Tag Archives: afaceri

De management de produs şi de organizare

12 septembrie 2010 - 08:52

Am avut pentru a înţelege mai bine conceptele, rolurile şi obligaţiile legate de managementul de produs si management de produs de marketing în companii de software, de ce sunt necesare, care sunt diferenţele şi modul în care acestea se potrivesc în interiorul unei structuri de organizare.

Cele mai multe persoane i nu se ştie niciodată interesat în acest domeniu specific de activitate, dar atunci când doriţi să fie o companie de produs (şi nu o companie de consultanta sau soluţie), va începe cu produse diferite pe platforme diferite pentru clienţii ţintă diferite vândute prin canale diferite, cu diferite preţuri, cu o instalare / procesul de livrare diferite şi că complexitatea trebuie să fie gestionate în mod corect.

Vă daţi seama că, pentru a permite companiei de produse să crească în direcţia dreptul de care aveţi nevoie pentru a organiza activităţi de gestionare a produselor în mod formal, nu închide mintea ta, în roluri de organizare rigide, cum ar fi marketing, vanzari, R & D.

Când vorbim despre managementul produsului i recomanda citirea luminoase rolul strategic al Product Management (Cum accent dictat de piaţă conduce companii de a construi produse de oamenii doresc să cumpere), care să clarifice o mulţime de lucruri, chiar dacă perspectivele separarea netă a roluri în managementul de produs, ceva nu e palarie prea mare pentru o companie mica, ca o pornire.

Încă mai prevede o diferenţiere a sarcinilor între Product Management şi comercializare a produselor.

O bună înţelegere a managementului de produs referitoare la pornire i S dat în articol Crearea Product Management la pornire arate de la caz diferite legate de rolurile de vizionar produs in cadrul companiei.

Se introduce CEO termeni de produs, în sensul că taxele de produse de gestionare a sari in jurul în funcţia de organizaţie diferite prin furnizarea de concentrare şi efort în cazul în care este nevoie, independent de faptul că funcţia de interne necesită un efort mai mare este, Marketing de Dezvoltare, de vânzări sau de comunicare. Asta înseamnă, practic, creşterea viziunea produsului, deoarece acesta este necesar în toate majore de produse legate de funcţiile de luare a viziunii companiei la nivel coerent.

O bună reprezentare de management de produs şi a activităţilor de comercializare a produselor este bine descrisă cu diferenţierea între strategica, tehnice şi de marketing şi sectorul nu este în mod clar separate între Management, Marketing (şi vânzări) şi R & D:

Am citit acest context manager de produs şi de cunoştinţe sunt diferite în funcţie de orientarea companiei ( în cazul în care nu aparţin de management de produs în cadrul organizaţiei? ):

B2C -> Marketing experienţă
B2B -> Tehnic de experienţă

O diferenţiere de iluminare (pentru mine), şi foarte important în ceea ce priveşte taxele de produse de management este diferenţierea între:

Product Management
Produs de marketing

Sarcinile specifice care aparţin Marketing Product Management vs sunt explicate foarte mult în Definiţii de urmat pentru Product Management şi Marketing Product sugerează că i pentru a citi, permiţându-vă pentru a defini mai bine sarcinile şi responsabilităţile în cadrul organizaţiei dumneavoastră. Acesta oferă, de asemenea, o definiţie bună a cerinţelor de locuri de muncă, dacă aveţi nevoie să caute pentru că figura!

În acelaşi timp, este important să înţelegem ce nu e de management de produs, în mod eficient de management Produsul nu este doar prioritizarea caracteristică .

În acelaşi timp, este important să înţelegem care figura profesionala nu este el însuşi un manager de produs:

Managerul de produs nu este un manager de marketing - în timp ce managementul de produs este, de obicei, văzută ca o disciplina de marketing, de marketing se concentreaza pe planul de marketing şi nu sunt de conducere, de obicei, direcţia generală de produs. În acest context, ar putea fi găsite toate acestea, Product Marketing Manager că e vorba de arme de comercializare a produsului, în special în organizaţii de dimensiuni reduse.

Managerul de produs nu este un manager de vânzări - director de vanzari sunt pe cale de a afla cum de a vinde un produs, după care metodologia de vânzări, tehnică şi canale şi acestea ar putea conduce compania de la o companie orientată spre piaţă (produs), pentru o companie orientată spre client (soluţie şi Consulting)

Managerul de produs nu este un dezvoltator - Programator sunt axate pe tehnologie, şi nu produsul global. Unii manageri de produs sunt mari dezvoltatori foşti, dar este dificil să se facă atât la o dată. Există o tensiune naturală între dezvoltatori si manageri de produs, care ar trebui să fie menţinute pentru a crea un produs echilibrat.
Managerul de produs nu este un manager de software - manager de software-ul este un manager funcţional şi, de obicei, nu se concentrează pe produs sau clienţilor.
Managerul de produs nu este un manager de proiect - manageri de proiect sunt despre cum şi când, în timp ce managerul de produs este despre ce. Managerii de proiect lucrează în strânsă colaborare cu managerii de produs pentru a asigura finalizarea cu succes a diferitelor faze în ciclul de viaţă al produsului.

Activităţile tipice de management de produs ar putea fi în sinteză extrem de rezumate după cum urmează:

Strategia: Planificarea unei strategii de produs
Tehnic: de conducere de produse evoluţii
Marketing: furnizarea de produse şi conţinut tehnic
Vanzari: oferă sprijin de pre vânzări şi lucra eficient, cu vanzari

Produs de management, astfel că nu este tocmai de dezvoltare, nu este tocmai de introducere pe piaţă, nu este tocmai de vânzări, astfel încât de obicei, este dificil de a identifica ", în cazul în care ar trebui să rămână" în interiorul structurii organizaţiei (este chiar dificil să se înţeleagă că este nevoie)?

Silicon Valley de marfuri Grupul oferă o perspectivă frumos pe Structura Organizatiei de marfuri prin arătând care sunt avantajele şi riscurile de mai multe alegeri. Încă Product Manager capricios spune că nu contează în cazul în care managerul de produs trăiesc în organizaţie .

Este relevant să fie atent să nu aibă de persoane care sunt mult prea tehnice sau prea mult orientate spre vânzare, în scopul de a umple golul între organizarea diferită. Fragmentarea prea mult din sarcinile din organizaţia poate duce la birocraţie, taxele prea mult pe o singură persoană poate duce la punerea în aplicare ineficientă a sarcinilor necesare în unele zone şi la un concurs intern ceea ce priveşte percepţia la rolurile traditionale.

Verificaţi există un CV foarte frumos de un profesionist cu experienta practica in managementul de produs (este o jumătate de buzunar / jumatate baieti de marketing).

Ah! O altă neînţelegere foarte comună este de a confunda cu comunicare de marketing în cazul în care ai găsit o definiţie atât de bună de marketing care chiar imi place si de inteles pentru relaţia strictă cu management de produs:

De introducere pe piaţă este cunoscut de piaţă atât de bine încât produsul în sine vinde

Dar ce se întâmplă atunci când nu se ocupe de un management de produs şi de marketing de produs managementul proceselor într-un mod definit?

O poveste frumoasă este prezentat ca exemplu, în rolul strategic de management de produs :

Fondatorul dvs., un tehnician genial, a început în urmă, când ani compania a renuntat la slujba zi pentru a comercializa timpul idee completă. El a creat un produs care el ştia doar nevoie de alte persoane. Şi avea dreptate. Destul de repede a dat destul de produs şi a angajat mai bun prieten al său de la colegiu ca VP de vânzări. Şi compania a crescut. Dar, înainte de mult timp, VP de vânzări plâns, "Suntem o companie de inginerie, condusă. Avem nevoie pentru a deveni client-orientat. "Şi care suna bine. Cu excepţia ... fiecare nou contract părea să ceară de lucru personalizat. Ai semnat un client în câteva zeci de segmente de piaţă şi zeci de voce ultimul client dominat întotdeauna planurile de produse. Ai ajuns la concluzia că "orientate spre client" înseamnă ", condus de ultimul client" şi că nu ar putea fi dreapta.

Dacă vrei să fii o companie de produs este relevant să urmeze exact o strategie de marketing conduse de produs şi de management, şi nu de vanzari.

Confuzie între funcţia de management de produs / marketing şi vânzări ar putea duce la o companie de produse pretenţii care nu sunt în măsură să procedeze în cadrul strategiei lor, pur şi simplu pentru că ei obtinerea oportunităţi de afaceri care conduc în afara domeniului de aplicare.

O companie de produse trebuie să investească în dezvoltarea sa de produse proprii şi de marketing, în scopul de a permite activitatea de vânzări rămâne concentrat şi pentru a garanta faptul că organizaţia este în fiecare zi mai eficientă pe piaţă.

După această citire, înţelegerea mea este că este relevant să identifice modul în care a crea un set de proces de afaceri flexibil, cu privire la modul de a se ocupe de management de produs şi diverse taxe de comercializare a produselor care le separă din vânzări.

Comment (0) Tag-uri de afaceri , de management , de marketing | Comentariu (0)

de afaceri de management de confidenţialitate de securitate tehnologie

Şarpe-ulei de securitate susţine pe cripto produs de securitate

19 iulie 2010 - 21:33

Piata de securitate să crească, mai multe companii se duce la piaţă, dar cum multe dintre ele sunt luaţi în serios ceea ce fac ei?

