Tag Archives: Privacy

intelligence intercettazioni sulla sicurezza della tecnologia

RFC 6189: ZRTP è finalmente uno standard!

11 Aprile 2011 - 22:54

Infine ZRTP è stato assegnato un incarico ufficiale RFC, RFC6189 ZRTP: il percorso dei mezzi chiave accordo per Unicast sicura RTP.

Aveva come dipendenza del SRTP con AES dimensione della chiave di 256bit, che ora è stato definito come RFC6188 .

E 'emozionante vedere la RFC finalmente rilasciato, in quanto si tratta di un traguardo importante per impostare ZRTP come standard ufficiale per la crittografia end-to-end molto simile a PGP è stato per email.

Ora, qualsiasi organizzazione al mondo sarà ufficialmente in grado di implementare ZRTP per la cifratura della voce protocollo end-to-end

Attualmente 3 diverse implementazioni pubbliche di protocollo ZRTP esiste:

Ognuno di essi forniscono diverse funzioni del protocollo, ma più importante sono noti per essere interoperabili.

Una nuova ondata sta arrivando al mondo crittografia della voce, irruenta in una zona grigia in cui la maggior parte delle aziende che fanno i sistemi di cifratura di telefonia è stato di attuazione di crittografia personalizzata.

Ora uno standard è stato impostato e ci sono alcuni motivi ancora da attuare qualcosa di diverso.

Hurra signor Zimmermann e tutta la comunità di imprese (come PrivateWave ) e gli individui (come Werner Dittmann ) che ha lavorato su di essa!

Oggi è un grande giorno, questo tipo di tecnologia è ormai ufficiale e anche con più implementazione esistente!

Filippo, che ha fatto di nuovo, i miei complimenti per il vostro spirito puro e determinazione :-)

Condividi
Comment (1) Tags , , , | Commento (1)
intercettazione sulla sicurezza

Progressi per GSM di cracking a Friburgo universitario

23 febbraio 2011 - 13:32

Il mondo emozionante di protocolli mobili (GSM, GSM-R, TETRA, UMTS, ecc), l'hacking è sempre attività ufficiali di ricerca dalle università.

L'investimento per rendere il codice versioni opensource del software di cracking sta dando l'opportunità agli studenti di università per lavorare su di esso, migliorare e fare una forte ricerca.

L'Università di Friburgo ha appena rilasciato la carta esercitazione pratica sul GSM crittografia A5 / 1 insieme a un gsmframencoder strumento di supporto per migliorare il processo di sniffing, decodifica e screpolature.

Apertura hardware, software apertura, protocollo aprendo dimostrano la debolezza di qualsiasi metodo o processo proprietario per accumulo tecnologie di comunicazione e di sicurezza.

Dovrebbe essere l'obiettivo di tutti i ricercatori a cercare di aprire-up e di rompere ogni tipo di tecnologia proprietaria e chiusa per costringere l'industria a va avanti solo con l'approccio interoperabile e aperto durante la progettazione di protocolli di telecomunicazione.

Condividi
Comment (0) Tags , , , , | Commento (0)
Informativa sulla tecnologia

La mia esperienza TOR exit node cercando di filtrare il traffico rumoroso

24 gennaio 2011 - 22:14

All'inizio di quest'anno ho deciso che è tempo di eseguire un exit node TOR così ho portato un VPS presso hetzner.de (perché sono elencati come un buon TOR ISP ) e la configurazione l'uscita-nodo con soprannome privacyresearch.infosecurity.ch con 100Mbit / collegamento s per primo 1TB di dati mensili, quindi 10Mbit / s flat.

Inoltre esegue TOR2WEB software su http://tor.infosecurity.ch .

Ho impostato l' uscita-politica come suggerito eseguendo exit-node con il minimo molestie e predisposto un modello di risposta abuso .

Nel primo giorno sono stato in esecuzione sul nodo ho ricevuto immediatamente DMCA lamentano a causa di peer to peer traffico.

Così ho deciso di filtrare out po 'di traffico P2P utilizzando OpenDPI modulo iptables e DMCA lamentano automaticamente scomparso:

iptables-A OUTPUT-m opendpi-edonkey-gadugadu-FastTrack-Gnutella-DirectConnect-bittorrent-WinMX-Soulseek-j REJECT

Allora, perché sono italiano, ho deciso di evitare il mio nodo TOR per connettersi allo spazio Italiana indirizzo internet al fine di ridurre la possibilità che uno stupido procuratore mi svegliava al mattino, perché non ha capito che sto facendo funzionare un nodo TOR.

Ho cercato, con l'aiuto di hellais che hanno scritto una sceneggiatura per fare uscire la politica rifiuta dichiarazione , di respingere tutte netblocks italiane sulla base di ioerror blockfinder ma abbiamo scoperto che i file torrc configurazione file con 1000 linee stava facendo schianto TOR.

Siamo andati ad aprire un ticket per segnalare il crollo del nostro tentativo di bloccare la politica di uscita TOR per paese e trovato un tentativo simile , dove abbiamo contribuito, ma non sembra essere ancora un problema aperto.

La conclusione è che non è possibile fare una politica di uscita Paese per exit node TOR in modo pulito ed educato così ho deciso di andare il modo sporco utilizzando iptables / geoip . Dopo aver combattuto affinché venga compilata correttamente, era una linea di iptables per bloccare il traffico andando a Italia:

iptables-A OUTPUT-p tcp-m state-state NEW-m geoip-DST-cc IT-j REJECT

Ora, dal mio exit-node alcuna connessione con le reti italiane sarà fatto e io sono sicuro contro possibilmente procuratori stupidi non capire TOR (ho un'eccezione per tutti TOR indirizzo IP del nodo applicato prima).

Dopo alcuni altri giorni ho iniziato a ricevere lamentele dovute alle attività portscan originati dai miei nodi Tor.

Dal mio punto di vista che voglio sostenere rete anonimato, non violazione al sistema anonimo e così voglio filtrare Partenza portscan e attacchi provenienti da s 'mia node.That una questione complessa che richiede un certo studio, così nel frattempo ho installato scanlogd e sbuffare perché voglio valutare quanti attacchi, che tipo di attacchi sono sempre fuori dal mio exit node TOR.
Più tardi cercherò di organizzare una sorta di filtraggio per essere sicuri di essere in grado di filtrare i maggiori attacchi.
Per ciò che è legato al portscan sembra che non ci sono strumenti pubblici per rilevare e filtrare portscan in uscita, ma solo per filtrare portscan in arrivo quindi probabilmente avranno bisogno di scrivere qualcosa ad hoc.
Mi riferisco come vanno le cose e se ci sarà qualche bel modo per implementare in modo Lightwave sbuffo-inline per importante tentativo selettivamente filtrare Partenza attacco proveniente dal mio exit-node.

Il mio obiettivo è quello di mantenere un exit node in esecuzione in di lunga durata (almeno 1 TB di traffico al mese donato al TOR), riducendo lo sforzo legato alla ISP lamentarsi e cercando di fare del mio meglio per eseguire l'uscita-nodo con un debito ragionevole.

Condividi
Comment (1) Tags | Commento (1)
Privacy

ZORG, nuovo + e Java ZRTP rilascio pubblico implementazione C +

12 Gennaio 2011 - 02:01

Ciao a tutti, oggi al PrivateWave Italia SpA, azienda italiana impegnata nello sviluppo di tecnologie per la protezione della privacy e sicurezza delle informazioni nel settore delle telecomunicazioni vocali dove sto CTO, rilasciamo ZORG, una nuova sorgente aperto implementazione del protocollo ZRTP disponibile per il download dal sito http://www. zrtp.org .

ZRTP [1] fornisce end-to-end di scambio di chiavi con curve ellittiche Diffie-Hellmann 384bit e crittografia AES-256 SRTP.

ZORG è stato originariamente sviluppato e implementato in PrivateGSM prodotti di crittografia voce di PrivateWave disponibili per le seguenti piattaforme: Blackberry, Nokia e iOS (iPhone).

Zorg C + + è stato integrato con PJSIP open source VoIP SDK [2] ed è fornito come patch di integrazione contro PJSIP 1.8.5. E 'stato testato su iPhone, Symbian, Windows, Linux e Mac OS X.

Zorg Java è stato integrato all'interno di una versione personalizzata di MJSIP [3] SDK open source su piattaforma Blackberry e include ottimizzazioni utilizzo di memoria necessarie per ridurre al minimo l'attività garbage collector.

Entrambe le piattaforme sono separati e crittografica modulare back-end in modo che l'implementazione di algoritmi di crittografia potrebbe essere facilmente scambiato con altre.

. ZORG è sotto licenza GNU AGPL e il codice sorgente è disponibile su GitHub a https://github.com/privatewave/ZORG .

Stiamo rilasciando sotto open source e in coerenza con il nostro approccio alla sicurezza [4], come speriamo davvero che possa essere utile per l'ecosistema open source per creare nuovi sistemi di crittografia della voce a sostegno della libertà di parola.

Più di 20 PJSIP basata fonte di software di crittazione VoIP e diverse scritte in Java potrebbero beneficiare direttamente ZORG rilascio.

Saremo lieti di ricevere la proposta di collaborazione, nuova integrazione, nuovo crittografico back-end, bug scouting e quant'altro utile per migliorare e far ZRTP affermare come standard di crittografia vocale.

Zorg è disponibile da http://www.zrtp.org .

