This article want to clarify and better explain the finding at infosecurityguard.com regaring voice encryption product evaluation.
This article want to tell you a different point of view other than infosecurityguard.com and explaining which are the rational with extensive explaination from security point of view.
Today i read news saying: “PhoneCrypt: Basic Vulnerability Found in 12 out of 15 Voice Encryption Products and went to read the website infosecurityguard .
Initially it appeared to my like a great research activity but then i started reading deeply the read about it.I found that it's not properly a security research but there is are concrete elements that's a marketing campaign well done in order to attract public media and publicize a product.
Imho they was able to cheat journalists and users because the marketing campaign was absolutely well done not to be discovered on 1st read attempt. I personally considered it like a valid one on 1st ready (they cheated me initially!).
But if you go deeply… you will understand that:
- it's a camouflage marketing initiative arranged by SecurStar GmbH and not a independent security research
- they consider a only security context where local device has been compromised (no software can be secured in that case, like saying SSL can be compromised if you have a trojan!)
- they do not consider any basic security and cryptographic security criteria
However a lot of important website reported it:
This article is quite long, if you read it you will understand better what's going on around infosecurityguard.com research and research result.
I want to to tell you why and how (imho) they are wrong.
The research missed to consider Security, Cryptography and Transparency!
Well, all this research sound much like being focused on the marketing goal to say that their PhoneCrypt product is the “super” product best of all the other ones.
Any security expert that would have as duty the “software evaluation” in order to protect the confidentiality of phone calls will evaluate other different characteristics of the product and the technology.
Yes, it's true that most of the product described by SecurStar in their anonymous marketing website called http://infosecurityguard.com have some weakness.
But the relevant weakness are others and PhoneCrypt unfortunately, like most of the described products suffer from this.
Let's review which characteristics are needed basic cryptography and security requirement (the best practice, the foundation and the basics!)
a – Security Trough Obscurity does not work
A basic rule in cryptography cames from 1883 by Auguste Kerckhoffs:
I en veltilrettelagt kryptografisk system, behøver kun nøglen til at være hemmelige, og der bør ikke være nogen hemmelighed i algoritmen.
Moderne kryptografer har taget dette princip, kalder noget andet "sikkerhed ved ubemærkethed."
Læs hvad Bruce Schneir, anerkendt ekspert og kryptograf i verden siger om dette Enhver sikkerhedsekspert vil fortælle dig, det er rigtigt. Selv en novice universitetsstuderende vil fortælle dig, det er rigtigt. Simpelthen fordi det er den eneste måde at gøre kryptering.
Næsten alle produkt, der beskrives i gennemgangen af SecurStar GmbH, omfatter PhoneCrypt, ikke give præcise oplysninger om deres kryptografiske teknologier.
Præcise oplysninger er:
- Detailed specification of cryptographic algorithm (that's not just saying “we use AES “)
- Detailed specification of cryptographic protocol (that's not just saying “we use Diffie Hellman ” )
- Detailed specification of measuring the cryptographic strenght (that's not just saying “we have 10000000 bit key size “)
Forudsat præcise detaljer betyder at have omfattende dokumentation med teoretiske og praktiske implikationer dokumenterer en enkelt måde, hvordan algoritmen fungerer, hvordan protokollen arbejder med nøjagtig specifikation at kopiere det for interoperabilitet test.
It means that scientific community should be able to play with the technology, audit it, hack it.
Hvis vi ikke ved noget om det kryptografisk system i detaljer, hvordan kan vi vide, hvilke er svaghed og styrke point?
Mike Fratto, site redaktør af Network Computing, lavet en stor artikel om "at sige nej til proprietære kryptografiske systemer" .
Cerias Purdue University tell this .
b – NON peer reviewed and NON scientifically approved Cryptography does not work
Under alle omstændigheder, og i enhver tilstand du gør kryptografi skal du være sikker på, at en anden vil tjekke, gennemgå, analysere, distruct og reconstract fra bunden din teknologi og give dem information gratis for offentligheden for åben diskussion.
Det er præcis, hvordan AES blev født, og som US National Institute of Standard gør krypto gør (med offentlig konkurrence med offentlig peer review, hvor kun de bedste evalueret vinder).
