Flokkur Archives: Viðskipti

upplýsingaöflun hlerun Privacy öryggi tækni

RFC 6189: ZRTP er loksins staðlað!

Apr 11, 2011 - 22:54

Loks ZRTP hefur verið falið opinbert RFC verkefni, RFC6189 ZRTP: Media Path Key samningi fyrir Unicast Öruggur RTP.

Það hafði sem ánauðar er SRTP með AES lykill stærð 256bit sem nú hefur verið skilgreind sem RFC6188 .

Það er spennandi að sjá RFC lokum gefa út, eins og það er mikilvægur áfangi að setja ZRTP sem opinber staðall fyrir endir-til-endir dulkóðun mikið eins PGP hefur verið fyrir tölvupóst.

Nú allir organization í the veröld vilja vera opinberlega hægt að framkvæma ZRTP fyrir endir-til-endir siðareglur rödd dulkóðun

Nú 3 mismunandi opinber gerð af ZRTP siðareglur til:

Hver þeirra veita mismunandi lögun af the siðareglur, en mikilvægast eru þekktir fyrir að vera samhæfð.

Ný bylgja er að koma á dulkóðun rödd heimsins, irrupting í gráu svæði þar sem mest af fyrirtækjum að gera sími dulkóðun kerfi hefur verið framkvæmd sérsniðnum dulkóðun.

Nú staðall hefur verið skipulag og það eru nokkrar ástæður til vinstri til að innleiða eitthvað öðruvísi.

Hurra Mr Zimmermann og allt samfélag fyrirtækja (eins PrivateWave ) og einstaklingar (eins Werner Dittmann ) sem vann á það!

Í dag er það frábær dagur, svo konar tækni er nú opinbert og einnig með mörgum núverandi framkvæmd!

Philip, gerðu þér það aftur, hrós mitt að hreinu anda þínum og ákvörðun :-)

Share
Comment (1) Tags , , , | Athugasemd (1)
hlerun Privacy öryggi

Framfarir í GSM sprunga í Freiburg háskóla

23 febrúar 2011 - 13:32

The spennandi heim af hreyfanlegur samskiptareglur (GSM, GSM-R, TETRA, UMTS, etc) reiðhestur er að fá opinberar rannsóknir frá háskólum.

Fjárfestingin að opensource losun Code sprunga hugbúnaður gefur tækifæri til nemenda háskóla til að vinna á það, bæta það og gera sterka rannsóknir.

Háskóli Freiburg út bara pappír Hagnýtt æfa á GSM Encryption A5 / 1 ásamt gsmframencoder styðja tól til að bæta sjúga upp í nefið, umskráningu og sprunga aðferð.

Opnun vélbúnaður, opnun hugbúnaður, opnun siðareglur sýna veikleika hvers konar sér aðferð eða ferli til að byggja upp samskipti og öryggi tækni.

Það ætti að vera markmið allra vísindamanna til að reyna að opna upp og sprunga hvers konar sér-og lokuð tækni að knýja iðnaður til fer á aðeins með samhæfðum og opinn nálgun á meðan að hanna fjarskipti samskiptareglum.

Share
Comment (0) Tags , , , , | Athugasemd (0)
upplýsingaöflun hlerun öryggi

TETRA reiðhestur kemur: OsmocomTETRA

Jan 23, 2011 - 10:27

Það er mjög spennandi að sjá losun OsmocomTETRA , fyrsta OpenSource SDR ( Software Skilgreint Radio ) framkvæmd TETRA demodulator, PHY og lægri MAC lag.

Það er TETRA útgáfa af GSM airprobe sem opna aðgang að þeim gögnum og ramma TETRA samskipti siðareglur, þannig að gefa mikla reiðhestur tækifæri!

Nú sem einnig TETRA tækni hefur verið opnuð við ættum að búast, á þessum 2011, að sjá opensource TETRA sjúga upp í nefið og sennilega einnig TEA dulkóðun (á Tetra Encryption Reiknirit) klikkaður!

TETRA er notað af lögreglu, neyðarþjónustu og herir sem val hreyfanlegur tjáskipti net sem getur virkar jafnvel án þess að framboð af þjónustusvæðis (aðeins farsíma-til-farsíma án stöð stöð) og veita nokkrar sérstakar hár þjónustu framboð.

Ég skrifaði um TETRA í mynd minni Major Voice öryggi siðareglur Review .

Í OsmocomBB póstlista var farið að ræða um einhverja TETRA net Staða:

  • Belgía Lögregla TETRA ASTRID net: unencrypted
  • Þýska lögreglan próf TETRA net í Aachen: unencrypted
  • Sumir fyrrverandi jugoslawia TETRA net: unencrypted
  • Holland C200 TETRA net: TEA2 dulkóðuð með truflanir tökkum
  • UK Airwave TETRA net: TEA2 dulkóðaðar með TEA2

Það verður virkilega gaman að sjá að nýtt Lögregla og bjarga þjónustu reiðhestur koma aftur frá gamla flaumi aldri til nýja stafræna útvarp :-)

Share
Comments (4) Tags , , , | Athugasemdir (4)
hugmyndir Kudos

Ríkisstjórn 2,0, Open Data og WikiLeaks

15 Jan 2011 - 20:05

Hugtökin bak WikiLeaks, Openleaks, GlobalLeaks, BalkanLeaks er miklu meira en bara að sýna leyndarmál til almennings.

Það er hluti af byltingu sem er að koma í fyrirtæki, gagnsæi ríkisstjórnarinnar og samvinnu við svokallaða "vefur 2,0 / wiki 'samvinna kerfi.

Hafa a líta á þá ríkisstjórn 2,0 - Inngangur af Anke Domscheit Berg, nýjunga Ríkisstjórn Program Vísbendingar um Microsoft Þýskalands og eiginkona Daniel Berg, co-stofnandi WikiLeaks og nú stofnandi Openleaks .

Líttu á Open Data ríkisstjórn 2,0 frumkvæði að framfylgja ríkisstjórn gagnsæi, draga úr spillingu og bæta árangur af stofnun ríkisins.

Að bylting það er bara meira en hópi anarco-Frjálshyggjufélagið angurvær krakkar sem vilja til að búa til glundroða með því að dreifa leyndarmál, það er bara að byrja að þjóta til að ná nýja skipulag líkan af stjórnvöldum með því að fá meira heill gagnsæi og sterka samvinnu við borgara.

Share
Comment (0) Tags | Athugasemd (0)
Næði öryggi tækni

Brengla hreyfanlegur til jarðlína símtöl með Stjörnumerki 1,8

25 okt 2010 - 12:15

Við út bara tæknilega Howto um hvernig á að byggja upp örugg farsíma til jarðlína VoIP innviði með:

Í næstu vikur aðra Howto eins og þessi mun koma út með öðrum vettvangi miðlara, svo sem FreeSWITCH, allt í anda gagnsæis og skiptimynt af OpenSource tækni öryggi.

Share
Comment (0) Tags , , , | Athugasemd (0)
öryggi

Átta Epic Bilun Reglugerð dulmál

21 október 2010 - 14:59

Mjög fræðandi grein um Eight Epic bilun Reglugerð dulmál og sameiginlegur misskilningur með eftirlitsstofnunum ríkisins sem ekki hafa a breiður sýn á hvernig tæknin virkar.

Ókunnugt eftirlitsstofnunum ríkisins er ekki litið svo á að ströng reglugerð myndi hafa eftirfarandi göllum:

  1. Það mun skapa öryggi ríkisins
  2. Það mun ekki stöðva slæmur krakkar
  3. Það mun skaða nýsköpun
  4. Það mun skaða US Viðskipti
  5. Það mun kosta neytendur
  6. Það verður unconstitutional
  7. Það vilja vera a gríðarstór tilkostnaður af dollurum skatta

Share
Comment (0) Tags , | Athugasemd (0)
Næði öryggi tækni

PrivateGSM: Blackberry / iPhone / Nokia farsíma rödd dulkóðun með ZRTP eða SRTP / SDES

19 október 2010 - 09:10

Ég forðast algerlega að nota eigin bloggið mitt til að gera kynningu á hvers konar vöru.

Þessi tími sem það er ekki öðruvísi, en ég vil segja þér staðreyndir um vörur ég vinn á án ímynda markaðssetningu, en dvelja tæknilega.

Í dag, á PrivateWave þar sem ég er yfirmaður tæknimála og co-stofnandi , út við opinberlega hreyfanlegur VoIP dulkóðun vörur fyrir Brómber, iPhone og Nokia:

  • 1. alltaf Brómber dulkóðuð VoIP með ZRTP - PrivateGSM VoIP Professional
  • 1. alltaf iPhone dulkóðuð VoIP með ZRTP - PrivateGSM VoIP Professional
  • 1. alltaf Brómber dulkóðuð VoIP viðskiptavinur með SRTP með SDES lykill skipti yfir SIP / TLS - PrivateGSM VoIP Enterprise

logo-privatewave-colore.png

Á PrivateWave notum mismunandi nálgun virðingu við flest rödd dulkóðun fyrirtæki þarna úti, lesa okkar nálgun að öryggismálum .

Þýðing þessara vara í tækni og iðnaður landslagi má lýsa sem fylgja:

  • Það er fyrsta rödd dulkóðun fyrirtæki nota aðeins staðla öryggi samskiptareglur (og við gerum ráð fyrir að markaðurinn muni bregðast við, eins og það er ljóst að sér tækni sem koma frá arfleifð CSD geta ekki veitt sömu gildi)
  • Það er fyrsta nálgun í dulkóðun rödd til að nota aðeins opinn uppspretta og staðall dulkóðun vél
  • Það er fyrsta rödd dulkóðun aðferð til að veita mismunandi öryggi líkan með mismunandi tækni (endir-til-endir fyrir ZRTP og endir-til-staður fyrir SRTP )

Þeir föruneyti af Mobile Secure Viðskiptavinir, hannað fyrir faglegum öryggi nota aðeins nota bestu fjarskipti og öryggi tækni, veita mikla vernd með góðum árangri einnig í slæmum skilyrðum net:

Umsóknir eru:

icona-pgsm.png

The stuðningsmaður hreyfanlegur tæki eru:

Varðandi ZRTP ákváðum að leggja áherslu og teygja allt öryggi og ofsóknaræði þáttur siðareglur með nokkrum Little viðbót:

Strangur heimilisfang bók sameining okkar, fer út ZRTP RFC forskrift, sem gæti verið viðkvæmt fyrir ákveðnum árásum þegar notuð á farsímum vegna hegðun notenda á ekki að líta á hreyfanlegur skjár.

Paranoy leið okkar nota ZRTP draga slík skilyrði, munum við skrifa um þetta seinna og / eða mun bæta sérstakar upplýsingar fyrir RFC skráningu.

Sum orð um PrivateGSM Professional með endir-til-endir dulkóðun með ZRTP

Lesa tæknilega lak þarna!

Til að sækja það smella hér og bara setja símanúmerið þitt

Þeir eru niðurstöður vinnusemi af öllum mínum mjög hæfum starfsmönnum (16 manns unnu á þessu 6 verkefni í 3 mismunandi kerfum) á krefjandi tækni (rödd dulkóðun) í erfiðu rekstrarumhverfi (dirty farsímanet og óhreinum hreyfanlegur óperu-kerfi) fyrir fleiri en 2 ár.

Ég er mjög stolt af starfsfólki okkar!

Hvað næst?

Í næstu vikur sem þú munt sjá út meiriháttar setja af heimildasöfnun svo sem sameining með stjörnum, freeswitch og annar öryggi virkt PBX, ásamt nokkrum spennandi annar öryggi tækni fréttir að ég er viss um að vilja vera eftir ;)

Það hefur verið erfitt að vinna og meira að gera en ég er þess fullviss að öryggi og OpenSource samfélag verður eins slíkar vörur og gagnsæ aðferð okkar einnig með opnum mikilvægum útgáfur og opinn sameining sem gera mjög pólitískt hlutlaus (afturvirkt ókeypis) tækni .

Share
Comments (2) Tags , , , , | Athugasemdir (2)
hlerun Privacy öryggi tækni

A par af fallegu VPN té

17 okt 2010 - 12:39

There ert a einhver fjöldi af ástæða hvers vegna einn þyrfti til að fá aðgang Internet trog VPN.

