This article want to clarify and better explain the finding at infosecurityguard.com regaring voice encryption product evaluation.
This article want to tell you a different point of view other than infosecurityguard.com and explaining which are the rational with extensive explaination from security point of view.
Today i read news saying: “PhoneCrypt: Basic Vulnerability Found in 12 out of 15 Voice Encryption Products and went to read the website infosecurityguard .
Initially it appeared to my like a great research activity but then i started reading deeply the read about it.I found that it's not properly a security research but there is are concrete elements that's a marketing campaign well done in order to attract public media and publicize a product.
Imho they was able to cheat journalists and users because the marketing campaign was absolutely well done not to be discovered on 1st read attempt. I personally considered it like a valid one on 1st ready (they cheated me initially!).
But if you go deeply… you will understand that:
- it's a camouflage marketing initiative arranged by SecurStar GmbH and not a independent security research
- they consider a only security context where local device has been compromised (no software can be secured in that case, like saying SSL can be compromised if you have a trojan!)
- they do not consider any basic security and cryptographic security criteria
However a lot of important website reported it:
This article is quite long, if you read it you will understand better what's going on around infosecurityguard.com research and research result.
I want to to tell you why and how (imho) they are wrong.
The research missed to consider Security, Cryptography and Transparency!
Well, all this research sound much like being focused on the marketing goal to say that their PhoneCrypt product is the “super” product best of all the other ones.
Any security expert that would have as duty the “software evaluation” in order to protect the confidentiality of phone calls will evaluate other different characteristics of the product and the technology.
是的，这是真的，大部分由Securstar公司在匿名的营销网站中描述的产品称为http://infosecurityguard.com的有一些弱点。
但相关的弱点是他人和有PhoneCrypt的不幸的是，大部分所描述的产品一样患上这种。
让我们回顾一下哪些特点是需要基本的加密技术和安全要求（最佳实践的基础和基本！）
- 安全海槽朦胧不起作用
加密卡梅斯从1883年由奥古斯特Kerckhoffs的一个基本原则：
在一个精心设计的加密系统，唯一的关键需求是秘密;算法应该没有保密。
现代密码学家已经接受了这一原则，要求任何东西“含糊的安全性。”
读什么布鲁斯Schneir说，在世界公认的专家和密码破译
任何安全专家会告诉你，这是事实。 即使是新手的大学生会告诉你，这是事实。 很简单，因为这是唯一的方式做加密。
几乎所有的产品描述在审查Securstar公司联系，包括有PhoneCrypt，不提供准确详细了解他们的加密技术。
精确的细节是：
提供精确的细节，意味着有大量的文档记录的算法是如何工作的，任何单一的方式协议如何工作的精确规格复制它的互操作性测试的理论和实际意义。
这意味着，科学界应该能够玩的是技术，审计它，砍它。
如果我们不知道任何关于密码系统的详细信息，我们怎么能知道哪些是弱点和力量点？
迈克·弗拉托，网站编辑，网络计算，做出了很大的文章“说不专有加密系统” 。
CERIAS普渡大学讲这个 。
B - 非同行评议的和非科学的批准加密不起作用
在任何情况下，在任何情况下，你做你需要的加密技术，以确保别人会检查，审查，分析，distruct和reconstract从头您的技术，并免费向公众提供这些信息进行公开讨论。
这究竟是如何AES出生，像美国国家标准学会做加密 （公共同行评审，只有最好的评估双赢公益大赛）。
公共讨论与公共的比赛，其中有很多在世界上最有名的密码学家和专家审查，黑客（他们的名字，姓氏和脸，不喜欢Notrax）提供他们的贡献，告诉他们认为。
这就是所谓的“同行评审”。
If a cryptographic technology has an extended and important peer review, distributed in the world coming from universities, private security companies, military institutions, hackers and all coming from different part of the world (from USA to Europe to Russia to South America to Middle east to China) and all of them agree that a specific technology it's secure…
Well, in that case we can consider the technology secure because a lot of entities with good reputation and authority coming from a lot of different place in the world have publicly reviewed, analyzed and confirmed that a technology it's secure.
How a private company can even think to invent on it's own a secure communication protocol when it's scientifically stated that it's not possible to do it in a “proprietary and closed way” ?
IBM tell you that peer review it's required for cryptography .
Bruce Schneier tell you that “Good cryptographers know that nothing substitutes for extensive peer review and years of analysis.”
Philip Zimmermann will tell you to beware of Snake Oil where the story is: “Every software engineer fancies himself a cryptographer, which has led to the proliferation of really bad crypto software.”
c – Closed source cryptography does not work
As you know any kind of “serious” and with “good reputation” cryptographic technology is implemented in opensource.
