uncompiled.com

German encryption firm SecurStar has strenuously denied being behind an apparently independent test of voice encryption products that found many of its rivals could be hacked using a $100 phone-tapping program.

In a blog on the subject, Fabio Pietrosanti, founder and CTO of Swiss encryption startup Khamsa, alleges that a supposedly independent test of 15 encryption products was in fact a marketing exercise designed to publicise one of only three products to pass the hacking test, SecurStar’s PhoneCrypt.

The tests by an anonymous researcher, ‘Notrax’, found that all but three programs and hardware products looked at could be bypassed by installing a simple wiretapping Trojan called FlexiSPY to record voice output without the programs giving the user any indication that security had been compromised.

Khamsa’s own GSM security software was not part of the test but the encryption technology it uses, ZRTP, came in for criticism. The moving force behind that system and its implementation in a program called Zfone is encryption pioneer and inventor of Pretty Good Privacy, Phil Zimmermann, who is also listed as being on Khamsa’s scientific board.

According to Pietrosanti, the unnamed ‘Notrax’ was subsequently traced to an IP address connected to SecurStar after the individual followed a link embedded in a blog Pietrosanti had posted.

“The SecurStar GmbH PBX is open on the internet, it contains all the names of their employee and confirm us that the author of http:/infosecurityguard.com [the domain used to post the original test] is that company and is the anonymous hacker called Notrax,” says Pietrosanti.

He adds that SecuStar also appeared to be logging Google keywords related to the topic so as to have some idea of how the tests were being discussed.

When contacted, SecurStar denied any involvement with the tests. “We do not have anything to do with these tests and I have no idea about him [Notrax],” said SecurStar CEO, Wilfried Hafner in a call to Techworld.

According to Hafner, that Notrax used a SecurStar IP address was because the individual concerned had probably used the company’s anonymity service that hides real IPs behind his company’s.

“We have two million people using this product. Or he may have been an old customer of ours,” said Hafner.

As far as they go, the tests do appear to find a legitimate weakness in the programs under test even if a connection to one of the companies involved would represent a huge conflict of interest and discredit them in the eyes of the security community. Pietrosanti is certainly correct to say that researchers are normally keen to be identified with their testing, something ‘Notrax’ has avoided doing so far.

Source

There are several flaws in the way that the iPhone handles digital certificates which could lead to an attacker being able to create his own trusted certificate and entice users into downloading malicious files onto their iPhones. The attack is the end result of a number of different problems with the way that the iPhone handles over-the-air provisioning, trusted root certificates and configuration files. But the result of the attack is that a remote hacker may be able to change some settings on the iPhone and force all of the user’s Web traffic to run through any server he chose and also to change the root certificate on the phone, enabling him to man-in-the-middle SSL traffic from the iPhone.

The chain of vulnerabilities and the attack was outlined in an anonymous blog post on the iPhone flaws on Friday. Charlie Miller, an Apple security researcher at Independent Security Evaluators, said that the attack works, although it would not lead to remote code execution on the iPhone.

“It definitely works. I downloaded the file and ran it and it worked,” Miller said. “The only thing is that it warns you that the file will change your phone, but it also says that the certificate is from Apple and it’s been verified.”

The problems start with the fact that the iPhone signs its own credentials using a certificate signed by Apple when it is requesting a configuration file from a remote server during the provisioning process. The only way to establish the validity of the Apple certificate is to verify each of the certificates that leads to the Apple root certificate authority, and that can only be done by getting the data from a jailbroken iPhone.

Source

A survey reveals that in the last year, 4500 memory sticks have been forgotten in people’s pockets as they take their clothes to be washed at the local dry cleaners. From 6th April onwards if data is lost and it causes a major security breach, this could now cost a company up to £500,000 with new powers given to the Information Commissioner’s office (ICO) to fine companies who have not sufficiently protected customers details under the Data Protection Act.

However, when compared with the same study twelve months ago, the number of these devices languishing forgotten in people’s pockets has halved, and yet it’s still a staggering number of possible data breaches and a potential money spinner for the ICO.

The survey was carried out in the UK to gauge the frequency and ease with which mobile devices, such as memory sticks, are lost or forgotten in strange places such as dry cleaners and should warn people across the globe to demonstrate prudence when downloading information to carry around with them as it does frequently get lost.

