Many voice encryption systems easily crackable

Malware will shut your yap


Updated A vast majority of voice encryption products are seriously flawed, according to controversial tests by an anonymous hacker.

Using the commercially available FlexiSpy wiretapping utility and a 'homemade' Trojan, Notrax (the anonymous hacker's nickname) claims to have defeated 11 out of 15 voice encryption technologies in tests. Notrax claims he was able to use malware trickery to bypass product encryption and eavesdrop on captured conversations in real time.

By suppressing any rings, notifications or call logs, these approaches illustrated by Notrax could potentially escape detection. Delivery of the Trojans could be accomplished by tricking a prospective victim into opening a booby-trapped message to their mobile or by manual installation.

However, GSMK Cryptophones, one vendor whose product security was called into question by the tests argues the hack could only be accomplished by artificially reducing the security of its product (see statement below). GSMK Cryptophones' objections raise wider questions about the fairness of the whole exercise.

Notrax published his conclusions at infosecurityguard.com here, before starting the ongoing publication of details for each of his 15 tests, some of which he has illustrated via videos posted on YouTube.

The only products to come unscathed through the tests were Rohde & Schwarz's Bluephone-Secure, SnapCell and PhoneCrypt. The jury is still out on Tripleton but the other 11 products tested, costing hundreds to thousands of dollars, all failed to thwart an attack based on FlexiSpy (which costs $100) and a custom Trojan.

A summary of Notrax's tests can be found here. Products that Notrax alleged cracked include CellCrypt and Phil Zimmerman's Zfone.

Of the three products that achieved a passing grade, only PhoneCrypt is software-based.

Hacker turned security reporter Steve Gold notes Notrax's approach is similar to the use of so-called `infinity' bugs on landline phones. Gold, writing for Infosecurity Magazine also reports that law enforcement, in particular the German government, have been interested in the use of Trojans to intercept voice communications, although that approach focused on eavesdropping on encrypted VoIP via the host PC.

Notrax's hacks, by contrast, also cover handsets but some of the same principles apply. Dan Kaminsky, noted security researcher of DNS cache poisoning fame, told El Reg: "Code execution is code execution. This ought not be surprising."

Wilfried Hafner, chief exec of SecurStar, the developers of PhoneCrypt, commented: "Like most security breaches, Notrax went for the weakest link; he did not attempt to crack the encryption itself, but used simple wiretapping techniques."

PhoneCrypt said its use of a monitor to detect if any application tries to access a resource or service during a phone call before shutting it down and providing a warning to users helped it defeat Notrax's hack. ®

Updated

GSMK Cryptophones, one of the products those security was called into question by the tests, argues that the hack relied on deliberately reducing the security settings on a device, a complex process. The firm is frustrated that it has not been able to contact Notrax directly in order to challenge the validity of his tests.

The default level of ‘high security’ on all GSMK Cryptophones would prevent the attack from taking place. The only way for this attack to occur, or indeed for any third party software to be installed on the phone, would be to lower the security settings on the device, in itself an involving task which demands the user undergo several processes.

The company conducts ongoing rigorous testing to ensure users are protected against the latest technologies designed to intercept encrypted products and has always been transparent in publishing details of its encryption capabilities.

It has not been possible to address the claims directly as the testing has been conducted by an anonymous source and the site does not detail any contact information.

The timing of the test occurs in the run-up to the Mobile World Congress in Barcelona next month, the mobile industry's biggest showcase. Suggestions of security problems involving voice encryption products therefore comes at the worst possible time for the vendors involved.


Other stories you might like

  • Despite global uncertainty, $500m hit doesn't rattle Nvidia execs
    CEO acknowledges impact of war, pandemic but says fundamentals ‘are really good’

    Nvidia is expecting a $500 million hit to its global datacenter and consumer business in the second quarter due to COVID lockdowns in China and Russia's invasion of Ukraine. Despite those and other macroeconomic concerns, executives are still optimistic about future prospects.

    "The full impact and duration of the war in Ukraine and COVID lockdowns in China is difficult to predict. However, the impact of our technology and our market opportunities remain unchanged," said Jensen Huang, Nvidia's CEO and co-founder, during the company's first-quarter earnings call.

    Those two statements might sound a little contradictory, including to some investors, particularly following the stock selloff yesterday after concerns over Russia and China prompted Nvidia to issue lower-than-expected guidance for second-quarter revenue.

    Continue reading
  • Another AI supercomputer from HPE: Champollion lands in France
    That's the second in a week following similar system in Munich also aimed at researchers

    HPE is lifting the lid on a new AI supercomputer – the second this week – aimed at building and training larger machine learning models to underpin research.

    Based at HPE's Center of Excellence in Grenoble, France, the new supercomputer is to be named Champollion after the French scholar who made advances in deciphering Egyptian hieroglyphs in the 19th century. It was built in partnership with Nvidia using AMD-based Apollo computer nodes fitted with Nvidia's A100 GPUs.

    Champollion brings together HPC and purpose-built AI technologies to train machine learning models at scale and unlock results faster, HPE said. HPE already provides HPC and AI resources from its Grenoble facilities for customers, and the broader research community to access, and said it plans to provide access to Champollion for scientists and engineers globally to accelerate testing of their AI models and research.

    Continue reading
  • Workday nearly doubles losses as waves of deals pushed back
    Figures disappoint analysts as SaaSy HR and finance application vendor navigates economic uncertainty

    HR and finance application vendor Workday's CEO, Aneel Bhusri, confirmed deal wins expected for the three-month period ending April 30 were being pushed back until later in 2022.

    The SaaS company boss was speaking as Workday recorded an operating loss of $72.8 million in its first quarter [PDF] of fiscal '23, nearly double the $38.3 million loss recorded for the same period a year earlier. Workday also saw revenue increase to $1.43 billion in the period, up 22 percent year-on-year.

    However, the company increased its revenue guidance for the full financial year. It said revenues would be between $5.537 billion and $5.557 billion, an increase of 22 percent on earlier estimates.

    Continue reading

Biting the hand that feeds IT © 1998–2022