В этой статье хочу уточнить и лучше объяснить нахождение в infosecurityguard.com regaring шифрования голоса для оценки продукции.
В этой статье хочу рассказать вам другую точку зрения, кроме infosecurityguard.com и объяснения, которые рационально с большим объяснений с точки зрения безопасности.
Сегодня я прочитал новости словами: "PhoneCrypt: основные уязвимости найдены в 12 из 15 продуктов шифрования речи и пошел читать сайт infosecurityguard .
Первоначально он появился в моей как большой научно-исследовательской деятельности, но потом я начал читать глубоко чтения о it.I обнаружили, что это не правильно исследований в области безопасности, но там конкретные элементы, что это маркетинговая кампания хорошо сделано в целях привлечения средств массовой информации и пропаганды продукта.
Imho они были в состоянии обмануть журналистов и пользователей, поскольку маркетинговая кампания была абсолютно хорошо сделано, чтобы не быть обнаружены на 1 читать попытку. Я лично считал, как допустимым на 1 готовы (они обманули меня сначала!).
Но если вы идете глубоко ... Вы поймете, что:
- Это инициатива камуфляж маркетинга организована SecurStar GmbH, а не независимые исследования безопасности
- Они считают только контекст безопасности, где местные устройство было скомпрометировано (программное обеспечение не может быть обеспечена в том случае, как говорят SSL может быть нарушена, если у вас есть троян!)
- Они не учитывают основных безопасности и криптографической критериям безопасности
Однако многие важные веб-сайт сообщил об этом:
Эта статья довольно долго, если вы читаете это вы будете лучше понимать, что происходит вокруг infosecurityguard.com исследования и результаты.
Я хочу рассказать вам, почему и как (имхо) они не правы.
Исследование пропустил рассмотреть безопасности, криптографии и прозрачность!
Ну, все эти исследования так же, как звук уделяется маркетинговой целью сказать, что их PhoneCrypt продукт «супер» продукт лучше всех остальных.
Любой эксперт по вопросам безопасности, что бы как долг "программное обеспечение оценки» для того, чтобы защитить конфиденциальность телефонных звонков будет оценивать других различных характеристик продукта и технологии.
Да, это правда, что большинство продуктов описывается SecurStar в своих анонимных веб-сайт маркетинговой называется http://infosecurityguard.com есть некоторые слабости.
Но соответствующие слабость и другие, и PhoneCrypt к сожалению, как и большинство из описанных продуктов страдают от этого.
Давайте рассмотрим, какие характеристики необходимы основные криптографические алгоритмы и требования (лучшие практики, фундамент и основы!)
- Безопасность прогиба Неизвестность не работает
Основное правило в предоставляемого вместе криптографии с 1883 по Kerckhoffs Огюст:
In a well-designed cryptographic system, only the key needs to be secret; there should be no secrecy in the algorithm.
Modern cryptographers have embraced this principle, calling anything else “security by obscurity.”
Read what Bruce Schneir, recognized expert and cryptographer in the world say
about this Any security expert will tell you that's true. Even a novice university student will tell you that's true. Simply because that's the only way to do cryptography.
Almost all product described in the review by SecurStar GmbH, include PhoneCrypt, does not provide precise details about their cryptographic technologies.
Precise details are:
- Detailed specification of cryptographic algorithm (that's not just saying “we use AES “)
- Detailed specification of cryptographic protocol (that's not just saying “we use Diffie Hellman ” )
- Detailed specification of measuring the cryptographic strenght (that's not just saying “we have 10000000 bit key size “)
Providing precise details means having extensive documentation with theoretical and practical implications documenting ANY single way of how the algorithm works, how the protocol works with precise specification to replicate it for interoperability testing.
It means that scientific community should be able to play with the technology, audit it, hack it.
If we don't know anything about the cryptographic system in details, how can we know which are the weakness and strength points?
Mike Fratto, Site editor of Network Computing, made a great article on “Saying NO to proprietary cryptographic systems” .