There are usually multiple implementation of the same cryptographic algorithm and cryptographic protocol to be able to review all the way it works and certify the interoperability.
Supposing to use a standard with precise and extended details on “how it works”, that has been “peer reviewed” by the scientific community BUT that has been re-implemented from scratch by a not so smart programmer and the implementation it's plenty of bugs.
Well, if the implementation is “opensource” this means that it can be reviewed, improved, tested, audited and the end user will certaintly have in it's own had a piece of technology “that works safely” .
Google release opensource crypto toolkit
Mozilla release opensource crypto toolkit
Bruce Schneier tell you that Cryptography must be opensource .
Another cryptographic point of view
I don't want to convince anyone but just provide facts related to science, related to cryptography and security in order to reduce the effect of misinformation done by security companies whose only goes is to sell you something and not to do something that make the world a better.
When you do secure products, if they are not done following the proper approach people could die.
It's absolutely something irresponsible not to use best practice to do crypto stuff.
To summarize let's review the infosecurityguard.com review from a security best pratice point of view.
| 产品名称 | Security Trough Obscurity | Public peer review | Open Source | Compromise locally? |
| Caspertec | Obscurity | No public review | 关闭 | 是 |
| CellCrypt | Obscurity
| No public review
| 关闭
| 是 |
| Cryptophone | Transparency | Limited public review | Public | 是 |
| Gold-Lock | Obscurity
| No public review
| 关闭
| 是 |
| Illix | Obscurity
| No public review
| 关闭
| 是 |
| No1.BC | Obscurity | No public review
| 关闭
| 是 |
| 有PhoneCrypt | Obscurity
| No public review
| 关闭
| 是 |
| Rode&Swarz | Obscurity
| No public review
| 关闭
| 是 |
| Secure-Voice | Obscurity
| No public review
| 关闭
| 是 |
| SecuSmart | Obscurity
| No public review
| 关闭
| 是 |
| SecVoice | Obscurity
| No public review
| 关闭
| 是 |
| SegureGSM | Obscurity
| No public review
| 关闭
| 是 |
| SnapCell | Obscurity
| No public review
| 关闭
| 是 |
| Tripleton | Obscurity
| No public review
| 关闭
| 是 |
| Zfone | Transparency | Public review
| 打开 | 是 |
| ZRTP | Transparency | Public review
| 打开 | 是 |
*Green means that it match basic requirement for a cryptographic secure system
* Red / Broken means that it does not match basic requirement for a cryptographic secure system
That's my analysis using a evaluation method based on cryptographic and security parameters not including the local compromise context that i consider useless.
However, to be clear, those are only basic parameters to be used when considering a voice encryption product (just to avoid being in a situation that appears like i am promoting other products). So it may absolutely possible that a product with good crypto ( transparency, peer reviewed and opensource) is absolutely a not secure product because of whatever reason (badly written, not usable causing user not to use it and use cleartext calls, politically compromised, etc, etc).
I think i will prepare a broader criteria for voice crypto technologies and voice crypto products, so it would be much easier and much practical to have a full transparent set of criterias to evaluate it.
But those are really the basis of security to be matched for a good voice encryption system!
Read some useful past slides on security protocols used in voice encryption systems (2nd part).
Now read below some more practical doubt about their research.
The security concept of the review is misleading: any hacked device can be always intercepted!
I think that the guys completely missed the point: ANY KIND OF SOFTWARE RUNNING ON A COMPROMISED OPERATING SYSTEM CAN BE INTERCEPTED
Now they are pointing out that also Zfone from Philip Zimmermann is broken (a pc software), just because they install a trojan on a PC like in a mobile phone?
Any security software rely on the fact that the underlying operating system is somehow trusted and preserve the integrity of the environment where the software run.
- If you have a disk encryption system but your PC if infected by a trojan, the computer is already compromised.
- If you have a voice encryption system but your PC is infected by a trojan, the computer is already compromised.
- If you have a voice encryption system but your mobile phone is infected by a trojan, the mobile phone is already compromised.
No matter which software you are running, in such case the security of your operating environment is compromised and in one way or another way all the information integrity and confidentiality is compromised.
Like i explained above how to intercept PhoneCrypt.
The only things that can protect you from this threat is running in a closed operating system with Trust Computing capability, implementing it properly.
For sure on any “Open” operating system such us Windows, Windows Mobile, Linux, iPhone or Android there's no chance to really protect a software.
On difficult operating system such as Symbian OS or RimOS maybe the running software can be protected (at least partially)
That's the reason for which the security concept that guys are leveraging to carry on their marketing campaign has no clue.
It's just because they control the environment, they know Flexispy software and so they adjusted their software not to be interceptable when Flexispy is installed.