Ştii, faci tehnologie de securitate înseamnă că sunteţi personal responsabil de protecţie a informaţiilor utilizatorului. Trebuie să îi facem conştienţi de ceea ce au nevoie, exact ceea ce vă fac şi ce fel de model de ameninţare produsului proteja.

O problema tipica de caracteristici de securitate de produse este reprezentat de incapacitatea utilizatorului de a evalua cererile de securitate ale produsului în sine.

Deci, există o mulţime companii a face o introducere pe piaţă care nu-aşa-etic de caracteristici de securitate, bazate pe fapte pe care nici un utilizator nu va fi capabil să-l evalueze.

Situaţia sa explicat anterior reşedinţa în problematica de securitate de criptare ulei de şarpe, o evoluţie în mediul ştiinţific criptografic, care să ne folosim astazi cele mai bune rase de tehnologii de protecţie a informaţiilor, fără a fi nevoie să vă faceţi griji prea mult despre backdoor-uri sau nesiguranţe.

Să vorbim despre criptare Snake Oil

Ulei Criptografia Snake : În criptografie , ulei de sarpe este un termen folosit pentru a descrie metode comerciale criptografice şi produse care sunt considerate false sau frauduloase. Diferenţierea criptografie sigur de criptografie nesigur poate fi dificil din punct de vedere al unui utilizator. Criptografi Multe, cum ar fi Bruce Schneier şi Phil Zimmermann , se angajează să educe publicul în modul în care se face securizat criptografie, precum şi evidenţierea de marketing înşelătoare a unor produse criptografice.

Mai referinţe cripto de securitate guru, Philip Zimmermann şi Bruce Schneier, a fost primul pentru a vorbi despre Criptare Snake Oil:

Ulei de sarpe de Philip Zimmermann

Ulei de sarpe de Bruce Schneier

Telecomunicaţii Michigan şi a Legii Technology Review a făcut, de asemenea, o analiză foarte bună referitoare la elementele de securitate de produse de securitate, SNAKE-OIL SECURITATE pretinde că "INCORECTĂ sistematic de produse de securitate . Ei explica despre trucuri de marketing urât folosite pentru a optimiza utilizatorilor incapacitatea de a evalua caracteristici de securitate, inclusiv implicarea responsabilitatea economică şi juridică.

Very famous is the sentence of Russ Nelson : Mai multe companii de securitate de ulei de sarpe de produse nu explică şi nu sunt clare cu privire la modelul de ameninţare în care produsul se aplică Foarte celebru este sentinţa. Russ Nelson :

"Amintiţi-vă, cripto fără un model de ameninţare este ca cookie-urile, fără lapte. ..... Criptografia fără un model de ameninţare este ca maternitatea fără plăcintă cu mere. Nu pot spune ca de destule ori. Mai mult, în general, de securitate fără un model de ameninţare este, prin definiţie, va eşua. "

Deci, cum să faţa locului produse petroliere şarpe de securitate?

Verificaţi o orientare de la faţa locului, produse petroliere Snake Encriptare: semne de avertizare de ulei de sarpe, software de criptare pentru a evita de către Matt Curtin .

Puteţi vedea acest lucru foarte bune Snake Exemple criptografice de ulei de Emility Ratliff (Architect la IBM Linux Securitate), care a încercat să facă exemplu clar despre cum să faţa locului Snake Oil criptografic.

Reprezentate aici orientarea de bază de la Matt Curtin de hârtie:

Companiile care pretind încredere în noi, ştim ceea ce facem "
Companiile care inventa noi termeni de tehnologie, fără a explica chiar si de inovare, numit Technobabble
Produs care utilizează protocoale non-publice, împreună cu proprietare şi Algoritmi Secret
Compania, care pretinde a fi inventat nou tip de criptografie sau o Descoperirile notabile Revoluţionare
Companiile care prezintă Certificare inutil şi evaluare ar trebui independentă, fără nici o valoare de securitate
Produs care pretinde a fi Unbreakabl e
Companiile care pretind alte produse sunt nesigure, cu dovezi false si artificiale
Companiile care pretind că sistemul lor este gradul militar , în timp ce toată lumea ştie că astăzi, criptografie, în sectorul civil este de conducere de inovare
Produs care au plângeri nefondate biţi (cum ar fi 16384 sau 46080 bit bit şi de autentificare a sesiuni)

Prin verificarea faptului că de puncte este posibil pentru a evalua cât de gravă o tehnologie de criptare sau un produs este.

Dar toate în toate cum să se stabilească faptul că abordarea de securitate lipsite de etică?

Este foarte semnificativ şi ar fi foarte util pentru fiecare tip de categorie de produse de securitate pentru a face unele directoare de evaluare puternic şi independent (cum ar fi OSSTMM pentru teste de penetrare), pentru a face acest proces de evaluare de securitate într-adevăr în mâinile utilizatorului.

Aceasta ar fi, de asemenea, foarte frumos pentru a fi cineva face analiza şi evaluarea de companii de produse de securitate, publicarea de rapoarte despre semnele de ulei de sarpe.

Comments (3) Tag-uri de afaceri , criptare , management , de marketing , politica , de confidenţialitate , voicesecurity | Comentarii (3)

de afaceri de informaţii interceptarea de confidentialitate securitate tehnologie

Blackberry de securitate şi criptare: Diavolul sau înger?

7 iulie 2010 - 10:39

Blackberry au o bună reputaţie şi de rău în ceea ce priveşte capacitatea sa de securitate, în funcţie de unghiul din care te uiţi la ea.

Acest post este un rezumat set de informaţii pentru a permite cititorului imaginea Get, fără a lua o poziţie mai mult ca RIM Blackberry şi pot fi considerate, în funcţie de punctul de vedere, o platformă extrem de sigură sau una extrem de periculoasă.

Să merge mai departe.

Pe BlackBerry de o parte este o multime platformă de caracteristici de criptare, caracteristici de securitate de pretutindeni, dispozitiv criptat (cu personalizat cripto), criptate (cu comunicare protocoale personalizate proprietare , cum ar fi PPPI), foarte bune Setări avansate de securitate, cadru de criptare de la Certicom ( detinut in prezent de RIM ).

Pe de altă parte ele nu oferă doar un aparat, ci o suprapunere de acces la reţea, denumit BIS ( BlackBerry Internet Service ), care este o reţea globală de arie largă în toată lumea în cazul în care BlackBerry introduceţi în timp ce navigaţi sau checkmail folosind blackberry.net AP.

Atunci când, sau o aplicaţie, utilizează APN blackberry.net nu sunt doar conectarea la internet cu conexiune la internet de transport, dar se intră în interiorul reţelei de RIM, care va proxy şi acţionează ca o poarta de acces pentru a ajunge pe internet.

Acelaşi lucru se întâmplă atunci când aveţi o utilizare corporativ: Atât aparatul BB şi BES corporative conecta la reţeaua de RIM, care actioneaza ca un fel de reţea de concentrare VPN .

Deci, practic toate comunicările traverseze RIM infrastructurii de servicii prin în format criptat, cu un set de criptare de proprietate şi protocoalele de comunicare.

Doar ca o notificare, cred că Google pentru a oferi gTalk peste blackberry.net APN, a făcut un acord, în scopul de a oferi servicii în interiorul reţelei BB la BB utilizatorilor. Când instalaţi gTalk te adăugat 3 cărţi de servicii , care punct de GTALKNA01 care este numele de poarta de acces în interiorul reţelei GTalk RIM, pentru a permite intra-BIS de comunicare şi acţionează ca o poarta de acces la internet GTalk.

Operatorii de telefonie mobilă, de obicei, nu sunt chiar permisiunea de a inspecta traficul între dispozitivul BlackBerry şi de reţea Blackberry.

Astfel, RIM si Blackberry sunt oarecum unic pentru abordarea lor ca acestea să ofere o platformă, o reţea şi un serviciu de toate pachet împreună şi nu se poate doar "sa aparat şi software-ului", dar de utilizator şi corporative sunt întotdeauna legate şi conectat la serviciul de de reţea.

Asta e bine şi că e rău, pentru că înseamnă că RIM oferă caracteristici de securitate extrem de bune şi capacităţi de a proteja informaţiile, şi dispozitiv de acces la informaţii la nivel de diferite faţă de terţe părţi.

Dar este întotdeauna dificil de a estima pericolul şi riscul legat de RIM sine şi care ar putea face presiuni politice de la RIM.

Vă rugăm să consideraţi că eu nu spun "RIM se uita la datele dvs.", dar a face o analiză de risc obiectiv: pentru modul în care platforma se face RIM au autoritate pe dispozitiv, pe baza informaţiilor de pe dispozitiv şi pe informaţiile care traversează de reţea. (Citeste-mi diapozitive Mobile Security ).

De exemplu, haideţi să considerăm acelaşi context pentru telefoanele Nokia.