[1] ZRTP: http://en.wikipedia.org/wiki/ZRTP
[2] PJSIP: http://www.pjsip.org
[3] MJSIP: http://www.mjsip.org
[4] approccio di sicurezza: http://www.privatewave.com/security/approch.html

Condividi
Comment (0) Tags , , , , | Commento (0)
Informativa sulla sicurezza della tecnologia

Encrypted cellulare per le chiamate ai telefoni fissi con Asterisk 1.8

25 Ottobre 2010 - 12:15

Abbiamo appena rilasciato un howto tecnico su come costruire Secured mobile per le infrastrutture VoIP fisso con:

Nelle prossime settimane altri howto come questo verrà fuori utilizzando altre piattaforme server come FreeSWITCH, il tutto in uno spirito di trasparenza e di leva di tecnologie di sicurezza opensource.

Condividi
Comment (0) Tags , , , | Commento (0)
Informativa sulla sicurezza della tecnologia

PrivateGSM: Blackberry / iPhone / Nokia crittografia della voce con ZRTP o SRTP / SDES

19 ottobre 2010 - 09:10

I Evitare assolutamente di usare il mio blog personale per fare la promozione di qualsiasi tipo di prodotto.

Quella volta non è diverso, ma voglio dirvi fatti su prodotti con cui lavoro senza di commercializzazione di fantasia, ma rimanendo tecnico.

Oggi, alle PrivateWave dove sto CTO e co-fondatore , abbiamo rilasciato pubblicamente prodotti di crittografia VoIP mobile per Blackberry, iPhone e Nokia:

  • Il primo mai Blackberry criptato VoIP con ZRTP - PrivateGSM VoIP professionale
  • Il primo iPhone mai criptato VoIP con ZRTP - PrivateGSM VoIP professionale
  • Il primo mai Blackberry client VoIP cifrato con SRTP con SDES scambio di chiavi su SIP / TLS - PrivateGSM VoIP Enterprise

logo-PrivateWave-colore.png

Al PrivateWave usiamo un approccio diverso rispetto alla maggior parte società crittografia della voce là fuori, leggere la nostra approccio alla sicurezza .

La rilevanza di questi prodotti della tecnologia e dell'industria paesaggio può essere riassunto come segue:

  • E 'la prima azienda di crittografia vocale utilizzando solo i protocolli di sicurezza standard (e ci aspettiamo che il mercato reagirà, come è chiaro che la tecnologia proprietaria proveniente dal patrimonio di CSD non può fornire lo stesso valore)
  • E 'il primo approccio di crittografia della voce da utilizzare solo open source e motore di crittografia standard
  • E 'il primo approccio di crittografia della voce di fornire modello di protezione diverso utilizzando diverse tecnologie (end-to-end per ZRTP e end-to-site per SRTP )

Quelli suite di mobili Clienti sicure, progettate per la sicurezza professionale utilizzare solo utilizzando le migliori tecnologie di telecomunicazione e di sicurezza, di fornire un elevato grado di protezione insieme con buone prestazioni anche in condizioni di rete cattive:

Le applicazioni sono:

icona-pgsm.png

I dispositivi mobili supportati sono:

Per quanto riguarda ZRTP abbiamo deciso di sottolineare e di allungare tutta la sicurezza e la funzionalità paranoica del protocollo con qualche piccola aggiunta:

La nostra stretta integrazione rubrica, va oltre ZRTP RFC specifica, che potrebbe essere vulnerabile a certi attacchi, quando utilizzato su telefoni cellulari a causa del comportamento degli utenti di non guardare lo schermo del cellulare.

Il nostro modo di usare paranoy ZRTP mitigare tali condizioni, scriveremo su questo più tardi e / o aggiungerà dettagli specifici per RFC inclusione.

Alcune parole su PrivateGSM Professional con crittografia end-to-end con ZRTP

Leggi la scheda tecnica lì!

Per scaricarlo clicca qui e appena messo il tuo numero di telefono

Questi sono i risultati del duro lavoro di tutto il mio staff molto qualificato (16 persone ha lavorato a questo 6 progetti per 3 piattaforme diverse) su tecnologie impegnative (crittografia della voce) in un ambiente operativo difficile (reti mobili sporchi e sistemi operativi mobili sporchi) per ulteriori di 2 anni.

Sono molto orgoglioso del nostro staff!

E dopo?

Nelle prossime settimane si vedrà il rilascio di grandi serie di documentazioni, quali l'integrazione con asterischi, FreeSWITCH e altre Security Enabled PBX, insieme a qualche altra notizia entusiasmante tecnologia di sicurezza che sono certo sarà notato ;)

E 'stato un lavoro duro e più hanno da fare, ma sono certo che la sicurezza e la comunità opensource piacerà tali prodotti e il nostro approccio trasparente anche con aperte rilasci importanti e integrazione open source che fanno una tecnologia molto politicamente neutrale (backdoor gratuito) .

Condividi
Comments (2) Tags , , , , | Commenti (2)
intercettazione sulla sicurezza della tecnologia

Un paio di provider di VPN bello

17 Ottobre 2010 - 12:39

Ci sono un sacco di motivi per cui si avrebbe bisogno di accedere a Internet attraverso una VPN.

Ad esempio, se si vive in un paese bloccando alcuni contenuti (come il sito anti-locale-government, porno, ecc) e / o protocolli (come Skype, VoIP) si sarebbe probabilmente desidera spostare la connettività a Internet al di fuori del paese di blocco brutta utilizzando tunnel VPN criptati.

Ho valutato diversi server VPN in hosting e di un paio di loro suona abbastanza bene tra la diffusa offerta di tali servizi:

SwissVPN

Uscire a internet dalla Svizzera.

Costo 6 CHF / mese

Indirizzo IP fisso pubblico Opzionale

Utile se avete bisogno di:

  • Basta superare i filtri del paese locale con buona larghezza di banda elevata
  • Esporre servizi pubblici attraverso la VPN con l'indirizzo IP pubblico fisso opzionale.

Overplay

Uscita sul internet, scegliendo fra 20 diversi paesi (ad ogni connessione).

Utile se dovete fare:

  • business intelligence sui concorrenti (che sembra venire dal paese X quando li si collega)
  • vedere film di / telefilm consentita solo da spazi web IP nazionali
  • vedere i risultati di Google tra i diversi paesi

Condividi
Comment (0) Tags , | Commento (0)
intercettazione sulla sicurezza

Remoto intercettando i telefoni VoIP snom

10 Settembre 2010 - 11:08

Suggerisco la lettura di intercettazioni a distanza i telefoni VoIP "sul VoIP Security Alliance blog da Shawn Merdinger .

Un esempio concreto di come l'infrastruttura telefonica attuale sono sempre più vulnerabili agli attacchi informatici.

Condividi
Comment (0) Tag , , | Commento (0)
intercettazione sulla sicurezza della tecnologia

Voice comunicazione seminario sicurezza

26 agosto 2010 - 12:04

Ciao,

ho fatto un discorso sulle tecnologie di sicurezza comunicazione vocale presso l'Università di Trento, a seguito di uno scambio di informazioni interessanti con Crypto Lab gestito professor Massimiliano Sala .

Suggerisco le persone interessate a leggerlo, soprattutto la seconda parte, in quanto vi è una categorizzazione innovativa delle varie tecnologie di crittografia vocale che vengono utilizzati in diversi settori.

Ho cercato di spiegare e di uscire da questo ampiamente frammentato settore tecnologico, fornendo un'ampia panoramica sulle tecnologie che di solito sono assolutamente estranei one-ogni-altro, ma praticamente tutti applicano ad esprimere la crittografia successivo categorizzazione:

  • Mobili standard di crittografia voce del settore TLC
  • Standard di crittografia vocale governative e militari
  • Standard di crittografia della voce di pubblica sicurezza
  • Standard di crittografia vocale IETF
  • Tecnologie di crittografia vocale proprietarie Varie

E 'un enorme slideware, 122 diapositive, vi suggerisco di andare a leggere la seconda parte saltare tecnologie di intercettazione generale già coperto dalla mia presentazione del 2009.

Voice sicurezza della comunicazione


Visualizza più presentazioni da Fabio Pietrosanti .

Soprattutto mi piace il concetto di crittografia a livello cioccolato che vogliono fornire qualche innovazione sul concetto di crittografia Snake Oil.

Ma ho bisogno di ottenere di più in profondità il contesto di crittografia grado di cioccolato, probabilmente non prima di fine anno, fornendo un corso applicato sulla comprensione e la valutazione praticamente il contesto di protezione reale delle varie tecnologie di crittografia vocale.

Condividi
Comment (0) Tags , , , | Commento (0)
intelligence intercettazioni sulla sicurezza della tecnologia

GSM di cracking in metodologie di test di penetrazione (OSSTMM)?

23 luglio 2010 - 08:16

As most of this blog reader already know, in past years there was a lot of activities related to public research for GSM auditing and cracking.

However when there was huge media coverage to GSM cracking research results, the tools to make the cracking was really early stage and still very inefficient.

Now Frank Stevenson , norwegian cryptanalyst that already broke the Content Scrambling System of DVD video disc, participating to the A51 cracking project started by Karsten Nohl , released Kraken , a new improved version of the A51 cracking system.

It's interesting to notice that WiFi cracking had a similar story, as the first WiFi wep cracking discovery was quite slow in earlier techniques but later Korek, an hacker working on cracking code, improve the attack system drammatically.

That's the story of security research cooperation, you start a research, someone follow it and improve it, some other follow it and improved it and at the end you get the result.

Read more on the Kraken GSM Cracking software release .

And stay tuned as next week at Blackhat Conference Karsten Nohl will explain the details of the required hardware setup and detailed instructions on how to do it :-)

I would really like to see those tools incorporated into Penetration Testing Linux Distribution BackTrack with OSSTMM methodology enforcing the testing of GSM interception and man in the middle :-)

If things proceed that way and Ettus Research (The producer of USRP2 software radio used for low cost GSM signal receiving) will not be taken down, we can still see this.