En offentlig diskussion med en offentlig konkurrence, hvor en masse af gennemgang af mest berømte og ekspert kryptograf i verden, hackere (med deres navn, efternavn og ansigt, ikke som Notrax) yde deres bidrag, fortælle, hvad de mener.
That's called “peer review”.
Hvis en kryptografisk teknologi har en udvidet og vigtig peer review, fordelt i verden, der kommer fra universiteter, private sikkerhedsfirmaer, militære institutioner, hackere og alle kommer fra forskellige dele af verden (fra USA til Europa til Rusland til Sydamerika til Mellemøsten til Kina) og alle af dem er enige om, at en bestemt teknologi er det sikkert ...
Tja, i dette tilfælde kan vi overveje teknologien sikker, fordi en masse af enheder med et godt omdømme og autoritet kommer fra en masse forskellige sted i verden offentligt har gennemgået, analyseret og bekræftede, at en teknologi, det er sikkert.
Hvordan en privat virksomhed kan selv mener at opfinde på sin egen en sikker kommunikationsprotokol, når det er videnskabeligt, at det ikke er muligt at gøre det på en "proprietær og lukket vej"?
IBM fortælle dig, at peer review er det nødvendigt for kryptering .
Bruce Schneier fortælle dig , at "Gode kryptografer ved, at intet kan erstatte en omfattende peer review og mange års analyse."
Philip Zimmermann will tell you to beware of Snake Oil where the story is: “Every software engineer fancies himself a cryptographer, which has led to the proliferation of really bad crypto software.”
c - Lukket kilde kryptografi virker ikke
Som du ved enhver form for "alvorlig", og med "gode omdømme" kryptografisk teknologi er implementeret i opensource.
There are usually multiple implementation of the same cryptographic algorithm and cryptographic protocol to be able to review all the way it works and certify the interoperability.
Supposing to use a standard with precise and extended details on “how it works”, that has been “peer reviewed” by the scientific community BUT that has been re-implemented from scratch by a not so smart programmer and the implementation it's plenty of bugs.
Well, if the implementation is “opensource” this means that it can be reviewed, improved, tested, audited and the end user will certaintly have in it's own had a piece of technology “that works safely” .
Google release opensource krypto toolkit
Mozilla release opensource krypto toolkit
Bruce Schneier fortælle dig, at kryptografi skal være opensource .
Another cryptographic point of view
I don't want to convince anyone but just provide facts related to science, related to cryptography and security in order to reduce the effect of misinformation done by security companies whose only goes is to sell you something and not to do something that make the world a better.
Når du gør sikre produkter, hvis de ikke er udført efter den korrekte fremgangsmåde folk kunne dø.
Det er absolut noget uansvarligt ikke at anvende den bedste praksis til at gøre krypto stuff.
For at opsummere så lad os gennemgå den infosecurityguard.com gennemgang fra et sikkerhedsmæssigt bedste pratice synspunkt.
| Product name | Security Trough Obscurity | Public peer review | Open Source | Compromise locally? |
| Caspertec | Obscurity | No public review | Closed | Ja |
| CellCrypt | Obscurity
| No public review
| Closed
| Ja |
| Cryptophone | Transparency | Begrænset offentlig gennemgang | Public | Ja |
| Guld-Lock | Obscurity
| No public review
| Closed
| Ja |
| Illix | Obscurity
| No public review
| Closed
| Ja |
| No1.BC | Obscurity | No public review
| Closed
| Ja |
| PhoneCrypt | Obscurity
| No public review
| Closed
| Ja |
| Rode&Swarz | Obscurity
| No public review
| Closed
| Ja |
| Sikker-Voice | Obscurity
| No public review
| Closed
| Ja |
| SecuSmart | Obscurity
| No public review
| Closed
| Ja |
| SecVoice | Obscurity
| No public review
| Closed
| Ja |
| SegureGSM | Obscurity
| No public review
| Closed
| Ja |
| SnapCell | Obscurity
| No public review
| Closed
| Ja |
| Tripleton | Obscurity
| No public review
| Closed
| Ja |
| Zfone | Transparency | Public review
| Åbent | Ja |
| ZRTP | Transparency | Public review
| Åbent | Ja |
* Grøn betyder, at det matcher grundlæggende forudsætning for en kryptografisk sikkert system
* Red / Broken means that it does not match basic requirement for a cryptographic secure system
That's my analysis using a evaluation method based on cryptographic and security parameters not including the local compromise context that i consider useless.