Til dæmis ef þú býrð í landi sljór ákveðnar innihald (eins og andstæðingur-staðnum-ríkisstjórn website, klám, etc) og / eða samskiptareglur (eins og Skype, VoIP) þú vildi sennilega vilja til að færa tengsl þín utan viðbjóðslegur blokka landinu með því að nota brengla VPN göng.

Ég metin nokkur farfuglaheimili VPN framreiðslumaður og a par af þeim hljómar alveg góður meðal útbreidd bjóða slíka þjónustu:

SwissVPN

Hætta við internetið frá Sviss.

Kostnaður 6 CHF / mánuði

Valfrjálst almenna fasta IP tölu

Gagnlegt ef þú þarft:

  • Bara framhjá staðbundnum filters landi með góðum hár bandwidth
  • Fletta Opinber þjónusta trog VPN með valfrjáls fasta almenna IP tölu.

Overplay

Hætta við internetið með því að velja milli 20 mismunandi löndum (hvert sinn sem þú tengist).

Gagnlegt ef þú þarft að gera:

  • viðskipti vitsmunir á keppinaut (virðist koma frá X landi þegar tengja þá)
  • sjá kvikmynd / telefilm leyft aðeins frá innlendum IP rými vefur
  • sjá google úrslit milli mismunandi landa

Share
Comment (0) Tags , | Athugasemd (0)
öryggi tækni

Ekki á hverjum sporöskjulaga ferill er sama: trog um ENA öryggi

26 September 2010 - 01:05 
 Eigin ECC ferill minn öryggi og val greiningu

 vn9jna1BdgrzDCYNBJHi09q09q.jpg 
  Flest nútíma dulritunarstjórneiningunni nota sporöskjulaga Curve Dulmáls (ECC) sem, með minni lykil stærð og draga úr útreikningur vald, gefa samsvarandi öryggi styrk hefðbundnum Grafhvelfing kerfi þekkt sem DH (Diffie-Hellman) eða RSA (Rivest, Shamir og Adleman). 
  Ekki allir vita að ECC dulkóðun er valið fyrir hvers konar framtíðar dulkóðun og að jafnvel TLS / SSL (dulkóðun notuð til að tryggja á vefnum) er að flytja til ENA. 
  Ég fann fullt af svokölluðum "sér vörum dulkóðun" sem yfirgefin RSA og DH til fer með ECC val, sem hafa tilhneigingu til handahófi nota ECC bita lykill stærð án þess þó að tilgreina hvers konar ECC Crypto venjast. 
  Hins vegar er það mikið rugl í kringum sporöskjulaga bugða, með fullt af mismunandi nöfn og lykill stærð gera erfitt fyrir a non-cryptographically reyndur-notandi til að gera eigin mynd þegar meta sumir dulritunarstjórneiningunni efni. 
  Vegna svo dreifðri rugl ég ákvað að gera eigin greiningu mína til að finna út hver eru bestu ECC dulkóðun línur og hægri ECC lykill að stærð. 
  Þessi greining langar til að veita iðnaður öryggi byggir val á meðal ýmissa línur og helstu stærðum, þannig að stærðfræði og dulritunarstjórneiningunni greiningu atriði sem hefur verið þegar verið gert á árunum, teknar ýmsar ákvarðanir teknar í nokkrum stöðlum og öryggi samskiptareglum. 
  Fyrst niðurstaðan. 
  Frá greiningu mína aðeins eftirfarandi ECC línur eru að huga að til notkunar í kerfum dulkóðun vegna ert sú eina valið milli mismunandi stjórnvalda (ANSI, NSA, SAG, NIST, ECC BrainPool), mismunandi öryggi siðareglur staðla (IPSec, OpenPGP, ZRTP, Kerberos, SSL / TLS) og aðeins einn passa NSA Suite B öryggiskröfur (de-þáttur staðall einnig fyrir NATO herinn umhverfi): 
  •   Sporöskjulaga Prime Bugða 256 bita - P-256 
  •   Sporöskjulaga Prime Bugða 384 bita - P-384 
  valfrjálst, bara fyrir virkilega ofsóknaræði sem vilja fá fleiri inni stærð hluti, samt ekki talin gagnleg: 
  •   Sporöskjulaga Prime Bugða 521 bita - P-521 
  Mig langar til að segja að Koblitz línur ætti að forðast, í hvaða takka stærð (163/283/409/571) sem þeir ekki hafa nóg ábyrgð á Grafhvelfing rökgreiningarheimspeki starfsemi og raun þeir eru: 
  •   Ekki hluti af NSA Suite-B dulmál val 
  •   Ekki hluti af ECC Brainpool val 
  •   Ekki hluti af ANSI X9.62 val 
  •   Ekki hluti af OpenPGP ECC eftirnafn val 
  •   Ekki hluti af Kerberos eftirnafn fyrir ECC bugða val 
  Ég býð lesandanum að fylgja trog greiningu mína að skilja grundvallaratriði sem hægt væri að skilja jafnvel án djúpt tæknilega bakgrunn en amk með góðum tæknilegum bakgrunni sumir undirstöðu hluti af dulmál. 
 Hér förum við greiningu

 

  Markmið mitt er að gera greiningu á hvaða / hvernig opið vísinda og öryggi samfélag velja ECC dulritunarstjórneiningunni kerfi fyrir notkun í siðareglur öryggi og staðla skilgreindar IETF RFC (þeir sem skilgreina Internet staðla í opnu og ritrýndum hátt). 
 Neðan mengi RFC kynna ENA inn í núverandi kerfi sem fá greind til að skilja hvað er betra að nota og hvað er betra að útiloka: 
 
  •   RFC5639 : ECC Brainpool Standard Curves & Bugða Generation 
  •   RFC4869 : NSA Suite B Dulritunarstýringar Suites fyrir IPSec 
  •   RFC5430 : NSA Suite B uppsetningu fyrir Transport Layer Security (TLS) 
  •   RFC5008 : NSA Suite B í í Öruggur / Multipurpose Internet Mail Extensions (S / MIME) 
  •   RFC3766 : Ákveðnar Styrkur fyrir opinbera notaðir til að skiptast samhverf Takkar 
  •   RFC5349 : sporöskjulaga Curve dulmálskóðun (ECC) Stuðningur við opinber lykill dulmál fyrir fyrstu Staðfesting á Kerberos (PKINIT) 
  •   RFC4492 : sporöskjulaga Bugða Dulmálsvísindi (ECC) dulmál Suites fyrir Transport Layer Security (TLS) 
  •   ZRTP rödd dulkóðun með Philip Zimmermann ECC ferlinum 
  •   ECC í OpenPGP (drög D fleki-jivsov-OpenPGP-ECC-06 ) 
  •   ECC Curves valin af Microsoft fyrir snjallkort Kerberos innskráningu 
  Við munum nota val gert af skilgreina vísindamaður Internet Security bókunum til að gera hluta af mati okkar. 
  Auk þess verður það að vera skilið að Curve val kemur frá mismunandi stjórnvalda sem gert eigin vali á línur í því skyni að segja að greininni hvað á að nota og hvað á að sleppa: 
  Við munum nota val gert af vísindamaður skilgreina öryggiskröfur í stöðlun stofnanir til að gera hluta af mati okkar. 
  Auk, eitthvað sem flestir ekki vita, en það er ákaflega viðeigandi að greiningu okkar, er að það eru annars konar ECC bugða dulmál og "stærð" þeirra það er mismunandi eftir því hvers konar ferill: 
  •   ECC Curves yfir forsætisráðherra Field (oft nefndur sem sporöskjulaga Curve og fulltrúa með P-keysize) 
  •   ECC Curves yfir Field tvöfaldur (oft nefndur sem Curve Koblitz og fulltrúi K-keysize) 
  Í ljósi þess að öryggi styrkur jafngildi um sporöskjulaga Bugða og Kobliz Bugða hafa mismunandi lykill stærð, til dæmis þegar við lesum ENA 571 við erum að vísa til Koblitz Curve með jafngildu styrk til ECC 521 Prime ferlinum. 
  Samanburður á styrk milli sporöskjulaga línur og Kotbliz bugða er greint hér að neðan (frá Mikey ECC internetinu Draft ): 
 | Koblitz | ECC | DH / DSA / RSA
 | 163 | 192 | 1024
 | 283 | 256 | 3072
 | 409 | 384 | 7680
 | 571 | 521 ​​| 15360

  Hér að neðan er það samanburður á allar valdar línur af öllum hinum ýmsu aðilum og viðkomandi nafn þeirra (frá IETF RFC4492 fyrir ECC notkun fyrir TLS ): 
 Bugða nöfn valin af mismunandi staðla stofnanir
 ------------ + --------------- + -------------
 SECG | ANSI X9.62 | NIST
 ------------ + --------------- + -------------
 sect163k1 | | NIST K-163
 sect163r1 | |
 sect163r2 | | NIST B-163
 sect193r1 | |
 sect193r2 | |
 sect233k1 | | NIST K-233
 sect233r1 | | NIST B-233
 sect239k1 | |
 sect283k1 | | NIST K-283
 sect283r1 | | NIST B-283
 sect409k1 | | NIST K-409
 sect409r1 | | NIST B-409
 sect571k1 | | NIST K-571
 sect571r1 | | NIST B-571
 secp160k1 | |
 secp160r1 | |
 secp160r2 | |
 secp192k1 | |
 secp192r1 | prime192v1 | NIST P-192
 secp224k1 | |
 secp224r1 |​​ | NIST P-224
 secp256k1 | |
 secp256r1 | prime256v1 | NIST P-256
 secp384r1 | | NIST P-384
 secp521r1 | | NIST P-521
 ------------ + --------------- + -------------

  Hvað strax birtast er að það eru aðeins tveir línur valdar af öllum yfirvöldum, og að það er almenn losun línur Koblitz eftir ANSI.The aðeins almennt viðurkenndar meðal 3 yfirvöld eru eftirfarandi tvær ECC ferill: 
  •   secp192r1 / prime192v1 / NIST P-192 
  •   secp256r1 / prime256v1 / NIST P-256 
  Af þeim val á ECC bugða fyrir TLS í RFC5430 sleppt alveg Koblitz línur og valið fyrir notkun aðeins: 
  •   P-256, P-384, P-521 
  The ECC Brainpool sleppt alveg Koblitz línur og valið fyrir notkun eftirfarandi ECC Ferlar: 
  •   P-160, P-192, P-224, P-256, P-320, P-384, P-512 (sem er eina sérstaklega vegna þess að það er ekki P-521, en ​​P-512, the eini lykillinn-stærð vísað ECC brainpool. tnx Ian Simons frá Athena SCS ) 
  OpenPGP Netið drög fyrir ECC notkun í PGP d fleki-jivsov-OpenPGP-ECC-06 skipstjóri alveg Koblitz línur og valið eftirfarandi ECC línur 
  •   P-256, P-384, P-521 
  The Kerberos siðareglur eftirnafn fyrir ECC notkun, skilgreint í RFC5349 og skilgreind af Microsoft fyrir snjallkort nafnplata sleppt alveg Koblitz línur og valið eftirfarandi ECC línur: 
  •   P-256, P-384, P-521 
  Svo hljómar, ljóst að rétt val á ENA er fyrir P-256, P-384 og P-521 en Koblitz ferill hefur verið sleppt fyrir Top Secret notkun og fyrir hvaða öryggi viðkvæmar siðareglur (IPSec, OpenPGP, ZRTP, Kerberos, SSL / TLS). 
  Hvers vegna ég gerði þessa greiningu? 
  Ég hef gert þessa greiningu eftir umræðu sem ég hafði um ákveðin rödd dulkóðun vörur, allar byggðar á sérsniðnum og sér siðareglur, sem allir eru að nota sporöskjulaga Curve Diffie Hellman 571 bita / ECDH 571/571-bita ECDH / Koblitz 571 bits. 
  Öllum þeim er nota K-571 að eins og áður er lýst, hefur verið fjarlægt úr öllum öryggi viðkvæmum umhverfi og siðareglur og vera mér hönnuður rödd dulkóðun efni ég held að dulmáls val þeirra er alls ekki best öryggi val. 
  Sennilega það hefur verið gert bara fyrir tilgang markaðssetningu, því K-571 (Koblitz ferill) virðist sterkari en P-521 (sporöskjulaga ferill miðað frumtala).  Ef þú ert "fleiri hluti" markaðssetning krakkar geta krafa til vera "öruggari".  Koblitz sporöskjulaga ferill eru hraðari en efstu leyndarmál virkt blómi sporöskjulaga feril og svo gefa framleiðslustjóri tækifæri til að veita "meiri hluti" í eigin vöru það er á meðan gæsla the lykill gengi hratt. 
  Það er spurning um heimspekilegar val. 
 Ég vil frekar að fylgja þróun vísindasamfélagið með auðmýkt ekki að íhuga sjálfur dulmáls sérfræðingur, fróður meira en almennt öryggi og vísindasamfélagi sig. 
  Ég vil frekar í staðinn að nota aðeins reiknirit sem eru samþykktar til notkunar í mjög óleyfilegar (leyndarmál flokkun), sem hafa verið valin af öllum yfirvöldum og Vinnuhópur greina dulritunaralgrími núverandi út-þar og að tákna val á nánast öllum stöðluðum öryggi samskiptareglur (IPSec, OpenPGP, ZRTP, Kerberos, SSL / TLS, etc). 
  Ég vil frekar að telja magn af heila vinna á Grafhvelfing ég nota, sem athuga það er í raun örugg, að leggja mat á hvort það er einhver veikleiki. 
  Fjölda Brais vinna á Grafhvelfing víða dreifðri eru stærðargráðu meiri en fjöldi heila vinna Grafhvelfing notuð af aðeins fáir (eins bugða Koblitz). 
  Svo ég er ekki demonizing sem nota ECDH 571 með Koblitz Curve, en viss ég get fullyrt að þeir hafi ekki tekið það besta val í skilmálar af öryggi og að allir öryggi sérfræðingar gera öryggi kvóti myndi íhuga þá staðreynd að sporöskjulaga Curve Diffie Hellman 571 bita gert með Koblitz Curve er ekki mikið dreifðri, það er varpað úr venjulegu siðareglur öryggi og það er ekki vottaður til efstu leyndarmál notkun. 
 Share 
  Comments (3) Tags  ,  ,  | Athugasemdir (3) 
  öryggi tækni 
  ESSOR, European Secure Software Skilgreint Radio (SDR) 
  25 September 2010 - 21:18 
  Ég hafði að líta á Evrópu Defense Agency website og fann ESSOR verkefni, vinna verkefni styrkt fyrir 106mln EUR að þróa stefnumótandi varnir samskipti vörur byggðar á nýjum Hugbúnaður Skilgreint Radio nálgun. 
  SDR nálgun er byltingarkennd kerfi sem er alveg breyta því hvernig vísindamenn og iðnaður er nálgun hvers konar þráðlausri tækni. 
  Grundvallaratriðum í stað brennandi vélbúnaður flís sem framkvæma flestar útvarpsbylgju samskiptareglum og tækni, eru þeir ýtt á "hugbúnaði" til sérhæfð útvarp vélbúnað sem getur unnið á fullt af mismunandi tíðni, sem gegnir tengi útvarp fyrir a einhver fjöldi af mismunandi samskiptareglum útvarpið. 
For example the USRP (Universal Software Radio Peripheral) from Ettus Research that cost 1000-2000USD fully loaded, trough the opensource GnuRadio framework, have seen opensource implementation of: 
 And a lot more protocols and transmission technologies. 
 That kind of new approach to Radio Transmission System is destinated to change the way radio system are implemented, giving new capability such as to upgrade the “radio protocol itself” in software in order to provide “radio protocol” improvements. 
 In the short terms we have also seen very strong security research using SDR technologies such as the GSM cracking and the Bluetooth Sniffing . 
 We can expect that other technologies, weak by design but protected by the restriction to hardware devices to hack the low level protocols, will be soon get hacked. In the first list i would really like to see the hacking of TETRA, a technology born with closed mindset and secret encryption algorithms, something i really dislike ;-) 
 Share 
 Tags  ,  | Comment (0) 
 business management 
 Product management and organization 
 12 September 2010 – 8:52 pm 
 I had to better understand the concepts, roles and duties related to Product management and Product marketing management in software companies, why are needed, which are the differences and how they fit inside an organization structure. 
 Most person i know never interested into this specific area of work, but when you want to be a product company (and not a consulting or solution company), you start having different products on different platforms for different target customers sold trough different channels with different pricing with a installation/different delivery process and that complexity must be managed in the proper way. 
 You realize that in order to let the product company grow in the right direction you need to organize product management activities formally, not closing your mind in rigid organization roles such as Marketing, Sales, R&D. 
 When we speak about Product Management i recommend the reading of the illuminating The strategic role of Product Management (How a market-driven focus leads companies to build products people want to buy) that clarify a lot of things, even if it outlook net separation of roles in product management, something t hat’s too heavy for a small company like a startup . 
 Still it provide a differentiation of duties between Product Management and Product Marketing . 
 A good understanding of the product management related to startup i s given in the article Creating Product Management at Startup showing up different case related to the roles of the product visionary into the company. 
 It introduce the terms ceo of the product in the sense that the product management duties jump around into the various organization function by providing focus and effort where it's needed, independently from the fact that the internal function requiring more effort is Development, Marketing, Sales or Communication. That's means practically enhancing the product vision as it's needed across all major product-related functions making the vision corporate-wide coherent. 
 A good representation of product management and product marketing activities is well described with the differentiation of between Strategical, Technical and Marketing sector and is not clearly separated between Management, Marketing(and Sales) and R&D : 
Triad.jpg
 I read that product manager background and knowledge are different depending on the company focus ( where does product management belong in the organization? ): 
  •  B2C -> Marketing reynslu 
  •   B2B -> tæknilega reynslu 
  An fræðandi (fyrir mig) og mjög mikilvægt aðgreining varðandi vöru stjórnun skyldur er aðgreining á milli: 
  •   Vara Stjórnun 
  •   Vara Markaðssetning 
  Sérstakar skyldur sem tilheyra markaðsdeildar vs stjórnun eru mjög útskýrt í Skilgreiningar hlutverk Vara Stjórnun og Vara Markaðssetning sem ég legg til að lesa, lettneska þú að skilgreina betur verkefni og ábyrgð yfir fyrirtækinu þínu.  Það veitir einnig góða skilgreiningu á kröfum starf ef þú þarft að leita að þeirri tölu! 
  Á sama tíma sem það er mikilvægt að skilja hvað er EKKI vara stjórnun, á áhrifaríkan Vara stjórnun er ekki bara eiginleiki forgangsröðun . 
  Á sama tíma er mikilvægt að skilja hvaða faglega tala er ekki sjálft er framleiðslustjóri: 
  •   Vörustjóri er ekki sölustjóri - en vara stjórnun er yfirleitt litið sem markaðssetning aga, markaður áherslu á markaðssetningu áætlun og eru yfirleitt ekki að keyra heildar vöru átt.  Í því samhengi gæti þó að finna vara sölustjóri Það er Armar markaðssetningu vörunnar, sérstaklega í lítilli stofnun. 
  •   Vörustjóri er ekki a velta framkvæmdastjóri - sölustjóri eru um að finna út hvernig á að selja vöru, eftir sem sölu aðferðafræði, tækni og sund og þeir gætu aka félaginu frá markaði stilla fyrirtæki (vöru) til viðskiptavina stilla fyrirtæki (lausn og ráðgjöf) 
  •   Vörustjóri er ekki forritari - Hönnuðir eru lögð áhersla á tækni og ekki heildar vöru.  Sumir mikill stjórnendur vara eru fyrrverandi verktaki, en það er erfitt að gera bæði í einu.  Það er náttúrulega spenna milli þróunaraðila og vara stjórnendur eiga að vera viðhaldið til að búa til jafnvægi vöru. 
  •   Vörustjóri er ekki hugbúnaður framkvæmdastjóri - hugbúnaður framkvæmdastjóri er hagnýtur framkvæmdastjóri og yfirleitt ekki lagt áherslu á vörunni eða viðskiptavini. 
  •   Vörustjóri er ekki verkefnastjóri - verkefnastjórar eru um hvernig og hvenær, en framleiðslustjóri er um hvað.  Verkefnastjórar vinna náið með stjórnendum vöru til að tryggja árangursríkur endalok af mismunandi stigum í lífi vöru hringrás. 
  Dæmigerður vara stjórnun starfsemi gæti verið í mikilli myndun stuttu máli sem fylgja: 
  •   Strategy: Skipulags vöru stefnu 
  •   Technical: leiðandi vara þróun 
  •   Markaðssetning: að veita vöru og tæknileg efni 
  •   Sala: veita fyrirfram sölu stuðning og vinna á áhrifaríkan hátt með sölu 
  Vara stjórnun þannig að það er ekki nákvæmlega þróun, er ekki einmitt markaðssetning, það er ekki nákvæmlega sölu, svo venjulega það er erfitt að skilgreina "þar sem það ætti að vera" inni í skipulag (það er jafnvel erfitt að skilja að er nauðsynleg)? 
  The Silicon Valley vöruflokk veita gott innsýn á Vara skipulag með því að benda hver eru kostir og áhættu af nokkrum val.  Enn cranky vörustjóri segja að það skiptir ekki máli þar sem framleiðslustjóri lifa í skipulagningu . 
  Það er viðeigandi að vera varkár ekki til að hafa menn sem eru of mikið tæknilega eða of mikið sala stilla í því skyni að fylla upp í skarð milli mismunandi skipulagi.  Of mikið sundrungu úthlutað skyldum yfir stofnun getur leitt til skriffinnsku, of mikið tolla á einn einstakling getur leitt til árangurslaus framkvæmd þarf verkefnum í sumum svæði og að innri samkeppni skynjun tilliti til hefðbundinna hlutverkum. 
Check there a very nice Resume of a professional with practical experience in product management (it's an half techie/half marketing guys). 
  Ah! Another very common misunderstanding is to confuse marketing with communication where ai found a so good definition of Marketing that i really like and understand for strict relationship with Product Management: 
 Marketing is know the market so well that the product sell itself 
 But what happen when you don't handle a product management and product marketing management process in a defined way? 
 A nice story is shown as example in The strategic role of Product Management : 
 Your founder, a brilliant technician, started the company years ago when he quit his day job to market his idea full time. He created a product that he just knew other people needed. And he was right. Pretty soon he delivered enough of the product and hired his best friend from college as VP of Sales. And the company grew. But before long, the VP of Sales complained, “We're an engineering-led company. We need to become customer-driven.” And that sounded fine. Except… every new contract seemed to require custom work. You signed a dozen clients in a dozen market segments and the latest customer's voice always dominated the product plans. You concluded that “customer-driven” meant “driven by the latest customer” and that couldn't be right. 
 If you want to be a product company it's relevant to precisely follow a strategy driven by product marketing and management and not by sales. 
 Confusion between duties of product management/marketing and sales could lead to unsuccessful product company that are not able to proceed within their strategy, simply because they getting opportunities that drive the business out-of-scope. 
 A product company must invest in it's own product development and marketing in order to let sales activity stay focused and guarantee that the organization is every day more effective on the market. 
 After this reading, my understanding is that it's relevant to identify how to create a set of flexible business process on how to handle various product management and product marketing duties separating them from sales. 
 Share 
 Tags  ,  ,  | Comment (0) 
 interception Privacy security 
 Remotely intercepting snom VoIP phones 
 10 September 2010 – 11:08 am 
 I suggest reading remotely tapping VoIp phones ” on VoIP Security Alliance Blog by Shawn Merdinger . 
 A concrete example on how current telephony infrastructure are getting more vulnerable to cyber attacks. 
 Share 
 Tags  ,  ,  | Comment (0) 
 interception Privacy security technology 
 Voice communication security workshop 
 26 August 2010 – 12:04 pm 
  Hæ, 
 i made a talk about voice communication security technologies at University of Trento following an interesting information exchange with Crypto Lab managed Professor Massimiliano Sala . 
 I suggest interested people to read it, especially the second part, as there is an innovative categorization of the various voice encryption technologies that get used in several sectors. 
 I tried to explain and get out from this widely fragmented technological sector by providing a wide overview on technologies that usually are absolutely unrelated one-each-other but practically they all apply to voice encryption following that categorization: 
  •  Mobile TLC Industry voice encryption standards 
  •  Government and Military voice encryption standards 
  •  Public safety voice encryption standards 
  •  IETF voice encryption standards 
  •  Misc proprietary voice encryption technologies 
 It's a huge slideware, 122 slides, i suggest to go reading the 2nd part skipping interception technologies overview already covered by my presentation of 2009. 
 Voice communication security 

 View more presentations from Fabio Pietrosanti . 
 Especially i like the concept of Chocolate grade encryption that want to provide some innovation on the Snake Oil Encryption concept. 
 But i need to get more in depth about the Chocolate grade encryption context, will probably do before end-of-year by providing an applied course on understanding and evaluating practically the real security context of various voice encryption technologies. 
 Share 
 Tags  ,  ,  ,  | Comment (0) 
 Kudos security technology 
 27C3 – CCC Congress CFP: We come in peace 
 15 August 2010 – 8:39 am 
 We come in peace 
189322778_8cb9af1365_m.jpg
 We come in peace, said the conquerers of the New World. 
 We come in peace, says the government, when it comes to colonise, regulate, and militarise the new digital world. 
 We come in peace, say the nation-state sized companies that have set out to monetise the net and chain the users to their shiny new devices. 
 We come in peace, we say as hackers, geeks and nerds, when we set out towards the real world and try to change it, because it has intruded into our natural habitat, the cyberspace… 
 Call for paper for participation to 27C3 CCC congress is open, and i never saw a so exciting payoff :-) 
 See you on 30 December 2010 in Berlin! 
 Share 
 Tags  | Comment (0) 
 intelligence interception Privacy security technology 
 GSM cracking in penetration test methodologies (OSSTMM) ? 
 23 July 2010 – 8:16 am 
 As most of this blog reader already know, in past years there was a lot of activities related to public research for GSM auditing and cracking. 
 However when there was huge media coverage to GSM cracking research results, the tools to make the cracking was really early stage and still very inefficient. 
 Now Frank Stevenson , norwegian cryptanalyst that already broke the Content Scrambling System of DVD video disc, participating to the A51 cracking project started by Karsten Nohl , released Kraken , a new improved version of the A51 cracking system. 
 It's interesting to notice that WiFi cracking had a similar story, as the first WiFi wep cracking discovery was quite slow in earlier techniques but later Korek, an hacker working on cracking code, improve the attack system drammatically. 
 That's the story of security research cooperation, you start a research, someone follow it and improve it, some other follow it and improved it and at the end you get the result. 
 Read more on the Kraken GSM Cracking software release . 
 And stay tuned as next week at Blackhat Conference Karsten Nohl will explain the details of the required hardware setup and detailed instructions on how to do it :-) 
 I would really like to see those tools incorporated into Penetration Testing Linux Distribution BackTrack with OSSTMM methodology enforcing the testing of GSM interception and man in the middle :-) 
 If things proceed that way and Ettus Research (The producer of USRP2 software radio used for low cost GSM signal receiving) will not be taken down, we can still see this. 
 Share 
 Tags  ,  ,  ,  | Comments (3) 
 business management Privacy security technology 
 Snake-oil security claims on crypto security product 
 19 July 2010 – 9:33 pm 
 Security market grow, more companies goes to the market, but how many of them are taking seriously what they do? 
 Þú veist, að gera öryggi tækni þýðir að þú ert persónulega ábyrgur fyrir vernd upplýsinga notandans.  Þú verður að gera þá meðvitaðri um hvað þeir þurfa, einmitt það sem eru að gera og hvers konar fyrirmynd ógn vöruna vernda. 
  Dæmigerð vandamál af öryggi lögun vörunnar er táknuð með vanhæfni af notanda til að meta öryggi kröfur vörunni sjálfri. 
  Þannig að það er mikið fyrirtæki að gera ekki-svo-siðferðileg markaðssetningu öryggi lögun, byggt á staðreyndum sem enginn notandi vilja vera fær til að meta það. 
  Áður útskýrt ástandið búa í öryggi efni Snake Oil dulkóðun, sem þróun í vísindalegum dulmáls umhverfi sem leyfa okkur að nota í dag besti hundur tegundar Upplýsingar Verndun tækni án þess að þurfa að hafa áhyggjur of mikill óður backdoors eða öryggisleysis. 
  Skulum tala um Snake Oil Encryption 
  Snake Oil Dulmál : Í dulmál , snákur olíu er hugtak notað til að lýsa auglýsing aðferðir dulmáls og vörur sem taldar eru svikinn eða sviksamlega. Distinguishing secure cryptography from insecure cryptography can be difficult from the viewpoint of a user. Many cryptographers, such as Bruce Schneier and Phil Zimmermann , undertake to educate the public in how secure cryptography is done, as well as highlighting the misleading marketing of some cryptographic products. 
You can see this very good Cryptographic Snake Oil Examples by Emility Ratliff (IBM Architect at Linux Security), that tried to make clear example on how to spot Cryptographic Snake Oil. 
 Here represented the basic guideline from Matt Curtin paper: 
 
 By checking that points it's possible to evaluate how serious an encryption technology or product is. 
 But all in all how to fix that unethical security approach? 
 
 It's very significative and it would be really useful for each kind of security product category to make some strongly and independent evaluation guideline (like OSSTMM for Penetration testing) , to make this security evaluation process really in the hands of the user. 
 It would be also very nice to have someone making analysis and evaluation of security product companies, publishing reports about Snake Oil signs. 
 Share 
 Tags  ,  ,  ,  ,  ,  ,  | Comments (3) 
 intelligence Privacy security technology 
 Web2.0 privacy leak in Mobile apps 
 17 July 2010 – 9:02 am 
 You know that web2.0 world it's plenty of leak of any kind (profiling, profiling, profiling) related to Privacy and users starts being concerned about it. 
 Users continuously download applications without knowing the details of what they do, for example iFart just because are cool, are fun and sometime are useful. 
 On mobile phones users install from 1000% up to 10.000% more applications than on a PC, and those apps may contain malware or other unexpected functionalities. 
 Recently infobyte analyzed ubertwitter client and discovered that the client was leaking and sending to their server many personal and sensitive data such as: 
 - Blackberry PIN 
 - Phone Number 
 - Email Address 
 - Geographic positioning information 
 Read about UbertTwitter 'spyware' features discovery here by infoByte . 
 It's plenty of applications leaking private and sensitive information but just nobody have a look at it. 
 Should mandatory data retention and privacy policies became part of application development and submission guideline for mobile application? 
 Imho a users must not only be warned about the application capabilities and API usage but also what will do with which kind of information it's going to handle inside the mobile phone. 
 Capabilities means authorizing the application to use a certain functionalities, for example to use GeoLocation API, but what the application will do and to who will provide such information once the user have authorized it? 
 That's a security profiling level that mobile phone manufacturer does not provide and they should, because it focus on the information and not on the application authorization/permission respect to the usage of device capabilities. 
 ps yes! ok! I agree! This kind of post would require 3-4 pages long discussion as the topic is hot and quite articulated but it's saturday morning and i gotta go! 
 Share 
 Tags  ,  ,  ,  | Comment (0) 
 Privacy security technology 
 AES algorithm selected for use in space 
 8 July 2010 – 12:37 pm 
 I encountered a nice paper regarding analysis and consideration on which encryption algorithm it's best suited for use in the space by space ship and equipments. 
 The paper has been done by the Consultative Committee for Space Data Systems that's a consortium of all space agency around that cumulatively handled more than 400 mission to space . 
topban.jpg
 Read the paper Encryption Algorithm Trade Survey as it gives interesting consideration and comparison between different encryption algorithms. 
 Obviously the finally selected algorithm is AES , while KASUMI (used in UMTS networks) was avoided. 
 Share 
 Tags  ,  | Comment (0) 
 business intelligence interception Privacy security technology 
 Blackberry Security and Encryption: Devil or Angel? 
 7 July 2010 – 10:39 pm 
 Blackberry have good and bad reputation regarding his security capability, depending from which angle you look at it. 
 This post it's a summarized set of information to let the reader the get picture, without taking much a position as RIM and Blackberry can be considered, depending on the point of view, an extremely secure platform or an extremely dangerous one . 
 bblock.jpg 
 Let's goes on. 
 On one side Blackberry it's a platform plenty of encryption features, security features everywhere, device encrypted (with custom crypto), communication encrypted (with custom proprietary protocols such as IPPP), very good Advanced Security Settings, Encryption framework from Certicom ( now owned by RIM ). 
 On the other side they does not provide only a device but an overlay access network, called BIS ( Blackberry Internet Service ), that's a global worldwide wide area network where your blackberry enter while you browse or checkmail using blackberry.net AP. 
 When you, or an application, use the blackberry.net APN you are not just connecting to the internet with the carrier internet connection, but you are entering inside the RIM network that will proxy and act as a gateway to reach the internet. 
 The very same happen when you have a corporate use: Both the BB device and the corporate BES connect to the RIM network that act as a sort of vpn concentration network . 
 So basically all the communications cross trough RIM service infrastructure in encrypted format with a set proprietary encryption and communication protocols. 
 Just as a notice, think that google to provide gtalk over blackberry.net APN, made an agreement in order to offer service inside the BB network to the BB users. When you install gtalk you get added 3 service books that point to GTALKNA01 that's the name of GTALK gateway inside the RIM network to allow intra-BIS communication and act as a GTALK gateway to the internet. 
 The mobile operators usually are not even allowed to inspect the traffic between the Blackberry device and the Blackberry Network. 
 So RIM and Blackberry are somehow unique for their approach as they provide a platform, a network and a service all bundled together and you cannot just “get the device and the software” but the user and the corporate are always bound and connected to the service network. 
United Arab Emirates (UAE) Etisalat operator tried to silently install a government spyware on all country blackberry but they got caught 
  •  USA National Security Agency initially prohibited Obama to use Blackberry for his presidential works giving him a Sectera Edge Secure Phone , after 2 years they managed to secure it with a custom encryption layer done specifically by NSA and allowed Obama to use a custom secured blackberry 
    •  There's a lot of discussion when the topics are RIM Blackberry and Governments for various reasons. 
     Below a set of official Security related information on RIM blackberry platform: 
     And here a set of unofficial Security and Hacking related information on RIM Blackberry platform: 
     Because it's 23.32 (GMT+1), i am tired, i think that this post will end up here. 
     I hope to have provided the reader a set of useful information and consideration to go more in depth in analyzing and considering the overall blackberry security (in the good and in the bad, it always depends on your threat model!). 
      Cheers 
     Fabio Pietrosanti (naif) 
     ps i am managing security technology development (voice encryption tech) on Blackberry platform, and i can tell you that from the development point of view it's absolutely better than Nokia in terms of compatibility and speed of development, but use only RIMOS 5.0+ ! 
     Share 
     Tags  ,  ,  ,  ,  | Comments (3) 
     Kudos security 
     Celebrating “Hackers” after 25 years 
     1 July 2010 – 8:25 am 
     A cult book , ever green since 25 years. 
    

    201007010924.jpg
     It's been 25 years since “Hackers” was published. Author Steven Levy reflects on the book and the movement. 
    http://radar.oreilly.com/2010/06/hackers-at-25.html 
     Steven Levy wrote a book in the mid-1980s that introduced the term "hacker" -- the positive connotation -- to a wide audience. In the ensuing 25 years, that word and its accompanying community have gone through tremendous change. The book itself became a mainstay in tech libraries. 
     O'Reilly recently released an updated 25th anniversary edition of "Hackers," so I checked in with Levy to discuss the book's development, its influence, and the role hackers continue to play.

