Researchers warn that Word and Google Desktop make encrypted information visible on partially encrypted hard drives If you’re using encryption software to keep part of your computer’s hard drive private, you may have a problem, according to researchers at the University of Washington and British Telecommunications.They’ve discovered that popular programs like Word and Google Desktop store data on unencrypted sections of a computer’s hard drive — even when the programs are working with encrypted files. “Information is spilling out from the encrypted region into the unencrypted region” said Tadayoshi Kohno, an assistant professor at the University of Washington in Seattle who co-authored the study.He believes that there are probably many other applications and operating system components that leak out information in a similar way. “I suspect that this is a potentially huge issue. We’ve basically cracked the surface,” he said.The researchers say that people who are using full-disk encryption, where every piece of data on their hard drive is encrypted, do not have to worry. However the issue pops up when users create an encrypted partition or virtual disk on their hard drives, leaving part of the drives unencrypted, or even when they store data on encrypted USB (Universal Serial Bus) devices, Kohno said. Nobody really knows how much data can be recovered from a partially encrypted disk, but the researchers say that they were able to recover copies of most of the Word documents created for their experiment from the software’s auto-recovery folder, even though the documents themselves were being saved to an encrypted part of the disk. “We just don’t know how much data is leaking out but it’s enough to be worried about,” Kohno said.With Google Desktop, the researchers were able to read snapshots of encrypted files when the program’s Enhanced Search option was enabled. The issue is not a bug in Word or Google Desktop, Kohno said. Rather, it’s “a problem with the way these applications interact with these encrypted virtual disks,” he said.Kohno and his team, which includes noted cryptographer Bruce Schneier, made their discovery while looking at so-called deniable file systems. These are encrypted file systems require two passwords before they reveal their full contents. They give the user a way to reveal a first encryption password without necessarily divulging the full contents of the hard drive because a second hidden section is protected by the second password.Looking at the TrueCrypt 5.1a deniable file system, they found that this same kind of data leakage occurred, exposing information that should have been protected by the system’s second password. The researchers say that the most recent TrueCrypt 6.0 software does fix some of these problems, but that their work shows just how hard it is to protect a partially encrypted hard drive.Their paper is set to be presented at the Usenix HotSec Workshop, July 29 in San Jose, California. Related content news Okta confirms recent hack affected all customers within the affected system Contrary to its earlier analysis, Okta has confirmed that all of its customer support system users are affected by the recent security incident. By Shweta Sharma Nov 30, 2023 3 mins Data Breach Cyberattacks Cybercrime news Top cybersecurity product news of the week New product and service announcements from Wiz, Palo Alto Networks, Sophos, SecureAuth, Kasada, Lacework, Cycode, and more. By CSO staff Nov 30, 2023 17 mins Generative AI Security feature How to maintain a solid cybersecurity posture during a natural disaster Fire, flood, eathquake, hurricane, tornado: natural disasters are becoming more prevalent and they’re a threat to cybersecurity that isn’t always on a company’s radar. Here are some ways to prepare for the worst. By James Careless Nov 30, 2023 8 mins Security Operations Center Data and Information Security Security Practices news analysis Attackers could abuse Google's SSO integration with Windows for lateral movement Compromised Windows systems can enable attackers to gain access to Google Workspace and Google Cloud by stealing access tokens and plaintext passwords. By Lucian Constantin Nov 30, 2023 8 mins Multi-factor Authentication Single Sign-on Remote Access Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe