While not exactly news that home and small enterprise routers tend to be insecure, the magnitude of the problems with Huawei’s devices was revealed at DefCon this year. Given the failure of the company’s engineers to recognize and navigate around longstanding security issues it seems particularly prudent for a public accounting of Huawei’s enterprise and ISP-focused routing products.
Tag: Security
Chris Soghoian has a good piece breaking down what we know, and don’t know, about Skype’s VoIP security. While not mentioned, it’s helpful to keep in mind that the security and anonymity offered by Skype is questionable regardless of whether the company provides a private key/enables MITM/etc for law enforcement agencies. Such questions are, and have been raised by academics for some time, as evidenced by the body of academic research on Skype and security.
To be clear: the following list is not a comprehensive accounting of literature that has been critical of Skype or VoIP encryption. Instead, the list is meant to show that researchers have been evaluating Skype’s security promises for a very long time. The present controversy around Skype’s security stance – i.e. can or can’t the company decrypt VoIP communications for law enforcement – should be read as an ongoing part of this narrative instead of as a revelatory moment that “changes everything.”
Phonotactic Reconstruction of Encrypted VoIP Conversations: Hookt on fon-iks (2011)
Abstract: In this work, we unveil new privacy threats against Voice-over-IP (VoIP) communications. Although prior work has shown that the interaction of variable bit-rate codecs and length-preserving stream ciphers leaks information, we show that the threat is more serious than previously thought. In particular, we derive approximate transcripts of encrypted VoIP conversations by segmenting an observed packet stream into subsequences representing individual phonemes and classifying those subsequences by the phonemes they encode. Drawing on insights from the computational linguistics and speech recognition communities, we apply novel techniques for unmasking parts of the conversation. We believe our ability to do so underscores the importance of designing secure (yet efficient) ways to protect the confidentiality of VoIP conversations.
Analysis of information leakage from encrypted Skype conversations (2010)
Abstract: Voice over IP (VoIP) has experienced a tremendous growth over the last few years and is now widely used among the population and for business purposes. The security of such VoIP systems is often assumed, creating a false sense of privacy. This paper investigates in detail the leakage of information from Skype, a widely used and protected VoIP application. Experiments have shown that isolated phonemes can be classified and given sentences identified. By using the dynamic time warping (DTW) algorithm, frequently used in speech processing, an accuracy of 60% can be reached. The results can be further improved by choosing specific training data and reach an accuracy of 83% under specific conditions. The initial results being speaker dependent, an approach involving the Kalman filter is proposed to extract the kernel of all training signals.
Recovery of Skype Application Activity Data from Physical Memory (2010)
Abstract: The use of Internet based communication technologies has become more prevalent in recent years. Technologies such as Skype provide a highly secure and decentralised method of communication. These technologies may also leave little evidence on static media causing conventional digital forensic processes to be ineffective. This research looks at exploiting physical memory to recover evidence from Internet based communication technologies where conventional methods cannot. The paper first proposes a set of generic target artefacts that defines information that may be targeted for recovery and the meaning that can be inferred from this. A controlled test was then undertaken where Skype was executed and the memory from the target machine collected. The analysis showed that it is feasible to recover the target data as applied to Skype, which would not be otherwise available. As this is the first set of tests of a series, the future direction is also discussed.
Blocking Skype through Deep Packet Inspection (2009)
Abstract: Skype is a peer-to-peer (P2P) voice over IP (VOIP) chat program. It provides its clients with an inexpensive means to communicate worldwide via the Internet through wired and wireless networks. In the past this application was limited strictly to computers, yet with continuous advancements in mobile communication, Skype phones and other mobile devices have recently hit the market in an attempt to capitalize on Skype’s reliable connection algorithms. However, despite the success of this application, it is important to note that due to Skype’s connection algorithm and the nature of P2P, a number of vulnerabilities emerge that threaten both users and their networks. This paper outlines how to block the Skype application through the use of deep packet inspection. This novel approach is completely scalable to networks of any size as a means of blocking one of the largest threats to commercial and government networks today.
Identifying Skype Traffic by Random Forest (2007)
Abstract: Despite of the great popularity, little is known about Skype network attributed to proprietary protocol. End-to-end encryption disables the traditional traffic detection methods. We presented genetic algorithm based Random Forest algorithm to identify Skype traffic using only transport layer statistics. Experimental results show that the proposed approach can immune to the encryption of the payload and be capable of detecting Skype traffic with accuracy over 95% while low computational complexity is required.
