Posted on

What does your smart phone say about you?

What does your smartphone say about you?

And we are not talking about design or style…

Keen fans of TV police dramas may be aware of the term ‘metadata’ which is frequently mentioned in the tense investigation scenes as the police narrow their focus on the perpetrator.  However how many of us actually know what metadata is?

Metadata is all the information relating to your phone call except the content of the call itself. It is the information we are used to seeing on itemised mobile phone bills; the when, how, from where and with whom we communicate. However, in the age of the smartphone, metadata collected from our daily activities actually reveals more about us than we realise. Most of us use our smartphone for more than just calls. It is our convenient go-to device for email, messaging, social media, banking, electronic wallet, GPS and camera, in addition to making calls. For many of us, losing our smartphones would impact our day-to-day lives far more than if we lost our credit card.

Digital footprint

A smartphone passively generates a vast amount of metadata, leaving behind a digital trace of the activity of its user. Each action and interaction provides a snapshot of our daily activities. Email addresses, websites visited, photos taken and files downloaded all present many new opportunities to gather metadata. Pieced together this information provides a comprehensive record of our associations and public movements, revealing a wealth of detail about our interactions, points of view and personal and professional associations. The reason metadata is so valuable is that it doesn’t lie, it is a digital footprint of our activities.

Stealing metadata

There are many ways that hackers can obtain metadata illegally. The SS7 vulnerability is well documented, and was one of the first topics that we wrote about in this blog (What’s up with WhatsApp). SS7 was designed over 40 years ago, long before phone hacking was considered a serious threat. SS7 stands for Signalling System No 7, also called the Common Channel Signalling System 7 in the US or Channel Interoffice Signalling 7 in the UK, and is the system that connects mobile phone and landline networks to each other. SS7 protocols enable phone networks to exchange information needed to process calls and text messages across disparate networks, including roaming on foreign networks, and to ensure correct billing. It also enables local number portability, prepaid payments, SMS and number translation.

Limitations in the SS7 protocols enable an attacker to mimic a victim’s device, steal personal data and to snoop on a users’ network communications. While this technique is used by nation states, there is equipment available on the dark web for a few hundred dollars that brings this type of attack into the domain of almost any tech-savvy criminal!

Fake base station

Exploiting the SS7 vulnerability isn’t the only means to access metadata. IMSI (international mobile subscriber identity) catchers, also known as fake base stations, are well established pieces of surveillance technology used by law enforcement all over the world. This portable device is used to intercept digital communications by essentially impersonating a legitimate mobile phone mast. The device can capture the IMSI of every phone in the area and intercept messages, calls and metadata, and even block phones from operating.

IMSI catchers are illegal to operate by parties other than law enforcement agencies and, even then, there are strict codes of conduct. However, for an attacker motivated by financial or commercial gain, remaining on the correct side of the law is rarely of concern! Videos freely available on YouTube show how a DIY IMSI catcher is relatively trivial to setup for a tech savvy criminal. The technology is available to anyone with a cheap laptop, $20 of readily available hardware and the ability to essentially copy and paste some commands into a computer terminal.

The power to control your own metadata

The fact that metadata is collated and sold by telecom carriers and internet companies shows how valuable it can be. Social media companies in particular are regularly sharing our metadata to third parties as a way of targeting advertising and this is typically the key value creator for such companies. Applying this capability across a population, it is possible to compile a very detailed, even invasive, picture of the population including behaviours and interactions which governments, organisations and cyber criminals can act upon.

Whilst it’s not possible to stop metadata from being generated, steps can be taken to control access to it. Armour Comms securely manages communications in the cloud ensuring metadata is minimised and protected. We also offer an on-premises solution for those who want complete control, allowing customers to store metadata on their own servers. Our solutions not only protect the content of communications, but also consider the broader aspects of securing your data and privacy

The weakest link

As the cyber security threat landscape evolves, it’s clear that securing modern methods of communication requires a new approach. Without secure practices, smartphones can effectively be viewed as surveillance devices, exposing confidential business dealings, intellectual property, state secrets, or commercially valuable information to risk. As the saying goes, you’re only as strong as your weakest link. If you fear that your mobile comms could be vulnerable to eavesdroppers, competitors or criminals then it’s time to act. Contact us today to discuss a solution.

Posted on

Latest WhatsApp hack highlights dangers of using consumer-grade (free) apps for business

WhatsApp Hack

Businesses using Consumer Apps risk facing stiff regulatory fines for data loss or worse

London, 14 May 2019: Armour Communications, the leading provider of specialist, secure communications solutions, calls for organisations to stop using consumer-grade, free apps when handling sensitive or commercial information. For people with jobs where security is paramount, for example, journalists, humanitarians, activists or special services working in unfriendly regimes, a phone that has been hacked via an app could put life at risk. For others, the risk of individual’s private information or commercial data being accessed will damage an organisation’s brand integrity and share price.

David Holman, Director at Armour Comms said; “This latest case of a serious vulnerability in a consumer-grade app highlights the dangers of using free apps, and that they are simply not robust enough for business. While such apps claim that they are secure because they are encrypted, there is so much more to security than just encryption.  Encryption is rarely the weakest link, and therefore, unlikely to be targeted by hackers.

“While this particular exploit may have been to target people with specific jobs, there are various other everyday hacks that can be executed relatively easily by low level criminals against these types of product that put users’ data at risk.  Breaches of GDPR are a risk to every type of business and come with significant fines.”  https://www.armourcomms.com/2018/07/31/free-apps-you-might-get-more-than-you-bargained-for/?cat-slug=10

In 2018, German automotive supplier Continental AG banned its workers from using the messenger services WhatsApp and Snapchat on company phones, due to concerns about GDPR compliance and general security. https://www.cnbc.com/2018/06/05/continental-bans-facebooks-whatsapp-and-snap-incs-snapchat.html

Holman continued; “These free apps proliferate by stealth through organisations, unless firms take positive action, like in the case of Continental AG last year. There are enterprise-grade apps available that provide the same convenient user experience of consumer grade apps, while keeping the user in control of their data and metadata. Some of these apps, like

Armour Mobile, have been certified by the National Cyber Security Centre (NCSC), so users can be confident that the software is secure by design.”

Armour Comms’ solutions for secure communications work on everyday smartphones, tablets and Windows 10 desktops. With the same usability as consumer-grade apps, and  with significantly enhanced security, Armour Mobile supports voice calls, video calls, one-to-one and group messaging, voice and video conference calls, file attachments, sent/received/read message status and message ‘burn’ (automatic timed deletion).

Using a FIPS 140-2 validated crypto core, Armour Mobile has been awarded many certifications including CPA (Commercial Product Assurance) from the NCSC and is included in the NATO Information Assurance catalogue.

Posted on

Biometrics – An extra layer of security

Biometrics

We will be showing the latest version of Armour Mobile at Cyber UK (24-25 April 2019), and one of our most exciting upgrades is the provision of the ability to use biometrics as an extra layer of authentication.

We haven’t just jumped on a bandwagon here, biometrics is an important development for security.  While our products use identity-based cryptography and are designed to enable secure, cross-platform communications by identifying and authenticating the end points, this doesn’t necessarily identify who is actually using the device.  (More about identity-based encryption (IBE) and its benefits in our previous blog post here: https://www.armourcomms.com/2018/02/27/are-you-talking-to-me/?cat-slug=10)

When biometric authentication is added to Armour Mobile, it also confirms that it is the right person using the phone.  Armour Mobile integrates with the biometric authentication algorithms on the latest smartphones (iOS and Android) and uses them to open the Armour Mobile app. The user simply logs in to our app using their fingerprint or face ID, which is authenticated by the device and – through its link into the mobile’s built-in, secure key store – can then unlock our app (when closed, our app’s data-at-rest is kept encrypted).

The biometric component makes it simpler to login without needing to retype a password every time. This convenience removes another of the (perceived) ease-of-use barriers to using a secure, enterprise app that has been designed for purpose, rather than a consumer-grade app.

We will be demoing exactly how it works on our stand B9 at Cyber UK, at the Scottish Event Campus,  Glasgow,  24 – 25 April.

In addition, we will be demonstrating full integration with Secure Chorus’ interoperability standards for encrypted voice calls, to a live audience, with Leonardo, BAE Applied Intelligence and a defence organisation. The interactive workshop, hosted by the NCSC and led by Secure Chorus takes place on 24 April at 14.00 and is part of Stream G.

Several of our partners are also exhibiting, including BAE Systems on stand E22, Amiosec on stand E20, Leonardo on stand E15, Qinetiq on stand B2, Nine23 on stand SBH15 and Templar Executives on stand SBH7.

So all in all, well worth a visit!  For more information and to register visit:  https://www.ncsc.gov.uk/section/cyberuk/overview

Posted on

It’s a question of Trust

Phone Number

Phone numbers – not that unique and not that secure!

A spate of recent disclosures calls into question once again the wisdom of using phone numbers for authentication. As we’ve discussed elsewhere on this blog, mobile phones are relatively easy to spoof, hijacking of phone accounts is becoming worryingly commonplace, and what happens if you lose your phone or have to change your mobile phone number? This hair raising account from Allison Nixon, director of security research at New York City-based cyber intelligence firm Flashpoint https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/, highlights many of the issues, for example, when phone numbers are used for authentication within apps, or when banks send out sensitive updates via SMS.