Condividi
Tags , , , | Comments (3)
business management Privacy security technology

Sicurezza di olio di serpente sostiene il crypto prodotto di sicurezza

19 July 2010 – 9:33 pm

Security market grow, more companies goes to the market, but how many of them are taking seriously what they do?

You know, doing security technology mean that you are personally responsible for the protection of the user's information. You must make them aware of what they need, exactly what your are doing and which kind of threat model your product protect.

A typical problem of product's security features is represented by the inability of the user to evaluate the security claims of the product itself.

So there's a lot companies doing a not-so-ethical marketing of security features, based on the facts that no user will be able to evaluate it.

The previously explained situation reside in the security topic of Snake Oil Encryption , an evolution in the scientific cryptographic environment that let us today use best of breed information protection technologies without having to worry too much about backdoors or insecurities.

Let's speak about Snake Oil Encryption

Snake Oil Cryptography : In cryptography , snake oil is a term used to describe commercial cryptographic methods and products which are considered bogus or fraudulent. Distinguishing secure cryptography from insecure cryptography can be difficult from the viewpoint of a user. Many cryptographers, such as Bruce Schneier and Phil Zimmermann , undertake to educate the public in how secure cryptography is done, as well as highlighting the misleading marketing of some cryptographic products.

The most referenced crypto security guru, Philip Zimmermann and Bruce Schneier, was the 1st to talk about Snake Oil Encryption:

Snake Oil by Philip Zimmermann

Snake Oil by Bruce Schneier

The Michigan Telecommunications and Technology Law Review also made a very good analysis related to the Security Features of Security Products, SNAKE-OIL SECURITY CLAIMS” THE SYSTEMATIC MISREPRESENTATION OF PRODUCT SECURITY . They explain about the nasty marketing tricks used to tweak users inability to evaluate the security features, including economic and legal responsibility implication.

Several snake oil security product companies does not explain and are not clear about the threat model to which the product apply. Very famous is the sentence of Russ Nelson :

“Remember, crypto without a threat model is like cookies without milk. ….. Cryptography without a threat model is like motherhood without apple pie. Can't say that enough times. More generally, security without a threat model is by definition going to fail.”

So, how to spot snake oil security products?

Check a guideline of to spot Snake Oil Encryption Products: Snake Oil Warning Signs, Encryption Software to Avoid by Matt Curtin .

You can see this very good Cryptographic Snake Oil Examples by Emility Ratliff (IBM Architect at Linux Security), that tried to make clear example on how to spot Cryptographic Snake Oil.

Here represented the basic guideline from Matt Curtin paper:


By checking that points it's possible to evaluate how serious an encryption technology or product is.

But all in all how to fix that unethical security approach?

It's very significative and it would be really useful for each kind of security product category to make some strongly and independent evaluation guideline (like OSSTMM for Penetration testing) , to make this security evaluation process really in the hands of the user.

It would be also very nice to have someone making analysis and evaluation of security product companies, publishing reports about Snake Oil signs.

Condividi
Tags , , , , , , | Comments (3)
intelligence Privacy security technology

Web2.0 privacy leak in Mobile apps

17 July 2010 – 9:02 am

You know that web2.0 world it's plenty of leak of any kind (profiling, profiling, profiling) related to Privacy and users starts being concerned about it.

Users continuously download applications without knowing the details of what they do, for example iFart just because are cool, are fun and sometime are useful.

thumb.php.jpg

On mobile phones users install from 1000% up to 10.000% more applications than on a PC, and those apps may contain malware or other unexpected functionalities.

Recently infobyte analyzed ubertwitter client and discovered that the client was leaking and sending to their server many personal and sensitive data such as:

- Blackberry PIN

- Phone Number

- Email Address

- Geographic positioning information

Read about UbertTwitter 'spyware' features discovery here by infoByte .

It's plenty of applications leaking private and sensitive information but just nobody have a look at it.

Should mandatory data retention and privacy policies became part of application development and submission guideline for mobile application?

Imho a users must not only be warned about the application capabilities and API usage but also what will do with which kind of information it's going to handle inside the mobile phone.

Capabilities means authorizing the application to use a certain functionalities, for example to use GeoLocation API, but what the application will do and to who will provide such information once the user have authorized it?

That's a security profiling level that mobile phone manufacturer does not provide and they should, because it focus on the information and not on the application authorization/permission respect to the usage of device capabilities.

ps yes! ok! I agree! This kind of post would require 3-4 pages long discussion as the topic is hot and quite articulated but it's saturday morning and i gotta go!

Condividi
Tags , , , | Comment (0)
Privacy security technology

AES algorithm selected for use in space

8 July 2010 – 12:37 pm

I encountered a nice paper regarding analysis and consideration on which encryption algorithm it's best suited for use in the space by space ship and equipments.

The paper has been done by the Consultative Committee for Space Data Systems that's a consortium of all space agency around that cumulatively handled more than 400 mission to space .

topban.jpg

Read the paper Encryption Algorithm Trade Survey as it gives interesting consideration and comparison between different encryption algorithms.

Obviously the finally selected algorithm is AES , while KASUMI (used in UMTS networks) was avoided.

Condividi
Tags , | Comment (0)
business intelligence interception Privacy security technology

Blackberry Security and Encryption: Devil or Angel?

7 July 2010 – 10:39 pm

Blackberry have good and bad reputation regarding his security capability, depending from which angle you look at it.

This post it's a summarized set of information to let the reader the get picture, without taking much a position as RIM and Blackberry can be considered, depending on the point of view, an extremely secure platform or an extremely dangerous one .

bblock.jpg

Andiamo va avanti.

Da un Blackberry lato si tratta di un sacco piattaforma di funzionalità di crittografia, funzioni di sicurezza ovunque, dispositivo cifrato (con l'abitudine crypto), comunicazione criptati (con protocolli proprietari personalizzati come PPPI), molto buono Impostazioni avanzate di protezione, di crittografia da Certicom ( ora di proprietà di RIM ).

D'altra parte essi non fornisce solo un dispositivo, ma una rete di accesso overlay, chiamato BIS ( BlackBerry Internet Service ), che è un mondo globale rete geografica in cui il vostro blackberry entrare mentre si naviga o Checkmail utilizzando blackberry.net AP.

Quando voi, o di un'applicazione, utilizzare l'APN blackberry.net non sono solo la connessione a internet con la connessione ad internet del vettore, ma si sta entrando all'interno della rete RIM che si procura e agire come un gateway per raggiungere Internet.

Lo stesso accade quando si ha un uso aziendale: Sia il dispositivo BB e il BES aziendale si connettono alla rete RIM che agiscono come una sorta di rete di concentrazione vpn .

Quindi, in pratica tutte le comunicazioni attraversano attraverso infrastrutture di servizi RIM in formato crittografato con crittografia proprietario set e protocolli di comunicazione.

Proprio come un avviso, pensare che a Google di fornire gtalk su APN blackberry.net, fatto un accordo al fine di offrire un servizio all'interno della rete di BB per gli utenti BB. Quando si installa gtalk vieni aggiunto 3 libri di servizi che puntano a GTALKNA01 questo è il nome della porta GTALK all'interno della rete RIM per consentire la comunicazione intra-BIS e di agire come un gateway GTALK a Internet.

Gli operatori di telefonia mobile di solito non hanno nemmeno il permesso di ispezionare il traffico tra il dispositivo BlackBerry e la rete Blackberry.

Così RIM e Blackberry sono in qualche modo unici per il loro approccio in quanto forniscono una piattaforma, una rete e un servizio tutto in bundle insieme e non si può semplicemente "ottenere il dispositivo e il software", ma l'utente e l'aziendale sono sempre tenuti e la connessione al servizio rete.

Questo è un bene e questo è male, perché significa che RIM fornire estremamente buone caratteristiche di sicurezza e funzionalità per proteggere le informazioni, il dispositivo e l'accesso alle informazioni a vari livelli contro terzi.

Ma è sempre difficile stimare la minaccia e rischio legato al cerchio stesso e che potrebbe fare pressione politica contro RIM.

Si prega di considerare che io non sto dicendo "RIM sta guardando i tuoi dati", ma facendo un'analisi obiettiva dei rischi: per come la piattaforma è fatta RIM hanno autorità sul dispositivo, sulle informazioni on-the-dispositivo e sulle informazioni che attraversano il rete. (Leggi le mie diapositive Mobile Security ).

Ad esempio, prendiamo in considerazione lo stesso contesto per telefoni cellulari Nokia.

Una volta che il dispositivo Nokia viene venduto, Nokia non ha autorità sul dispositivo, né sulle informazioni on-the-dispositivo né sulle informazioni che attraversano la rete. Ma è anche vero che Nokia fornisce appena il dispositivo e non fornisce il valore di servizi come l'integrazione Enterprise (Il tunnel VPN RIM), la rete di accesso BRI e tutte le funzioni di provisioning di sicurezza locali e remoti che Blackberry forniscono aggiunto.

Quindi è una questione di considerare il contesto di rischio in modo corretto quando si sceglie la piattaforma, con un esempio molto simile alla scelta di Microsoft Exchange Server (sul proprio servizio) o se ottenere un servizio SaaS come Google Apps.

In entrambi i casi è necessario fidarsi del provider, ma nel primo esempio è necessario fidarsi di Microsoft che non mette una backdoor sul software, mentre nel secondo esempio è necessario fidarsi di Google, come un fornitore di piattaforme e di servizio, che non accede i tuoi dati.

Quindi è un paradigma diverso da valutare a seconda del modello di minaccia.

