80% of Cell Phone Encryption Solutions Insecure

An anonymous reader writes "Mobile Magazine writes about a blogger named Notrax who has tested 15 methods of secure encryption for mobile phones; out of those he found only 3 could not be cracked at some level. '12 of them were "worthless." It's easy to take the software at face value when it "tells you" that the call is secured. But how does someone actually go about being sure that it is secured? Notrax did some digging and discovered he could break in to almost all of them in under 30 minutes.'" (Above link is to a slightly older description of Notrax's approach; then, it was 9 out of 10 products that were worthless, instead of 12 out of 15.)

Comments

Nothing to see here, move along

[johndoe42]

News flash: if someone installs a trojan on your phone, then encrypting your call is insecure.

No sh*t. Don't let people install trojans on your phone.

Misleading article

[badboy_tw2002]

This guy didn't break any encryption. He admitted up front he couldn't, except for some vague handwavy stuff about distributed brute force key attacks. Instead, he installed a trojan on the phone that records the phone conversation. He didn't even write the trojan. The awesome software he couldn't crack (the "20%") were "secure" because it was either different hardware his cool program didn't work for, or some older gear the program didn't run on. Phew! I'll make sure to buy those now that I know they're air tight.

Came for a cool story about breaking over the air phone encryption but all I got was a script kiddie installing software and making grand pronouncements to get pageviews.

Re:Misleading article

[PybusJ]

In my opinion this whole this is a marketing scam for one of the products mentioned. The things that make me suspicious:

- "Blogger, hacker and IT security expert Notrax" 's infosecurityguard blog was started in Dec 2009, just before he started his ambitious series of security reviews.

- There are no details of who he is "for his own safety"

- He calls the systems he's failed to break "secure" and highlights them in reassuring green to attract you attention (only admitting in the small print that he means he hasn't broken them yet). This is not the kind of language security researchers use.

- Most of the the products are "details to be published", including respected software such as Zphone/ZRTP. Just one shines out as both "secure" and "review available". That miracle product is PhoneCrypt. Oooh, I must click on that review now -- oh look at that glowing prose.

"SecurStar is the company behind PhoneCrypt." Now I wonder what relation our mysterious, benevolent friend Notrax has to SecurStar.

To me all the smells lead to a fake marketing blog. Nice story /.

Re:Backdoors != news

[sexconker]

Corollary: any encryption technology that you need to rely on should be open source and well-understood. The hardware you use it on should be completely open and you should understand how things work on that hardware. Even better if you have compiled that code yourself.

Oh fuck off.
I suppose you wrote the compiler too?
I suppose to used an electron microscope and scanned every fucking bit of your CPU and memory and such?

If you want to be fucking paranoid, be paranoid all the way.
Don't use paranoia FUD to push your FOSS agenda.

While it's true that there's shit they can do, it's also true that there's NOTHING you can do about it. FOSS cloak or not.

Re:Backdoors != news

[s4ltyd0g]

They wont waste time hacking your phone. They have a legal intercept box in the server room. No need for back doors on the phone.

They can't know!

[nate nice]

If anyone knows what I'm putting on my pizza, I'm FUCKED.

Re:I Don't Trust Wireless In General

[BitZtream]

Okay, you're paranoid. And delusional.

The most important fact is that no one actually gives a shit about your phone calls so even if they could listen to every word any time they wanted to, it still wouldn't matter. The sooner you realize you aren't that special, the sooner your paranoia will go away.