Odată ce dispozitivul Nokia este vândut, Nokia nu are autoritate asupra dispozitivului, nici de informaţiile pe dispozitiv sau pe informaţii care traversează reţeaua. Dar este, de asemenea, adevărat că Nokia oferă doar aparatul şi nu oferă servicii cu valoare adăugată, cum ar fi integrarea Enterprise (RIM VPN tunel), reţeaua de acces BRI şi toate caracteristicile locale şi la distanţă de securitate prevazute că Blackberry oferă.

Deci, este o chestiune de risc, având în vedere contextul în mod corespunzător atunci când alegerea platforma, cu un exemplu foarte similar cu alegerea Microsoft Exchange Server (pe propriul serviciu), sau dacă a obţine un serviciu SaaS ca Google Apps.

În ambele cazul în care aveţi nevoie să aibă încredere furnizor, dar în primul exemplu trebuie să ai încredere că Microsoft nu a pus un backdoor pe software-ul în timp ce în exemplul două trebuie să ai încredere Google, ca un furnizor de platformă şi de servicii, care nu are acces la informaţiile dumneavoastră.

Deci, este o paradigmă diferite pentru a fi evaluate în funcţie de modelul dvs. de ameninţare.

Dacă modelul dvs. de ameninţare permite să ia în considerare RIM ca un furnizor de servicii de încredere treia parte (la fel ca Google) decât e ok. Dacă aveţi un context de risc foarte ridicat, cum ar fi de top-secret, unul, apoi să analizăm şi să evalueze cu atenţie dacă nu este mai bine pentru a menţine serviciile Blackberry complet izolat de dispozitiv sau de a folosi un alt sistem, fără interacţiunea cu serverele producătorului şi servicii.

Acum, haideţi să ne întoarcem la unele de cercetare şi unele fapte despre BlackBerry şi mure de securitate în sine.

Întâi de toate, mai multe guverne au avut de a face cu RIM, în scopul de a le forţa de a oferi acces la informaţiile care traversează reţelele lor de servicii în timp ce altele au decis să interzică folosirea în mod direct Blackberry pentru înalţii funcţionari publici, din cauza servere localizate în Marea Britanie şi Statele Unite ale Americii, în timp ce altele au decis să backdoors instala propriile lor.

Serviciile secrete ruse (FSB), ajunge la un acord cu RIM si acum FSB-ul poate trage cu urechea Blackberry e-mail şi de trafic web în Rusia
Guvernul a interzis franceză Blackberry pentru utilizarea de către oficiali guvernamentali şi, de asemenea, înlocuit de dispozitive pentru utilizare de criptare de voce
Guvernul indian a făcut presiuni asupra RIM pentru a reduce capacităţile de criptare şi de mai târziu au anunţat că au spart mure de criptare . Un rezumat la India-RIM poveste de Bruce Schneier .
Emiratele Arabe Unite (EAU), operatorul Etisalat a încercat pentru a instala în tăcere un spyware guvern cu privire la toate BlackBerry tara , dar a fost prins
Statele Unite ale Americii Agenţia Naţională de Securitate iniţial interzisă Obama, de a utiliza BlackBerry pentru lucrările sale prezidenţiale care îi dau un telefon Edge Secure Sectera , după 2 ani ei au reuşit să-l asigure cu un strat de criptare personalizat realizat special de către ANS şi a permis lui Obama de a utiliza un BlackBerry securizat personalizat

Există o mulţime de discuţii atunci când subiectele sunt RIM Blackberry şi guverne, pentru diferite motive.

Mai jos un set de informaţii legate de securitate oficial pe platforma RIM BlackBerry:

Oficial de securitate Intrebari pe site-ul RIM
BlackBerry Internet Service Caracteristici de securitate
Fără fir de date de securitate

Şi aici, un set de securitate şi informaţii neoficiale legate de Hacking pe platforma RIM Blackberry:

Hackish BlackBox analize de securitate de către FX de Phenoelit : Analiza sistemelor complexe - caz Blackberry
Accesarea corporative prin intranet Blackberry BBProxy Hack
Blackberry program de master de control pic de hacking
Cum de a evita BlackBerry politica IT
Mure Inversarea de cercetare (cea mai mare parte de Dr. Bolsen, cu toate acestea nimeni nu s-au mai decompiled şi publicat RIMOS întregi)
- Ocolind Blackberry Semnătura COD

Pentru ca e 23.32 (GMT +1), eu sunt obosit, cred că acest post se va termina aici.

Sper să fi furnizat cititorului un set de informaţii utile şi luarea în considerare a merge mai în profunzime în analiza şi luând în considerare global de securitate mure (în bine şi în rău, întotdeauna depinde de modelul de ameninţare dvs.!).

Noroc

Fabio Pietrosanti (naiv)

PS Sunt de gestionare dezvoltarea tehnologiei de securitate (criptare voce Tech), pe platforma Blackberry, şi eu pot să vă spun că, din punct de vedere al dezvoltării este absolut mai bine decat Nokia în ceea ce priveşte compatibilitatea şi viteza de dezvoltare, dar utilizarea numai RIMOS 5.0 +!

Comments (3) Tag-uri de afaceri , criptare , hacking , mobile , de confidenţialitate | Comentarii (3)

de afaceri războiului cibernetic de informaţii de confidentialitate securitate tehnologie

China Criptare Regulamentele

16 iunie 2010 - 13:11

Bună tuturor,

Am gasit acest articol foarte interesant pe criptare China de import / export / regulamentele interne efectuate de Baker & McKenzie, în SUA.

Este puternic orientate spre afaceri şi de reglementare să ofere o imagine foarte bine realizat pe modul în care China reglementări funcţionează şi cum se poate comporta în viitor.

Citeste aici Decriptarea Statutul Chinei de criptare a lui (sub formă Bakernet site-ul).

Comment (0) Tag-uri de afaceri , războiului cibernetic , criptare , de confidenţialitate , voicesecurity | Comentariu (0)

de afaceri de interceptare de confidenţialitate de securitate tehnologie

Discuţie Mobile Security WHYMCA la conferinţă

02 iunie 2010 - 07:56

Vreau să vă împărtăşesc câteva slide-uri am folosit pentru a vorbi despre securitatea pe telefonul mobil la whymca mobil conferinta de la Milano.

Citeste aici mi diapozitive pe Mobile Security .

Diapozitivele oferă o gamă largă de o imagine de ansamblu în profunzime în materie de securitate legate de mobile, i ar trebui sa faci unele slidecast despre el pune, de asemenea, audio. Poate se va face, nu poate, depinde de momentul în care este întotdeauna o resursă insuficient.

Comment (0) Tag-uri de afaceri , criptare , hacking , mobil , de confidenţialitate , voicesecurity , zrtp | Comentariu (0)

de afaceri de interceptare de confidenţialitate tehnologie

SecurStar GmbH Phonecrypt răspunsuri cu privire la caz Infosecurityguard / Notrax: absolut nerezonabil! :-)

O februarie 2010 - 18:04

UPDATE 20.04.2010: http://infosecurityguard.com a fost dezactivat. Notrax de identitate a devenit cunoscut tipi mai multe din mediile de securitate de voce (nu se poate spune, dar vă puteţi imagina, am avut dreptate!) Şi, astfel încât prietenii noştri a decis să trow departe site-ul, din cauza responsabilităţii juridice în conformitate cu legile din Marea Britanie şi Statele Unite ale Americii.

UPDATE: rezumatul de la Nisa din toată povestea (stiu, e lung si complicat de a citi la prima ora) pe SIPVicious VoIP de securitate pe blog-ul de Sandro Gauci .

După descoperirile mele, domnul Hafner, SecurStar şef exec, în cele din urmă a încercat să apere acţiunile lor, invocând scuze absolut nejustificate la Reg loc public scuze pentru ceea ce au făcut: crearea unui fals de securitate independente de cercetare pentru a promova lor de produse PhoneCrypt .

El a încercat să ne convingă că persoana din spatele IP 217.7.213.59, folosit de autor de infosecurityguard.com şi arătând la linia lor de birou DSL, a fost acest Notrax hacker, folosind lor de serviciu anonim surfing şi nu un angajat al lor, la sediul lor:

“SecurStar chief exec Wilfried Hafner denied any contact with Notrax. Notrax, he said, must have been using his firm's anonymous browsing service, SurfSolo, to produce the results reported by Pietrosanti”

Let's reflect a moment on this sentence… Would really an hacker looking for anonymity spend 64 EUR to buy their anonymity surfing service called surfsolo instead of using the free and much more secure TOR (the onion router) ?Then let's reflect on this other piece of information:

The IP 217.7.213.59 is SecurStar GmbH's office DSL line
On 217.7.213.59 they have installed their VoIP/Asterisk PBX and internet gateway
They promote their anonymous proxy service for “Anonymous p2p use” ( http://www.securstar.com/products_ssolo.php ). Who would let users do p2p from the office dsl line where they have installed their corporate VoIP PBX ? If you do VoIP you can't let third party flood your line w/ p2p traffic, your phone calls would became obviously unreliable (yes, yes, you can do QoS, but you would not place an anonymous navigation proxy on your company office DSL line…).
Which company providing an anonymous navigation service would ever use their own office IP address? Just think how many times you would have the police knocking at your door and your employees as the prime suspects. (In past i used to run a TOR node, i know the risks…). Also think how many times you would find yourself blacklisted on google as a spyware bot.
Mr. Hafner also says “We have two million people using this product. Or he may have been an old customer of ours”. 2M users on a DSL line, really?
I don't use Surfsolo service, however their proxies are probably these ones:

surfsolo.securstar.net – 67.225.141.74

surfsolo.securstar.com – 69.16.211.133

Frankly speaking I can easily understand that Mr. Hafner is going do whatever he can to protect his company from the scandal, but the “anonymous proxy” excuse is at the very least suspicious.