Se il vostro modello di minaccia lasciare RIM si considera come un terzo fornitore di servizi di fiducia (molto simile a google) che è ok. Se si dispone di un contesto di rischio molto elevato, come top-secret, allora cerchiamo di considerare e valutare attentamente se non è meglio mantenere i servizi BlackBerry completamente isolato dal dispositivo o utilizzare un altro sistema senza l'interazione con i server e servizi di produttore.

Ora, torniamo ad alcune ricerche e alcuni fatti circa la mora e la sicurezza della mora stessa.

Prima di tutto i diversi governi hanno avuto a che fare con RIM in modo da costringerli a fornire l'accesso alle informazioni che attraversano le loro reti di servizi, mentre altri hanno deciso di vietare l'utilizzo direttamente Blackberry per gli alti funzionari a causa del server che si trovano nel Regno Unito e Stati Uniti, mentre altri hanno deciso di installare i propri backdoor.

C'è un sacco di discussioni in cui i temi sono RIM Blackberry e governi per vari motivi.

Qui di seguito una serie di informazioni correlate Sicurezza ufficiale su piattaforma BlackBerry RIM:

E qui un set di sicurezza non ufficiali e le informazioni correlate Hacking su piattaforma RIM Blackberry:

Perché è 23.32 (GMT +1), io sono stanco, penso che questo post finirà qui.

Spero di aver fornito al lettore una serie di informazioni utili e di considerazione di andare più in profondità nell'analisi e considerando la sicurezza generale mora (nel bene e nel male, dipende sempre dal modello di minaccia!).

Saluti

Fabio Pietrosanti (naif)

ps sto gestire lo sviluppo della tecnologia di sicurezza (voce crittografia Tech) su piattaforma Blackberry, e posso dire che dal punto di vista dello sviluppo è assolutamente migliore di Nokia in termini di compatibilità e velocità di sviluppo, ma usare solo RIMOS 5.0 +!

Condividi
Comments (3) Tag , , , , | Commenti (3)
Informativa sulla sicurezza della tecnologia

Botnet per RSA di cracking?

30 giugno 2010 - 02:29

I read an interesting article about putting 1.000.000 computers, given the chance for a serious botnet owner to get it, to crack RSA.

The result is that in such context attacking an RSA 1024bit key would take only 28 years, compared to theoretical 19 billion of years.

Reading of this article , is extremely interesting because it gives our very important consideration on the cryptography strength respect to the computation power required to carry on cracking attempt, along with industry approach to “default security level”.

I would say a must read .

Condividi
Tags , | Comment (0)
business cyberwarfare intelligence Privacy security technology

China Encryption Regulations

16 June 2010 – 1:11 pm

Hi all,

i found this very interesting paper on China Encryption Import/Export/Domestic Regulations done by Baker&Mckenzie in the US.

It's strongly business and regulatory oriented giving a very well done view on how china regulations works and how it may behave in future.

Leggi qui Decifrare Regolamento della Cina di crittografia (forma Bakernet sito web).

Condividi
Comment (0) Tags , , , , | Commento (0)
attività di intercettazione sulla sicurezza della tecnologia

Cellulare parlare Sicurezza a WHYMCA conferenza

2 Giugno 2010 - 19:56

Voglio condividere alcune slide che ho usato per parlare di sicurezza mobile in conferenza mobili whymca a Milano.

Leggi qui le mie diapositive sulla sicurezza mobile .

Le diapositive forniscono una vasta una panoramica approfondita di questioni connesse alla sicurezza mobile, dovrei fare qualche slidecast su di esso mettere anche l'audio. Forse lo farà, forse no, dipende dal tempo che è sempre una risorsa insufficiente.

Condividi
Comment (0) Tags , , , , , , | Commento (0)
Informativa sulla sicurezza della tecnologia

iPhone PIN: crittografia inutile

1 Giugno 2010 - 02:53

Recentemente ho passato una delle mie più telefoni cellulari con cui vado in giro per iPhone.

Sono particolarmente preoccupato per la protezione dei dati in caso di furto e così cominciai ad avere uno sguardo intorno a circa il sistema di protezione iPhone fornito.

C'è una interessante serie di iPhone Affari Caratteristiche di sicurezza che mi fanno pensare che iPhone si sta muovendo nella giusta via per la protezione di sicurezza del telefono cellulare, ma ancora un sacco di cose che deve essere fatto, soprattutto per i gravi Enterprise e gli utenti del Governo.

201006011551.jpg

Per esempio si è scoperto che la protezione PIN iPhone è inutile e può essere spezzato solo di collegare l'iPhone ad una macchina Linux e l'accesso al dispositivo come una chiavetta USB.

Questo è qualcosa che disturba la mia mentalità paranoica che mi fanno pensare a non utilizzare i dati sensibili sul mio iPhone Se non posso proteggere i miei dati.

Probabilmente un prodotto di crittografia del disco indipendente iPhone sarebbe molto utile al fine di consentire al mercato di creare schemi di protezione che si adattano ai diversi contesti di rischio che diversi utenti possono avere.

Probabilmente un consumatore generale non è preoccupato per questa vulnerabilità PIN, ma per me, lavora all'interno envirnonment altamente confidenziali come l'intelligenza, la finanza e militari, è qualcosa che non posso accettare.

Ho bisogno di una forte crittografia del disco sul mio cellulare.

Faccio forte crittografia della voce per esso , ma sarebbe davvero bello avere anche qualcosa per proteggere i dati interi di iPhone e non solo le telefonate.

Condividi
Comment (0) Tags , , , , | Commento (0)
Complimenti sulla sicurezza della tecnologia

Codice di exploit contro SecurStar DriveCrypt pubblicato

25 maggio 2010 - 05:00

Sembra che la comunità degli hacker in qualche modo simile a bersaglio prodotti SecurStar, forse perché comunità degli hacker non piace l'approccio etico spesso rivelato già descritto in precedenza in questo blog di articoli e commenti degli utenti.

Nel 2004 un sacco di accusa contro Hafner di SecurStar è andato fuori a causa del presunto furto di proprietà intellettuale per quanto riguarda i codici opensource come Encryption 4 le masse e annuncio legale anche contro il libero e opensource TrueCrypt progetto.

Nel 2008 c'è stata una violazione al sistema di autenticazione pre-boot contro DriveCrypt Plus postato su Full-Disclosure.

All'inizio del 2010 è stata la volta del falso ricerca Infosecurity segretamente sponsorizzato da SecurStar a http://infosecurityguard.com (che ora hanno cercato di rimuovere dal web a causa della situazione imbarazzante, ma il backup della storia sono disponibili, comunità degli hacker ancora aspettare per le scuse).

Ora, a metà 2010, a seguito di una ricerca pubblicata nel dicembre 2009 circa Disk Encryption vulnerabilità software realizzati da Neil Kettle (mu-b), ricercatore di sicurezza presso Digit-laboratori e tester Penetrazione a soluzioni di rete convergenti , DriveCrypt è risultato essere di rottura vulnerabili e sfruttabili sicurezza del sistema e codice di exploit on-dispositivo è stato appena rilasciato.

Exploit di codice riportato di seguito (grazie Neil per il codice di rilascio!):

  • Arbitraria di codice kernel esecuzione exploit di sicurezza di DriveCrypt: DriveCrypt-dcr.c
  • File arbitrario la lettura / scrittura di exploit di sicurezza mediante parametri definibili dall'utente non controllati a ZxCreateFile / ReadFile / WriteFile: DriveCrypt-fopen.c

The exploit code has been tested against DriveCrypt 5.3, currently released DriveCrypt 5.4 is reported to be vulnerable too as it has just minor changes related to win7 compatibility. Can anyone make a double check and report a comment here?

Very good job Neil!

In the meantime the Free Truecrypt is probably the preferred choice for disk encryption, given the fact that it's difficult to trust DriveCrypt, PGP has been acquired by Symantec and there are very bad rumors about the trust that people have in Symantec and there are not many widely available alternatives.

Rumors say that also PhoneCrypt binaries are getting analyzed and the proprietary encryption system could reveal something fun…

Condividi
Tags , , , | Comment (0)
interception Privacy security technology

Quantum cryptography broken

20 May 2010 – 8:15 pm

Quantum cryptography it's something very challenging, encryption methods that leverage the law of phisycs to secure communications over fiber lines.

To oversimplify the system is based on the fact that if someone cut the fiber, put a tap in the middle, and joint together the other side of the fiber, the amount of “errors” that will be on the communications path will be higher than 20% .

So if QBER (Quantum Bit Error Rate) goes above 20% then it's assumed that the system is intercepted.

Researcher at university of toronto was able to cheat the system with a staying below the 20%, at 19.7% , thus tweaking the threshold used by the system to consider the communication channel secure vs compromised.

The product found vulnerable is called Cerberis Layer2 and produced by the Swiss ID Quantique .

Some possibile approach to detect the attack has been provided but probably, imho, such kind of systems does not have to be considered 100% reliable until the technology will be mature enough.

Traditional encryption has to be used together till several years, eventually bundled with quantum encryption whether applicable.

When we will see a quantum encryption systems on an RFC like we have seen for ZRTP , PGP and SSL ?

-naif

Condividi
Tags , , | Comment (0)
Privacy security technology

great point of view

20 April 2010 – 6:50 pm

Because security of a cryptographic system it's not a matter of “how many bits do i use” but using the right approach to do the right thing to mitigate the defined security risk in the most balanced way.

security.png

Condividi
Tags , , | Comment (0)
Privacy security technology

Encryption is not scrambling: be aware of scrambler!

20 April 2010 – 5:50 pm

Most of us know about voice scrambler that can be used across almost any kind of voice based communication technology.

Extremely flexible approach: works everything

Extreme performance: very low latency

but unfortunately…

Extremely weak: Scrambling cannot be considered secure.

Only encryption can be considered secure under the Kerckoff's principle .