Revealing skype traffic: when randomness plays with you (2007)
Abstract: Skype is a very popular VoIP software which has recently attracted the attention of the research community and network operators. Following a closed source and proprietary design, Skype protocols and algorithms are unknown. Moreover, strong encryption mechanisms are adopted by Skype, making it very difficult to even glimpse its presence from a traffic aggregate. In this paper, we propose a framework based on two complementary techniques to reveal Skypetraffic in real time. The first approach, based on Pearson’sChi-Square test and agnostic to VoIP-related trafficcharacteristics, is used to detect Skype’s fingerprint from the packet framing structure, exploiting the randomness introduced at the bit level by the encryption process. Conversely, the second approach is based on a stochastic characterization of Skype traffic in terms of packet arrival rate and packet length, which are used as features of a decision process based on Naive Bayesian Classifiers.In order to assess the effectiveness of the above techniques, we develop an off-line cross-checking heuristic based on deep-packet inspection and flow correlation, which is interesting per se. This heuristic allows us to quantify the amount of false negatives and false positives gathered by means of the two proposed approaches: results obtained from measurements in different networks show that the technique is very effective in identifying Skype traffic. While both Bayesian classifier and packet inspection techniques are commonly used, the idea of leveraging on randomness to reveal traffic is novel. We adopt this to identify Skype traffic, but the same methodology can be applied to other classification problems as well.
VoIP and Skype Security (2005)
A critical evaluation of Skype’s security stance as juxtaposed against other peer-to-peer models, ISDN/VoIP services, and what we can take away from Skype’s claims about encryption and voice security.
Skype Security Evaluation (2005)
Since 1 June 2005 I have been analyzing the security properties of Skype software and services, with a focus on the current and planned uses of cryptography. I have had unimpeded access to Skype engineers and to Skype source code. I have found out a lot about Skype. The more I found out, the happier I became.
Any pieces of literature you think are absolute must adds to this list?
Categories
Comment on Lion’s Internet Recovery
I’ve recently added a new non-spinning disk to my system and decided to give Lion’s disk recovery system a try: how did it actually perform, where were there problems, and how were they resolved?
I was incredibly impressed with the general functionality of the Internet-based recovery mechanism. After adding the new disk I was asked to connect to a local wireless network and then basic recovery data was streamed into RAM. From there I successfully downloaded and installed the OS, and restored files and settings from encrypted network storage. Total time to restore the OS and about 200GB of data: 3.5 hours.
Were there any problems? Yes, though only one is truly significant to my mind. While the password for logging into the OS remained the drive encryption that I’d set up through the OS (i.e. Filevault 2) had to be re-intitialized. When I attempted to do so I received warnings that the disk could not be encrypted.
This constituted a major problem for me.
The solution was relatively simple, though annoying. Apparently the Internet-based recovery process fails to install a recovery partition on the disk. Without this partition Filevault 2 cannot be enabled. The solution was to reinstall Lion from within the OS. This doesn’t change any settings and, effectively, is just used to create the disk-based recovery partition. After the partition is set up Filevault 2 can be enabled without a problem.
I don’t have a particular issue with having to jump through some hoops to re-enable the disk encryption. I do, however, have issues with the fact that there are no warnings that this security setting isn’t enabled/carried through when re-installing Lion and importing data and settings from a Time Capsule. In effect, if I wasn’t poking around settings to ascertain whether they had been carried over I likely would have never known that the disk hadn’t been encrypted. This is a particularly serious information flow error as far as I’m concerned. Hopefully Apple will integrate some kind of a notice system in the future to alert users about which settings were and were not carried over, as well as more verbosity concerning why Filevault 2 cannot be enabled after an Internet-based OS restoration.
Rob Graham has a good look at the challenges facing SandForce controllers – which are used by a large number of the solid state hard drives on the consumer market – as related to disk encryption. I highly recommend reading it but, if you just don’t have the time, here’s the key takeaway: “The problem with a SandForce controller is that all its features are lost when using full disk encryption, but all its downsides remain. Thus, if you plan on using an SSD for your notebook computer, you should plan on getting something other than a SandForce controller.”
I use the term ‘normals’ in an utterly positive sense: Vanity Fair’s recent piece, titled “World War 3.0,” scatters enough truth through the article that it possesses a veneer of credibility while obfuscating falsehoods and myths. The result is that unsavvy readers will be left with conceptions the everything is peachy with ICANN (false), that the ITU is coming to take over the ‘net (false), that the Internet is boundary-less (false), that there are honest-to-God “good guys” (the disorderly folks) and villains (orderly organizations like states), and that loosening arms exports related to encryption is significantly linked to the theft of IP (arguably very false).
Unfortunately, there is enough truth scattered throughout the article that someone who isn’t familiar with the terrains of Internet security, governance, and IP policies could be easily drawn into an appealing and accessible narrative. It is precisely narratives like this that those of us familiar with Internet policies have to fervently oppose and correct, with a recognition that not correcting the record can promote serious misinformation leading to disastrous (or, at best, misguided) policy responses by the “bad guys” of the Internet (i.e. state actors).
