May 06, 2011
By Leon Erlanger | InfoWorld
Researchers from the University of Southern California and the National University of Science and Technology in Pakistan have developed an application that secures data by hiding it in plain sight.
As most people know, encryption is the principal method for securing sensitive data today, and strong encryption schemes such as AES can be effective at keeping important info out of the wrong hands. However, encrypted data is easily identified, which makes it ripe for attack, if not through brute force then by using keyloggers, social engineering, or other coercion to obtain encryption keys.
Rather than encrypting sensitive data, the application, described in a paper entitled "Designing a Cluster-Based Covert Channel to Evade Disk Investigation and Forensics," hides the data in plain sight, so to speak, by taking advantage of typical file system design. Like NTFS and FAT, it breaks the file into fragments and scatters them across the disk drive. However, it uses a covert channel to modify the fragmentation patterns and conceal them from anyone who doesn't have access to the fragmentation scheme. No additional information is stored on the drive. Unlike encryption, anyone who doesn't have access to the scheme will be unaware that the data even exists.
After trying the application on a variety of drives using the FAT32 file system, the researchers concluded that up to 20MB of data can be hidden on a 160GB drive. The researchers claim the technique degrades drive performance considerably less than encryption/decryption, and it can be a valuable tool for preventing the types of high-profile data breaches that have plagued enterprises in recent times. On a stranger note, the paper points out that the technique can thwart investigations by giving owners plausible deniability since the user can truthfully deny any data is hidden on the drive.
This article, "Data protection, hidden in plain sight," was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest business technology news, follow InfoWorld.com on Twitter.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.