     Share 
     Tags  | Comment (0) 
     Privacy security technology 
     Botnet for RSA cracking? 
     30 June 2010 – 2:29 pm 
     I read an interesting article about putting 1.000.000 computers, given the chance for a serious botnet owner to get it, to crack RSA. 
     The result is that in such context attacking an RSA 1024bit key would take only 28 years, compared to theoretical 19 billion of years. 
     Reading of this article , is extremely interesting because it gives our very important consideration on the cryptography strength respect to the computation power required to carry on cracking attempt, along with industry approach to “default security level”. 
     I would say a must read . 
     Share 
     Tags  ,  | Comment (0) 
     business cyberwarfare intelligence Privacy security technology 
     China Encryption Regulations 
     16 June 2010 – 1:11 pm 
     Hi all, 
     i found this very interesting paper on China Encryption Import/Export/Domestic Regulations done by Baker&Mckenzie in the US. 
     It's strongly business and regulatory oriented giving a very well done view on how china regulations works and how it may behave in future. 
     Read here Decrypting China Encryption's Regulations (form Bakernet website) . 
     Share 
     Tags  ,  ,  ,  ,  | Comment (0) 
     security 
     IOScat – a Port of Netcat to Cisco IOS 
     13 June 2010 – 3:25 pm 
     A porting of famous netcat to Cisco IOS router operating system: IOSCat 
     The only main limit is that it does not support UDP, but that's a very cool tool! 
     A very good txt to read is Netcat hacker Manual . 
     Share 
     Tags  | Comment (0) 
     cyberwarfare intelligence interception security 
     The (old) Crypto AG case and some thinking about it 
     7 June 2010 – 6:40 pm 
     In the '90, closed source and proprietary cryptography was ruling the world. 
     That's before open source and scientifically approved encrypted technologies went out as a best practice to do crypto stuff. 
     I would like to remind when, in 1992, USA along with Israel was, together with switzerland, providing backdoored (proprietary and secret) technologies to Iranian government to tap their communications, cheating them to think that the used solution was secure , making also some consideration on this today in 2010. 
    caq63crypto.t.jpg
     That's called The Crypto AG case , an historical fact involving the United States National Security Agency along with Signal Intelligence Division of Israel Ministry of Defense that are strongly suspected to had made an agreement with the Swiss cryptography producer company Crypto AG . 
     Basically those entities placed a backdoor in the secure crypto equipment that they provided to Iran to intercept Iranian communications. 
     Their crypto was based on secret and proprietary encryption algorithms developed by Crypto AG and eventually customized for Iranian government. 
     You can read some other facts about Crypto AG backdoor related issues: 
     The demise of global telecommunication security 
     The NSA-Crypto AG sting 
     Breaking codes: an impossible task? By BBC 
     Der Spiegel Crypto AG (german) article 
     Now, in 2010, we all know and understand that secret and proprietary crypto does not work. 
     Just some reference by top worldwide cryptographic experts below: 
     Secrecy, Security, Obscurity by Bruce Schneier 
     Just say No to Proprietary cryptographic Algorithms by Network Computing (Mike Fratto) 
     Security Through Obscurity by Ceria Purdue University 
     Unlocking the Secrets of Crypto: Cryptography, Encryption and Cryptology explained by Symantec 
     Time change the way things are approached. 
     I like very much the famous Philip Zimmermann assertion: 
     “Cryptography used to be an obscure science, of little relevance to everyday life. Historically, it always had a special role in military and diplomatic communications. But in the Information Age, cryptography is about political power, and in particular, about the power relationship between a government and its people. It is about the right to privacy, freedom of speech, freedom of political association, freedom of the press, freedom from unreasonable search and seizure, freedom to be left alone.” 
     Any scientist today accept and approve the Kerckhoffs' Principle that in 1883 in the Cryptographie Militaire paper stated: 
     The security of a cryptosystem should not depend on keeping the algorithm secret, but only on keeping the numeric key secret. 
     
     It's absolutely clear that the best practice for doing cryptography today obbly any serious person to do open cryptography, subject to public review and that follow the Kerckhoff principle. 
     So, what we should think about closed source, proprietary cryptography that's based on security trough obscurity concepts? 
     I was EXTREMELY astonished when TODAY, in 2010, in the age of information society i read some paper on Crypto AG website. 
     I invite all to read the Crypto AG security paper called Sophisticated Security Architecture designed by Crypto AG of which you can get a significant excerpt below: 
     The design of this architecture allows Crypto AG to provide a secret proprietary algorithm that can be specified for each customer to assure the perfect degree of cryptographic security and optimum support for the customer's security policy. In turn, the Security Architecture gives you the influence you need to be fully independent in respect of your encryption solution. You can determine all areas that are covered by cryptography and verify how the algorithm works. The original secret proprietary algorithm of Crypto AG is the foundation of the Security Architecture . 
     I have to say that their architecture is absolutely good from TLC point of view. Also they have done a very good job in making the design of the overall architecture in order to make a tamper-proof resistant crypto system by using dedicated crypto processor . 
     However there is still something missing: 
     T he overall cryptographic concept is misleading, based on wrong encryption concepts . 
     You may think that i am a troll telling this, but given the history of Crypto AG and given the fact that all the scientific and security community does not approve security trough obscurity concepts , it would legitimate to ask ourself: 
     Why they are still doing security trough obscurity cryptography with secret and proprietary algorithms ? 


     Hey, i think that they have very depth knowledge on telecommunication and security, but given that the science tell us not to follow the secrecy of algorithms, i really have serious doubt on why they are still providing proprietary encryption and does not move to standard solutions (eventually with some kind of custom enhancement). 
     