So please don't even consider any kind of analog scrambler if you need real security.

Read deeply the paper Implementation of a real-time voice encryption system ” by Markus Brandau, especially the cryptoanalysis paragraph.

Condividi
Tags , , , , | Comment (0)
business interception Privacy technology

SecurStar GmbH Phonecrypt answers on the Infosecurityguard/Notrax case: absolutely unreasonable! :-)

1 February 2010 – 6:04 pm

UPDATE 20.04.2010: http://infosecurityguard.com has been disabled. Notrax identity became known to several guys in the voice security environments (cannot tell, but you can imagine, i was right!) and so our friends decided to trow away the website because of legal responsibility under UK and USA laws.

UPDATE: Nice summary of the whole story (i know, it's long and complicated to read at 1st time) on SIPVicious VoIP security blog by Sandro Gauci .

Following my discoveries, Mr. Hafner, SecurStar chief exec, tried to ultimately defend their actions, citing absolutely unreasonable excuses to The Reg instead of publicly apologizing for what they have done: creating a fake independent security research to promote their PhoneCrypt product .

He tried to convince us that the person behind IP 217.7.213.59, used by the author of infosecurityguard.com and pointing to their office DSL line, was this hacker Notrax, using their anonymous surfing service and not one of their employees at their office:

“SecurStar chief exec Wilfried Hafner denied any contact with Notrax. Notrax, he said, must have been using his firm's anonymous browsing service, SurfSolo, to produce the results reported by Pietrosanti”

Let's reflect a moment on this sentence… Would really an hacker looking for anonymity spend 64 EUR to buy their anonymity surfing service called surfsolo instead of using the free and much more secure TOR (the onion router) ?Then let's reflect on this other piece of information:

  • The IP 217.7.213.59 is SecurStar GmbH's office DSL line
  • On 217.7.213.59 they have installed their VoIP/Asterisk PBX and internet gateway
  • They promote their anonymous proxy service for “Anonymous p2p use” ( http://www.securstar.com/products_ssolo.php ). Who would let users do p2p from the office dsl line where they have installed their corporate VoIP PBX ? If you do VoIP you can't let third party flood your line w/ p2p traffic, your phone calls would became obviously unreliable (yes, yes, you can do QoS, but you would not place an anonymous navigation proxy on your company office DSL line…).
  • Which company providing an anonymous navigation service would ever use their own office IP address? Just think how many times you would have the police knocking at your door and your employees as the prime suspects. (In past i used to run a TOR node, i know the risks…). Also think how many times you would find yourself blacklisted on google as a spyware bot.
  • Mr. Hafner also says “We have two million people using this product. Or he may have been an old customer of ours”. 2M users on a DSL line, really?
  • I don't use Surfsolo service, however their proxies are probably these ones:

surfsolo.securstar.net – 67.225.141.74

surfsolo.securstar.com – 69.16.211.133

Frankly speaking I can easily understand that Mr. Hafner is going do whatever he can to protect his company from the scandal, but the “anonymous proxy” excuse is at the very least suspicious.

How does the fact that the “independent research” was semantically a product review of PhoneCrypt, along with the discovery that the author come from the SecurStar GmbH IP address offices, along with the anonymity of this Notrax guy (SecurStar calls him a “well known it security professional” in their press release..) sound to you?

It's possible that earth will get an attack from outer space that's going to destroy our life?

Statistically extremely difficult, but yes, possible. More or less like the “anonymous proxy” story told by Mr. Hafner to cover the fact that they are the ones behind the infosecurityguard.com fake “independent security review”.

Hey, I don't need anything else to convince myself or to let the smart person have his own thoughts on this.

I just think that the best way for SecurStar to get out of this mess would probably be to provide public excuses to the hacking community for abusing the name and reputation of real independent security researches, for the sake of a marketing stunt.

Saluti,

Fabio Pietrosanti

ps I am currently waiting for some other infos that will more precisely confirm that what Mr. Hafner is saying is not properly true. Restate sintonizzati.

Condividi
Tags , , , , , | Comment (0)
business interception Privacy security

Evidence that infosecurityguard.com/notrax is SecurStar GmbH Phonecrypt – A fake independent research on voice crypto

1 February 2010 – 12:32 am

Below evidence that the security review made by an anonymous hacker on http://infosecurityguard.com is in facts a dishonest marketing plan by the SecurStar GmbH to promote their voice crypto product.

I already wrote about that voice crypto analysis that appeared to me very suspicious.

Now it's confirmed, it's a fake independent hacker security research by SecurStar GmbH, its just a marketing trick!

How do we know that Infosecurityguard.com, the fake independent security research, is a marketing trick from SecurStar GmbH?

1) I posted on http://infosecurityguard.com a comments to a post with a link to my blog to that article on israelian ministry of defense certification

2) The author of http://infosecurityguard.com went to approve the comment and read the link on my own blog http://infosecurity.ch

3) Reaching my blog he leaked the IP address from which he was coming 217.7.213.59 (where i just clicked on from wordpress statistic interface)

4) On http:// 217.7.213.59/panel there is the IP PBX interface of the SecurStar GmbH corporate PBX (openly reachable trough the internet!)

5) The names of the internal PBX confirm 100% that it's the SecurStar GmbH:

6) There is 100% evidence that the anonymous hacker of http://infosecurityguard.com is from SecurStar GmbH

Below the data and reference that let us discover that it's all but a dishonest marketing tips and not an independent security research.

Kudos to Matteo Flora for it's support and for his article in Debunking Infosecurityguard identity !

The http referral tricks

When you read a link going from a website to another one there is an HTTP protocol header, the “Referral”, that tell you from which page someone is going to another webpage.

The referral demonstrated that the authors of http://infosecurityguard.com read my post, because it was coming from http://infosecurityguard.com/wp-admin/edit-comments.php that's the webpage you use as a wordpress author/editor to approve/refuse comments. And here there was the link.

That's the log entry:

217.7.213.59 – - [30/Jan/2010:02:56:37 -0700] “GET /20100129/licensed-by-israel-ministry-of-defense-how-things-really-works/ HTTP/1.0″ 200 5795 “ http://infosecurityguard.com/wp-admin/edit-comments.php ” “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)”

The PBX open on the internet tell us that's SecurStar GmbH

The SecurStar GmbH PBX is open on the internet, it contains all the names of their employee and confirm us that the author of http:/infosecurityguard.com is that company and is the anonymous hacker called Notrax.

Here there is their forum post where the SecurStar GmbH guys are debugging IPCOPfirewall & Asterisk together (so we see also details of what they use) where there is the ip 217.7.213.59 .

SecurStarproof.png

That's also really fun!

They sell secure telephony but their company telephony system is openly vulnerable on the internet . :-)

I was thinking to call the CEO, Hafner, via SIP on his internal desktop PBX to announce we discovered him tricks.. :->

They measured their marketing activity

Looking at the logs of my website i found that they was sensing the google distribution of information for the following keywords, in order to understand how effectively they was able to attack competing products. It's reasonable, if you invest money in a marketing campaign you want to see the results :-)

They reached my blog and i logged their search:

infosecurityguard+cryptophone

infosecurityguard+gold-lock

217.7.213.59 – - [30/Jan/2010:02:22:42 -0700] “GET / HTTP/1.0″ 200 31057 “http://www.google.de/search?sourceid=navclient&ie=UTF-8&rlz=1T4SKPB_enDE350DE350&q=infosecurityguard+cryptophone” “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)”

217.7.213.59 – - [30/Jan/2010:04:15:07 -0700] “GET /20100130/about-the-voice-encryption-analysis-phonecrypt-can-be-intercepted-serious-security-evaluation-criteria/ HTTP/1.0″ 200 15774 “http://www.google.de/search?sourceid=navclient&ie=UTF-8&rlz=1T4SKPB_enDE350DE350&q=gold-lock+infosecurityguard” “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)”


The domain registration data
The domain have been registered on 1st December 2009, just two months to start preparing the dishonest marketing campaign:

Domain Name: INFOSECURITYGUARD.COM

Registrar: GODADDY.COM, INC.

Updated Date: 01-dec-2009

Creation Date: 01-dec-2009

The domain is anonymously privacy protected trough a whois privacy service:

Administrative Contact: Private, Registration INFOSECURITYGUARD.COM@domainsbyproxy.com , Domains by Proxy, Inc. DomainsByProxy.com

Notrax hacker does not exist on google
As you know any hacker that get public usually have presence of it's activity on google, attending mailinglists, forum, homepage, past research, participation to conferences, etc, etc.
The fake hacker that they wanted us to to think was writing an independent blog does NOT have any trace on google. Only some hit about an anonymous browser called Notrax but nothing about that hacker.
Maybe when SecurStar provided the anonymity tool to their marketing agency, to help them protecting anonymity for the fake research, their provided them the anonymous browser notrax.So the marketing guy thinking about the nickname of this fake hackers used what? Notrax! :-)

The “independent review”completely oriented in publicizing PhoneCrypt

Of the various review don the phonecrypt review is only positive and amazing good feedback, while the other are only bad feedback and no single good point.

As you can imagine, in any kind of independent product evaluation, for all products there are goods and bad points. No. In this one there are only product that are good and product that are bad.

They missed to consider the security of the technology used by the products

They completely avoided to speak about cryptography and security of the products.

They do not evaluated basic security features that must be in that kind of products.That's in order not to let anyone see that they did not followed basic security rules in building up their PhoneCrypt.
The technology is closed source, no transparency on algorithms and protocols, no peer review.Read my new comparison (from the basic cryptographic requirement point of view) About the voice encryption analysis (criteria, errors and different results) .
The results are somehow different than their one .

UPDATE: Who's Wilfried Hafner (SecurStar founder) ?