If you develop a trojan with the other techniques i described above you will 100% intercept PhoneCrypt.
On that subject also Dustin Tamme l, Security researcher of BreakPoint Systems , pointed on on VoIP Security Alliance mailing lists that the security analysis is based on wrong concepts .
The PhoneCrypt can be intercepted: it's just that they don't wanted to tell you!
PhoneCrypt can be intercepted with “on device spyware”.
为什么呢？
Because Windows Mobile is an unsecure operating environment and PhoneCrypt runs on Windows Mobile.
Windows Mobile does not use Trusted Computing and so any software can do anything.
The platform choice for a secure telephony system is important.
How?
I quickly discussed with some knowledgeable windows mobile hackers about 2 different way to intercept PhoneCrypt with an on-device spyware (given the unsecure Windows Mobile Platform).
a) Inject a malicious DLL into the software and intercept from within the Phonecrypt itself.
In Windows Mobile any software can be subject to DLL code injection.
What an attacker can do is to inject into the PhoneCrypt software (or any software running on the phone), hooking the Audio related functions acting as a “function proxy” between the PhoneCrypt and the real API to record/play audio.
It's a matter of “hooking” only 2 functions, the one that record and the one that play audio.
That's simple, any programmer will tell you to do so.
They simply decided that's better not to make any notice about this.
b) Create a new audio driver that simply act as a proxy to the real one and intercept PhoneCrypt
In Windows Mobile you can create new Audio Drivers and new Audio Filters.
What an attacker can do is to load a new audio driver that does not do anything else than passing the real audio driver function TO/FROM the realone. In the meantime intercept everything recorded and everything played :-)
They simply decided that's better not to make any notice to that way of intercepting phone call on PhoneCrypt .
这些都是仅有2快速的想法，更可能可以做。
听起来很像一个营销活动 - 不是一个安全的研究。
我要告诉你。 我非常仔细地分析问题，在大多数方面。 这一切的东西话音加密analisys的声音对我来说像一个营销竞选的Securstar公司联系到出售有PhoneCrypt的赢得口碑。 来吸引媒体说，以间接的方式，欺骗媒体，有PhoneCrypt是唯一一个安全良好的阐述和充分的准备运动。 看到新闻稿Securstar公司的“安全研究员告诉，有PhoneCrypt是唯一的安全产品”的Notrax 。 Securstar公司有PhoneCrypt的匿名黑客的“Notrax”认为是安全的“软件解决方案”是唯一的产品。
在同行业竞争的唯一的“软件版本”：
- SnapCell -没有人可以买它。 保安公司甚至没有过了一个网页。 该公司几乎不存在了。 这听起来很奇怪，只有那些其他的产品被认为是安全的以及有PhoneCrypt。
...让我们看看什么样的多媒体内容在黄金锁 Cellcrypt和有PhoneCrypt的的不同的评论，以了解多少按下有PhoneCrypt审查最有吸引力的营销人员：
| 应用 | 应用截图 | 与示范截取视频 | 网络演示 |
| 有PhoneCrypt | 5 | 0 | 1 | |
| CellCrypt | 0 | 2 | 0 |
| GoldLock | 1 | 2 | 0 |
很明显，有PhoneCrypt明确显示更多的功能和主要的安全功能比其他产品说明审查。
它们之间的差别太大，我们应该怀疑它是一种营销技巧？
但其他奇怪的事情再次有人做过分析的方式...