How does the fact that the “independent research” was semantically a product review of PhoneCrypt, along with the discovery that the author come from the SecurStar GmbH IP address offices, along with the anonymity of this Notrax guy (SecurStar calls him a “well known it security professional” in their press release..) sound to you?

It's possible that earth will get an attack from outer space that's going to destroy our life?

Statistically extremely difficult, but yes, possible. More or less like the “anonymous proxy” story told by Mr. Hafner to cover the fact that they are the ones behind the infosecurityguard.com fake “independent security review”.

Hey, I don't need anything else to convince myself or to let the smart person have his own thoughts on this.

I just think that the best way for SecurStar to get out of this mess would probably be to provide public excuses to the hacking community for abusing the name and reputation of real independent security researches, for the sake of a marketing stunt.

Salutari,

Fabio Pietrosanti

ps I am currently waiting for some other infos that will more precisely confirm that what Mr. Hafner is saying is not properly true. Stay tuned.

Tags business , encryption , hacking , marketing , Privacy , voicesecurity | Comment (0)

business interception Privacy security

Evidence that infosecurityguard.com/notrax is SecurStar GmbH Phonecrypt – A fake independent research on voice crypto

1 February 2010 – 12:32 am

Below evidence that the security review made by an anonymous hacker on http://infosecurityguard.com is in facts a dishonest marketing plan by the SecurStar GmbH to promote their voice crypto product.

I already wrote about that voice crypto analysis that appeared to me very suspicious.

Now it's confirmed, it's a fake independent hacker security research by SecurStar GmbH, its just a marketing trick!

How do we know that Infosecurityguard.com, the fake independent security research, is a marketing trick from SecurStar GmbH?

1) I posted on http://infosecurityguard.com a comments to a post with a link to my blog to that article on israelian ministry of defense certification

2) The author of http://infosecurityguard.com went to approve the comment and read the link on my own blog http://infosecurity.ch

3) Reaching my blog he leaked the IP address from which he was coming 217.7.213.59 (where i just clicked on from wordpress statistic interface)

4) On http:// 217.7.213.59/panel there is the IP PBX interface of the SecurStar GmbH corporate PBX (openly reachable trough the internet!)

5) The names of the internal PBX confirm 100% that it's the SecurStar GmbH:

Hafner : Wilfried Hafner, CEO and founder of SecurStar GmbH (linkedin profile)
Can : Can Yavuzyilman, Country Manager at SecurStar GmbH (linkedin profile)
Markus : Markus Bensinger, System Administrator at SecurStar GmbH (linkedin profile)

6) There is 100% evidence that the anonymous hacker of http://infosecurityguard.com is from SecurStar GmbH

Below the data and reference that let us discover that it's all but a dishonest marketing tips and not an independent security research.

Kudos to Matteo Flora for it's support and for his article in Debunking Infosecurityguard identity !

The http referral tricks

When you read a link going from a website to another one there is an HTTP protocol header, the “Referral”, that tell you from which page someone is going to another webpage.

The referral demonstrated that the authors of http://infosecurityguard.com read my post, because it was coming from http://infosecurityguard.com/wp-admin/edit-comments.php that's the webpage you use as a wordpress author/editor to approve/refuse comments. And here there was the link.

That's the log entry:

217.7.213.59 – - [30/Jan/2010:02:56:37 -0700] “GET /20100129/licensed-by-israel-ministry-of-defense-how-things-really-works/ HTTP/1.0″ 200 5795 “ http://infosecurityguard.com/wp-admin/edit-comments.php ” “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)”

The PBX open on the internet tell us that's SecurStar GmbH

The SecurStar GmbH PBX is open on the internet, it contains all the names of their employee and confirm us that the author of http:/infosecurityguard.com is that company and is the anonymous hacker called Notrax.

Here there is their forum post where the SecurStar GmbH guys are debugging IPCOPfirewall & Asterisk together (so we see also details of what they use) where there is the ip 217.7.213.59 .

Asta este, de asemenea, foarte distractiv!

They sell secure telephony but their company telephony system is openly vulnerable on the internet . :-)

I was thinking to call the CEO, Hafner, via SIP on his internal desktop PBX to announce we discovered him tricks.. :->

They measured their marketing activity

Looking at the logs of my website i found that they was sensing the google distribution of information for the following keywords, in order to understand how effectively they was able to attack competing products. It's reasonable, if you invest money in a marketing campaign you want to see the results :-)

They reached my blog and i logged their search:

infosecurityguard+cryptophone

infosecurityguard+gold-lock

217.7.213.59 – - [30/Jan/2010:02:22:42 -0700] “GET / HTTP/1.0″ 200 31057 “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)”

217.7.213.59 – - [30/Jan/2010:04:15:07 -0700] “GET HTTP/1.0″ 200 15774 “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)”

The domain registration data
The domain have been registered on 1st December 2009, just two months to start preparing the dishonest marketing campaign:

Domain Name: INFOSECURITYGUARD.COM

Registrar: GODADDY.COM, INC.

Updated Date: 01-dec-2009

Creation Date: 01-dec-2009

The domain is anonymously privacy protected trough a whois privacy service:

Administrative Contact: Private, Registration INFOSECURITYGUARD.COM@domainsbyproxy.com , Domains by Proxy, Inc. DomainsByProxy.com

Notrax hacker does not exist on google
As you know any hacker that get public usually have presence of it's activity on google, attending mailinglists, forum, homepage, past research, participation to conferences, etc, etc.
The fake hacker that they wanted us to to think was writing an independent blog does NOT have any trace on google. Only some hit about an anonymous browser called Notrax but nothing about that hacker.
Maybe when SecurStar provided the anonymity tool to their marketing agency, to help them protecting anonymity for the fake research, their provided them the anonymous browser notrax.So the marketing guy thinking about the nickname of this fake hackers used what? Notrax! :-)

The “independent review”completely oriented in publicizing PhoneCrypt

Of the various review don the phonecrypt review is only positive and amazing good feedback, while the other are only bad feedback and no single good point.

As you can imagine, in any kind of independent product evaluation, for all products there are goods and bad points. No. In this one there are only product that are good and product that are bad.

They missed to consider the security of the technology used by the products

They completely avoided to speak about cryptography and security of the products.

They do not evaluated basic security features that must be in that kind of products.That's in order not to let anyone see that they did not followed basic security rules in building up their PhoneCrypt.
The technology is closed source, no transparency on algorithms and protocols, no peer review.Read my new comparison (from the basic cryptographic requirement point of view) About the voice encryption analysis (criteria, errors and different results) .
The results are somehow different than their one .

UPDATE: Who's Wilfried Hafner (SecurStar founder) ?

I got a notice from a reader regarding Wilfred Hafner, SecurStar founder, CEO and security expert.

He was arrested in 1997 for telephony related fraud (check 2nd article on Phrack) earning from telephony fraud 254.000 USD causing damages to local telcos trough blueboxing for 1.15 Million USD.

He was not doing “Blueboxing” for the pleasure of phreaking and connecting with other hackers, but to earn money.

Hacking for profit (and not for fun) in 1997… brrr…. No hacker's ethic at all!

All in all, is that lawful?

Badmouthing a competitor amounts to an unfair competition practice in most jurisdictions, so it is arguable (to say the least) that SecurStar is right on a legally sound ground here.
Moreover, there are some specific statutes in certain jurisdictions which provide for a straightforward ban on the practice we are talking about. For example in the UK the British Institute of Practitioners in Advertising - in compliance with the Consumer protection from Unfair Trading regulation – ruled that:

”falsely claiming or creating the impression that the trader is not acting for the purposes relating to his trade, business, craft or profession, or falsely representing oneself as a consumer” is a criminal offense .

We have no doubt that PRPR (which is the UK-based *PR company for SecurStar GmbH, led by Peter Rennison and Allie Andrews as stated in SecurStar Press Release ) did provide their client with this information. Heck, they *are* in the UK, they simply cannot ignore that!

IANAL, but I would not be surpised if someone filed a criminal complaint or start civil litigation for unfair competition against SecurStar GmbH.
Whether this is going to be a matter for criminal and/or civil Courts or not is not that important. However, it is clear enough that SecurStar GmbH appears to be at least ethically questionable and not really worth of trust.

Nice try, gentlemen… however, next time just do it right (whether “right” for them means “in a honest manner” or “in a fashion not to be caught” I will let them choose)”

Fabio Pietrosanti (naif)

Tags business , encryption , hacking , marketing , Privacy , voicesecurity | Comments (7)

business interception Privacy security

Dishonest security: The SecurStart GmbH Phonecrypt case

1 February 2010 – 12:30 am

I would like to provide considerations on the concept of ethics that a security company should have respect to the users, the media and the security environment.

SecurStar GmbH made very bad things making that infosecuriguard.com fake independent research.

It's unfair approach respect to hacking community.