I got a notice from a reader regarding Wilfred Hafner, SecurStar founder, CEO and security expert.

He was arrested in 1997 for telephony related fraud (check 2nd article on Phrack) earning from telephony fraud 254.000 USD causing damages to local telcos trough blueboxing for 1.15 Million USD.

He was not doing “Blueboxing” for the pleasure of phreaking and connecting with other hackers, but to earn money.

Hacking for profit (and not for fun) in 1997… brrr…. No hacker's ethic at all!

All in all, is that lawful?

Badmouthing a competitor amounts to an unfair competition practice in most jurisdictions, so it is arguable (to say the least) that SecurStar is right on a legally sound ground here.
Moreover, there are some specific statutes in certain jurisdictions which provide for a straightforward ban on the practice we are talking about. For example in the UK the British Institute of Practitioners in Advertising - in compliance with the Consumer protection from Unfair Trading regulation – ruled that:

”falsely claiming or creating the impression that the trader is not acting for the purposes relating to his trade, business, craft or profession, or falsely representing oneself as a consumer” is a criminal offense .

We have no doubt that PRPR (which is the UK-based *PR company for SecurStar GmbH, led by Peter Rennison and Allie Andrews as stated in SecurStar Press Release ) did provide their client with this information. Heck, they *are* in the UK, they simply cannot ignore that!

IANAL, but I would not be surpised if someone filed a criminal complaint or start civil litigation for unfair competition against SecurStar GmbH.
Whether this is going to be a matter for criminal and/or civil Courts or not is not that important. However, it is clear enough that SecurStar GmbH appears to be at least ethically questionable and not really worth of trust.

Nice try, gentlemen… however, next time just do it right (whether “right” for them means “in a honest manner” or “in a fashion not to be caught” I will let them choose)”

Fabio Pietrosanti (naif)

Condividi
Tags , , , , , | Comments (7)
business interception Privacy security

Dishonest security: The SecurStart GmbH Phonecrypt case

1 February 2010 – 12:30 am

I would like to provide considerations on the concept of ethics that a security company should have respect to the users, the media and the security environment.

SecurStar GmbH made very bad things making that infosecuriguard.com fake independent research.

It's unfair approach respect to hacking community.

It's unfair marketing to end user. They should not be tricking by creating fake independent review.

It's unfair competition in the security market.

Let's make some more important consideration on this.

Must be serious on cryptographic products. They are not toys

When you do cryptographic tools you should be really aware of what you are doing, you must be really serious.

If you do bad crypto people could die.

If you don't follow basic security rules for transparency and security for cryptography you are putting people life at risk.

You are taking the responsibility of this. (I want to sleep at night, don't think SecurStar CEO/CTO care about this…)

Security research need reference and transparency

Security research have to be public, well done, always subject to public discussion and cooperation.
Security research should not be instrumentally used for marketing purpose.Security research should be done for awareness and grow of the knowledge of the worldwide security environment.

Hacking environment is neutral, should not be used instrumentally

Hackers are considered neutral, nerds, doing what they do for their pleasure and passion.

If you work in the security market you work with hackers.

If you use hackers and hacking environment for your own marketing purposes you are making something very nasty.

Hackers give you the technology and knowledge and you use them for your own commercial purpose.

Consideration on the authority of the information online

That's something that pose serious consideration on the authority of information online.An anonymous hacker, with no reference online, made a product security review that appear like an independent one. I have to say that the fake review was very well prepared, it always posed good/bad things in an indirect way. It did not appeared to me at 1st time like a fake. But going deeply i found what's going on.

However Journalists, news media and blogger went to the TRAP and reviewed their fake research. TheRegister, NetworkWorld and a lot of blogs reported it. Even if the author was completely anonymous.

What they have done is already illegal in UK

SecurStar GmbH is lucky that they are not in the UK, where doing this kind of things is illegal .

Fabio Pietrosanti (naif)

Condividi
Tags , , , , | Comment (0)
business interception Privacy security technology

About the SecurStar GmbH Phonecrypt voice encryption analysis (criteria, errors and different results)

30 January 2010 – 2:02 am

This article want to clarify and better explain the finding at infosecurityguard.com regaring voice encryption product evaluation.
This article want to tell you a different point of view other than infosecurityguard.com and explaining which are the rational with extensive explaination from security point of view.
Today i read news saying: “PhoneCrypt: Basic Vulnerability Found in 12 out of 15 Voice Encryption Products and went to read the website infosecurityguard .

Initially it appeared to my like a great research activity but then i started reading deeply the read about it.I found that it's not properly a security research but there is are concrete elements that's a marketing campaign well done in order to attract public media and publicize a product.
Imho they was able to cheat journalists and users because the marketing campaign was absolutely well done not to be discovered on 1st read attempt. I personally considered it like a valid one on 1st ready (they cheated me initially!).

But if you go deeply… you will understand that:
- it's a camouflage marketing initiative arranged by SecurStar GmbH and not a independent security research
- they consider a only security context where local device has been compromised (no software can be secured in that case, like saying SSL can be compromised if you have a trojan!)
- they do not consider any basic security and cryptographic security criteria

However a lot of important website reported it:

This article is quite long, if you read it you will understand better what's going on around infosecurityguard.com research and research result.

I want to to tell you why and how (imho) they are wrong.

The research missed to consider Security, Cryptography and Transparency!

Well, all this research sound much like being focused on the marketing goal to say that their PhoneCrypt product is the “super” product best of all the other ones.
Any security expert that would have as duty the “software evaluation” in order to protect the confidentiality of phone calls will evaluate other different characteristics of the product and the technology.

Caspertec Oscurità Nessuna rivista pubblica Chiuso Sì CellCrypt Obscurity
No public review
Closed
Sì Cryptophone Transparency Limited public review Pubblico Sì Gold-Lock Obscurity
No public review
Closed
Sì Illix Obscurity
No public review
Closed
Sì No1.BC Obscurity No public review
Closed
Sì PhoneCrypt Obscurity
No public review
Closed
Sì Rode&Swarz Obscurity
No public review
Closed
Sì Secure-Voice Obscurity
No public review
Closed
Sì SecuSmart Obscurity
No public review
Closed
Sì SecVoice Obscurity
No public review
Closed
Sì SegureGSM Obscurity
No public review
Closed
Sì SnapCell Obscurity
No public review
Closed
Sì Tripleton Obscurity
No public review
Closed
Sì Zfone Transparency Public review
Aprire Sì ZRTP Transparency Public review
Aprire Sì

*Green means that it match basic requirement for a cryptographic secure system

* Red / Broken means that it does not match basic requirement for a cryptographic secure system
That's my analysis using a evaluation method based on cryptographic and security parameters not including the local compromise context that i consider useless.

However, to be clear, those are only basic parameters to be used when considering a voice encryption product (just to avoid being in a situation that appears like i am promoting other products). So it may absolutely possible that a product with good crypto ( transparency, peer reviewed and opensource) is absolutely a not secure product because of whatever reason (badly written, not usable causing user not to use it and use cleartext calls, politically compromised, etc, etc).
I think i will prepare a broader criteria for voice crypto technologies and voice crypto products, so it would be much easier and much practical to have a full transparent set of criterias to evaluate it.

But those are really the basis of security to be matched for a good voice encryption system!
Read some useful past slides on security protocols used in voice encryption systems (2nd part).

Now read below some more practical doubt about their research.

The security concept of the review is misleading: any hacked device can be always intercepted!

I think that the guys completely missed the point: ANY KIND OF SOFTWARE RUNNING ON A COMPROMISED OPERATING SYSTEM CAN BE INTERCEPTED

Now they are pointing out that also Zfone from Philip Zimmermann is broken (a pc software), just because they install a trojan on a PC like in a mobile phone?
Any security software rely on the fact that the underlying operating system is somehow trusted and preserve the integrity of the environment where the software run.

  • If you have a disk encryption system but your PC if infected by a trojan, the computer is already compromised.
  • If you have a voice encryption system but your PC is infected by a trojan, the computer is already compromised.
  • If you have a voice encryption system but your mobile phone is infected by a trojan, the mobile phone is already compromised.

No matter which software you are running, in such case the security of your operating environment is compromised and in one way or another way all the information integrity and confidentiality is compromised.

Like i explained above how to intercept PhoneCrypt.

The only things that can protect you from this threat is running in a closed operating system with Trust Computing capability, implementing it properly.
For sure on any “Open” operating system such us Windows, Windows Mobile, Linux, iPhone or Android there's no chance to really protect a software.
On difficult operating system such as Symbian OS or RimOS maybe the running software can be protected (at least partially)

That's the reason for which the security concept that guys are leveraging to carry on their marketing campaign has no clue.
It's just because they control the environment, they know Flexispy software and so they adjusted their software not to be interceptable when Flexispy is installed.
If you develop a trojan with the other techniques i described above you will 100% intercept PhoneCrypt.

On that subject also Dustin Tamme l, Security researcher of BreakPoint Systems , pointed on on VoIP Security Alliance mailing lists that the security analysis is based on wrong concepts .

The PhoneCrypt can be intercepted: it's just that they don't wanted to tell you!