The article is worth a read, though it may bring your blood to a boil. Regardless of its factual accuracy, however, I suspect that the piece can be read as how non-experts perceive the past decade or so of Internet policies and practices. As such it’s incredibly valuable for those of us in the trenches to get a better perspective on how our conflicts are seen publicly, if only to make out actions and processes that much clearer for the general citizenry.
The risks that onerous copyright laws pose for law enforcement are rarely considered, despite such laws (potentially) threatening national security operations. In Sweden, following efforts to dissuade file sharing, the population is increasingly moving to encrypted VPN connections to continue their sharing. From an article over at Torrentfreak,
according to new research from the Cybernorms research group at Sweden’s Lund University, an increasing proportion of the country’s population are taking measures to negate the effects of spying on their online activities.
The study reveals that 700,000 Swedes now make themselves anonymous online with paid VPN services such as The Pirate Bay’s iPredator.
What does this have to do with law enforcement? As the Swedish population moves to encrypted communications it limits authorities’ insights into the data traffic moving through Swedish networks. Consequently, the copyright lobby is (unintentionally) increasing the challenges of applying digital ‘wiretaps’ on Swedish citizens. While not something that the copyright lobbies are necessarily concerned with, these developments can be problematic for national security agencies.
I’m not advocating that communications should necessarily be easier for such agencies to investigate – far from it – but do I think that before aligning legislative efforts with copyright groups it is critical for legislators to think of the broader implications associated with ‘strong’ copyright laws. While such laws might dissuade some file sharing, are the benefits derived from limiting file sharing sufficient to justify disadvantaging national security and intelligence operation?
A great of speculation exists around mobile companies of all stripes: are they secure? Do they secretly insert backdoors for government? What kinds of assurances do customers and citizens have around the devices?
Recently these concerns exploded (again) following a Reuters article that notes serious problems in ZTE mobile phones. There are a series of reasons that security agencies can, and do, raise concerns about foreign built equipment (some related more to economics than good security practice). While it’s possible that ZTE’s vulnerabilities were part of a Chinese national-security initiative, it’s entirely likely (and more probable) that ZTE’s backdoor access into their mobiles is a genuine, gigantic, mistake. Let’s not forget that even ‘our’ companies are known for gross security incompetence.
In the ZTE case it doesn’t matter if the backdoor was deliberate or not. It doesn’t matter if the company patches the devices, either, because a large number of customers will never apply updates to their phones. This means that, for all intents and purposes, these devices will have well publicized security holes for the duration of their existence. It’s that kind of ongoing vulnerability – one that persists regardless of vendor ‘patches’ – that is increasingly dangerous in the mobile world, and a threat that is arguably more significant (at the moment) than whether we can trust company X or Y.
National mail carriers are important for loads of reasons, including legal protections around letters carried by them versus those carried by couriers. These mail carriers are far less agile than their private competitors and have been incredibly slow to recognize the need to change existing processes and practices. They desperately need to find new growth avenues to remedy declining gross and net revenues.
As a demonstration of how little Canada Post ‘gets’ the market and business it’s in today, we can turn to this comment:
Canada Post chief executive officer Deepak Chopra foresees a future in which consumers receive and pay their bills, get their paycheques, renew drivers’ licences, pay parking tickets, buy magazines and receive personalized ad pitches – all online, through ePost.
This isn’t a future: it’s the present. The only ‘future’ part of what he is outlining is that all these (already daily) functions would be routed through ePost. Unless Canada Post has an incredible value proposition – security, government mandates, or somehow implementing these functions better than existing services are mechanisms that immediately come to mine – I can’t see how the organization will exist in any semblance of what it is today, tomorrow.
Categories
Making Dropbox a Little Safer
Research conducted by Christopher Soghoian demonstrated that Dropbox lacks a security model that genuinely protects user data. As a consequence, while Dropbox is a convenient service it isn’t one that can really be trusted. Regardless, individuals around the world do, and will, continue to use the service.
Recognizing the user-constrains around cloud file-storage solutions, BoxCryptor has provided the tools to encrypt files before they are sent to Dropbox. This lets users rely on Dropbox for convenient storage while also reducing their risk profiles. All in all, it’s a win-win for the consumer.
The instructions are for OS X, Leopard, Snow Leopard, and Lion, and are relatively easy to follow. If you want to secure yourself a little bit better than you likely are right now you’d be well served to set up automatic encryption now. As an added bonus, the instructions will let you also choose Microsoft’s or Google’s cloud services so long as you point the “EncFS Raw Path” to the file path of these other services (don’t worry: it’ll be super clear what that refers to as you go through the instructions!).
Excited Pixels 