However, to be clear, those are only basic parameters to be used when considering a voice encryption product (just to avoid being in a situation that appears like i am promoting other products). So it may absolutely possible that a product with good crypto ( transparency, peer reviewed and opensource) is absolutely a not secure product because of whatever reason (badly written, not usable causing user not to use it and use cleartext calls, politically compromised, etc, etc).
Jeg tror, jeg vil forberede et bredere kriterier for voice krypto-teknologier og voice krypto-produkter, så det ville være meget lettere og meget praktisk at have en fuld transparent sæt kriterier til at evaluere den.
Men de er virkelig basis af sikkerhed, der skal matches til en god voice kryptering system!
Read some useful past slides on security protocols used in voice encryption systems (2nd part).
Now read below some more practical doubt about their research.
Sikkerheden begrebet anmeldelse er misvisende: enhver hacket enhed kan altid opfanget!
Jeg tror, at de fyre helt gået glip af point: Enhver form for software på en kompromitteret operativsystemet kan blive opsnappet
Nu er de påpeger, at også Zfone fra Philip Zimmermann er brudt (en pc-software), bare fordi de installerer en trojansk på en pc som i en mobiltelefon?
Enhver sikkerhedssoftware påberåbe sig, at det underliggende operativsystem eller anden måde er tillid og bevare integriteten af det miljø, hvor softwaren kører.
- If you have a disk encryption system but your PC if infected by a trojan, the computer is already compromised.
- If you have a voice encryption system but your PC is infected by a trojan, the computer is already compromised.
- Hvis du har en stemme krypteringssystem, men din mobiltelefon er inficeret med en trojan, er mobiltelefonen allerede kompromitteret.
Uanset hvilken software, du kører, i et sådant tilfælde sikkerheden på din driftsmiljøet er kompromitteret, og på en eller anden måde at alle de oplysninger, integritet og fortrolighed er kompromitteret.
Like i explained above how to intercept PhoneCrypt.
De eneste ting, der kan beskytte dig mod denne trussel kører i et lukket styresystem med Trust Computing kapacitet, gennemføre det ordentligt.
For sikker på enhver "Åbn" operativsystem os Windows, Windows Mobile, Linux, iPhone eller Android er der ingen chance for virkelig at beskytte en software.
På vanskelige operativsystem som Symbian OS eller RimOS måske kører software kan være beskyttet (i det mindste delvist)
Det er grunden til, at sikkerheden koncept, fyre udnytte til at udøve deres marketing kampagne har ingen anelse.
Det er bare fordi de kontrollerer for miljøet, de kender Flexispy software og så de tilpasset deres software ikke at være interceptable når Flexispy er installeret.
Hvis du udvikler en trojan med de andre teknikker jeg beskrevet ovenfor vil du 100% skæringspunkt PhoneCrypt.
On that subject also Dustin Tamme l, Security researcher of BreakPoint Systems , pointed on on VoIP Security Alliance mailing lists that the security analysis is based on wrong concepts .
The PhoneCrypt can be intercepted: it's just that they don't wanted to tell you!
PhoneCrypt can be intercepted with “on device spyware”.
Hvorfor?
Because Windows Mobile is an unsecure operating environment and PhoneCrypt runs on Windows Mobile.
Windows Mobile does not use Trusted Computing and so any software can do anything.
The platform choice for a secure telephony system is important.
Hvordan?
I quickly discussed with some knowledgeable windows mobile hackers about 2 different way to intercept PhoneCrypt with an on-device spyware (given the unsecure Windows Mobile Platform).
a) Inject a malicious DLL into the software and intercept from within the Phonecrypt itself.
In Windows Mobile any software can be subject to DLL code injection.
What an attacker can do is to inject into the PhoneCrypt software (or any software running on the phone), hooking the Audio related functions acting as a “function proxy” between the PhoneCrypt and the real API to record/play audio.
It's a matter of “hooking” only 2 functions, the one that record and the one that play audio.
