueCrypt/encrypt blob transfers” on the wire…
-
-
-
@ErrataRob yes, but it wil have high entropy compared to other traffic. It won’t look like an .mp3 or an .avi, for example… -
@thegrugq@ErrataRob how do you distinguish it from, say, a burst of OpenVPN traffic? Or an scp of a large file? -
@cynicalsecurity@ErrataRob because the destination is a webserver that is a file host web site? At a wild guess. -
@thegrugq@ErrataRob OK, but why should it be specifically TrueCrypt and not "something else"? -
@cynicalsecurity@ErrataRob any encrypted blob being uploaded to a file sharing site…and then downloaded from Syria/Turkey -
@thegrugq@ErrataRob it sounds terribly impractical, inefficient, insecure and, ultimately, unlikely.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.