PhoneCrypt can be intercepted with “on device spyware”.
Perché?
Because Windows Mobile is an unsecure operating environment and PhoneCrypt runs on Windows Mobile.
Windows Mobile does not use Trusted Computing and so any software can do anything.
The platform choice for a secure telephony system is important.
Come?
I quickly discussed with some knowledgeable windows mobile hackers about 2 different way to intercept PhoneCrypt with an on-device spyware (given the unsecure Windows Mobile Platform).

a) Inject a malicious DLL into the software and intercept from within the Phonecrypt itself.
In Windows Mobile any software can be subject to DLL code injection.
What an attacker can do is to inject into the PhoneCrypt software (or any software running on the phone), hooking the Audio related functions acting as a “function proxy” between the PhoneCrypt and the real API to record/play audio.
It's a matter of “hooking” only 2 functions, the one that record and the one that play audio.
Read the official Microsoft documentation on how to do DLL injection on Windows Mobile processes. or forum discussing the technique of injecting DLL on windows mobile processes.
That's simple, any programmer will tell you to do so.
They simply decided that's better not to make any notice about this.
b) Create a new audio driver that simply act as a proxy to the real one and intercept PhoneCrypt
In Windows Mobile you can create new Audio Drivers and new Audio Filters.
What an attacker can do is to load a new audio driver that does not do anything else than passing the real audio driver function TO/FROM the realone. In the meantime intercept everything recorded and everything played :-)
Here there is an example on how to do Audio driver for Windows Mobile .
Here a software that implement what i explain here for Windows “Virtual Audio Cable” .
The very same concept apply to Windows Mobile. Check the book “Mobile Malware Attack and Defense” at that link explaining techniques to play with those techniques.
They simply decided that's better not to make any notice to that way of intercepting phone call on PhoneCrypt .
Those are just 2 quick ideas, more can be probably done.

Sounds much like a marketing activity – Not a security research.

I have to tell you. I analyzed the issue very carefully and on most aspects. All this things about the voice encryption analisys sounds to me like a marketing campaign of SecurStar GmbH to sell PhoneCrypt and gain reputation. A well articulated and well prepared campaign to attract the media saying, in an indirect way cheating the media, that PhoneCrypt is the only one secure. You see the press releases of SecurStar and of the “Security researcher Notrax telling that PhoneCrypt is the only secure product” . SecurStar PhoneCrypt is the only product the anonymous hacker “Notrax” consider secure of the “software solutions”.
The only “software version” in competition with:

– SnapCell – No one can buy it. A security company that does not even had anymore a webpage. The company does not almost exist anymore.
– rohde-schawarz – A company that have in his list price and old outdated hardware secure phone . No one would buy it, it's not good for genera use.

Does it sounds strange that only those other products are considered secure along with PhoneCrypt .

Also… let's check the kind of multimedia content in the different reviews available of Gold-Lock, Cellcrypt and Phonecrypt in order to understand how much the marketing guys pressed to make the PhoneCrypt review the most attractive:

Applicazione Screenshots of application Video with demonstration of interception Network demonstration
PhoneCrypt 5 0 1
CellCrypt 0 2 0
GoldLock 1 2 0

It's clear that PhoneCrypt is reviewed showing more features explicitly shown and major security features product description than the other.

Too much difference between them, should we suspect it's a marketing tips?

But again other strange things analyzing the way it was done…
If it was “an impartial and neutral review” we should see good and bad things on all the products right?

Ok, see the table below regarding the opinion indicated in each paragraph of the different reviews available of Gold-Lock, CellCrypt and Phonecrypt (are the only available) to see if are positive or negative.

Applicazione Number of paragraphs Positive paragraphs Negative paragraphs Neutral paragraphs
PhoneCrypt 9 9 0 0
CellCrypt 12 0 10 2
GoldLock 9 0 8 1

Detailed paragraphs opinion analysis of Phonecrypt
Paragraph of review Opinion expressed
From their website Positive Marketing feedback
Apple iPhone Positive Marketing feedback
Disk Encryption or voice Encryption Positive Marketing feedback
PBX Compatibility? Really Positive Marketing feedback
Cracking <10. Not. Positive Marketing feedback
Good thinking! Positive Marketing feedback
A little network action Positive Marketing feedback
UI Positive Marketing feedback
Good Taste Positive Marketing feedback
Detailed paragraphs opinion analysis of Gold-Lock 3G
Paragraph of review Opinion expressed
From their website Negative Marketing feedback
Licensed by The israeli Ministry of Denfese Negative Marketing feedback
Real Company or Part Time hobby Negative Marketing feedback
16.000 bit authentication Negative Marketing feedback
DH 256 Negative Marketing feedback
Downad & Installation! Neutral Marketing feedback
Cracking it <10 Negative Marketing feedback
Marketing BS101 Negative Marketing feedback
Cool video stuff Negative Marketing feedback
Detailed paragraphs opinion analysis of CellCrypt
Paragraph of review Opinion expressed
From their website Neutral Marketing feedback
A little background about cellcrypt Negative Marketing feedback
Master of Marketing Negative Marketing feedback
Secure Voice calling Negative Marketing feedback
Who's buying their wares Negative Marketing feedback
Downad & Installation! Neutral Marketing feedback
My Demo environment Negative Marketing feedback
Did they forget some code Negative Marketing feedback
Cracking it <5 Negative Marketing feedback
Room Monitoring w/ FlexiSpy Negative Marketing feedback
Cellcrypt unique features.. Negative Marketing feedback
Plain old interception Negative Marketing feedback
The Haters out there Negative Marketing feedback

Now it's clear that from their point of view on PhoneCrypt there is no single bad point while the other are always described in a negative way.
No single good point. Strange?
All those considerations along with the next ones really let me think that's very probably a marketing review and not an independent review.

Other similar marketing attempt from SecurStar

SecurStar GmbH is known to have used in past marketing activity leveraging this kind of “technical speculations”, abusing of partial information and fake unconfirmed hacking stuff to make marketing/media coverage.
Imho a rare mix of unfairness in leveraging the difficult for people to really understand the complexity of security and cryptography.

They already used in past Marketing activities like the one about creating a trojan for Windows Mobile and saying that their software is secure from the trojan that they wrote.
Read about their marketing tricks of 2007

They developed a Trojan (RexSpy) for Windows Mobile, made a demonstration capability of the trojan and later on told that they included “Anti-Trojan” capability to their PhoneCrypt software.They never released informations on that trojan, not even proved that it exists.

The researcher Collin Mulliner told at that time that it sounds like a marketing tips (also because he was not able to get from SecurStar CEO Hafner any information about that trojan):

“This makes you wonder if this is just a marketing thing.”

Now, let's try to make some logical reassignment.
It's part of the way they do marketing, an very unfriendly and unpolite approach with customers, journalist and users trying to provide wrong security concepts for a market advantage. Being sure that who read don't have all the skills to do in depth security evaluation and find the truth behind their marketing trips.

Who is the hacker notrax?

It sounds like a camouflage of a fake identity required to have an “independent hacker” that make an “independent review” that is more strong on reputation building.
Read about his bio:

¾ Human, ¼ Android (Well that would be cool at least.) I am just an enthusiast of pretty much anything that talks binary and if it has a RS232 port even better. During the day I masquerade as an engineer working on some pretty cool projects at times, but mostly I do the fun stuff at night. I have been thinking of starting an official blog for about 4.5 years to share some of the things I come across, can't figure out, or just cross my mind. Due to my day job and my nighttime meddling, I will update this when I can. I hope some find it useful, if you don't, well you don't.

There are no information about this guy on google.
Almost any hacker that get public have articles online, post in mailing archive and/or forum or some result of their activity.
For notrax, nothing is available.

Inoltre diamo un'occhiata al dominio ...
The domain infosecurityguard.com is privacy protected by domainsbyproxy to prevent understanding who is the owner.
The domain has been created 2 months ago on 01-Dec-09 on godaddy.com registrar.

What's also very interesting to notice that this “unknown hacker with no trace on google about him that appeared on December 2009 on the net” is referred on SecurStar GmbH Press Release as a “An IT security expert”.

Maybe they “know personally” who's this anonymous notrax? :)

Am i following my own conspiracy thinking or maybe there's some reasonable doubt that everything was arrange in that funny way just for a marketing activity?

Social consideration

If you are a security company you job have also a social aspects, you should also work to make the world a better place (sure to make business but “not being evil”). You cannot cheat the skills of the end users in evaluating security making fake misleading information.

You should do awareness on end users, to make them more conscious of security issues, giving them the tools to understand and decide themselves.

Hope you had fun reading this article and you made your own consideration about this.

Fabio Pietrosanti (naif)

ps Those are my personal professional opinion, let's speak about technology and security, not marketing.
pps i am not that smart in web writing, so sorry for how the text is formatted and how the flow of the article is unstructured!

Condividi
Tags , , , , , , | Comments (4)
cyberwarfare intelligence interception Privacy security

Licensed by Israel Ministry of Defense? How things really works!

29 January 2010 – 10:12 am

You should know that Israel is a country where if a company need to develop encryption product they must be authorized by the government.

The government don't want that companies doing cryptography can do anything bad to them and what they can do of good for the government, so they have to first be authorized.

Companies providing interception and encryptio n m ust apply to a license because Israel law on this is so restrictive to be similar to china law .

That's because those kind of technologies are considered fundamental for the intelligence and espionage capabilities of Israel country.

To give some example of “Licensed by Israel Ministry of Defense” companies:

GSM encryption products “Licensed by Israel Ministry of Defense” – Gold-lock

Interception of communication products “Licensed by Israel Ministry of Defense” – Verint

HF encrypted Radio “Licensed by Israel Ministry of Defense” – Kavit

Surveillance services and equipment “Licensed by Israel Ministry of Defense” – Multi Tier Solutions

For example how to apply for a “License by Israel Ministry of Defense” if you do encryption technologies in Israel?

Be sure to be an israeli company, click here and fill the forms.

Someone will contact you from encryption-control@mod.gov.il and will discuss with you whether to give you or not the license to sell.

What does the department of defense will require from an israeli company in order to provide them the authorization to make and sell interception and encryption products?

Well, what they want and what they really ask nobody knows.

It's a secret dealing of Israel Ministry of Defense with each “licensed” company.