That's simple, any programmer will tell you to do so.
They simply decided that's better not to make any notice about this.
b) Create a new audio driver that simply act as a proxy to the real one and intercept PhoneCrypt
In Windows Mobile you can create new Audio Drivers and new Audio Filters.
What an attacker can do is to load a new audio driver that does not do anything else than passing the real audio driver function TO/FROM the realone. In the meantime intercept everything recorded and everything played :-)
They simply decided that's better not to make any notice to that way of intercepting phone call on PhoneCrypt .
Those are just 2 quick ideas, more can be probably done.
Sounds much like a marketing activity – Not a security research.
I have to tell you. I analyzed the issue very carefully and on most aspects. All this things about the voice encryption analisys sounds to me like a marketing campaign of SecurStar GmbH to sell PhoneCrypt and gain reputation. A well articulated and well prepared campaign to attract the media saying, in an indirect way cheating the media, that PhoneCrypt is the only one secure. You see the press releases of SecurStar and of the “Security researcher Notrax telling that PhoneCrypt is the only secure product” . SecurStar PhoneCrypt is the only product the anonymous hacker “Notrax” consider secure of the “software solutions”.
The only “software version” in competition with:
–
SnapCell – No one can buy it. A security company that does not even had anymore a webpage. The company does not almost exist anymore.
Does it sounds strange that only those other products are considered secure along with PhoneCrypt .
Also… let's check the kind of multimedia content in the different reviews available of Gold-Lock, Cellcrypt and Phonecrypt in order to understand how much the marketing guys pressed to make the PhoneCrypt review the most attractive:
| Application | Screenshots of application | Video with demonstration of interception | Network demonstration |
| PhoneCrypt | 5 | 0 | 1 | |
| CellCrypt | 0 | 2 | 0 |
| GoldLock | 1 | 2 | 0 |
It's clear that PhoneCrypt is reviewed showing more features explicitly shown and major security features product description than the other.
Too much difference between them, should we suspect it's a marketing tips?
But again other strange things analyzing the way it was done…
If it was “an impartial and neutral review” we should see good and bad things on all the products right?
Ok, see the table below regarding the opinion indicated in each paragraph of the different reviews available of Gold-Lock, CellCrypt and Phonecrypt (are the only available) to see if are positive or negative.
| Application | Number of paragraphs | Positive paragraphs | Negative paragraphs | Neutral paragraphs |
| PhoneCrypt | 9 | 9 | 0 | 0 |
| CellCrypt | 12 | 0 | 10 | 2 |
| GoldLock | 9 | 0 | 8 | 1 |
Detailed paragraphs opinion analysis of Phonecrypt | Paragraph of review | Opinion expressed |
| From their website | Positive Marketing feedback |
| Apple iPhone | Positive Marketing feedback |
| Disk Encryption or voice Encryption | Positive Marketing feedback |
| PBX Compatibility? Really | Positive Marketing feedback |
| Cracking <10. Not. | Positive Marketing feedback |
| Good thinking! | Positive Marketing feedback |
| A little network action | Positive Marketing feedback |
| UI | Positive Marketing feedback |
| Good Taste | Positive Marketing feedback |
| Paragraph of review | Opinion expressed |
| From their website | Negative Marketing feedback |
| Licensed by The israeli Ministry of Denfese | Negative Marketing feedback |
| Real Company or Part Time hobby | Negative Marketing feedback |
| 16.000 bit authentication | Negative Marketing feedback |
| DH 256 | Negative Marketing feedback |
| Downad & Installation! | Neutral Marketing feedback |
| Cracking it <10 | Negative Marketing feedback |
| Marketing BS101 | Negative Marketing feedback |
| Cool video stuff | Negative Marketing feedback |
Detailed paragraphs opinion analysis of
CellCrypt | Paragraph of review | Opinion expressed |
| From their website | Neutral Marketing feedback |
| A little background about cellcrypt | Negative Marketing feedback |
| Master of Marketing | Negative Marketing feedback |
| Secure Voice calling | Negative Marketing feedback |
| Who's buying their wares | Negative Marketing feedback |
| Downad & Installation! | Neutral Marketing feedback |
| My Demo environment | Negative Marketing feedback |
| Did they forget some code | Negative Marketing feedback |
| Cracking it <5 | Negative Marketing feedback |
| Room Monitoring w/ FlexiSpy | Negative Marketing feedback |
| Cellcrypt unique features.. | Negative Marketing feedback |
| Plain old interception | Negative Marketing feedback |
| The Haters out there | Negative Marketing feedback |
Now it's clear that from their point of view on PhoneCrypt there is no single bad point while the other are always described in a negative way.