Another issue regarding the use of personal numbers is where employees use their own mobile phones for business. If numbers are published in a corporate directory, that means anyone who works for the organisation has access to those personal numbers. Industry contacts related an incident where this led to female employees receiving unwanted calls at weekends, which as well as being a nuisance and potentially intimidating for the victim, also raises concerns as to their employer’s management of their personal data!

So while using our mobile numbers for authentication is very convenient, it is now becoming frighteningly insecure.

What else is at risk if your social media account is hacked?

If that isn’t enough horror to contemplate for one day, we have recently heard how ‘9 million data items containing passwords in plain text’ have been exposed at our perennial favourite, Facebook… for years!  And their response?  “We’ve not found any cases so far in our investigations where someone was looking intentionally for passwords, nor have we found signs of misuse of this data”. We’re guessing that any malfeasance is unlikely to be admitted! More details here:

https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/

How many websites now invite us to login using our Facebook credentials? If your Facebook identity is hacked, what else does the hacker gain access to?

Security by design – or just an after-thought?

This brings us to the salient point that when large companies talk about security and encryption, it often doesn’t seem to apply to their own staff.  Indeed, one of the points made by Allison Nixon, is that banks often don’t know how to remove a mobile phone number associated with an account once the account holder has lost the phone number.

When it comes to keeping your private data secure, this all makes the case for using apps that are designed specifically with security in mind, not consumer-grade apps where security is an after-thought and a begrudging add-on at that!

Armour Mobile can be used with abstract numbers or random strings as identifiers, you don’t need to expose your own mobile number. These identifiers are then tied back to real-world identities within the Armour system, which is controlled in our secure cloud, or by your own, on-premises administrators.  Providing the users are known in some manner, and the identities are centrally controlled, this approach provides better security than relying on phone numbers to prove someone’s identity.

Posted on

Army Reservists Cyber Protection team pilot Armour Mobile

Army Reserves

A recent initiative to give the Army Reserves more responsibility has led to the forming of a Cyber Protection Team.  One of the first issues that the team addressed, was to find a more secure way to communicate. In other words, a secure replacement for WhatsApp.  Like many organisations, WhatsApp (along with other consumer-grade apps) has become widely adopted across the Armed Services.  It has invaded almost by stealth.  It’s easy to use, everyone has it, and it’s encrypted.  What’s not to like.

However, as we have discussed on many occasions, consumer-grade apps are generally owned by multi-national social media companies, that don’t particularly care about your meta data, and might even sell it to advertisers.

Recognising this vulnerability, the Cyber Protection Team is piloting Armour Mobile.  Currently being used very successfully by a small group that often work remotely, the plan is to encourage the use of Armour Mobile more widely.

Watch this space for further details.

Posted on

Armour supports Royal Signals Cyclist

Working in secure comms, we come across many interesting and varied characters, all with a different background story to tell.  Recently I met Mark Howells, a reservist with the Royal Signals, and formerly a full timer, having seen several tours of active service. Mark has been instrumental in setting up a new cyber protection team within his regiment, and we’ve talked shop on several occasions.

However, what really got my interest was when Mark started to tell me about the proactive steps he was taking to deal with his Post Traumatic Stress Syndrome (PTSD). Depending on which source to you go to, PTSD affects from 5 – 10% of military personnel, and is on the increase.  Although the increase could be because it is now a recognised condition, that is talked about, and so people feel more able to ask for help.  Whichever way you look at it, mental health is something that we all need to be aware of.

Mark told me how he found cycling was a great therapy helping him to manage his symptoms, and so continue an active and healthy lifestyle.  With coaching from the Army, and a strict training regime, Mark has achieved a lot.  Not only that, he has big ambitions.

Mark’s goal is to represent his country at the Invictus Games in 2020.  Meanwhile he is taking part in events every week, and has a packed schedule of races for the coming season.

At Armour we are very proud to support Mark in his endeavours, and will publish occasional posts here, to up date you of his progress.

Posted on

Armour Comms launches Armour Mobile v3.0 at Cyber UK and demonstrates interoperability for encrypted voice to live audience at Secure Chorus’ workshop

Cyber UK Venue

Cyber UK 2019,  24 – 25 April

Scottish Event Campus, Glasgow,

Stand: B9

London, 26 March 2019: Armour Communications, the leading provider of specialist, secure communications solutions, is launching the latest version of its flagship product Armour Mobile at Cyber UK 2019 – the premier annual cyber security event run by the UK’s NCSC (National Cyber Security Centre).  In addition, Armour will be demonstrating full integration of Secure Chorus’ interoperability standards for encrypted voice calls, to a live audience, with Leonardo, BAE Applied Intelligence and a defence organisation. The interactive workshop, hosted by the NCSC and led by Secure Chorus takes place on 24 April at 14.00 and is part of Stream G.