It's unfair marketing to end user. They should not be tricking by creating fake independent review.

It's unfair competition in the security market.

Let's make some more important consideration on this.

Must be serious on cryptographic products. They are not toys

When you do cryptographic tools you should be really aware of what you are doing, you must be really serious.

If you do bad crypto people could die.

If you don't follow basic security rules for transparency and security for cryptography you are putting people life at risk.

You are taking the responsibility of this. (I want to sleep at night, don't think SecurStar CEO/CTO care about this…)

Security research need reference and transparency

Security research have to be public, well done, always subject to public discussion and cooperation.
Security research should not be instrumentally used for marketing purpose.Security research should be done for awareness and grow of the knowledge of the worldwide security environment.

Hacking environment is neutral, should not be used instrumentally

Hackers are considered neutral, nerds, doing what they do for their pleasure and passion.

If you work in the security market you work with hackers.

If you use hackers and hacking environment for your own marketing purposes you are making something very nasty.

Hackers give you the technology and knowledge and you use them for your own commercial purpose.

Consideration on the authority of the information online

That's something that pose serious consideration on the authority of information online.An anonymous hacker, with no reference online, made a product security review that appear like an independent one. I have to say that the fake review was very well prepared, it always posed good/bad things in an indirect way. It did not appeared to me at 1st time like a fake. But going deeply i found what's going on.

However Journalists, news media and blogger went to the TRAP and reviewed their fake research. TheRegister, NetworkWorld and a lot of blogs reported it. Even if the author was completely anonymous.

What they have done is already illegal in UK

SecurStar GmbH is lucky that they are not in the UK, where doing this kind of things is illegal .

Fabio Pietrosanti (naif)

Tags business , hacking , marketing , Privacy , voicesecurity | Comment (0)

business interception Privacy security technology

About the SecurStar GmbH Phonecrypt voice encryption analysis (criteria, errors and different results)

30 January 2010 – 2:02 am

This article want to clarify and better explain the finding at infosecurityguard.com regaring voice encryption product evaluation.
This article want to tell you a different point of view other than infosecurityguard.com and explaining which are the rational with extensive explaination from security point of view.
Today i read news saying: “PhoneCrypt: Basic Vulnerability Found in 12 out of 15 Voice Encryption Products and went to read the website infosecurityguard .

Initially it appeared to my like a great research activity but then i started reading deeply the read about it.I found that it's not properly a security research but there is are concrete elements that's a marketing campaign well done in order to attract public media and publicize a product.
Imho they was able to cheat journalists and users because the marketing campaign was absolutely well done not to be discovered on 1st read attempt. I personally considered it like a valid one on 1st ready (they cheated me initially!).

But if you go deeply… you will understand that:
- it's a camouflage marketing initiative arranged by SecurStar GmbH and not a independent security research
- they consider a only security context where local device has been compromised (no software can be secured in that case, like saying SSL can be compromised if you have a trojan!)
- they do not consider any basic security and cryptographic security criteria

However a lot of important website reported it:

This article is quite long, if you read it you will understand better what's going on around infosecurityguard.com research and research result.

I want to to tell you why and how (imho) they are wrong.

The research missed to consider Security, Cryptography and Transparency!

Well, all this research sound much like being focused on the marketing goal to say that their PhoneCrypt product is the “super” product best of all the other ones.
Any security expert that would have as duty the “software evaluation” in order to protect the confidentiality of phone calls will evaluate other different characteristics of the product and the technology.

Yes, it's true that most of the product described by SecurStar in their anonymous marketing website called http://infosecurityguard.com have some weakness.
But the relevant weakness are others and PhoneCrypt unfortunately, like most of the described products suffer from this.
Let's review which characteristics are needed basic cryptography and security requirement (the best practice, the foundation and the basics!)

a – Security Trough Obscurity does not work

A basic rule in cryptography cames from 1883 by Auguste Kerckhoffs:

In a well-designed cryptographic system, only the key needs to be secret; there should be no secrecy in the algorithm.

Modern cryptographers have embraced this principle, calling anything else “security by obscurity.”

Read what Bruce Schneir, recognized expert and cryptographer in the world say about this

Any security expert will tell you that's true. Even a novice university student will tell you that's true. Simply because that's the only way to do cryptography.

Almost all product described in the review by SecurStar GmbH, include PhoneCrypt, does not provide precise details about their cryptographic technologies.

Precise details are:

Detailed specification of cryptographic algorithm (that's not just saying “we use AES “)
Detailed specification of cryptographic protocol (that's not just saying “we use Diffie Hellman ” )
Detailed specification of measuring the cryptographic strenght (that's not just saying “we have 10000000 bit key size “)

Providing precise details means having extensive documentation with theoretical and practical implications documenting ANY single way of how the algorithm works, how the protocol works with precise specification to replicate it for interoperability testing.
It means that scientific community should be able to play with the technology, audit it, hack it.
If we don't know anything about the cryptographic system in details, how can we know which are the weakness and strength points?

Mike Fratto, Site editor of Network Computing, made a great article on “Saying NO to proprietary cryptographic systems” .
Cerias Purdue University tell this .

b – NON peer reviewed and NON scientifically approved Cryptography does not work

In any case and in any condition you do cryptography you need to be sure that someone else will check, review, analyze, distruct and reconstract from scratch your technology and provide those information free to the public for open discussion.
That's exactly how AES was born and like US National Institute of Standard make crypto does (with public contest with public peer review where only the best evaluated win).
A public discussion with a public contest where the a lot of review by most famous and expert cryptographer in the world, hackers (with their name,surname and face, not like Notrax) provide their contribution, tell what they thinks.
That's called “peer review”.

If a cryptographic technology has an extended and important peer review, distributed in the world coming from universities, private security companies, military institutions, hackers and all coming from different part of the world (from USA to Europe to Russia to South America to Middle east to China) and all of them agree that a specific technology it's secure…
Well, in that case we can consider the technology secure because a lot of entities with good reputation and authority coming from a lot of different place in the world have publicly reviewed, analyzed and confirmed that a technology it's secure.

How a private company can even think to invent on it's own a secure communication protocol when it's scientifically stated that it's not possible to do it in a “proprietary and closed way” ?
IBM tell you that peer review it's required for cryptography .
Bruce Schneier tell you that “Good cryptographers know that nothing substitutes for extensive peer review and years of analysis.”
Philip Zimmermann will tell you to beware of Snake Oil where the story is: “Every software engineer fancies himself a cryptographer, which has led to the proliferation of really bad crypto software.”

c – Closed source cryptography does not work

As you know any kind of “serious” and with “good reputation” cryptographic technology is implemented in opensource.
There are usually multiple implementation of the same cryptographic algorithm and cryptographic protocol to be able to review all the way it works and certify the interoperability.
Supposing to use a standard with precise and extended details on “how it works”, that has been “peer reviewed” by the scientific community BUT that has been re-implemented from scratch by a not so smart programmer and the implementation it's plenty of bugs.

Well, if the implementation is “opensource” this means that it can be reviewed, improved, tested, audited and the end user will certaintly have in it's own had a piece of technology “that works safely” .

Google release opensource crypto toolkit
Mozilla release opensource crypto toolkit
Bruce Schneier tell you that Cryptography must be opensource .

Another cryptographic point of view

I don't want to convince anyone but just provide facts related to science, related to cryptography and security in order to reduce the effect of misinformation done by security companies whose only goes is to sell you something and not to do something that make the world a better.

When you do secure products, if they are not done following the proper approach people could die.
It's absolutely something irresponsible not to use best practice to do crypto stuff.

To summarize let's review the infosecurityguard.com review from a security best pratice point of view.

Product name	Security Trough Obscurity	Public peer review	Open Source	Compromise locally?
Caspertec	Obscurity	No public review	Closed	Da
CellCrypt	Obscurity	No public review	Closed	Da
Cryptophone	Transparency	Limited public review	Public	Da
Gold-Lock	Obscurity	No public review	Closed	Da
Illix	Obscurity	No public review	Closed	Da
No1.BC	Obscurity	No public review	Closed	Da
PhoneCrypt	Obscurity	No public review	Closed	Da
Rode&Swarz	Obscurity	No public review	Closed	Da
Secure-Voice	Obscurity	No public review	Closed	Da
SecuSmart	Obscurity	No public review	Closed	Da
SecVoice	Obscurity	No public review	Closed	Da
SegureGSM	Obscurity	No public review	Closed	Da
SnapCell	Obscurity	No public review	Closed	Da
Tripleton	Obscurity	No public review	Closed	Da
Zfone	Transparency	Public review	Open	Da
ZRTP	Transparency	Public review	Open	Da

*Green means that it match basic requirement for a cryptographic secure system

* Red / Broken means that it does not match basic requirement for a cryptographic secure system

That's my analysis using a evaluation method based on cryptographic and security parameters not including the local compromise context that i consider useless.

However, to be clear, those are only basic parameters to be used when considering a voice encryption product (just to avoid being in a situation that appears like i am promoting other products). So it may absolutely possible that a product with good crypto ( transparency, peer reviewed and opensource) is absolutely a not secure product because of whatever reason (badly written, not usable causing user not to use it and use cleartext calls, politically compromised, etc, etc).
I think i will prepare a broader criteria for voice crypto technologies and voice crypto products, so it would be much easier and much practical to have a full transparent set of criterias to evaluate it.

