Obfuscation Engines Explained.
An obfuscation engine is a security tool that disguises data by creating fake data alongside real data. This technique confuses adversaries, making it difficult to determine what is genuine. It enhances security by “poisoning the well,” ensuring unauthorized users cannot easily identify valuable information.
Why physical security and encryption aren’t enough
Credit: XKCD.
Most sensitive data is compromised by user error or guessed passwords. No security measures can protect you if you are forced to give over your password.
What is “Logical Security?”
Logical security employs obfuscation to remove any links between real and fake data, making it impossible to discern which is which. This technique, known as “poisoning the well,” ensures that unauthorized users are left with confusing and misleading information.
This approach solves the problem of “Chekhov’s Gun,” where adversaries can draw logical conclusions about your activities based on your security setup. By disrupting these logical chains, obfuscation prevents any clear understanding of your data, thereby enhancing overall security and privacy.
Warning: An adversary can still attempt to brute force the vaults, making it crucial to use strong passwords. Strong passwords significantly reduce the risk of successful attacks, ensuring your data remains secure even against persistent hacking efforts.
How Data Obfuscation works
The obfuscation engine creates fake vaults with fake files that mirror real usage patterns. These vaults are then encrypted and the decryption keys are trashed, ensuring they can never be opened. This makes it impossible to distinguish real vaults from fake ones.
Real data vaults also contain fake files to further disguise the actual data. This additional layer of obfuscation ensures that even if an adversary gains access, they cannot easily determine which files are genuine, significantly enhancing overall data security.
How (fake) vaults are created
Vaults are created with multiple fake vaults alongside the real one, using extensive randomization to hide the real vaults and cover all normal usage patterns. This ensures that the real data is well-concealed among the fake vaults.
The system also monitors the size of the fake vaults to ensure there is sufficient fake data to mask the real data. This continuous adjustment maintains the effectiveness of the obfuscation, making it extremely difficult for an adversary to identify which vaults contain the actual sensitive information.
Creating (real) user vaults
The obfuscation engine protects real data vaults by adding fake files and active decoys, which are updated with random data each time the vault is accessed. This continuous updating ensures that even if multiple versions of your encrypted vaults are discovered, it becomes very difficult to determine actual usage patterns.
By incorporating active decoys, the engine further disguises the real data, creating a constantly shifting landscape of information. This approach significantly enhances security, making it nearly impossible for an adversary to identify and access your genuine data.
Creating (fake) files
Fake files are created by generating a random number of files, ranging from 1 to 20,000. These files vary in size from small to very large, with checks to ensure they don’t occupy too much space. Nested directories are then created, and files are distributed randomly within them, making it impossible to deduce anything from the file structure.
This process iterates until the desired size is reached, resulting in a large number of fake files with no obvious usage pattern. This randomness is also applied to real vaults, further obfuscating true data and making it extremely challenging for adversaries to discern real information.
Using your (real) vaults
To use the real vaults, you select the vault and enter your password, which mounts it securely. You can then perform any necessary actions with your data. When you’re done, you simply close the vault.
Upon closing, the system adds random code to your active decoy files and randomizes timestamps and access logs. This makes it impossible for anyone to determine when you accessed what, ensuring your activities remain completely hidden and secure.
“Reasonably Secure” Encryption
This is “reasonably secure” encryption, balancing security and complexity. More complex systems are more likely to fail, so we opt for a simple yet secure solution. We use EncFS for encryption, which could be compromised if an opponent has multiple versions of the same encrypted files.
While there are security features to reduce this risk, our system is designed to protect you if the laptop is compromised. Uploading or sharing the encrypted files will weaken security. This balanced approach ensures robust protection without unnecessary complexity.
Still works if your adversary knows you are using it
The best part of logical security is that it works even when your opponent knows you’re using it. In fact, it can work even better. When adversaries know or discover you are using this security approach, they realize they cannot trust what they might uncover.
This knowledge discourages them from attempting to access your data, as they understand the information is likely obfuscated and unreliable. The awareness of this security method acts as an additional deterrent, enhancing overall protection.