如果这是“公正和中立的评论”我们应该看到所有产品的好和坏的东西？
好吧，请参阅下面的表格在每个段落黄金锁，CellCrypt和有PhoneCrypt的的不同的评论表示认为（是唯一可用的），看是否是正面或负面的。
| 应用 | 段数 | 正段落 | 负段落 | 中性段落 |
| 有PhoneCrypt | 9 | 9 | 0 | 0 |
| CellCrypt | 12 | 0 | 10 | 2 |
| GoldLock | 9 | 0 | 8 | 1 |
Detailed paragraphs opinion analysis of Phonecrypt | Paragraph of review | Opinion expressed |
| From their website | Positive Marketing feedback |
| 苹果iPhone | Positive Marketing feedback |
| Disk Encryption or voice Encryption | Positive Marketing feedback |
| PBX Compatibility? Really | Positive Marketing feedback |
| Cracking <10. 不是的。 | Positive Marketing feedback |
| 良好的思维！ | Positive Marketing feedback |
| A little network action | Positive Marketing feedback |
| UI | Positive Marketing feedback |
| Good Taste | Positive Marketing feedback |
| Paragraph of review | Opinion expressed |
| From their website | Negative Marketing feedback |
| Licensed by The israeli Ministry of Denfese | Negative Marketing feedback |
| Real Company or Part Time hobby | Negative Marketing feedback |
| 16.000 bit authentication | Negative Marketing feedback |
| DH 256 | Negative Marketing feedback |
| Downad & Installation! | Neutral Marketing feedback |
| Cracking it <10 | Negative Marketing feedback |
| Marketing BS101 | Negative Marketing feedback |
| Cool video stuff | Negative Marketing feedback |
Detailed paragraphs opinion analysis of
CellCrypt | Paragraph of review | Opinion expressed |
| From their website | Neutral Marketing feedback |
| A little background about cellcrypt | Negative Marketing feedback |
| Master of Marketing | Negative Marketing feedback |
| Secure Voice calling | Negative Marketing feedback |
| Who's buying their wares | Negative Marketing feedback |
| Downad & Installation! | Neutral Marketing feedback |
| My Demo environment | Negative Marketing feedback |
| Did they forget some code | Negative Marketing feedback |
| Cracking it <5 | Negative Marketing feedback |
| Room Monitoring w/ FlexiSpy | Negative Marketing feedback |
| Cellcrypt unique features.. | Negative Marketing feedback |
| Plain old interception | Negative Marketing feedback |
| The Haters out there | Negative Marketing feedback |
Now it's clear that from their point of view on PhoneCrypt there is no single bad point while the other are always described in a negative way.
No single good point. Strange?
All those considerations along with the next ones really let me think that's very probably a marketing review and not an independent review.
Other similar marketing attempt from SecurStar
SecurStar GmbH is known to have used in past marketing activity leveraging this kind of “technical speculations”, abusing of partial information and fake unconfirmed hacking stuff to make marketing/media coverage.
Imho a rare mix of unfairness in leveraging the difficult for people to really understand the complexity of security and cryptography.
They already used in past Marketing activities like the one about creating a trojan for Windows Mobile and saying that their software is secure from the trojan that they wrote.
Read about their marketing tricks of 2007
They developed a Trojan (RexSpy) for Windows Mobile, made a demonstration capability of the trojan and later on told that they included “Anti-Trojan” capability to their PhoneCrypt software.They never released informations on that trojan, not even proved that it exists.
The researcher Collin Mulliner told at that time that it sounds like a marketing tips (also because he was not able to get from SecurStar CEO Hafner any information about that trojan):
“This makes you wonder if this is just a marketing thing.”
Now, let's try to make some logical reassignment.
It's part of the way they do marketing, an very unfriendly and unpolite approach with customers, journalist and users trying to provide wrong security concepts for a market advantage. Being sure that who read don't have all the skills to do in depth security evaluation and find the truth behind their marketing trips.
Who is the hacker notrax?
It sounds like a camouflage of a fake identity required to have an “independent hacker” that make an “independent review” that is more strong on reputation building.
Read about his bio:
¾ Human, ¼ Android (Well that would be cool at least.) I am just an enthusiast of pretty much anything that talks binary and if it has a RS232 port even better. During the day I masquerade as an engineer working on some pretty cool projects at times, but mostly I do the fun stuff at night. I have been thinking of starting an official blog for about 4.5 years to share some of the things I come across, can't figure out, or just cross my mind. Due to my day job and my nighttime meddling, I will update this when I can. I hope some find it useful, if you don't, well you don't.
There are no information about this guy on google.
Almost any hacker that get public have articles online, post in mailing archive and/or forum or some result of their activity.
For notrax, nothing is available.
此外，让我们来看看在域...
域infosecurityguard.com隐私保护domainsbyproxy的防止理解的所有者是谁。
域已创建2个月前的12月01日09 godaddy.com过户登记。
什么也很有趣的发现，这个“未知的黑客没有一丝他对谷歌于2009年12月出现净Securstar公司联系新闻稿 “被称为“IT安全专家”。
也许他们“认识的人”谁是这个匿名notrax的吗？ :)
我按照我自己的阴谋思维或者有一些合理的怀疑，一切都只是一个营销活动，有趣的方式安排？
社会代价
如果你是一个安全公司，你工作也有社会方面的，你也应该努力使世界变得更美好的地方（务必使业务，但“不被邪恶”）。 你不能欺骗最终用户的技能，在评估安全制假误导性的信息。
你应该这样做对最终用户的意识，使他们更加意识到安全问题，给他们的工具来了解，并自行决定。
希望你有乐趣，看完这篇文章，你做你自己的思考。
：法比奥Pietrosanti（纳伊夫）
PS这些都是我个人的专业意见，让我们来谈谈技术和安全性，而不是营销。
PPS我不是智能网络写作，太对不起如何格式化文本以及如何流动的文章是非结构化的！