Armour Mobile v3.0 introduces significant new features including biometric authentication (fingerprint and facial recognition), and rapid ‘auto’ provisioning of new users using secure QR codes or encrypted links within emails. There is a host of additional refinements, including sending a secure voicemail or text note when a user is unable to accept a voice or video call; accessibility options such as user-defined text sizes; and MessageBurn has added sophistication – for example, a marker to alert the user if they failed to read a secure message before it has been ‘burned’.

The demonstration of interoperability for encrypted voice calls at the Secure Chorus workshop will show how Armour Mobile can connect multiple groups or communities transparently to end users, maximising the ease with which they can communicate securely across different organisations. This is particularly useful where security requirements preclude these groups from merging their IT networks and, instead, provides a novel solution to allow them to collaborate securely on joint projects.

David Holman, Director at Armour Comms commented; “For enterprise security to be effective it needs to be transparent to the end user. With this in mind, Armour Mobile v3.0 has been developed to include many new features that significantly enhance usability. The new auto-provisioning facility means that Armour Mobile can now be deployed on a large scale, quickly with minimal overhead for IT, security and the end-user.

“Interoperability is a key criteria for a communications app, and we are delighted to be able to demonstrate how Armour Mobile is able to work across user communities, so that even where a different Key Management System (KMS) is in use, the end user only needs to know a colleague’s secure contact number to be able to communicate with them securely.”

Armour Comms’ solutions for secure communications work on everyday smartphones, tablets and Windows 10 desktops. With the same usability as consumer-grade apps, and  with significantly enhanced security, Armour Mobile supports voice calls, video calls, one-to-one and group messaging, voice and video conference calls, file attachments and sent/received/read message status. Message Burn limits the lifespan of sensitive data at rest, where users can set a time at which their messages are automatically deleted (or as the name implies, ‘burn’) on the recipient’s device, for immediate action after being read, or at a given time after sending, according to confidentiality.

Using a FIPS 140-2 validated crypto core, Armour Mobile has been awarded many other certifications including CPA (Commercial Product Assurance) from the NCSC and is included in the NATO Information Assurance catalogue.

Armour Comms partners also exhibiting at Cyber UK include: BAE Systems on stand E22, Amiosec on stand E20, Leonardo on stand E15, Qinetiq on stand B2, Nine23 on stand SBH15 and Templar Executives on stand SBH7.

Posted on

Armour Comms shows latest secure mobile comms apps at Security & Policing

Security & Policing Home Office Event

5 – 7 March 2019

Farnborough International Exhibition and Conference Centre

Stand: F25

London, 5 March 2019: Armour Communications, a leading provider of specialist, secure communications solutions, will be demonstrating the latest versions of Armour Mobile, Armour Blue and Armour Desktop at the Home Office’s Security and Policing event.

Armour Comms’ solutions for secure communications work on everyday smartphones, tablets and Windows 10 desktops. With the same usability as consumer-grade apps, and  with significantly enhanced security, Armour Mobile supports voice calls, video calls, one-to-one and group messaging, voice and video conference calls, file attachments and sent/received/read message status. Message Burn limits the lifespan of sensitive data at rest, where users can set a time at which their messages are automatically deleted (or as the name implies, ‘burn’) on the recipient’s device, for immediate action after being read, or in the future, according to confidentiality.

Armour will be showing a technology preview of the latest version of Armour Blue which  includes Mission Critical Push to Talk (MCPTT) functionality that meets the requirements of public safety mission critical voice communication.

The latest version of Armour Desktop extends the secure mobile communications capabilities of Armour Mobile and Armour Blue via a Windows 10 softphone, and, can bring additional Command and Control capabilities.

In 2018, Armour successfully participated in a week of plug-testing for (MCPTT) protocols organised by the European Telecommunications Standards Institute (ETSI) and The Critical Communications Association (TCCA) in Texas. The protocols are fully integrated into the Armour Blue solution and supports different use cases including emergency and blue light, police and law enforcement, covert ops and others.

David Holman, Director at Armour Comms commented; “At Armour we are committed to developing and delivering highly usable, secure communications solutions that are equally suitable for use by the Enterprise, as well as the more security conscious organisations such as Government departments, Police and Law Enforcement and Special Services.”

Using a FIPS 140-2 validated crypto core, Armour Mobile has been awarded many other certifications including CPA (Commercial Product Assurance) from the National Cyber Security Centre (NCSC) and is included in the NATO Information Assurance catalogue.