<story><title>TrueCrypt suggesting migration to BitLocker?</title><url>http://truecrypt.sourceforge.net/</url></story><parent_chain><item><author>ultramancool</author><text>After examining all the facts, I think it&amp;#x27;s most likely they just didn&amp;#x27;t want to develop it anymore:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    * PGP matches
    * Authenticode matches
    * SourceForge data was modified
    * DNS records were modified
&lt;/code&gt;&lt;/pre&gt;
And to top it off, let&amp;#x27;s put ourselves in the theoretical attacker&amp;#x27;s shoes, the binaries when run make no unexpected connection attempts or write to any unexpected places and don&amp;#x27;t appear to contain any unexpected imports, so if this was a hack, it&amp;#x27;s a very stealthy and very boring one. The most they achieved would be uninteresting to most attackers. It would only really be an effective attack against people who had TrueCrypt volumes but not a current copy of TrueCrypt as there&amp;#x27;s no compelling reason for anyone to upgrade to 7.2 and certainly they&amp;#x27;d be skeptical after this. Any attacker with the intelligence and patience for such an attack would surely realize how poor an execution this would be. A better attack would be &amp;quot;here, it&amp;#x27;s TrueCrypt 8, it has loads of EFI support and mad security, everyone should install it, it&amp;#x27;s the best!&amp;quot;. There&amp;#x27;s simply no reason to shut it down like this, unless the attack is just an elaborate practical joke.&lt;p&gt;It&amp;#x27;s quite possible this came from 1 big developer hack, but considering how the release was done, with full source and everything for every supported platform... if it was a hack, it&amp;#x27;s a very, very good one. They&amp;#x27;ve also decided to modify the license terms, perhaps bringing it into compatibility with more common FOSS licenses.&lt;p&gt;I think it&amp;#x27;s far more likely at this point that the devs, who had not updated their software in years, finally decided to call the project over and have marked it insecure because the codebase is now unmaintained and should be assumed insecure.</text></item><item><author>Adaptive</author><text>In order of likelihood:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    * Defaced site, timed to screw up a big announcement
    * Rogue content maintainer
    * Phase II of audit turned up something rather bad
      (edit: NO - see tptacek below)
&lt;/code&gt;&lt;/pre&gt;
edit: Variations on &amp;quot;developer forced to do this&amp;quot; (cf simmerian&amp;#x27;s comment):&lt;p&gt;&lt;pre&gt;&lt;code&gt;    * Developer was big brother all along and they are shutting it down
    * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly)
    * Legally or otherwise compelled to compromise source code,
      dev complies and&amp;#x2F;or nukes project from orbit
&lt;/code&gt;&lt;/pre&gt;
The last alternative would be suggested in part by the strange content of the page, assuming it is legit from the developer: Normally I&amp;#x27;d expect at &lt;i&gt;least&lt;/i&gt; something like &amp;quot;there&amp;#x27;s a major vuln that is unfixable and we&amp;#x27;ll disclose formally in a week&amp;#x2F;two, migrate now.&amp;quot;.</text></item></parent_chain><comment><author>hifier</author><text>I agree that it appears the developers are calling it quits. If you look at the diff itself, they have replaced large chunks of logic with an abort routine, passing the message &amp;quot;Insecure App&amp;quot;.&lt;p&gt;This does not explicitly suggest vulnerabilities exist in older versions, but rather the latest version with these changes is very explicitly insecure and should not be used. This does leave room for issues to have been discovered in old versions - maybe rather than fix, they are throwing in the towel.</text></comment>
<story><title>TrueCrypt suggesting migration to BitLocker?</title><url>http://truecrypt.sourceforge.net/</url></story><parent_chain><item><author>ultramancool</author><text>After examining all the facts, I think it&amp;#x27;s most likely they just didn&amp;#x27;t want to develop it anymore:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    * PGP matches
    * Authenticode matches
    * SourceForge data was modified
    * DNS records were modified
&lt;/code&gt;&lt;/pre&gt;
And to top it off, let&amp;#x27;s put ourselves in the theoretical attacker&amp;#x27;s shoes, the binaries when run make no unexpected connection attempts or write to any unexpected places and don&amp;#x27;t appear to contain any unexpected imports, so if this was a hack, it&amp;#x27;s a very stealthy and very boring one. The most they achieved would be uninteresting to most attackers. It would only really be an effective attack against people who had TrueCrypt volumes but not a current copy of TrueCrypt as there&amp;#x27;s no compelling reason for anyone to upgrade to 7.2 and certainly they&amp;#x27;d be skeptical after this. Any attacker with the intelligence and patience for such an attack would surely realize how poor an execution this would be. A better attack would be &amp;quot;here, it&amp;#x27;s TrueCrypt 8, it has loads of EFI support and mad security, everyone should install it, it&amp;#x27;s the best!&amp;quot;. There&amp;#x27;s simply no reason to shut it down like this, unless the attack is just an elaborate practical joke.&lt;p&gt;It&amp;#x27;s quite possible this came from 1 big developer hack, but considering how the release was done, with full source and everything for every supported platform... if it was a hack, it&amp;#x27;s a very, very good one. They&amp;#x27;ve also decided to modify the license terms, perhaps bringing it into compatibility with more common FOSS licenses.&lt;p&gt;I think it&amp;#x27;s far more likely at this point that the devs, who had not updated their software in years, finally decided to call the project over and have marked it insecure because the codebase is now unmaintained and should be assumed insecure.</text></item><item><author>Adaptive</author><text>In order of likelihood:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    * Defaced site, timed to screw up a big announcement
    * Rogue content maintainer
    * Phase II of audit turned up something rather bad
      (edit: NO - see tptacek below)
&lt;/code&gt;&lt;/pre&gt;
edit: Variations on &amp;quot;developer forced to do this&amp;quot; (cf simmerian&amp;#x27;s comment):&lt;p&gt;&lt;pre&gt;&lt;code&gt;    * Developer was big brother all along and they are shutting it down
    * Security vuln about to be disclosed, dev scrambles to inform (albeit poorly)
    * Legally or otherwise compelled to compromise source code,
      dev complies and&amp;#x2F;or nukes project from orbit
&lt;/code&gt;&lt;/pre&gt;
The last alternative would be suggested in part by the strange content of the page, assuming it is legit from the developer: Normally I&amp;#x27;d expect at &lt;i&gt;least&lt;/i&gt; something like &amp;quot;there&amp;#x27;s a major vuln that is unfixable and we&amp;#x27;ll disclose formally in a week&amp;#x2F;two, migrate now.&amp;quot;.</text></item></parent_chain><comment><author>mandelbulb</author><text>&amp;gt;&amp;gt;After examining all the facts, I think it&amp;#x27;s most likely they just didn&amp;#x27;t want to develop it anymore:&lt;p&gt;So they decided to end things with such an extremely juvenile behavior devaluating the years they have invested in this project even if not recently?&lt;p&gt;Unless the responsible one fell into clinical depression it&amp;#x27;s a pretty strange reason.</text></comment>