Secfone beyond encrypted mobile communication - Key protection

A recent blog post on the impacts of Snowden's leaded documents on encryption softwares skyrocketed on this blog. Thanks folks!

However several questions came up concerning Secfone's solution let me answer them here. I try not to be too technical, so it will be understandable for non-infosec users too.

How Secfone protects encryption keys?

One of the fundamental issues in communication encryption is how the solution protects the encryption keys. If the keys are compromised, than the communication can easily be tapped. Encryption softwares can use only the device's (smartphone) store and CPU to store, generate, manage and use encryption keys. However these hardware elements are not designed to protect anything. This is one of the biggest weak-point of all encryption software.

Secfone uses TPM technology (Trusted Platform Module), a cryptochip integrated into a micro SD card (the card goes into the micro SD slot of the smartphone). This hardware piece is designed to generate, store, manage, use and PROTECT encryption keys. The cryptochip is designed to be very sensitive on purpose. That means the information can't be retrieved from the chip (it is not readable by design). If you try to hack the cryptochip - with an oscilloscope, or put it under an electro-microscope, try to freeze and remove it - it damages the chip and all the information it stores is lost immediately. This is the only proven technology today that can protect encryption keys (More on TPM technology: 5 functions of TPM you did not know about).

Interesting: One of an early version of cryptochips was hacked by Cristopher Tarnovsky in 2010. The hack required very high level of expertise and physical possession of the chip. This hack does not work anymore with the new hardwares.

What about stealing the encryption keys?

Good question. There are some companies that use cryptochip (they call it security card or trustchip, this is the very same thing) and put the keys into the chip at production. The keys are safe inside the cryptochip, it is no question, but can be compromised BEFORE they put it into the chip.

Secfone has its own method. Secfone does not put keys into the cryptochip, but uses cryptochip's functions to generate the keys for itself at production. What does it mean?

1. Keys needed to decrypt the information that arrives to the device NEVER leave the safe storage of cryptochip.
2. Keys can not be stolen from the factory or from a sysadmin.
3. Nobody knows the keys (producer of the cryptocard, Secfone, the customer, nobody)

Interesting: Cryptochip is a military-grade technology under special export regulations. Strict legislation apply to keep information on who possesses the technology. It can not be exported to "sensitive" countries. 

Now the keys are safe. However, there are more layers of security in Secfone, I will write a post about them soon.

Thanks for reading. If you found this blog post interesting, please spread the word.

Snowden killed all iPhone encryptions

If you use encryption software on your iPhone and you paid for it, than you paid for illusion not for security. Thanks to Snowden and security researcher Jacob Appelbaum now the entire World knows the magic word DROPOUTJEEP and the meaning of it.

DROPOUTJEEP is a spyware program developed by NSA that runs on iPhone, and provides access to almost everything. It can intercept SMS messages, can read the contact lists, locate the iPhone based on cell tower data, and the best part is, it can turn on the camera and the microphone, and can listen to any conversation. It can even be deployed remotely.

According to leaked documents NSA claims 100% success rate on iOS devices. It is impossible to reach 100%, unless you have access to a backdoor. Of course Apple denies that it helped NSA to build iPhone's backdoor, but it does not change anything. It does not change the 100% success rate.

How DROPOUTJEEP impact encryption softwares on iPhone?

Now come the bad news. It is well known for the industry experts that purely software-based mobile encryption solutions can not secure any communication. Now things are going bad to worse. No encryption solution can protect your communication on iPhone. Not even hardware based solutions.

Since DROPOUTJEEP can manage the microphone of the iPhone, it listens to the conversation BEFORE any encryption takes place. Your software or hardware solution can even use military-grade 4096 bit encryption keys, it provides zero security if you use it on iPhone. If you use Gold Lock, Silent Circle, Zfone, Crypttalk, Cellcrypt, Kryptos, Secustar or any other encryption software on iPhone and you still need secure mobile communication, consider just deleting your app.

Time to reconsider what you think about encryption software and iPhone security.