Cerias Purdue University tell this .
b – NON peer reviewed and NON scientifically approved Cryptography does not work
In any case and in any condition you do cryptography you need to be sure that someone else will check, review, analyze, distruct and reconstract from scratch your technology and provide those information free to the public for open discussion.
That's exactly how AES was born and like US National Institute of Standard make crypto does (with public contest with public peer review where only the best evaluated win).
A public discussion with a public contest where the a lot of review by most famous and expert cryptographer in the world, hackers (with their name,surname and face, not like Notrax) provide their contribution, tell what they thinks.
That's called “peer review”.
If a cryptographic technology has an extended and important peer review, distributed in the world coming from universities, private security companies, military institutions, hackers and all coming from different part of the world (from USA to Europe to Russia to South America to Middle east to China) and all of them agree that a specific technology it's secure…
Well, in that case we can consider the technology secure because a lot of entities with good reputation and authority coming from a lot of different place in the world have publicly reviewed, analyzed and confirmed that a technology it's secure.
How a private company can even think to invent on it's own a secure communication protocol when it's scientifically stated that it's not possible to do it in a “proprietary and closed way” ?
IBM tell you that peer review it's required for cryptography .
Bruce Schneier tell you that “Good cryptographers know that nothing substitutes for extensive peer review and years of analysis.”
Philip Zimmermann will tell you to beware of Snake Oil where the story is: “Every software engineer fancies himself a cryptographer, which has led to the proliferation of really bad crypto software.”
c – Closed source cryptography does not work
As you know any kind of “serious” and with “good reputation” cryptographic technology is implemented in opensource.
There are usually multiple implementation of the same cryptographic algorithm and cryptographic protocol to be able to review all the way it works and certify the interoperability.
Supposing to use a standard with precise and extended details on “how it works”, that has been “peer reviewed” by the scientific community BUT that has been re-implemented from scratch by a not so smart programmer and the implementation it's plenty of bugs.
Well, if the implementation is “opensource” this means that it can be reviewed, improved, tested, audited and the end user will certaintly have in it's own had a piece of technology “that works safely” .
Google release opensource crypto toolkit
Mozilla release opensource crypto toolkit
Bruce Schneier tell you that Cryptography must be opensource .
Another cryptographic point of view
I don't want to convince anyone but just provide facts related to science, related to cryptography and security in order to reduce the effect of misinformation done by security companies whose only goes is to sell you something and not to do something that make the world a better.
When you do secure products, if they are not done following the proper approach people could die.
It's absolutely something irresponsible not to use best practice to do crypto stuff.
To summarize let's review the infosecurityguard.com review from a security best pratice point of view.
| Product name | Security Trough Obscurity | Public peer review | Open Source | Compromise locally? |
| Caspertec | Obscurity | No public review | Closed | Да |
| CellCrypt | Obscurity
| No public review
| Closed
| Да |
| Cryptophone | Transparency | Limited public review | Public | Да |
| Gold-Lock | Obscurity
| No public review
| Closed
| Да |
| Illix | Obscurity
| No public review
| Closed
| Да |
| No1.BC | Obscurity | No public review
| Closed
| Да |
| PhoneCrypt | Obscurity
| No public review
| Closed
| Да |
| Rode&Swarz | Obscurity
| No public review
| Closed
| Да |
| Secure-Voice | Obscurity
| No public review
| Closed
| Да |
| SecuSmart | Obscurity
| No public review
| Closed
| Да |
| SecVoice | Obscurity
| No public review
| Closed
| Да |
| SegureGSM | Obscurity
| No public review
| Closed
| Да |
| SnapCell | Obscurity
| No public review
| Closed
| Да |
| Tripleton | Obscurity
| No public review
| Closed
| Да |
| Zfone | Transparency | Public review
| Open | Да |
| ZRTP | Transparency | Public review
| Open | Да |
*Green means that it match basic requirement for a cryptographic secure system
* Red / Broken means that it does not match basic requirement for a cryptographic secure system
That's my analysis using a evaluation method based on cryptographic and security parameters not including the local compromise context that i consider useless.