But those are really the basis of security to be matched for a good voice encryption system!
Read some useful past slides on security protocols used in voice encryption systems (2nd part).

Now read below some more practical doubt about their research.

The security concept of the review is misleading: any hacked device can be always intercepted!

I think that the guys completely missed the point: ANY KIND OF SOFTWARE RUNNING ON A COMPROMISED OPERATING SYSTEM CAN BE INTERCEPTED

Now they are pointing out that also Zfone from Philip Zimmermann is broken (a pc software), just because they install a trojan on a PC like in a mobile phone?
Any security software rely on the fact that the underlying operating system is somehow trusted and preserve the integrity of the environment where the software run.

If you have a disk encryption system but your PC if infected by a trojan, the computer is already compromised.
If you have a voice encryption system but your PC is infected by a trojan, the computer is already compromised.
If you have a voice encryption system but your mobile phone is infected by a trojan, the mobile phone is already compromised.

No matter which software you are running, in such case the security of your operating environment is compromised and in one way or another way all the information integrity and confidentiality is compromised.

Like i explained above how to intercept PhoneCrypt.

The only things that can protect you from this threat is running in a closed operating system with Trust Computing capability, implementing it properly.
For sure on any “Open” operating system such us Windows, Windows Mobile, Linux, iPhone or Android there's no chance to really protect a software.
On difficult operating system such as Symbian OS or RimOS maybe the running software can be protected (at least partially)

That's the reason for which the security concept that guys are leveraging to carry on their marketing campaign has no clue.
It's just because they control the environment, they know Flexispy software and so they adjusted their software not to be interceptable when Flexispy is installed.
If you develop a trojan with the other techniques i described above you will 100% intercept PhoneCrypt.

On that subject also Dustin Tamme l, Security researcher of BreakPoint Systems , pointed on on VoIP Security Alliance mailing lists that the security analysis is based on wrong concepts .

The PhoneCrypt can be intercepted: it's just that they don't wanted to tell you!

PhoneCrypt can be intercepted with “on device spyware”.
Why?
Because Windows Mobile is an unsecure operating environment and PhoneCrypt runs on Windows Mobile.
Windows Mobile does not use Trusted Computing and so any software can do anything.
The platform choice for a secure telephony system is important.
Cum?
I quickly discussed with some knowledgeable windows mobile hackers about 2 different way to intercept PhoneCrypt with an on-device spyware (given the unsecure Windows Mobile Platform).

a) Inject a malicious DLL into the software and intercept from within the Phonecrypt itself.

In Windows Mobile any software can be subject to DLL code injection.

Ce, un atacator poate face este de a injecta în software-ul PhoneCrypt (sau orice software care rulează pe telefon), prindere funcţiile audio conexe care acţionează ca un "proxy funcţie" între PhoneCrypt şi API-ul real pentru a înregistra / reda audio.

Este o chestiune de "prindere", doar 2 funcţii, una care şi înregistrare audio care o joc.

Citiţi documentaţia oficială Microsoft pe modul de a face injectare DLL pe Windows Mobile procese. sau forum discuta tehnica de injectare DLL asupra proceselor de Windows Mobile.

Asta e simplu, orice programator va va spune să facă acest lucru.

Ei au pur şi simplu a decis că e mai bine să nu facă nici o notificare cu privire la acest lucru.

b) Crearea unui nou driver audio, care acţionează pur şi simplu ca un proxy de real şi de interceptare PhoneCrypt

În Windows Mobile puteţi crea noi drivere audio si filtre noi audio.

Ce, un atacator poate face este de a încărca un driver audio nou, care nu face nimic altceva decât trecerea funcţie reală driverul audio la / de la RealOne. Între timp, în tot ceea ce intercepta înregistrate şi a jucat tot :-)

Aici este un exemplu privind modul de a face driver audio pentru Windows Mobile .

Aici, un software care pun în aplicare ceea ce am explicat aici pentru Windows "Cablu audio Virtual" .

Conceptul acelasi aplică la Windows Mobile. Verificaţi cartea "Atac malware-ului mobil şi apărare" , la care se leagă de a explica tehnicile de a juca cu aceste tehnici.

Ei au pur şi simplu a decis că e mai bine să nu facă nici o notificare pentru acest mod de a intercepta convorbiri telefonice pe PhoneCrypt.

Acestea sunt doar 2 idei rapide, mai poate fi, probabil, face.

Suna mai mult ca o activitate de marketing - nu o cercetare de securitate.

Am să vă spun. Am analizat problema foarte mare atenţie şi pe cele mai multe aspecte. Toate aceste lucruri legate de analiza de criptare voce sună pentru mine ca o campanie de marketing de SecurStar GmbH a vinde PhoneCrypt şi să câştige reputaţie. O campanie bine articulat şi bine pregătiţi pentru a atrage mass-media spune, într-un mod indirect inseala mass-media, care PhoneCrypt este doar un sigur. Puteţi vedea comunicatele de presă ale SecurStar şi de "securitate Notrax cercetător spune că PhoneCrypt este singurul produs sigur" . SecurStar PhoneCrypt este singurul produs hacker anonim "Notrax", considera sigure de "solutii software".
Doar "versiunea software-ului", în concurenţă cu:

- SnapCell - nimeni nu o poate cumpăra. O companie de securitate care nu a avut nici o pagină web mai. Compania nu există aproape mai.

- Rohde-schawarz - O companie care au în lista de preţuri său şi vechiul telefon hardware-ul vechi sigure . Nimeni nu ar cumpara aceasta, nu e bine pentru utilizarea genuri.

Are suna ciudat că numai aceste produse sunt considerate sigure de alte împreună cu PhoneCrypt.

De asemenea, ... sa verifice tipul de conţinut multimedia în comentarii cu diferite disponibile de aur-Lock, Cellcrypt şi Phonecrypt , în scopul de a înţelege cât de mult cei de marketing presate pentru a face revizuirea PhoneCrypt cele mai atractive:

Cerere	Imagini de aplicare	Video cu demonstraţia de interceptare	Reţea de demonstraţie
PhoneCrypt	5	0	1
CellCrypt	0	2	0
GoldLock	1	2	0

Este clar că PhoneCrypt este revizuită prezintă mai multe caracteristici în mod explicit prezentate majore de securitate şi descrierea caracteristicilor produsului decât celălalt.

Diferenţa prea mare între ele, ar trebui să bănuim că este un Sfaturi de marketing?

Dar, din nou, de alte lucruri ciudate analiza modul în care a fost făcut ...
Dacă a fost "o analiză imparţială şi neutră" ar trebui să vedem lucrurile bune şi rele pe toate produsele potrivite?

Ok, a se vedea tabelul de mai jos în ceea ce priveşte avizul indicate în fiecare punctul de clienţi diferite disponibile de aur-Lock, CellCrypt şi Phonecrypt (sunt disponibile numai), pentru a vedea dacă sunt pozitive sau negative.

Cerere	Numărul de punctele	Punctele pozitive	Punctele negative	Punctele neutre
PhoneCrypt	9	9	0	0
CellCrypt	12	0	10	2
GoldLock	9	0	8	1

Analiza detaliată punctele avizul Phonecrypt

Punctul de revizuire	Opinia exprimată
De la site-ul lor	Feedback-ul pozitiv de marketing
Apple iPhone	Feedback-ul pozitiv de marketing
Disk Encryption sau criptare voce	Feedback-ul pozitiv de marketing
PBX de compatibilitate? Într-adevăr	Feedback-ul pozitiv de marketing
Cracking <10. Nu.	Feedback-ul pozitiv de marketing
Bune de gândire!	Feedback-ul pozitiv de marketing
Un pic de reţea de acţiune	Feedback-ul pozitiv de marketing
UI	Feedback-ul pozitiv de marketing
Bun gust	Feedback-ul pozitiv de marketing

Analiza detaliată punctele avizul de aur-Lock 3G

Punctul de revizuire	Opinia exprimată
De la site-ul lor	Feedback-ul negativ de marketing
Licenţiat de Ministerul israelian al Denfese	Feedback-ul negativ de marketing
Compania Real sau partea hobby Ora	Feedback-ul negativ de marketing
16.000 biţi autentificare	Feedback-ul negativ de marketing
DH 256	Feedback-ul negativ de marketing
Downad & Instalare!	Neutru feedback-ul de marketing
Cracking o <10	Feedback-ul negativ de marketing
Marketing BS101	Feedback-ul negativ de marketing
Misto video de chestii	Feedback-ul negativ de marketing

Analiza detaliată punctele avizul CellCrypt

Punctul de revizuire	Opinia exprimată
De la site-ul lor	Neutru feedback-ul de marketing
Un pic de fond despre cellcrypt	Feedback-ul negativ de marketing
Maestru de Marketing	Feedback-ul negativ de marketing
Secure Apelare vocală	Feedback-ul negativ de marketing
Cine cumpără marfa lor,	Feedback-ul negativ de marketing
Downad & Instalare!	Neutru feedback-ul de marketing
Demo mea de mediu	Feedback-ul negativ de marketing
Au uitat un cod	Feedback-ul negativ de marketing
Cracking o <5	Feedback-ul negativ de marketing
Cameră de monitorizare w / ClickAPEL	Feedback-ul negativ de marketing
Cellcrypt caracteristici unice ..	Feedback-ul negativ de marketing
Plain Old interceptarea	Feedback-ul negativ de marketing
Cele Haters acolo	Feedback-ul negativ de marketing

Acum este clar că, din punctul lor de vedere cu privire la PhoneCrypt nu există nici un singur punct de rău în timp ce altele sunt întotdeauna descrise într-un mod negativ.
Nici un singur punct bun. Ciudat?
Toate aceste consideraţii, împreună cu cele urmatoarele să ma gândesc că e foarte probabil, o analiză de marketing şi nu o revizuire independentă.