Takeaway

The good news is you still can have secure mobile communication. Avoid iPhone and BlackBerry, use open source operating system. Choose cryptochip (hardware) based encrypted mobile communication solution with triple-level protection. Triple level protection keeps any unauthorized process to access your phone's microphone.

If you have found anything new in this blog post, please share it. Thank you :-)

Top 5 mobile security news in 2013

2013 was all about mobile security. NSA scandals were on top of the news since it turned out that European politicians were tapped. Furthermore we had to say goodbye to some illusions concerning mobile communication security. Check the list below for details.

1. Regular cellphones can be tapped for less than 300 USD.
We thought that tapping into a regular GSM cellphone requires sophisticated methods and tools. It turned out that regular GSM calls are in greater danger than we thought.
More on this: http://bit.ly/1cSZhcG

2. Edward Snowden released classified materials
Internet surveillance programs watch users every move. NSA intercepts US and European telephone metadata.
Snowden Wiki: http://bit.ly/1k2Mwjx

3. Chancellor Merkel's mobile phone tapped by NSA
Even political leaders can be tapped. And they are. We thought that they have access to the best encryption technologies to protect their communication. Not so successfully...
More on this: http://bit.ly/1k2KcsQ, http://bit.ly/1irqbuh

4. NSA has nearly complete backdoor access to Apple's iPhone
Experts in mobile security industry knew that Apple's iPhone is not a secure system when it comes to eavesdropping. Now everyone knows that it's a personal bug carried by millions of users.
More on this: http://bit.ly/19CK6hN

5. Military technology protects European companies
Companies started to look for secure mobile communication solution. Secfone made its military technology available for European companies.
More in this: http://bit.ly/1dQwthh

The most important task now is to protect yourself and your sensitive information. Companies and individuals has to make the first steps in 2014. As a first step, choose a really secure mobile communication solution. Which one is safe? Read these and be an expert:
3 characteristics of any eavesdrop proof mobile communication solution 
Cryptohip, security card or trustchip 
5 functions of TPM you did not know about

And a bonus video for those who do not know much about software based encryptions.

Have a secure, eavesdrop free 2014!

3 characteristics of any eavesdrop proof mobile communication solution

Eavesdropping and tapping is a hot topic right now. But how can a company choose a really eavesdrop proof solution?

You can read articles on daily basis on how politicians were tapped by several national agencies. You might think that there is no eavesdrop proof mobile communication solution on the market, because if there were, at least Angela Merkel would buy it. Let's take a close look.

There are 3 requirements of eavesdrop proof encrypted mobile solutions:

1. Purely software-based solutions are not secure

The reason is evident. Computer softwares are codes that reside and run on devices, like laptops, smartphones or tablets. These codes use the general storing and processing capabilities of devices, which are not designed to protect or secure any information. So if you find a software on Google Play or iTunes Store that claims it can protect you communications if you download it, it is simply not true.

Think of softwares that can be downloaded from torrent sites. Those softwares consist of codes. Codes, that construct a purely software based encryption solution too. Sounds safe?

If you have ever encountered a software that can not be copied, that software must have been included some kind of unique hardware protection (USB dongle for example). The unique hardware piece provides the security, because the hardware can not be copied.

2. Using standard encrpytion methods reduces security

If a solution claims that is uses standard encryption that means only one thing: It is a way easier to crack that solution than a solution that use non-standard encryption. Standardization is a big help for a cracker. The more characteristics regulated by the standard, the easier to crack the solution. Not mentioning that agencies specialized in cracking encryptions have hardware designed to crack standardized encryptions.

3. Certificates of agencies indicate backdoor

If you run into a solution that claims it is a certified solution of for example an Israeli agency, that means you can be sure that the agency in question has access to a backdoor in the solution. The reason is simple. There is not a single agency in a world that would encourage the use of a solution that can not be controlled - that is eavesdropped - by that agency. The picture is getting clear as you think it over...

Now comes the final question. Are there solutions on the market meeting these requirements? Of course yes, there are. But most of them are not available for public, only for agencies and governmental institutes.

UPDATE:

The only hardware based encrypted mobile communication solution that provides triple layer protection is Secfone.

Secfone Official Website

Please click +Google or share on Facebook if you found this article interesting.