However, to be clear, those are only basic parameters to be used when considering a voice encryption product (just to avoid being in a situation that appears like i am promoting other products). So it may absolutely possible that a product with good crypto ( transparency, peer reviewed and opensource) is absolutely a not secure product because of whatever reason (badly written, not usable causing user not to use it and use cleartext calls, politically compromised, etc, etc).
I think i will prepare a broader criteria for voice crypto technologies and voice crypto products, so it would be much easier and much practical to have a full transparent set of criterias to evaluate it.
But those are really the basis of security to be matched for a good voice encryption system!
Read some useful past slides on security protocols used in voice encryption systems (2nd part).
Now read below some more practical doubt about their research.
The security concept of the review is misleading: any hacked device can be always intercepted!
I think that the guys completely missed the point: ANY KIND OF SOFTWARE RUNNING ON A COMPROMISED OPERATING SYSTEM CAN BE INTERCEPTED
Now they are pointing out that also Zfone from Philip Zimmermann is broken (a pc software), just because they install a trojan on a PC like in a mobile phone?
Any security software rely on the fact that the underlying operating system is somehow trusted and preserve the integrity of the environment where the software run.
- If you have a disk encryption system but your PC if infected by a trojan, the computer is already compromised.
- If you have a voice encryption system but your PC is infected by a trojan, the computer is already compromised.
- If you have a voice encryption system but your mobile phone is infected by a trojan, the mobile phone is already compromised.
No matter which software you are running, in such case the security of your operating environment is compromised and in one way or another way all the information integrity and confidentiality is compromised.
Like i explained above how to intercept PhoneCrypt.
The only things that can protect you from this threat is running in a closed operating system with Trust Computing capability, implementing it properly.
For sure on any “Open” operating system such us Windows, Windows Mobile, Linux, iPhone or Android there's no chance to really protect a software.
On difficult operating system such as Symbian OS or RimOS maybe the running software can be protected (at least partially)
That's the reason for which the security concept that guys are leveraging to carry on their marketing campaign has no clue.
It's just because they control the environment, they know Flexispy software and so they adjusted their software not to be interceptable when Flexispy is installed.
If you develop a trojan with the other techniques i described above you will 100% intercept PhoneCrypt.
On that subject also Dustin Tamme l, Security researcher of BreakPoint Systems , pointed on on VoIP Security Alliance mailing lists that the security analysis is based on wrong concepts .
The PhoneCrypt can be intercepted: it's just that they don't wanted to tell you!
PhoneCrypt can be intercepted with “on device spyware”.
Почему?
Because Windows Mobile is an unsecure operating environment and PhoneCrypt runs on Windows Mobile.
Windows Mobile does not use Trusted Computing and so any software can do anything.
The platform choice for a secure telephony system is important.
How?
I quickly discussed with some knowledgeable windows mobile hackers about 2 different way to intercept PhoneCrypt with an on-device spyware (given the unsecure Windows Mobile Platform).
a) Inject a malicious DLL into the software and intercept from within the Phonecrypt itself.
In Windows Mobile any software can be subject to DLL code injection.
What an attacker can do is to inject into the PhoneCrypt software (or any software running on the phone), hooking the Audio related functions acting as a “function proxy” between the PhoneCrypt and the real API to record/play audio.
It's a matter of “hooking” only 2 functions, the one that record and the one that play audio.
That's simple, any programmer will tell you to do so.
They simply decided that's better not to make any notice about this.
b) Create a new audio driver that simply act as a proxy to the real one and intercept PhoneCrypt
In Windows Mobile you can create new Audio Drivers and new Audio Filters.
What an attacker can do is to load a new audio driver that does not do anything else than passing the real audio driver function TO/FROM the realone. In the meantime intercept everything recorded and everything played :-)
They simply decided that's better not to make any notice to that way of intercepting phone call on PhoneCrypt .