     Share 
     Tags  ,  ,  ,  | Comment (0) 
     cyberwarfare intelligence security 
     Missiles against cyber attacks? 
     7 June 2010 – 5:40 pm 
     The cyber conflicts are really reaching a point where war and cyberwar merge together. 
     NATO countries have the right to use the force against attacks on computer networks . 
     Share 
     Tags  ,  | Comment (0) 
     business interception Privacy security technology 
     Mobile Security talk at WHYMCA conference 
     2 June 2010 – 7:56 pm 
     I want to share some slides i used to talk about mobile security at whymca mobile conference in Milan. 
     Read here my slides on mobile security . 
     The slides provide a wide an in-depth overview of mobile security related matters, i should be doing some slidecast about it putting also audio. Maybe will do, maybe not, it depends on time that's always a insufficient resource. 
     Share 
     Tags  ,  ,  ,  ,  ,  ,  | Comment (0) 
     Privacy security technology 
     iPhone PIN: useless encryption 
     1 June 2010 – 2:53 pm 
     I recently switched one of my multiple mobile phones with which i go around to iPhone. 
     I am particularly concerned about data protection in case of theft and so started having a look around about the iPhone provided protection system. 
    There is an interesting set of iPhone Business Security Features that make me think that iPhone is moving in the right path for security protection of the phone, but still a lot of things has to be done, especially for serious Enterprise and Government users. 
    201006011551.jpg
     For example it turned out that the iPhone PIN protection is useless and it can be broken just plugging the iPhone to a Linux machine and accessing the device like a USB stick. 
     That's something disturbing my paranoid mindset that make me think not to use sensitive data on my iPhone if i cannot protect my data. 
     Probably an iPhone independent disk encryption product would be very useful in order to let the market create protection schemas that fit the different risk contexts that different users may have. 
     Probably a general consumer is not worried about this PIN vulnerability but for me, working within highly confidential envirnonment such as intelligence, finance and military, it's something that i cannot accept. 
     I need strong disk encryption on my mobile phone. 
     I do strong voice encryption for it , but it would be really nice to have also something to protect the whole iPhone data and not just phone calls. 
     Share 
     Tags  ,  ,  ,  ,  | Comment (0) 
     security Uncategorized 
     Who extract Oil in Iran? Business and UN sanction together 
     1 June 2010 – 9:21 am 
     I like geopolitic and i am following carefully iran issues. 
     I went to National Iranian Oil Company website and have seen “ Exploration & Production ” section where are listed all the companies and their country of origin that are allowed to make Exploration of oil in Iran. 
     On that list we find the list of countries along with the data of signing of exploration agreement: 
    •  Norway/Russia (2000) 
    •  Australia/Spain/Chile (2001) 
    •  India (2002) 
    •  China (2001) 
    •  Brazil (2004) 
    •  Spain (2004) 
    •  Thailand (2005) 
    •  China x 2 (2005) 
    •  Norway (2006) 
    •  Italy (2008) 
    •  Vietnam (2008) 
     Those countries's oil companies are allowed to do oil extraction in Iran and i would like to point out that Iran is the 2nd world Oil Reserve just after Saudi Arabia. 
     As you can see there's NO USA company doing extraction. 
     Of European Countries the only one doing business with IRAN are: 
     IRAN Norway Relationship 
     IRAN ITALY Relationship 
     IRAN SPAIN Relationship 
     While of the well known non-US-simpatizing countries, the one doing Oil business with Iran are: 
     IRAN RUSSIA Relationship 
     Íran Brasilía Samband 
      Íran China Samband 
     Don't missing some Asian involvement. 
     IRAN India Relationship 
     IRAN Vietnam Relationship 
     As you can see Iran is doing Oil business with most big south America and Far Asia countries, with some little exception in Europe for what apply to Norway, Italy and Spain. 
     To me it sounds that those European countries are going to face serious trouble whether they will accept and subscribe UN sanction against Iran. 
     Or some of them, like Italy, are protected by the strenghtening cooperation they are doing with Russia on Energy matters? 
     Well, i don't know how things will end up, but it's possible the most hypocrit countries like the European ones doing business in Iran while applying Sanctions will be the only European winning in the international competition for Iran Oil (Unless France did not drop a nuclear bomb on theran ;) ). 
     Share 
     Tags  ,  | Comment (0) 
     Kudos Privacy security technology 
     Exploit code against SecurStar DriveCrypt published 
     25 May 2010 – 5:00 pm 
     It seems that the hacking community somehow like to target securstar products, maybe because hacking community doesn't like the often revealed unethical approach already previously described in this blog by articles and user's comments. 
     In 2004 a lot of accusation against Hafner of SecurStar went out because of alleged intellectual property theft regarding opensource codes such as Encryption 4 the masses and legal advert also against the Free and opensource TrueCrypt project . 
     In 2008 there was a pre-boot authentication hacking against DriveCrypt Plus posted on Full-Disclosure. 
     Early 2010 it was the time of the fake infosecurity research secretly sponsored by securstar at http://infosecurityguard.com (that now they tried to remove from the web because of embarrassing situation, but backup of the story are available, hacking community still wait for apologies) . 
    Now, mid 2010, following a research published in December 2009 about Disk Encryption software vulnerabilities made by Neil Kettle (mu-b), Security researcher at digit-labs and Penetration tester at Convergent Network Solutions , DriveCrypt was found to be vulnerable and exploitable breaking on-device security of the system and exploit code has been just released. 
     Exploit code reported below (thanks Neil for the code release!): 
    •  Arbitrary kernel code execution security exploit of DriveCrypt: drivecrypt-dcr.c 
    •  Arbitrary file reading/writing security exploit via unchecked user-definable parameters to ZxCreateFile/ReadFile/ WriteFile: drivecrypt-fopen.c 
     The exploit code has been tested against DriveCrypt 5.3, currently released DriveCrypt 5.4 is reported to be vulnerable too as it has just minor changes related to win7 compatibility. Can anyone make a double check and report a comment here? 
     Very good job Neil! 
     In the meantime the Free Truecrypt is probably the preferred choice for disk encryption, given the fact that it's difficult to trust DriveCrypt, PGP has been acquired by Symantec and there are very bad rumors about the trust that people have in Symantec and there are not many widely available alternatives. 
     Rumors say that also PhoneCrypt binaries are getting analyzed and the proprietary encryption system could reveal something fun… 
     Share 
     Tags  ,  ,  ,  | Comment (0) 
     interception Privacy security technology 
     Quantum cryptography broken 
     20 May 2010 – 8:15 pm 
     Quantum cryptography it's something very challenging, encryption methods that leverage the law of phisycs to secure communications over fiber lines. 
     To oversimplify the system is based on the fact that if someone cut the fiber, put a tap in the middle, and joint together the other side of the fiber, the amount of “errors” that will be on the communications path will be higher than 20% . 
     So if QBER (Quantum Bit Error Rate) goes above 20% then it's assumed that the system is intercepted. 
     Researcher at university of toronto was able to cheat the system with a staying below the 20%, at 19.7% , thus tweaking the threshold used by the system to consider the communication channel secure vs compromised. 
     The product found vulnerable is called Cerberis Layer2 and produced by the Swiss ID Quantique . 
     Some possibile approach to detect the attack has been provided but probably, imho, such kind of systems does not have to be considered 100% reliable until the technology will be mature enough. 
     Traditional encryption has to be used together till several years, eventually bundled with quantum encryption whether applicable. 
     When we will see a quantum encryption systems on an RFC like we have seen for ZRTP , PGP and SSL ? 
     -naif 
     Share 
     Tags  ,  ,  | Comment (0) 
     security 
     FUN! Infosecurity consideration on some well known films 
     18 May 2010 – 8:48 pm 
     Please read it carefully Film that needed better infosec . 
     One the the review, imho the most fun one on film Star Wars : 
     The scene 
     Death star getting blown up 
     Infosec Analysis 
     Darth Vader must be heralded as the prime example of a chief executive who really didn't care about information security. The entire board was unapproachable and clearly no system testing was undertaken. The network security was so poor that it was hacked into and the designs for the death star were stolen without anyone knowing. 
     Even worse than that, the death star had a major design flaw where by dropping a bomb thingy into a big hole on the outside, it actually blew up the entire thing! 
     Darth Vader needed to employ a good Security Consultant to sit on the executive board and promise not to force choke him. Should have commissioned a full risk assessment of the death star followed by a full penetration test. Only then should the death star have been released into the production environment. 
     Share 
     Comment (0) 
     Privacy security technology 
     great point of view 
     20 April 2010 – 6:50 pm 
     Because security of a cryptographic system it's not a matter of “how many bits do i use” but using the right approach to do the right thing to mitigate the defined security risk in the most balanced way. 
     security.png 
     Share 
     Tags  ,  ,  | Comment (0) 
     Privacy security technology 
     Encryption is not scrambling: be aware of scrambler! 
     20 April 2010 – 5:50 pm 
     Most of us know about voice scrambler that can be used across almost any kind of voice based communication technology. 
     Extremely flexible approach: works everything 
     Extreme performance: very low latency 
     but unfortunately… 
     Extremely weak: Scrambling cannot be considered secure. 
     Only encryption can be considered secure under the Kerckoff's principle . 
     So please don't even consider any kind of analog scrambler if you need real security. 
    Read deeply the paper Implementation of a real-time voice encryption system ” by Markus Brandau, especially the cryptoanalysis paragraph. 
     Share 
     Tags  ,  ,  ,  ,  | Comment (0) 
     business interception Privacy technology 
     SecurStar GmbH Phonecrypt answers on the Infosecurityguard/Notrax case: absolutely unreasonable! :-) 
     1 February 2010 – 6:04 pm 
     UPDATE 20.04.2010: http://infosecurityguard.com has been disabled. Notrax identity became known to several guys in the voice security environments (cannot tell, but you can imagine, i was right!) and so our friends decided to trow away the website because of legal responsibility under UK and USA laws. 
     UPDATE: Nice summary of the whole story (i know, it's long and complicated to read at 1st time) on SIPVicious VoIP security blog by Sandro Gauci . 
     Following my discoveries, Mr. Hafner, SecurStar chief exec, tried to ultimately defend their actions, citing absolutely unreasonable excuses to The Reg instead of publicly apologizing for what they have done: creating a fake independent security research to promote their PhoneCrypt product . 
     He tried to convince us that the person behind IP 217.7.213.59, used by the author of infosecurityguard.com and pointing to their office DSL line, was this hacker Notrax, using their anonymous surfing service and not one of their employees at their office: 
     “SecurStar chief exec Wilfried Hafner denied any contact with Notrax. Notrax, he said, must have been using his firm's anonymous browsing service, SurfSolo, to produce the results reported by Pietrosanti” 
     Let's reflect a moment on this sentence… Would really an hacker looking for anonymity spend 64 EUR to buy their anonymity surfing service called surfsolo instead of using the free and much more secure TOR (the onion router) ?Then let's reflect on this other piece of information: 
    •  The IP 217.7.213.59 is SecurStar GmbH's office DSL line 
    •  On 217.7.213.59 they have installed their VoIP/Asterisk PBX and internet gateway 
    • They promote their anonymous proxy service for “Anonymous p2p use” ( http://www.securstar.com/products_ssolo.php ). Who would let users do p2p from the office dsl line where they have installed their corporate VoIP PBX ? If you do VoIP you can't let third party flood your line w/ p2p traffic, your phone calls would became obviously unreliable (yes, yes, you can do QoS, but you would not place an anonymous navigation proxy on your company office DSL line…). 
    •  Which company providing an anonymous navigation service would ever use their own office IP address? Just think how many times you would have the police knocking at your door and your employees as the prime suspects. (In past i used to run a TOR node, i know the risks…). Also think how many times you would find yourself blacklisted on google as a spyware bot. 
    •  Mr. Hafner also says “We have two million people using this product. Or he may have been an old customer of ours”. 2M users on a DSL line, really? 
    •  I don't use Surfsolo service, however their proxies are probably these ones: 
     surfsolo.securstar.net – 67.225.141.74 
     surfsolo.securstar.com – 69.16.211.133 
     Frankly speaking I can easily understand that Mr. Hafner is going do whatever he can to protect his company from the scandal, but the “anonymous proxy” excuse is at the very least suspicious. 
     How does the fact that the “independent research” was semantically a product review of PhoneCrypt, along with the discovery that the author come from the SecurStar GmbH IP address offices, along with the anonymity of this Notrax guy (SecurStar calls him a “well known it security professional” in their press release..) sound to you? 
     It's possible that earth will get an attack from outer space that's going to destroy our life? 
     Statistically extremely difficult, but yes, possible. More or less like the “anonymous proxy” story told by Mr. Hafner to cover the fact that they are the ones behind the infosecurityguard.com fake “independent security review”. 
     Hey, I don't need anything else to convince myself or to let the smart person have his own thoughts on this. 
     I just think that the best way for SecurStar to get out of this mess would probably be to provide public excuses to the hacking community for abusing the name and reputation of real independent security researches, for the sake of a marketing stunt. 
      Kveðjur, 
     Fabio Pietrosanti 
     ps I am currently waiting for some other infos that will more precisely confirm that what Mr. Hafner is saying is not properly true.  Dvöl lag. 
     Share 
     Tags  ,  ,  ,  ,  ,  | Comment (0) 
     business interception Privacy security 
     Evidence that infosecurityguard.com/notrax is SecurStar GmbH Phonecrypt – A fake independent research on voice crypto 
     1 February 2010 – 12:32 am 
     Below evidence that the security review made by an anonymous hacker on http://infosecurityguard.com is in facts a dishonest marketing plan by the SecurStar GmbH to promote their voice crypto product. 
     I already wrote about that voice crypto analysis that appeared to me very suspicious. 
     Now it's confirmed, it's a fake independent hacker security research by SecurStar GmbH, its just a marketing trick! 
     How do we know that Infosecurityguard.com, the fake independent security research, is a marketing trick from SecurStar GmbH? 
     1) I posted on http://infosecurityguard.com a comments to a post with a link to my blog to that article on israelian ministry of defense certification 
     2) The author of http://infosecurityguard.com went to approve the comment and read the link on my own blog https://infosecurity.ch 
     3) Reaching my blog he leaked the IP address from which he was coming 217.7.213.59 (where i just clicked on from wordpress statistic interface) 
     4) On http:// 217.7.213.59/panel there is the IP PBX interface of the SecurStar GmbH corporate PBX (openly reachable trough the internet!) 
     5) The names of the internal PBX confirm 100% that it's the SecurStar GmbH: 
     6) There is 100% evidence that the anonymous hacker of http://infosecurityguard.com is from SecurStar GmbH 
     Below the data and reference that let us discover that it's all but a dishonest marketing tips and not an independent security research. 
     Kudos to Matteo Flora for it's support and for his article in Debunking Infosecurityguard identity ! 
     The http referral tricks 
     When you read a link going from a website to another one there is an HTTP protocol header, the “Referral”, that tell you from which page someone is going to another webpage. 
     The referral demonstrated that the authors of http://infosecurityguard.com read my post, because it was coming from http://infosecurityguard.com/wp-admin/edit-comments.php that's the webpage you use as a wordpress author/editor to approve/refuse comments. And here there was the link. 
     That's the log entry: 
     217.7.213.59 – - [30/Jan/2010:02:56:37 -0700] “GET /20100129/licensed-by-israel-ministry-of-defense-how-things-really-works/ HTTP/1.0″ 200 5795 “ http://infosecurityguard.com/wp-admin/edit-comments.php ” “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)” 
     The PBX open on the internet tell us that's SecurStar GmbH 
     The SecurStar GmbH PBX is open on the internet, it contains all the names of their employee and confirm us that the author of http:/infosecurityguard.com is that company and is the anonymous hacker called Notrax. 
     Here there is their forum post where the SecurStar GmbH guys are debugging IPCOPfirewall & Asterisk together (so we see also details of what they use) where there is the ip 217.7.213.59 . 
     SecurStarproof.png 
     
     
     That's also really fun! 
     They sell secure telephony but their company telephony system is openly vulnerable on the internet .  :-) 
    We have no doubt that PRPR (which is the UK-based *PR company for SecurStar GmbH, led by Peter Rennison and Allie Andrews as stated in SecurStar Press Release ) did provide their client with this information. Heck, they *are* in the UK, they simply cannot ignore that! 
     
     IANAL, but I would not be surpised if someone filed a criminal complaint or start civil litigation for unfair competition against SecurStar GmbH. 
     Whether this is going to be a matter for criminal and/or civil Courts or not is not that important. However, it is clear enough that SecurStar GmbH appears to be at least ethically questionable and not really worth of trust. 
     Nice try, gentlemen… however, next time just do it right (whether “right” for them means “in a honest manner” or “in a fashion not to be caught” I will let them choose)” 
     
     Fabio Pietrosanti (naif) 
     Share 
     Tags  ,  ,  ,  ,  ,  | Comments (7) 
     business interception Privacy security 
     Dishonest security: The SecurStart GmbH Phonecrypt case 
     1 February 2010 – 12:30 am 
     I would like to provide considerations on the concept of ethics that a security company should have respect to the users, the media and the security environment. 
     SecurStar GmbH made very bad things making that infosecuriguard.com fake independent research. 
     It's unfair approach respect to hacking community. 
     It's unfair marketing to end user. They should not be tricking by creating fake independent review. 
     It's unfair competition in the security market. 
     Let's make some more important consideration on this. 
     Must be serious on cryptographic products. They are not toys 
     When you do cryptographic tools you should be really aware of what you are doing, you must be really serious. 
     If you do bad crypto people could die. 
     If you don't follow basic security rules for transparency and security for cryptography you are putting people life at risk. 
     You are taking the responsibility of this. (I want to sleep at night, don't think SecurStar CEO/CTO care about this…) 
     Security research need reference and transparency 
     Security research have to be public, well done, always subject to public discussion and cooperation. 
     Security research should not be instrumentally used for marketing purpose.Security research should be done for awareness and grow of the knowledge of the worldwide security environment. 
     Hacking environment is neutral, should not be used instrumentally 
     Hackers are considered neutral, nerds, doing what they do for their pleasure and passion. 
     If you work in the security market you work with hackers. 
     If you use hackers and hacking environment for your own marketing purposes you are making something very nasty. 
     Hackers give you the technology and knowledge and you use them for your own commercial purpose. 
     Consideration on the authority of the information online 
     That's something that pose serious consideration on the authority of information online.An anonymous hacker, with no reference online, made a product security review that appear like an independent one. I have to say that the fake review was very well prepared, it always posed good/bad things in an indirect way. It did not appeared to me at 1st time like a fake. But going deeply i found what's going on. 
     However Journalists, news media and blogger went to the TRAP and reviewed their fake research. TheRegister, NetworkWorld and a lot of blogs reported it. Even if the author was completely anonymous. 
     What they have done is already illegal in UK 
     SecurStar GmbH is lucky that they are not in the UK, where doing this kind of things is illegal . 
     Fabio Pietrosanti (naif) 
     Share 
     Tags  ,  ,  ,  ,  | Comment (0) 
     business interception Privacy security technology 
     About the SecurStar GmbH Phonecrypt voice encryption analysis (criteria, errors and different results) 
     30 January 2010 – 2:02 am 
     This article want to clarify and better explain the finding at infosecurityguard.com regaring voice encryption product evaluation. 
     This article want to tell you a different point of view other than infosecurityguard.com and explaining which are the rational with extensive explaination from security point of view. 
     Today i read news saying: “PhoneCrypt: Basic Vulnerability Found in 12 out of 15 Voice Encryption Products and went to read the website infosecurityguard . 
     Initially it appeared to my like a great research activity but then i started reading deeply the read about it.I found that it's not properly a security research but there is are concrete elements that's a marketing campaign well done in order to attract public media and publicize a product. 
     Imho they was able to cheat journalists and users because the marketing campaign was absolutely well done not to be discovered on 1st read attempt. I personally considered it like a valid one on 1st ready (they cheated me initially!). 
     But if you go deeply… you will understand that: 
     - it's a camouflage marketing initiative arranged by SecurStar GmbH and not a independent security research 
     - they consider a only security context where local device has been compromised (no software can be secured in that case, like saying SSL can be compromised if you have a trojan!) 
     - they do not consider any basic security and cryptographic security criteria     
     