What we know for sure is that Verint, a “Licensed by Israel Ministry of Defense”, placed a backdoor to intercept companies and governments in the US and Netherland into the interception systems they was selling.

Verint, a Licensed by Israel Ministry of Defense Company, provided to Israel government eavesdropped communications of private and government users in the United States and in the Netherland .

CIA officier reported that Israel Ministry of Defense was known to pay Verint a reimbursement of 50% of their costs in order to have from Verint espionage services trough their commercial activity on selling “backdoored” interception equipment to spy foreign users.


It can be a legitimate doubt that the cooperation within the Israeli Ministry of Defense may be problematic for an Israeli company that want to sell interception and encryption product abroad.

Those companies may be forced to make the interests of Israel Ministry of Defense and not the interests of the customers (like Verint scandal is a real-world example).

So, how would a “Licensed by Israel Ministry of Defense” be a good things to promote?

It represent the risk that the “Israel Ministry of Defense”, like is publicly known that it has already have done with Verint, will interfere with what the company do.

It represent the risk that the “Israel Ministry of Defense” may reasonably provide “reimbursement” of costs paying the company and get what they would likely would like to get.

So, what does really “Israel Ministry of Defense” want from Israel companies doing encryption and interception technologies?

Should we ask ourself whether Israeli companies doing encryption and interception businesses are more interested to do business or to do “outsourced espionage services” for their always paying customer, the “Israel Ministry of Defense”.

For sure, in the age of financial crisis, the Israel Ministry of Defense is a paying customer that does not have budget problem…

Strict control, strict rules, strong government strategic and military cooperation.

Fate attenzione.

If you want to read more about this matters, about how technologies from certain countries is usually polluted with their governments military and secret services strategies stay tuned as i am preparing a post about this .

You will much better understand about that subjects on the “Licensed by Israel Ministry of Defense”.

Condividi
Tags , , , , | Comment (0)
intelligence interception Privacy technology

Location Based Services: the big brother thanks you ;-)

1 December 2009 – 7:13 pm

Do you use your iphone, google phone, blackberry or nokia smartphone with cool built-in GPS?

Well law enforcement can now know even better where you are, at any time, even with historical data and much better than BTS based location systems.

Sprint has given 8 million times customer's GPS information to law enforcement (sound something like a semi-automatic request).

Read here .

Nice extract is:

Sprint Nextel provided law enforcement agencies with its customers' (GPS) location information over 8 million times between September 2008 and October 2009. This massive disclosure of sensitive customer information was made possible due to the roll-out by Sprint of a new, special web portal for law enforcement officers.

The informations was provided at wiretapping and interception industry conference ISS WASH in Washingtown.

If you want see directly the video:


Sprint: 50 million customers, 8 million law enforcement GPS requests in 1 year from Christopher Soghoian on Vimeo .


Then you know that “big brother” is watching you only because you let him to watch you.

Condividi
Tags , , , | Comment (0)
cyberwarfare intelligence interception Privacy

Gold-Lock Security Encryption Contest: be careful!

25 November 2009 – 2:56 pm

This post is to talk about the “unfair” marketing approach of Gold-Lock, an israeli company doing mobile voice encryption authorized by Israeli Ministry of Defence .

Following an announcement seen on Linkedin “Information Security Community” group:

GoldLock is offering US$ 100.000 and a job for an unencryption

GoldLock, an israeli encryption and security company is offering US$ 100.000 and a job to anyone capable to decrypt a cellular conversation contained in a file provided in their site ( https://www.gold-lock.com/app/en/?wicket:interface=:8 ::::).
The transcription must be sent back to GoldLock until February 1st, 2010.
The contest is open to all and any tools or technology may be used.
Good luck to all!!!

I commented:

Not having a public protocol specification is not even scientifically serious to make a marketing tricks like this.
I would say to gold-lock, let's release the source code and let anyone compile the cryptographic engine if you trust not to to have something nasty inside… ;)

Toni Koivunen from F-secure said:

So… They will pay $100k if you get through the AES and the hassle with keys.
If someone would pull it off they would certainly make a truckload more money elsewhere. Plus they would retain the rights to the code/technology that they created, which isn't the case if they go for the $100k since the License pretty clearly says that:
# An assignment letter to Gold Line, in a form satisfactory to Gold Line of your technology and the Work Plan (the “Technology”). Such assignment form shall enable Gold Line to transfer the rights on the Technology to Gold Line, including the right to register patents and all other rights.
# A release and waiver form, in a form satisfactory to Gold Line, duly executed by you and any other participant of any rights to the Technology.
Plus of course Gold Line retains the right to change the rules of the game with prior notice. Or needing to notify afterwards either.
Sounds fair :)

Michel Scovetta from Computer Associates said:

It sounds like the purpose of this is to get some cheap testing out of it, and to be able to say something like, “The best crypto experts in the world tried to break it, and were unable to.”

According to some of the docs on Gold Lock's website, they use ECC-256 and a “modified DH key exchange” (which tingles my spidey senses), SHA-256, and then XOR for the actual data encryption. They use practically blasphemous language like, “Each component of the Gold Lock Enterprise solution is tested and proven secure against any conceivable attack.”

*Proven* secure? *Any conceivable* attack? Orrore!

In another doc on their site, they talk about their first layer relying on 1024-bit RSA. GoDaddy doesn't even allow 1024-bit keys to be used anymore when generating $20 SSL certificates. They quote 300 billion MIPS-years to break, but if my math is correct, that comes down to about 52 days on the top supercomputer right now. Not trivial, but this is an offline attack, so time is on the side of the attacker.

The description then talks about the device generating 16k keys when you register the device. If the protocol is “secure”, then it should be “secure” with only a single key. If it's not secure with a single key, then generating 16k keys could only make it 16k times more secure, which is far off from a proof of security.

I agree with Fabio – a fair contest would be to include source code and the cryptographic specification. Also, as other contests have proven (eg SecureWebMail), the weakest point isn't usually the cryptography. It's all of the other stuff, and it doesn't look like any of it is being disclosed for the contest.

http://xkcd.com/538/

Mike

I would say that all those considerations from security experts from well known and established security companies bring us to consider that:

  • Gold-lock is not transparent on their encryption at all and they work trough bad practice of Security Trough Obscurity (no one know what's inside the product)
  • Gold-lock is not playing a fair game by proposing this 'security contest'
  • Gold-lock being certified by Israeli ministry of defence may raise doubt related to possible relationship with the intelligence… Read by post Certified by Israeli MInistry of Defense .

Voice security is a sensible matters and lacks of transparency and governmental relationship for cryptographic choices usually does not provide anything good…

Think about it…

Condividi
Tags , , , | Comment (0)
cybercrime Privacy

Disk encryption sometimes 'works'

9 novembre 2009 - 02:53

Io sono uno di persona convinta che un sistema di crittografia del disco del computer non vi proteggerà da autorità pubbliche, se sono convinti sufficiente e il caso è molto importante.

Ci sono un sacco di strada per convincere una persona a rilasciare una password.

Tuttavia c'è un caso in Australia, dove non rivelare la password del disco ha determinato un modo efficace per evitare di andare in prigione:

Secret code saves man who spied on flatmates

My opinion is just that spying flatmates is not a so relevant and particular crime and that law enforcement did not used 'convincing systems' to get the password of encrypted disk.

UPDATE 29.06.2010: It also worked for Daniel Dantas against FBI .

Condividi
Tags , , | Comment (0)
intelligence interception Privacy

Political conflict in Turkey between Prosecutors and Wiretappers

7 November 2009 – 3:38 pm

It seems that in Turkey the Telecommunication Directorate (TIB), in charge of managing the wiretapping, intercepted the president of the Judge and Prosecutors Associations.

Prosecutors and Judge usually does not like being tapped, and so the 1st High Criminal Court ordered an audit of all the recording done by the TIB since 2006.

Leggi di più qui .

Condividi
Tags , , , | Comment (0)
cyberwarfare intelligence interception Privacy security

UAE government placing backdoors into Blackberry devices

21 July 2009 – 2:25 pm

Nice attempt to place backdoors inside Blackberry devices.

It seems that UAE government wanted to do something nasty placing backdoors trough software upgrades in Etilsat (local mobile operator) blackberry devices, obviously with the cooperation of the mobile operator itself.

Fortunately, the power of the security community discovered and unveiled the facts. Check it out.

Etisat patch designed for surveillance

Wired magazine: Blackberry spies

Security exists only with transparency.

Condividi
Tags , , , | Comment (0)
business cyberwarfare intelligence interception Privacy security

Voice encryption in government sectors

6 July 2009 – 11:02 pm

I will make some in depth articles about how voice encryption really works in government environments.

The open standards and open source still have to reach the military and government environments for what's related to secure speech.

To give you an idea of the complexity and kind of particular issues that exists, look at the USA 3G Wireless Security: A Government Perspective and the A Waveform Architecture to Support Security and Interoperability in Multi-National Wireless Networks for Tactical Communication .

They are using so-custom protocols like Secure Communications Interoperability Protocol that require the use of patented MELPe ultra-narrowband codec that there's not a real market of application and equipment using this. Only a small elite of government controlled companies from few countries manage this de-facto lobby.

Should we change this bringing open standards also to government sectors?

Condividi
Tags , , , | Comment (0)
intelligence Privacy technology

Voice Security and Privacy slides

6 July 2009 – 10:15 pm

Below my slides on voice security and privacy from Security Summit 2009 .

mmm, yes i am working in this area from 2005, will write again about it.

2009: Voice Security And Privacy (Security Summit – Milan)

Visualizza più presentazioni da Fabio Pietrosanti .

sux

Condividi
Tags , , , | Comment (0)