Sean Glynn from Credant Technologies said “This survey is just one illustration of the stark truth that device losses are happening everywhere, everyday, worldwide. Organizations want to leverage the business benefits of mobile computing and provide their employees the flexibility to work wherever and whenever they want to. However, this must be balanced with the requirement of protecting the organizations data, especially to avoid penalties – such as that promised by the ICO, brand damage or even embarrassing press headlines. If sensitive or valuable data is being carried then people should protect it with encryption to prevent unauthorized access at any point – as it could easily end up in the wrong hands.”

Source

Cryptographers have moved closer to their goal of eavesdropping on cellphone conversations after cracking the secret code used to prevent the interception of radio signals as they travel between handsets and mobile operators’ base stations.

The code is designed to prevent the interception of phone calls by forcing mobile phones and base stations to rapidly change radio frequencies over a spectrum of 80 channels. Without knowing the precise sequence, would-be eavesdroppers can assemble only tiny fragments of a conversation.

At a hacker conference in Berlin that runs through Wednesday, the cryptographers said they’ve cracked the algorithm that determines the random channel hopping and have devised a practical means to capture entire calls using equipment that costs about $4,000. At the heart of the crack is open-source software for computer-controlled radios that makes the frequency changes at precisely the same time, and in the same order, that the cellphone and base station do.

“We now know this is possible,” said Karsten Nohl, a 28-year-old cryptographer and one of the members of an open-source project out to prove that GSM, the technical standard used by about 80 percent of the mobile market, can’t be counted on to keep calls private. The attack “is practical, and there are real vulnerabilities that people are exploiting.”

A spokeswoman for the GSM Association, which represents 800 operators in 219 countries, said officials hadn’t yet seen the research.

“GSM networks use encryption technology to make it difficult for criminals to intercept and eavesdrop on calls,” she wrote in an email. “Reports of an imminent GSM eavesdropping capability are common.”

Source

The formidable combination of Matt Galligan (Founder, Socialthing!) and Joe Stump (Former Lead-Architect, Digg) came out on-top yesterday at ‘Under the Radar‘. The duo’s new company SimpleGeo won both the judges & audience awards for the location category at the event. ‘Under the Radar’ helps to give up-and-coming technology innovators a stage to show what they’ve been up to.

TechCrunch gave their insight on the company’s offerings:

SimpleGeo is akin to an ‘Amazon Web Services’ for location: developers looking to integrate location based services (LBS) can plug into some simple APIs and SimpleGeo will do most of the legwork for them. The startup originated as a gaming company, but after spending four months building out their location platform, Stump and Galligan realized they had stumbled across an opportunity: location is soon going to become an expected feature in many applications, and there’s no reason developers should have to reinvent the wheel every time they want to include the feature. SimpleGeo is looking to do it for them.

The team of Galligan and Stump stands to bring a level playing-field to many smaller developers. By utilizing their infrastructure, SDK, and services, developers who were previously too intimidated to get into location-based development now have an opportunity to see their ideas through.

Source

Hackers can steal data off jailbroken iPhones by leveraging the same vulnerability that currently is being used to spread a mischievous worm.

The new exploit, spotted by researchers at Intego, a Mac security firm, allows attackers to siphon data off victim devices, including music, text messages, email, contacts and other personal information.

Peter James, an Intego spokesman, told SCMagazineUS.com on Wednesday that public attack code is circulating across various internet forums, but researchers are unsure if there have been any in-the-wild exploits.

An Apple spokesperson did not respond to a request for comment.

Source

Sophos reports that some Apple iPhone owners in Australia have seen their smartphones get infected by a worm that has changed their wallpaper to an image of 1980s pop musician Rick Astley.

The worm, which could have spread to other countries, is capable of breaking into jailbroken iPhones if their owners have not changed the default password after installing SSH. Once in place, the worm appears to attempt to find other iPhones on the mobile phone network that are similarly vulnerable, and installs itself again.

On each installation, the worm – written by a hacker calling themselves “ikee” – changes the lock background wallpaper to an image of Rick Astley with the message:

ikee is never going to give you up

Graham Cluley comments on his popular blog at Sophos:

What’s clear is that if you have jailbroken your iPhone or iPod Touch, and installed SSH, then you must always change your root user password to something different than the default, “alpine”. In fact, it would be a good idea if you didn’t use a dictionary word at all. The worm will not affect users who have not jailbroken their iPhones or who have not installed SSH.

Source