Alte comercializare încercare similară de la SecurStar

SecurStar GmbH este cunoscut pentru a fi utilizate în activitatea de marketing trecut pârghie acest tip de "speculaţii tehnice", abuzând de informaţii parţiale şi fals lucruri neconfirmate de hacking pentru a face de comercializare / mass-media.
IMHO un amestec rar de nedreptate în pârghie dificil pentru oameni să înţeleagă cu adevărat complexitatea de securitate şi criptografie.

Ei au deja utilizate în activităţile de marketing trecut ca unul despre crearea unui troian pentru Windows Mobile şi spunând că software-ul lor este sigur de troian care ei au scris.
Citiţi despre trucurile lor de marketing ale anului 2007

Ei au dezvoltat un troian (RexSpy) pentru Windows Mobile, a făcut o demonstraţie de capacitatea de troian şi mai târziu a spus că a inclus "Anti-troian", capacitatea lor PhoneCrypt software.They nu a lansat informatii cu privire la acest troian, nu chiar a demonstrat că există .

Cercetătorul Collin Mulliner a spus că în momentul în care sună ca un Sfaturi de marketing (de asemenea, pentru că el nu a reuşit să obţină de la SecurStar CEO Hafner orice informaţii despre acest troian):

“This makes you wonder if this is just a marketing thing.”

Now, let's try to make some logical reassignment.
It's part of the way they do marketing, an very unfriendly and unpolite approach with customers, journalist and users trying to provide wrong security concepts for a market advantage. Being sure that who read don't have all the skills to do in depth security evaluation and find the truth behind their marketing trips.

Who is the hacker notrax?

It sounds like a camouflage of a fake identity required to have an “independent hacker” that make an “independent review” that is more strong on reputation building.
Read about his bio:

¾ Human, ¼ Android (Well that would be cool at least.) I am just an enthusiast of pretty much anything that talks binary and if it has a RS232 port even better. During the day I masquerade as an engineer working on some pretty cool projects at times, but mostly I do the fun stuff at night. I have been thinking of starting an official blog for about 4.5 years to share some of the things I come across, can't figure out, or just cross my mind. Due to my day job and my nighttime meddling, I will update this when I can. I hope some find it useful, if you don't, well you don't.

There are no information about this guy on google.
Almost any hacker that get public have articles online, post in mailing archive and/or forum or some result of their activity.
For notrax, nothing is available.

Additionally let's look at the domain…
The domain infosecurityguard.com is privacy protected by domainsbyproxy to prevent understanding who is the owner.
The domain has been created 2 months ago on 01-Dec-09 on godaddy.com registrar.

What's also very interesting to notice that this “unknown hacker with no trace on google about him that appeared on December 2009 on the net” is referred on SecurStar GmbH Press Release as a “An IT security expert”.

Maybe they “know personally” who's this anonymous notrax? :)

Am i following my own conspiracy thinking or maybe there's some reasonable doubt that everything was arrange in that funny way just for a marketing activity?

Social consideration

If you are a security company you job have also a social aspects, you should also work to make the world a better place (sure to make business but “not being evil”). You cannot cheat the skills of the end users in evaluating security making fake misleading information.

You should do awareness on end users, to make them more conscious of security issues, giving them the tools to understand and decide themselves.

Hope you had fun reading this article and you made your own consideration about this.

Fabio Pietrosanti (naif)

ps Those are my personal professional opinion, let's speak about technology and security, not marketing.
pps i am not that smart in web writing, so sorry for how the text is formatted and how the flow of the article is unstructured!

Tags business , encryption , marketing , mobile , Privacy , voicesecurity , zrtp | Comments (4)

business management

Index of economic freedom

21 December 2009 – 11:43 am

When looking at facts and figures about globalized world, the index of economic freedom is a nice tool to make proper considerations.

Tags business , civilrights , management , policy | Comment (0)

business management security

Military contractors going commercial

10 November 2009 – 11:48 am

Most military contractors are suffering from the restriction of government's budgets for military expenses and are moving into commercial markets, still they have to adjust a lot of things.

Read here a nice analysis from rochtel on how military contractors should adapt their strategy.

Tags business , management | Comment (0)

business security technology

Iphone jailbreaking crashing towers? FUD!

30 July 2009 – 9:14 am

It's interesting to read a news about an anti-jailbreaking statement by apple that say that with jailbreaked phones it may be possible to crash mobile operator's towers:

By tinkering with this code, “a local or international hacker could potentially initiate commands (such as a denial of service attack) that could crash the tower software, rendering the tower entirely inoperable to process calls or transmit data,”

So fun, as the Baseband Processor interface of iPhone is precisely the same of Google android and all Windows Mobile powered devices:

Basically the operating system use AT commands (do you remember old hayes modem commands?) with additional parameters documented and standardized by 3GPP that let more deep (but not that much deep) interaction with the mobile networks.

Please note that those AT commands are standard and widely available on all phones and are the interface to the Baseband Processor .

On iPhone that's the list of commands that an from apple point of view could let “a international hacker to crash the tower software” :

Undocumented commands on iPhone

Damn, those European anarchist of Nokia are providing publicly also their AT command sets, and are AVAILABLE TO ANYONE:

Nokia AT Commands

Oh jesus! Also the terrorist oriented Microsoft corporation let third party to use AT commands:

Windows Mobile AT Commands

It's absolutely unacceptable that also RIM, canadian funky against USA, provide access to AT commands:

Blackberry AT commands

And it's unbelivable to see that Google Android also document how the system speak to the Baseband Processor and find on forums that it's ease to access it:

Google Android Basedband Processor

Not to speak to ALL other mobile manufactuer that use the very same approach and let any party to speak via AT commands to the baseband processor of the phone.

Is the baseband processor of iphone buggy and the AT&T tower software buggy so that it's dangerous to let the user make experiment with it?

Probably yes, and so those are only excuse because the software involved are not robust enough.

Apple, be careful, you have the trust of your users because you are apple you always have done things for the user advantages.

Users does like telephone companies that are huge lobbies that try to restrict and control users as much as possible.

If you, Apple, start behaving like a phone company users will not trust you anymore.

Be careful with FUD statements.

Tags business , hacking , mobile | Comment (0)

business cybercrime cyberwarfare management

chinese espionage: the worst and more silent threat for western countries

27 July 2009 – 10:03 pm

Hi all,

in the past few years i saw an incredible increase in the amount of “public” news about espionage against different western countries and usually coming from far-east, typically china.

China want to be the largest economic power within 2020 and it's following a grow rate of 8% per year. Their “controlled” capitalism without the inefficiency of the democracy it's something that's beating the western countries, less efficient because democratic.

China, in order to quickly grow it's R&D capacity make an extensive use of espionage, it's estimated that Chinese government have more than 1.000.000 intelligence agents worldwide.

And they know how to do espionage, their “spy” does not cost that much like western countries' spy, less guarantee, less payments.

Also they are using cyber espionage as an important source of information and competitiveness against western countries companies and government R&D results. China is so un-cooperative that now also western countries spying each other, or even Russian, use chinese internet space as the “start base” for their internet based espionage activities.

I knew of a USA phisher that used to build it's own trojan with a chinese version of Windows Xp with a chinese version of the Microsoft Visual Studio development suite. De ce? For information deception, in order to tweak the forensics effort of the FBI analyst and have them think that it's own attacks was coming from China!

Any investigators that see an attack coming from china typically think “oh shit, it comes from china, we're lost”, and now even cybercrime use China like a far-west, untouchable base for cyber attacks.

Back tracing attacks coming from china it's like trying to find out what's inside a black hole , it's a one-way trip and no information comes back.

To give better an idea of what i am speaking about just get the following list of reference:

Germany accuses China of industrial espionage

Chinese trainee goes on trial as French industry fears espionage

US Vulnerable to Chinese Cyber Espionage

Massive Chinese Espionage Network

Cyber Spy Network Also Targetting Finland

How do the western countries defend themself?

That's a nice points to speak about because there's no simple way to defend against espionage other than considering it like a serious and concrete threat.

Governments should be able to get more understanding that their approach to informations systems and information security policy must not only exists on paper but also be applied everywhere in order to be effective. Governments are complex organizations and only a few are enough smart to be able to quickly and efficiently make security policies really be implemented organization-wide. But they are trying to, especially the most competitive ones like USA, UK and Germany .

Companies instead should acquire awareness of the problem that is present, available, concrete as concrete is the chance that someone enter into the offices to steal good (not for espionage). For that reason companies place alarm systems, access control with badge, camera monitoring systems.