No single good point. Strange?
All those considerations along with the next ones really let me think that's very probably a marketing review and not an independent review.
Other similar marketing attempt from SecurStar
SecurStar GmbH is known to have used in past marketing activity leveraging this kind of “technical speculations”, abusing of partial information and fake unconfirmed hacking stuff to make marketing/media coverage.
Imho a rare mix of unfairness in leveraging the difficult for people to really understand the complexity of security and cryptography.
They already used in past Marketing activities like the one about creating a trojan for Windows Mobile and saying that their software is secure from the trojan that they wrote.
Read about their marketing tricks of 2007
They developed a Trojan (RexSpy) for Windows Mobile, made a demonstration capability of the trojan and later on told that they included “Anti-Trojan” capability to their PhoneCrypt software.They never released informations on that trojan, not even proved that it exists.
The researcher Collin Mulliner told at that time that it sounds like a marketing tips (also because he was not able to get from SecurStar CEO Hafner any information about that trojan):
“This makes you wonder if this is just a marketing thing.”
Now, let's try to make some logical reassignment.
It's part of the way they do marketing, an very unfriendly and unpolite approach with customers, journalist and users trying to provide wrong security concepts for a market advantage. Being sure that who read don't have all the skills to do in depth security evaluation and find the truth behind their marketing trips.
Who is the hacker notrax?
It sounds like a camouflage of a fake identity required to have an “independent hacker” that make an “independent review” that is more strong on reputation building.
Read about his bio:
¾ Human, ¼ Android (Well that would be cool at least.) I am just an enthusiast of pretty much anything that talks binary and if it has a RS232 port even better. During the day I masquerade as an engineer working on some pretty cool projects at times, but mostly I do the fun stuff at night. I have been thinking of starting an official blog for about 4.5 years to share some of the things I come across, can't figure out, or just cross my mind. Due to my day job and my nighttime meddling, I will update this when I can. I hope some find it useful, if you don't, well you don't.
There are no information about this guy on google.
Almost any hacker that get public have articles online, post in mailing archive and/or forum or some result of their activity.
For notrax, nothing is available.
Derudover lad os se på det domæne ...
Domænet infosecurityguard.com er privatliv beskyttet af domainsbyproxy at forhindre forståelsen, der er ejeren.
Domænet er oprettet 2 måneder siden den 01-Dec-09 om godaddy.com registrator.
Hvad er også meget interessant at bemærke, at denne "ukendte hacker uden spor på google om ham, der dukkede op på December 2009 om net" er nævnt på SecurStar GmbH pressemeddelelse som en "An it-sikkerhed ekspert".
Måske de "kender personligt" hvem er denne anonyme notrax? :)
Følger jeg min egen sammensværgelse tænkning eller måske er der nogle rimelig tvivl om, at alt var arrangere i denne sjov måde bare for en marketing aktivitet?
Social overvejelse
Hvis du er et vagtselskab du job har også et sociale aspekter, bør du også arbejde for at gøre verden til et bedre sted (sikker på at gøre forretninger, men "ikke er onde"). Du kan ikke snyde de færdigheder af slutbrugerne i evalueringen sikkerheden gør falske vildledende oplysninger.
Du bør gøre bevidstheden om slutbrugere, for at gøre dem mere bevidste om sikkerhedsspørgsmål, give dem redskaber til at forstå og selv afgøre.
Håber du havde det sjovt at læse denne artikel, og du har lavet din egen overvejelse om dette.
Fabio Pietrosanti (naif)
ps Det er min personlige professionelle mening, så lad os tale om teknologi og sikkerhed, ikke markedsføring.
pps jeg er ikke så smart i web skriftligt, så ondt af, hvordan teksten er formateret, og hvordan strømmen af artiklen er ustruktureret!