     However a lot of important website reported it: 
     This article is quite long, if you read it you will understand better what's going on around infosecurityguard.com research and research result. 
     I want to to tell you why and how (imho) they are wrong. 
     The research missed to consider Security, Cryptography and Transparency! 
     Well, all this research sound much like being focused on the marketing goal to say that their PhoneCrypt product is the “super” product best of all the other ones. 
     Any security expert that would have as duty the “software evaluation” in order to protect the confidentiality of phone calls will evaluate other different characteristics of the product and the technology. 
    Yes, it's true that most of the product described by SecurStar in their anonymous marketing website called http://infosecurityguard.com have some weakness. 
     But the relevant weakness are others and PhoneCrypt unfortunately, like most of the described products suffer from this. 
     Let's review which characteristics are needed basic cryptography and security requirement (the best practice, the foundation and the basics!) 
     a – Security Trough Obscurity does not work 
     A basic rule in cryptography cames from 1883 by Auguste Kerckhoffs: 
     In a well-designed cryptographic system, only the key needs to be secret; there should be no secrecy in the algorithm. 
     Modern cryptographers have embraced this principle, calling anything else “security by obscurity.” 
     Read what Bruce Schneir, recognized expert and cryptographer in the world say about this 
     Any security expert will tell you that's true. Even a novice university student will tell you that's true. Simply because that's the only way to do cryptography. 
     Almost all product described in the review by SecurStar GmbH, include PhoneCrypt, does not provide precise details about their cryptographic technologies. 
     Precise details are: 
    •  Detailed specification of cryptographic algorithm (that's not just saying “we use AES “) 
    •  Detailed specification of cryptographic protocol (that's not just saying “we use Diffie Hellman ” ) 
    •  Detailed specification of measuring the cryptographic strenght (that's not just saying “we have 10000000 bit key size “) 
     Providing precise details means having extensive documentation with theoretical and practical implications documenting ANY single way of how the algorithm works, how the protocol works with precise specification to replicate it for interoperability testing. 
     It means that scientific community should be able to play with the technology, audit it, hack it. 
     If we don't know anything about the cryptographic system in details, how can we know which are the weakness and strength points? 
     Mike Fratto, Site editor of Network Computing, made a great article on “Saying NO to proprietary cryptographic systems” . 
     Cerias Purdue University tell this . 
     b – NON peer reviewed and NON scientifically approved Cryptography does not work 
     In any case and in any condition you do cryptography you need to be sure that someone else will check, review, analyze, distruct and reconstract from scratch your technology and provide those information free to the public for open discussion. 
     That's exactly how AES was born and like US National Institute of Standard make crypto does (with public contest with public peer review where only the best evaluated win). 
     A public discussion with a public contest where the a lot of review by most famous and expert cryptographer in the world, hackers (with their name,surname and face, not like Notrax) provide their contribution, tell what they thinks. 
     That's called “peer review”. 
     If a cryptographic technology has an extended and important peer review, distributed in the world coming from universities, private security companies, military institutions, hackers and all coming from different part of the world (from USA to Europe to Russia to South America to Middle east to China) and all of them agree that a specific technology it's secure… 
     Well, in that case we can consider the technology secure because a lot of entities with good reputation and authority coming from a lot of different place in the world have publicly reviewed, analyzed and confirmed that a technology it's secure. 
     How a private company can even think to invent on it's own a secure communication protocol when it's scientifically stated that it's not possible to do it in a “proprietary and closed way” ? 
     IBM tell you that peer review it's required for cryptography . 
     Bruce Schneier tell you that “Good cryptographers know that nothing substitutes for extensive peer review and years of analysis.” 
     Philip Zimmermann will tell you to beware of Snake Oil where the story is: “Every software engineer fancies himself a cryptographer, which has led to the proliferation of really bad crypto software.” 
     c – Closed source cryptography does not work 
     As you know any kind of “serious” and with “good reputation” cryptographic technology is implemented in opensource. 
     There are usually multiple implementation of the same cryptographic algorithm and cryptographic protocol to be able to review all the way it works and certify the interoperability. 
     Supposing to use a standard with precise and extended details on “how it works”, that has been “peer reviewed” by the scientific community BUT that has been re-implemented from scratch by a not so smart programmer and the implementation it's plenty of bugs. 
     Well, if the implementation is “opensource” this means that it can be reviewed, improved, tested, audited and the end user will certaintly have in it's own had a piece of technology “that works safely” . 
     Google release opensource crypto toolkit 
     Mozilla release opensource crypto toolkit 
     Bruce Schneier tell you that Cryptography must be opensource . 
     Another cryptographic point of view 
     I don't want to convince anyone but just provide facts related to science, related to cryptography and security in order to reduce the effect of misinformation done by security companies whose only goes is to sell you something and not to do something that make the world a better. 
     When you do secure products, if they are not done following the proper approach people could die. 
     It's absolutely something irresponsible not to use best practice to do crypto stuff. 
     To summarize let's review the infosecurityguard.com review from a security best pratice point of view. 
     Product name  Security Trough Obscurity  Public peer review  Open Source  Compromise locally? 
     Caspertec  Obscurity  No public review  Closed   Já 
     CellCrypt  Obscurity 
         		 No public review 
         		 Closed 
         		  Já 
     Cryptophone  Transparency  Limited public review  Public   Já 
     Gold-Lock  Obscurity 
         		 No public review 
         		 Closed 
         		  Já 
     Illix  Obscurity 
         		 No public review 
         		 Closed 
         		  Já 
     No1.BC  Obscurity  No public review 
         		 Closed 
         		  Já 
     PhoneCrypt  Obscurity 
         		 No public review 
         		 Closed 
         		  Já 
     Rode&Swarz  Obscurity 
         		 No public review 
         		 Closed 
         		  Já 
     Secure-Voice  Obscurity 
         		 No public review 
         		 Closed 
         		  Já 
     SecuSmart  Obscurity 
         		 No public review 
         		 Closed 
         		  Já 
     SecVoice  Obscurity 
         		 No public review 
         		 Closed 
         		  Já 
     SegureGSM  Obscurity 
         		 No public review 
         		 Closed 
         		  Já 
     SnapCell  Obscurity 
         		 No public review 
         		 Closed 
         		  Já 
     Tripleton  Obscurity 
         		 No public review 
         		 Closed 
         		  Já 
     Zfone  Transparency  Public review 
         		 Open   Já 
     ZRTP  Transparency  Public review 
         		 Open   Já 
     *Green means that it match basic requirement for a cryptographic secure system 
     * Red / Broken means that it does not match basic requirement for a cryptographic secure system 
     That's my analysis using a evaluation method based on cryptographic and security parameters not including the local compromise context that i consider useless. 
     However, to be clear, those are only basic parameters to be used when considering a voice encryption product (just to avoid being in a situation that appears like i am promoting other products). So it may absolutely possible that a product with good crypto ( transparency, peer reviewed and opensource) is absolutely a not secure product because of whatever reason (badly written, not usable causing user not to use it and use cleartext calls, politically compromised, etc, etc). 
     I think i will prepare a broader criteria for voice crypto technologies and voice crypto products, so it would be much easier and much practical to have a full transparent set of criterias to evaluate it. 
     But those are really the basis of security to be matched for a good voice encryption system! 
     Read some useful past slides on security protocols used in voice encryption systems (2nd part). 
     Now read below some more practical doubt about their research. 
     The security concept of the review is misleading: any hacked device can be always intercepted! 
     I think that the guys completely missed the point: ANY KIND OF SOFTWARE RUNNING ON A COMPROMISED OPERATING SYSTEM CAN BE INTERCEPTED 
     Now they are pointing out that also Zfone from Philip Zimmermann is broken (a pc software), just because they install a trojan on a PC like in a mobile phone? 
     Any security software rely on the fact that the underlying operating system is somehow trusted and preserve the integrity of the environment where the software run. 
    •  If you have a disk encryption system but your PC if infected by a trojan, the computer is already compromised. 
    •  If you have a voice encryption system but your PC is infected by a trojan, the computer is already compromised. 
    •  If you have a voice encryption system but your mobile phone is infected by a trojan, the mobile phone is already compromised. 
     No matter which software you are running, in such case the security of your operating environment is compromised and in one way or another way all the information integrity and confidentiality is compromised. 
     Like i explained above how to intercept PhoneCrypt. 
     The only things that can protect you from this threat is running in a closed operating system with Trust Computing capability, implementing it properly. 
     For sure on any “Open” operating system such us Windows, Windows Mobile, Linux, iPhone or Android there's no chance to really protect a software. 
     On difficult operating system such as Symbian OS or RimOS maybe the running software can be protected (at least partially) 
     That's the reason for which the security concept that guys are leveraging to carry on their marketing campaign has no clue. 
     It's just because they control the environment, they know Flexispy software and so they adjusted their software not to be interceptable when Flexispy is installed. 
     If you develop a trojan with the other techniques i described above you will 100% intercept PhoneCrypt. 
     On that subject also Dustin Tamme l, Security researcher of BreakPoint Systems , pointed on on VoIP Security Alliance mailing lists that the security analysis is based on wrong concepts . 
     The PhoneCrypt can be intercepted: it's just that they don't wanted to tell you! 
     PhoneCrypt can be intercepted with “on device spyware”. 
     Why? 
     Because Windows Mobile is an unsecure operating environment and PhoneCrypt runs on Windows Mobile. 
     Windows Mobile does not use Trusted Computing and so any software can do anything. 
     The platform choice for a secure telephony system is important. 
     How? 
     I quickly discussed with some knowledgeable windows mobile hackers about 2 different way to intercept PhoneCrypt with an on-device spyware (given the unsecure Windows Mobile Platform). 
     a) Inject a malicious DLL into the software and intercept from within the Phonecrypt itself. 
     In Windows Mobile any software can be subject to DLL code injection. 
     What an attacker can do is to inject into the PhoneCrypt software (or any software running on the phone), hooking the Audio related functions acting as a “function proxy” between the PhoneCrypt and the real API to record/play audio. 
     It's a matter of “hooking” only 2 functions, the one that record and the one that play audio. 
     Read the official Microsoft documentation on how to do DLL injection on Windows Mobile processes. or forum discussing the technique of injecting DLL on windows mobile processes. 
     That's simple, any programmer will tell you to do so. 
     They simply decided that's better not to make any notice about this. 
     b) Create a new audio driver that simply act as a proxy to the real one and intercept PhoneCrypt 
     In Windows Mobile you can create new Audio Drivers and new Audio Filters. 
     What an attacker can do is to load a new audio driver that does not do anything else than passing the real audio driver function TO/FROM the realone. In the meantime intercept everything recorded and everything played :-) 
     Here there is an example on how to do Audio driver for Windows Mobile . 
     Here a software that implement what i explain here for Windows “Virtual Audio Cable” . 
     The very same concept apply to Windows Mobile. Check the book “Mobile Malware Attack and Defense” at that link explaining techniques to play with those techniques. 
     They simply decided that's better not to make any notice to that way of intercepting phone call on PhoneCrypt . 
     Those are just 2 quick ideas, more can be probably done. 
     Sounds much like a marketing activity – Not a security research. 
     I have to tell you. I analyzed the issue very carefully and on most aspects. All this things about the voice encryption analisys sounds to me like a marketing campaign of SecurStar GmbH to sell PhoneCrypt and gain reputation. A well articulated and well prepared campaign to attract the media saying, in an indirect way cheating the media, that PhoneCrypt is the only one secure. You see the press releases of SecurStar and of the “Security researcher Notrax telling that PhoneCrypt is the only secure product” . SecurStar PhoneCrypt is the only product the anonymous hacker “Notrax” consider secure of the “software solutions”. 
     The only “software version” in competition with: 
     – SnapCell – No one can buy it. A security company that does not even had anymore a webpage. The company does not almost exist anymore. 
     – rohde-schawarz – A company that have in his list price and old outdated hardware secure phone . No one would buy it, it's not good for genera use. 
     Does it sounds strange that only those other products are considered secure along with PhoneCrypt . 
     Also… let's check the kind of multimedia content in the different reviews available of Gold-Lock, Cellcrypt and Phonecrypt in order to understand how much the marketing guys pressed to make the PhoneCrypt review the most attractive: 
     Application  Screenshots of application  Video with demonstration of interception  Network demonstration 
     PhoneCrypt   5   0   1 
     CellCrypt   0   2   0 
     GoldLock   1   2   0 
     It's clear that PhoneCrypt is reviewed showing more features explicitly shown and major security features product description than the other. 
     Too much difference between them, should we suspect it's a marketing tips? 
     But again other strange things analyzing the way it was done… 
     If it was “an impartial and neutral review” we should see good and bad things on all the products right? 
     Ok, see the table below regarding the opinion indicated in each paragraph of the different reviews available of Gold-Lock, CellCrypt and Phonecrypt (are the only available) to see if are positive or negative. 
     Application  Number of paragraphs  Positive paragraphs  Negative paragraphs  Neutral paragraphs 
     PhoneCrypt   9   9   0   0 
     CellCrypt   12   0   10   2 
     GoldLock   9   0   8   1 
     