Those are just 2 quick ideas, more can be probably done.
Sounds much like a marketing activity – Not a security research.
Я должен вам сказать. Я проанализировал вопрос очень тщательно и по большинству аспектов. Все это вещи о АНАЛИЗ шифрования речи звучит для меня как маркетинговую кампанию SecurStar GmbH продать PhoneCrypt и получить репутацию. Четко сформулированы и хорошо подготовленной кампании по привлечению средств массовой информации говорят, косвенным образом обманывают СМИ, что PhoneCrypt является единственным безопасным. Вы видите, что пресс-релизы SecurStar и «Исследователь безопасности Notrax говорят, что PhoneCrypt единственный безопасный продукт" . SecurStar PhoneCrypt является единственным продуктом, анонимный хакер "Notrax" считают безопасным из "программного обеспечения".
Только "версии" в конкуренции с:
- SnapCell - никто не может его купить. Безопасность компании, которая даже не была больше веб-страниц. Компания почти не существует больше. Означает ли это звучит странно, что только те, другие продукты считаются безопасными, а также PhoneCrypt.
Кроме того, ... давайте проверим рода мультимедийного контента в различные обзоры доступны в золото-Lock, Cellcrypt и Phonecrypt для того, чтобы понять, насколько маркетинг парней нажатия, чтобы сделать обзор PhoneCrypt наиболее привлекательным:
| Применение | Скриншоты приложения | Видео с демонстрацией перехват | Сеть демонстрации |
| PhoneCrypt | 5 | 0 | 1 | |
| CellCrypt | 0 | 2 | 0 |
| GoldLock | 1 | 2 | 0 |
Понятно, что PhoneCrypt рассматривается показывает больше возможностей явно показали и основные функции безопасности, описание продукта, чем другие.
Слишком большая разница между ними, мы должны подозревать, что это советы по маркетингу?
Но, опять же другие странные вещи анализа, как это было сделано ...
Если бы это был "беспристрастным и нейтральным обозрение" мы должны видеть хорошие и плохие вещи на все продукты, не так ли?
Хорошо, см. таблицу ниже по мнению указанных в каждом абзаце различные обзоры доступны Золото-Lock, CellCrypt и Phonecrypt (это только возможно), чтобы убедиться, положительные или отрицательные.
| Применение | Количество пунктов | Положительные пунктов | Отрицательные пунктов | Нейтральная пунктов |
| PhoneCrypt | 9 | 9 | 0 | 0 |
| CellCrypt | 12 | 0 | 10 | 2 |
| GoldLock | 9 | 0 | 8 | 1 |
| Пункт обзора | Мнение, выраженное |
| С их сайта | Положительная обратная связь маркетинга |
| Apple iPhone | Positive Marketing feedback |
| Disk Encryption or voice Encryption | Positive Marketing feedback |
| PBX Compatibility? Really | Positive Marketing feedback |
| Cracking <10. Нет. | Positive Marketing feedback |
| Good thinking! | Positive Marketing feedback |
| A little network action | Positive Marketing feedback |
| UI | Positive Marketing feedback |
| Good Taste | Positive Marketing feedback |
| Paragraph of review | Opinion expressed |
| From their website | Negative Marketing feedback |
| Licensed by The israeli Ministry of Denfese | Negative Marketing feedback |
| Real Company or Part Time hobby | Negative Marketing feedback |
| 16.000 bit authentication | Negative Marketing feedback |
| DH 256 | Negative Marketing feedback |
| Downad & Installation! | Neutral Marketing feedback |
| Cracking it <10 | Negative Marketing feedback |
| Marketing BS101 | Negative Marketing feedback |
| Cool video stuff | Negative Marketing feedback |
Detailed paragraphs opinion analysis of
CellCrypt | Paragraph of review | Opinion expressed |
| From their website | Neutral Marketing feedback |
| A little background about cellcrypt | Negative Marketing feedback |
| Master of Marketing | Negative Marketing feedback |
| Secure Voice calling | Negative Marketing feedback |
| Who's buying their wares | Negative Marketing feedback |
| Downad & Installation! | Neutral Marketing feedback |
| My Demo environment | Negative Marketing feedback |
| Did they forget some code | Negative Marketing feedback |
| Cracking it <5 | Negative Marketing feedback |
| Room Monitoring w/ FlexiSpy | Negative Marketing feedback |
| Cellcrypt unique features.. | Negative Marketing feedback |
| Plain old interception | Negative Marketing feedback |
| The Haters out there | Negative Marketing feedback |
Now it's clear that from their point of view on PhoneCrypt there is no single bad point while the other are always described in a negative way.
