Is your mechanic making a second living from your media and devices?
Listening to a recent episode (#134) of the Security Now! podcast by Leo Laporte and Steve Gibson (at http://www.grc.com/securitynow.htm), Steve noted that he had left his USB Drive with his key chain when he took his car in for service. He felt safe because the drive was encrypted using TrueCrypt (a public domain encryption product).
Subsequently, (in episode #139) a listener wrote to Steve to tell him some horror stories from auto shops of how the mechanics at some places (even some big name dealerships) will routinely snoop through cars in for service to see if there are any MP3s, CDs, etc. Mostly, they just want to “harmlessly” expand their music collections, but who knows what they might find.
On top of that, one listener pointed out that TrueCrypt uses an executable on the key to do encryption and decryption of the data. If that executable were replaced maliciously, any program could be made to run when you think you are decrypting the data on the drive.
My concern is that such a program might even give what looks like a valid error message saying something like, “TrueCrypt system error - data file corrupted. Please enter your password to attempt a recovery”. If you entered a password, it could be snagged and sent back to the mothership.
This logically begs another question. Are mechanics being paid to plant malicious code on media devices left in your car? Best not to let them have access to any of your media or devices while its in the shop.
Of course, one might leave a honey stick in one’s car to test their integrity. On the other hand, perhaps car dealers wanting to keep their teams honest might be interested in planting test devices that can be tracked.
Leave a Reply
Is your mechanic making a second living from your media and devices?
Listening to a recent episode (#134) of the Security Now! podcast by Leo Laporte and Steve Gibson (at http://www.grc.com/securitynow.htm), Steve noted that he had left his USB Drive with his key chain when he took his car in for service. He felt safe because the drive was encrypted using TrueCrypt (a public domain encryption product).
Subsequently, (in episode #139) a listener wrote to Steve to tell him some horror stories from auto shops of how the mechanics at some places (even some big name dealerships) will routinely snoop through cars in for service to see if there are any MP3s, CDs, etc. Mostly, they just want to “harmlessly” expand their music collections, but who knows what they might find.
On top of that, one listener pointed out that TrueCrypt uses an executable on the key to do encryption and decryption of the data. If that executable were replaced maliciously, any program could be made to run when you think you are decrypting the data on the drive.
My concern is that such a program might even give what looks like a valid error message saying something like, “TrueCrypt system error - data file corrupted. Please enter your password to attempt a recovery”. If you entered a password, it could be snagged and sent back to the mothership.
This logically begs another question. Are mechanics being paid to plant malicious code on media devices left in your car? Best not to let them have access to any of your media or devices while its in the shop.
Of course, one might leave a honey stick in one’s car to test their integrity. On the other hand, perhaps car dealers wanting to keep their teams honest might be interested in planting test devices that can be tracked.