     
     Detailed paragraphs opinion analysis of Phonecrypt 
     Paragraph of review  Opinion expressed 
     From their website  Positive Marketing feedback 
     Apple iPhone  Positive Marketing feedback 
     Disk Encryption or voice Encryption  Positive Marketing feedback 
     PBX Compatibility? Really  Positive Marketing feedback 
     Cracking <10. Not.  Positive Marketing feedback 
     Good thinking!  Positive Marketing feedback 
     A little network action  Positive Marketing feedback 
     UI  Positive Marketing feedback 
     Good Taste  Positive Marketing feedback 
     Detailed paragraphs opinion analysis of Gold-Lock 3G 
     Paragraph of review  Opinion expressed 
     From their website  Negative Marketing feedback 
     Licensed by The israeli Ministry of Denfese  Negative Marketing feedback 
     Real Company or Part Time hobby  Negative Marketing feedback 
     16.000 bit authentication  Negative Marketing feedback 
     DH 256  Negative Marketing feedback 
     Downad & Installation!  Neutral Marketing feedback 
     Cracking it <10  Negative Marketing feedback 
     Marketing BS101  Negative Marketing feedback 
     Cool video stuff  Negative Marketing feedback 
     Detailed paragraphs opinion analysis of CellCrypt 
     Paragraph of review  Opinion expressed 
     From their website  Neutral Marketing feedback 
     A little background about cellcrypt  Negative Marketing feedback 
     Master of Marketing  Negative Marketing feedback 
     Secure Voice calling  Negative Marketing feedback 
     Who's buying their wares  Negative Marketing feedback 
     Downad & Installation!  Neutral Marketing feedback 
     My Demo environment  Negative Marketing feedback 
     Did they forget some code  Negative Marketing feedback 
     Cracking it <5  Negative Marketing feedback 
     Room Monitoring w/ FlexiSpy  Negative Marketing feedback 
     Cellcrypt unique features..  Negative Marketing feedback 
     Plain old interception  Negative Marketing feedback 
     The Haters out there  Negative Marketing feedback 
     Now it's clear that from their point of view on PhoneCrypt there is no single bad point while the other are always described in a negative way. 
     No single good point. Strange? 
     All those considerations along with the next ones really let me think that's very probably a marketing review and not an independent review. 
     Other similar marketing attempt from SecurStar 
     SecurStar GmbH is known to have used in past marketing activity leveraging this kind of “technical speculations”, abusing of partial information and fake unconfirmed hacking stuff to make marketing/media coverage. 
     Imho a rare mix of unfairness in leveraging the difficult for people to really understand the complexity of security and cryptography. 
     They already used in past Marketing activities like the one about creating a trojan for Windows Mobile and saying that their software is secure from the trojan that they wrote. 
     Read about their marketing tricks of 2007 
     They developed a Trojan (RexSpy) for Windows Mobile, made a demonstration capability of the trojan and later on told that they included “Anti-Trojan” capability to their PhoneCrypt software.They never released informations on that trojan, not even proved that it exists. 
     The researcher Collin Mulliner told at that time that it sounds like a marketing tips (also because he was not able to get from SecurStar CEO Hafner any information about that trojan): 
     “This makes you wonder if this is just a marketing thing.” 
     Now, let's try to make some logical reassignment. 
     It's part of the way they do marketing, an very unfriendly and unpolite approach with customers, journalist and users trying to provide wrong security concepts for a market advantage. Being sure that who read don't have all the skills to do in depth security evaluation and find the truth behind their marketing trips. 
     Who is the hacker notrax? 
     It sounds like a camouflage of a fake identity required to have an “independent hacker” that make an “independent review” that is more strong on reputation building. 
     Read about his bio: 
     ¾ Human, ¼ Android (Well that would be cool at least.) I am just an enthusiast of pretty much anything that talks binary and if it has a RS232 port even better. During the day I masquerade as an engineer working on some pretty cool projects at times, but mostly I do the fun stuff at night. I have been thinking of starting an official blog for about 4.5 years to share some of the things I come across, can't figure out, or just cross my mind. Due to my day job and my nighttime meddling, I will update this when I can. I hope some find it useful, if you don't, well you don't. 
     There are no information about this guy on google. 
     Almost any hacker that get public have articles online, post in mailing archive and/or forum or some result of their activity. 
     For notrax, nothing is available. 
     Additionally let's look at the domain… 
     The domain infosecurityguard.com is privacy protected by domainsbyproxy to prevent understanding who is the owner. 
     The domain has been created 2 months ago on 01-Dec-09 on godaddy.com registrar. 
     What's also very interesting to notice that this “unknown hacker with no trace on google about him that appeared on December 2009 on the net” is referred on SecurStar GmbH Press Release as a “An IT security expert”. 
     Maybe they “know personally” who's this anonymous notrax?  :) 
     Am i following my own conspiracy thinking or maybe there's some reasonable doubt that everything was arrange in that funny way just for a marketing activity? 
     Social consideration 
     If you are a security company you job have also a social aspects, you should also work to make the world a better place (sure to make business but “not being evil”). You cannot cheat the skills of the end users in evaluating security making fake misleading information. 
     You should do awareness on end users, to make them more conscious of security issues, giving them the tools to understand and decide themselves. 
     Hope you had fun reading this article and you made your own consideration about this. 
     Fabio Pietrosanti (naif) 
     ps Those are my personal professional opinion, let's speak about technology and security, not marketing. 
     pps i am not that smart in web writing, so sorry for how the text is formatted and how the flow of the article is unstructured! 
     Share 
     Tags  ,  ,  ,  ,  ,  ,  | Comments (4) 
     cyberwarfare intelligence interception Privacy security 
     Licensed by Israel Ministry of Defense? How things really works! 
     29 January 2010 – 10:12 am 
     You should know that Israel is a country where if a company need to develop encryption product they must be authorized by the government. 
     The government don't want that companies doing cryptography can do anything bad to them and what they can do of good for the government, so they have to first be authorized. 
     Companies providing interception and encryptio n m ust apply to a license because Israel law on this is so restrictive to be similar to china law . 
     That's because those kind of technologies are considered fundamental for the intelligence and espionage capabilities of Israel country. 
     To give some example of “Licensed by Israel Ministry of Defense” companies: 
     GSM encryption products “Licensed by Israel Ministry of Defense” – Gold-lock 
     Interception of communication products “Licensed by Israel Ministry of Defense” – Verint 
     HF encrypted Radio “Licensed by Israel Ministry of Defense” – Kavit 
     Surveillance services and equipment “Licensed by Israel Ministry of Defense” – Multi Tier Solutions 
     For example how to apply for a “License by Israel Ministry of Defense” if you do encryption technologies in Israel? 
     Be sure to be an israeli company, click here and fill the forms. 
     Someone will contact you from encryption-control@mod.gov.il and will discuss with you whether to give you or not the license to sell. 
     What does the department of defense will require from an israeli company in order to provide them the authorization to make and sell interception and encryption products? 
     Well, what they want and what they really ask nobody knows. 
     It's a secret dealing of Israel Ministry of Defense with each “licensed” company. 
     What we know for sure is that Verint, a “Licensed by Israel Ministry of Defense”, placed a backdoor to intercept companies and governments in the US and Netherland into the interception systems they was selling. 
     Verint, a Licensed by Israel Ministry of Defense Company, provided to Israel government eavesdropped communications of private and government users in the United States and in the Netherland . 
     CIA officier reported that Israel Ministry of Defense was known to pay Verint a reimbursement of 50% of their costs in order to have from Verint espionage services trough their commercial activity on selling “backdoored” interception equipment to spy foreign users. 
     It can be a legitimate doubt that the cooperation within the Israeli Ministry of Defense may be problematic for an Israeli company that want to sell interception and encryption product abroad. 
     Those companies may be forced to make the interests of Israel Ministry of Defense and not the interests of the customers (like Verint scandal is a real-world example). 
     So, how would a “Licensed by Israel Ministry of Defense” be a good things to promote? 
     It represent the risk that the “Israel Ministry of Defense”, like is publicly known that it has already have done with Verint, will interfere with what the company do. 
     It represent the risk that the “Israel Ministry of Defense” may reasonably provide “reimbursement” of costs paying the company and get what they would likely would like to get. 
     So, what does really “Israel Ministry of Defense” want from Israel companies doing encryption and interception technologies? 
     Should we ask ourself whether Israeli companies doing encryption and interception businesses are more interested to do business or to do “outsourced espionage services” for their always paying customer, the “Israel Ministry of Defense”. 
     For sure, in the age of financial crisis, the Israel Ministry of Defense is a paying customer that does not have budget problem… 
     Strict control, strict rules, strong government strategic and military cooperation. 
     Be careful. 
     If you want to read more about this matters, about how technologies from certain countries is usually polluted with their governments military and secret services strategies stay tuned as i am preparing a post about this . 
     You will much better understand about that subjects on the “Licensed by Israel Ministry of Defense”. 
     Share 
     Tags  ,  ,  ,  ,  | Comment (0) 
     business management 
     Index of economic freedom 
     21 December 2009 – 11:43 am 
     When looking at facts and figures about globalized world, the index of economic freedom is a nice tool to make proper considerations. 
     Share 
     Tags  ,  ,  ,  | Comment (0) 
      öryggi 
     Recuva: Nice windows data recovery tool 
     12 November 2009 – 1:10 pm 
     Not a professional tool but an easy, quick and free one. 
     If you just accidently deleted some files on windows or your employee leave the company deleting all his data, well that you get out from trouble quickly. 
     It also came out in a 'portable' version to be loaded from an usb stick drive. 
     Check Recuva recovery tool 
     Share 
     Tags  | Comment (0) 
      Næsta síða » 
      Næsta síða »