No single good point. Strange?
All those considerations along with the next ones really let me think that's very probably a marketing review and not an independent review.
Other similar marketing attempt from SecurStar
SecurStar GmbH is known to have used in past marketing activity leveraging this kind of “technical speculations”, abusing of partial information and fake unconfirmed hacking stuff to make marketing/media coverage.
Imho a rare mix of unfairness in leveraging the difficult for people to really understand the complexity of security and cryptography.
They already used in past Marketing activities like the one about creating a trojan for Windows Mobile and saying that their software is secure from the trojan that they wrote.
Read about their marketing tricks of 2007
They developed a Trojan (RexSpy) for Windows Mobile, made a demonstration capability of the trojan and later on told that they included “Anti-Trojan” capability to their PhoneCrypt software.They never released informations on that trojan, not even proved that it exists.
The researcher Collin Mulliner told at that time that it sounds like a marketing tips (also because he was not able to get from SecurStar CEO Hafner any information about that trojan):
“This makes you wonder if this is just a marketing thing.”
Now, let's try to make some logical reassignment.
It's part of the way they do marketing, an very unfriendly and unpolite approach with customers, journalist and users trying to provide wrong security concepts for a market advantage. Being sure that who read don't have all the skills to do in depth security evaluation and find the truth behind their marketing trips.
Who is the hacker notrax?
It sounds like a camouflage of a fake identity required to have an “independent hacker” that make an “independent review” that is more strong on reputation building.
Read about his bio:
¾ Human, ¼ Android (Well that would be cool at least.) I am just an enthusiast of pretty much anything that talks binary and if it has a RS232 port even better. During the day I masquerade as an engineer working on some pretty cool projects at times, but mostly I do the fun stuff at night. I have been thinking of starting an official blog for about 4.5 years to share some of the things I come across, can't figure out, or just cross my mind. Due to my day job and my nighttime meddling, I will update this when I can. I hope some find it useful, if you don't, well you don't.
There are no information about this guy on google.
Almost any hacker that get public have articles online, post in mailing archive and/or forum or some result of their activity.
For notrax, nothing is available.
Additionally let's look at the domain…
The domain infosecurityguard.com is privacy protected by domainsbyproxy to prevent understanding who is the owner.
The domain has been created 2 months ago on 01-Dec-09 on godaddy.com registrar.
What's also very interesting to notice that this “unknown hacker with no trace on google about him that appeared on December 2009 on the net” is referred on SecurStar GmbH Press Release as a “An IT security expert”.
Maybe they “know personally” who's this anonymous notrax? :)
Am i following my own conspiracy thinking or maybe there's some reasonable doubt that everything was arrange in that funny way just for a marketing activity?
Social consideration
If you are a security company you job have also a social aspects, you should also work to make the world a better place (sure to make business but “not being evil”). You cannot cheat the skills of the end users in evaluating security making fake misleading information.
You should do awareness on end users, to make them more conscious of security issues, giving them the tools to understand and decide themselves.
Hope you had fun reading this article and you made your own consideration about this.
Fabio Pietrosanti (naif)
ps Those are my personal professional opinion, let's speak about technology and security, not marketing.
pps i am not that smart in web writing, so sorry for how the text is formatted and how the flow of the article is unstructured!
