Voice crypto fails spark astroturf claims
SecurStar denies running dirty tricks marketing campaign
Doubts have arisen about the integrity of supposedly anonymous tests on the security of voice encryption products.
As previously reported, an "anonymous hacker" called Notrax claims to have defeated 11 out of 15 phone scrambling technologies using the commercially available FlexiSpy wiretapping utility and a 'homemade' Trojan. Notrax published findings from his ongoing work on a blog at infosecurityguard.com.
Other security watchers were suspicious of what the tests actually proved and whether they were actually a marketing exercise disguised as a security review. News of the tests was publicised last week via a press release issued by SecurStar, the developers of PhoneCrypt, one of only three products and the only software technology to come out clean from the tests.
The previously unknown infosecurityguard.com used by Notrax is anonymously registered. Security blogger Fabio Pietrosanti (naif) turned Veronica Mars by baiting a blog post on infosecurityguard.com back to a post on his blog at infosecurity.ch.
This meant that when the blog post on infosecurityguard.com was approved the IP address of a machine making the approval was recorded in infosecurity.ch logs. Sure enough this happened, allowing the IP address of the infosecurityguard.com blog to be traced back to SecurStar.
"This is evidence that the security review made by an anonymous hacker on infosecurityguard.com is in facts a dishonest marketing plan by the SecurStar GmbH to promote their voice crypto product," Pietrosanti writes in a post containing screenshots and evidence to support his conclusion.
Pietrosanti added in an email to El Reg: "I don't remember in all my life a so irresponsible and dirty marketing trick in the security world, abusing of hackers reputations."
Asked to comment on this evidence, SecurStar chief exec Wilfried Hafner denied any contact with Notrax. Notrax, he said, must have been using his firm's anonymous browsing service, SurfSolo, to produce the results reported by Pietrosanti.
Hafner firmly denied suggestions SecureStar had commissioned the research. "If we had done this research we would have published the results ourselves and taken the credit," Hafner told El Reg. "We don't know of Notrax, although it's possible he might have been a tester we gave products to in order to test."
Notrax's work had only publicised a well-known problem, according to Hafner, the susceptibility of phone encryption technology to viruses (malware). "The difference is he taped the tests and posted a YouTube video," Hafner said.
Hafner argued more attention ought to be focused on the results of the tests rather than who is behind them. He criticised Pietrosanti for trying to discredit the results of the tests but acknowledged that other criticism of the test methodology being less than objective may have some validity.
He denied running an astroturfing campaign. "The results were quite favourable. I think that many firms when they see such research would jump on the horse and use it for marketing."
SecurStar's decision to use Notrax's research for publicity purposes just days away from the Mobile World Congress has sparked a scrap that has turned personal. Pietrosanti's blog post points out that Hafner was jailed for three years for phone phreaking offences in Germany back in 1994.
Hafner acknowledged this but said this happened well before he co-founded SecurStar in 2001. "I broke into satellites. It was wrong but it was a long time ago and gave me a solid understanding of security. People are mashing [throwing] dirt to make me and SecurStar look bad, as if we had done something wrong."
Pietrosanti works for a Swiss firm called Khamsa who make phone encryption software called PrivateGSM and have crypto luminary Phil Zimmermann on the board. Zimmerman's Zfone software was one of the 11 products that failed the test. "This is why he [Pietrosanti] is trying to discredit the tests," Hafner alleged. ®
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
COMMENTS
"Voice crypto fails spark astroturf claims"
What on earth does that title mean? What is a spark astroturf claim, and how can one fail it?
privacy.li
Well if you quote Privacy.li then i am really sorry to tell you but that is to say it nicely a bunch of sammers and criminals and if you make a short search on the internet you will find stories about their practices all over the place.....
just the first two that cam up on google:
http://www.wirelessforums.org/comp-security-misc/beware-scamster-site-privacy-li-19874.html
and
http://www.homelandstupidity.us/2005/07/09/privacyli-not-to-be-trusted/
As about of SecurStar i dont particularly care if they hired somebody to do the hack, they did it themselfs or they dont have anything to do with it... What i am concerned is that so many security vendors did not do protect their products agains such an easy attack.
In defence...
I'll make no bones about this. I work for SecurStar's British subsidiary developer, I own a very small shareholding but my opinions expressed here are MY own not SecurStars.
At the end of the day were the flaws exposed REAL ?
http://news.techworld.com/security/3211618/accusations-fly-over-voice-encyption-hack/
"
As far as they go, the tests do appear to find a legitimate weakness in the programs under test even if a connection to one of the companies involved would represent a huge conflict of interest and discredit them in the eyes of the security community. Pietrosanti is certainly correct to say that researchers are normally keen to be identified with their testing, something ‘Notrax' has avoided doing so far.
"
I do not currently know if anyone within SecurStar did this or not We are in the UK and quite "divorced" from other German parent company activities such as PhoneCrypt which we have had no involvment in whatsoever..
No doubt I will get to know. Having said that, if a flaw has been exposed in a competitors software, then surely it will now get fixed ? It WILL get fixed won't it ? Would it have got fixed before ?
I do know that Wilfried Hafner is passionate about security, and IS a gifted hacker. After nine years working for this company, (nine wonderful and happy years I might add) I never cease to be amazed when he refutes some of my own ideas, regarding things we should do with the software we develop, or the bugs he has found in the past. If he indeed did find the Phone encryption security problem and he went public with it, under the company banner what would people think then ? Would it be worse still ? Should he have just kept completely quiet ? It is certainly not his voice in the Notrax video (which I have now seen) that's for sure.
What really needs to happen FIRST of all, is that the companies concerned need to review the assertions made, and if necessary address the flaws in the software, however they've been identified.
In any case. personally if there was a serious issue with our software, then I would *expect* competitors to try and make some milage from it. At the end of the day, isn't that what business is all about ? It's one of the reasons I am not a business man and never could be I am simply not 'hard nosed' enough.
In the longer term, I am sure their products will be fixed, and that can ONLY be to the advantage of their customers however the flaws were revealed. The authors of the software concerned should make it a priority to fix the problems instead of bleating on how horrible the company is. If indeed the company is at all responsible.
Perhaps Wilfried did try and make some milage out of these flaws I honestly do not know. He is a good hacker and has often found issues of this kind. BUT he is, at the end of the day, a business man as well.
--
Now, ask me about my iPhones, (3g and 3Gs) my 09 reg Ford C-Max car with Sony CD/Radio and USB connection, and how neither iphone works anymore with the car's USB port.. On the older iphone I could play the tracks back via the console, until OS 3 was installed. The thing won't even recognise the 3Gs phone at all.
Ask me who, of the four companies concerned (including the garage) really even cares about my problem, instead of just playing pass the parcel instead of helping me get it sorted. That's bad and horrible practice as well, but we consumers simply have to put up with it.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM Implementer’s Checklist
Steps to Take Before Choosing a Business Continuity Partner
