Feeds

Many voice encryption systems easily crackable

Malware will shut your yap

Top 5 reasons to deploy VMware with Tegile

Updated A vast majority of voice encryption products are seriously flawed, according to controversial tests by an anonymous hacker.

Using the commercially available FlexiSpy wiretapping utility and a 'homemade' Trojan, Notrax (the anonymous hacker's nickname) claims to have defeated 11 out of 15 voice encryption technologies in tests. Notrax claims he was able to use malware trickery to bypass product encryption and eavesdrop on captured conversations in real time.

By suppressing any rings, notifications or call logs, these approaches illustrated by Notrax could potentially escape detection. Delivery of the Trojans could be accomplished by tricking a prospective victim into opening a booby-trapped message to their mobile or by manual installation.

However, GSMK Cryptophones, one vendor whose product security was called into question by the tests argues the hack could only be accomplished by artificially reducing the security of its product (see statement below). GSMK Cryptophones' objections raise wider questions about the fairness of the whole exercise.

Notrax published his conclusions at infosecurityguard.com here, before starting the ongoing publication of details for each of his 15 tests, some of which he has illustrated via videos posted on YouTube.

The only products to come unscathed through the tests were Rohde & Schwarz's Bluephone-Secure, SnapCell and PhoneCrypt. The jury is still out on Tripleton but the other 11 products tested, costing hundreds to thousands of dollars, all failed to thwart an attack based on FlexiSpy (which costs $100) and a custom Trojan.

A summary of Notrax's tests can be found here. Products that Notrax alleged cracked include CellCrypt and Phil Zimmerman's Zfone.

Of the three products that achieved a passing grade, only PhoneCrypt is software-based.

Hacker turned security reporter Steve Gold notes Notrax's approach is similar to the use of so-called `infinity' bugs on landline phones. Gold, writing for Infosecurity Magazine also reports that law enforcement, in particular the German government, have been interested in the use of Trojans to intercept voice communications, although that approach focused on eavesdropping on encrypted VoIP via the host PC.

Notrax's hacks, by contrast, also cover handsets but some of the same principles apply. Dan Kaminsky, noted security researcher of DNS cache poisoning fame, told El Reg: "Code execution is code execution. This ought not be surprising."

Wilfried Hafner, chief exec of SecurStar, the developers of PhoneCrypt, commented: "Like most security breaches, Notrax went for the weakest link; he did not attempt to crack the encryption itself, but used simple wiretapping techniques."

PhoneCrypt said its use of a monitor to detect if any application tries to access a resource or service during a phone call before shutting it down and providing a warning to users helped it defeat Notrax's hack. ®

Updated

GSMK Cryptophones, one of the products those security was called into question by the tests, argues that the hack relied on deliberately reducing the security settings on a device, a complex process. The firm is frustrated that it has not been able to contact Notrax directly in order to challenge the validity of his tests.

The default level of ‘high security’ on all GSMK Cryptophones would prevent the attack from taking place. The only way for this attack to occur, or indeed for any third party software to be installed on the phone, would be to lower the security settings on the device, in itself an involving task which demands the user undergo several processes.

The company conducts ongoing rigorous testing to ensure users are protected against the latest technologies designed to intercept encrypted products and has always been transparent in publishing details of its encryption capabilities.

It has not been possible to address the claims directly as the testing has been conducted by an anonymous source and the site does not detail any contact information.

The timing of the test occurs in the run-up to the Mobile World Congress in Barcelona next month, the mobile industry's biggest showcase. Suggestions of security problems involving voice encryption products therefore comes at the worst possible time for the vendors involved.

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.