But espionage does not mean fighting and protecting against poor thieves but instead against more sophisticated, either technically and socially, attacker that can use old school intelligence techniques always effective. Getting employed and stealing information while working. Simulate to be customers to establish a link trust with a salesman and then find a reason to let him execute some malicious software “hey, but my modellization software demostrate that your model used to measure the performance of your product it's not the one you advertised. Check it out, see your self with the software we used!” . What do you think the salesman will do in order to catch the prospect customer?

Only awareness, knowledge about the issues can make such risk to be considered seriously.

Governments should provide financing to industrial associations, chamber of commerces and similar agencies in order to make such awareness national wide and let entrepreneurs became conscious and became prepared to recognize, identify and stop espionage activities.

The law perspective

Governments should strenghten their laws in order to be able have the required rights tools to enforce the protection from espionage.

Look at the analysis made by my smart cousin Angelo Pietrosanti on espionage “Is the European R&D Equally protected from espionage as in the US R&D?”

Ţară	Civil Sanction against trade secret threat	Criminal Sanction against trade secret threat	Year of last modificationg
Statele Unite ale Americii	5 mln $	up to 10(for domenistic) or 15 (for foreigners) Years of Jail	1996 ( Economic Espionage Act )
Germania	YES	up to 3 Years of Jail	1986
Franţa	0.03 mln $	up to 2 Years of Jail	1992
Regatul Unit	YES	NO	1984
Italia	YES	up to 2 Years of Jail	1942
Elveţia	YES	up to 3 Years of Jail	1986
Finlanda	YES	up to 3 Years of Jail	1990
Suedia	YES	up to 6 Years of Jail	1990
The Netherlands	YES	up to 4 Years of Jail	1992

What this table show?

Outdated law (except USA)
Not so serious sanctions against espionage activities. (except USA)

Maybe some european policy on this could help.

In conclusion

We are in an economic war where the winner is not the one having more forces, but the one being more technologically advanced, and economically clever.

Chinese are demonstrating to be enough aggressive and clever, will the western countries be able to react both on the defense and the attack in this war?

Tags business , cybercrime , cyberwarfare , management , policy | Comment (0)

business cybercrime

Criminal business model: Somali pirate case study

27 July 2009 – 10:00 pm

Hi all,

this blog post is to have a nice economical point of view on somali pirates business model, something nice as also crime is a business and need it's business evaluation:

An economic Analysis of Somali Pirates Business Model

It sounds much like a great deal, check it out the details:

The attack model and costs

The negotiation phase (Offer and Counter offer)

The resolution

And for the pleasure of home gamer, Cuttrhouat Capitalism: the game

Tags business , cybercrime | Comment (0)

business technology

Nokia World in Stuttgard 2-3 September

11 July 2009 – 3:46 pm

Everyone who's business is directly connected to mobile, aggregators, operators and generally speaking mobility application should really attend Nokia World where most of the world key people in the mobile business .

It's extremely interesting to see the evolution of the business models related to the Application Portals, how the mobile operators are changing their approach to the market, the increasing of value added services related to mobile industry.

And the most important things is, the mobile operators will be able to became financial operators to really provide mobile payment systems integrated into any day digital life?

And if this will happen, how the manufacturer and operating system provider will play this game?

Tags business , mobile | Comment (0)

business technology

Saas: is the end of the myth?

10 July 2009 – 7:00 am

Saas business models growth a lot during the past few years and i personally appreciate it.

No software to be installed, configured, maintained, service available when you needed with a early adoption time and most important reduction (or apparent reduction) of the total costs of ownership.

I had few experience with SaaS business (as a customer) and i have to say that the following Gartner Group analysis on SaaS businesses imho tell you the truth only for half of statements:

There is always a partial integration issue (not all systems are so flexible to really integrate into your business like you would like)
There is often a lacks of the technical requirements needed by the specific business case
I DO NOT agree that there is a barrier in the costs, as SaaS usually let you start spending only a few. However it's true that while doing the deployment you should be more conservative in the usage of features and items (es: I am using for my company a hosted VoIP PBX system, we pay for each extension we add. We don't have test extension or extensions that are not strictly needed because it costs. When we had an internal VoIP PBX system, we was plenty of test extension. This slightly increase some complexity in maintenance and deployment, even if the total cost of maintenance is a lot lower than an internal system to be managed.

So we can assume that Saas it's for most but not for all, especially if the need of customizations for the very specific business needs are relevant.

An in depth analysis and testing has to be carried on, in order to discover all the limits of the solution, on functionalities and pricing, to really discover if the specific solution fit the business need.

Tags business , marketing | Comment (0)

business management

Best advices by world leaders

10 July 2009 – 6:36 am

Today i found a very nice set of 22 'best advices' on Fortune coming from world leaders and i would really like to link there some of the most interesting ones (at least for me).

I think that those suggestion let you work and manage your projects and goals (in any situation you play a leadership role, being business or personal stuff) in a proper, rational and effective way.

Colin Powel: Focus on performance, not power

Jim Sinegal: Show, don't tell

Mort Zuckerman: Do what you love

Meredith Whitney: Always set realistic goals

Lauren Zalaknick: Listen (others opinion)

Robin Li: Underpromise and overdelivery (while running a company)

Mika Brzezinski: Use failure to motivate yourself

Tags business , management | Comment (0)

business management technology

The real goal of online marketing: lead generation

7 July 2009 – 7:57 am

Often i discuss about online marketing, however it include the mysterious “marketing” magic word that's tipically subject to misunderstanding and misconception .

The end goal of online marketing is to generate qualified leads coming from international markets.

Some interesting links about it, and how things should be properly done are below:

I would really like to see an effective leverage of online techniques and tools as the main interface and providers of information, the main pre-sales agent of the company explaining almost everything required to get back a qualified lead.

Tags business , management , marketing | Comment (0)

business cyberwarfare intelligence interception Privacy security

Voice encryption in government sectors

6 July 2009 – 11:02 pm

I will make some in depth articles about how voice encryption really works in government environments.

The open standards and open source still have to reach the military and government environments for what's related to secure speech.

To give you an idea of the complexity and kind of particular issues that exists, look at the USA 3G Wireless Security: A Government Perspective and the A Waveform Architecture to Support Security and Interoperability in Multi-National Wireless Networks for Tactical Communication .

They are using so-custom protocols like Secure Communications Interoperability Protocol that require the use of patented MELPe ultra-narrowband codec that there's not a real market of application and equipment using this. Only a small elite of government controlled companies from few countries manage this de-facto lobby.

Should we change this bringing open standards also to government sectors?

Tags business , cyberwarfare , Privacy , voicesecurity | Comment (0)

business management

Product Management

6 July 2009 – 10:50 pm

You know, product management it's a job for half-fish, half-meat guys, that understand both business needs and technology issues.

I found two amazing and very well done presentations about it, i suggest to read it as it clarify a lot of things of the marketing and technical activities applied to the management of products inside companies to reach the market.

The strategic Role of Product Management

Very in depth presentation. Ask yourself, do you know what's the differences between marketing and promotions, sales, advertising? How to really manage the core of the company, the product?

Strategic Role – Product Management

View more presentations from Afzal Khan .

Product Management for BrainMates

Very smooth presentation going to the point: A product is the tiny overlap between the needs of a business, the aspirations of it's development team and the unsatisfied desires of the customer.

Product Management For Brainmates

View more presentations from Alan Jones .

Tags business , management | Comment (0)

Playhouse de intimitate, securitate, hacking, criptare, informaţii şi unele lucruri de afaceri

Tag Archives: afaceri

De management de produs şi de organizare

Şarpe-ulei de securitate susţine pe cripto produs de securitate

Blackberry de securitate şi criptare: Diavolul sau înger?

China Criptare Regulamentele

Discuţie Mobile Security WHYMCA la conferinţă

SecurStar GmbH Phonecrypt răspunsuri cu privire la caz Infosecurityguard / Notrax: absolut nerezonabil! :-)

Evidence that infosecurityguard.com/notrax is SecurStar GmbH Phonecrypt – A fake independent research on voice crypto

Dishonest security: The SecurStart GmbH Phonecrypt case

About the SecurStar GmbH Phonecrypt voice encryption analysis (criteria, errors and different results)

The research missed to consider Security, Cryptography and Transparency!

a – Security Trough Obscurity does not work

b – NON peer reviewed and NON scientifically approved Cryptography does not work

c – Closed source cryptography does not work

Another cryptographic point of view

The security concept of the review is misleading: any hacked device can be always intercepted!

The PhoneCrypt can be intercepted: it's just that they don't wanted to tell you!

Suna mai mult ca o activitate de marketing - nu o cercetare de securitate.

Diferenţa prea mare între ele, ar trebui să bănuim că este un Sfaturi de marketing?

Alte comercializare încercare similară de la SecurStar

Who is the hacker notrax?

Social consideration

Index of economic freedom

Military contractors going commercial

Iphone jailbreaking crashing towers? FUD!

chinese espionage: the worst and more silent threat for western countries

Criminal business model: Somali pirate case study

Nokia World in Stuttgard 2-3 September

Saas: is the end of the myth?

Best advices by world leaders

The real goal of online marketing: lead generation

Voice encryption in government sectors

Product Management

Traducător

Despre

Stare de nervozitate

Posturi recente