Posted on

What is your metadata giving away about you?

The importance of protecting your metadata.

You don’t need to know what is being said in a conversation to know it is significant.  Sometimes just knowing that someone is talking to someone else gives adversaries, competitors, unfriendly nation states, tabloid journalists/paparazzi all they need.

So just because your mobile conversations are encrypted, doesn’t mean all the information is encrypted and therefore unavailable – protecting your metadata and understanding exactly who has access to it, and what they might do with it, is every bit as important

What is metadata?

Metadata is ‘data about data’.  Most people don’t give it a second thought when communicating digitally.  In effect, it’s the envelope with the address of the person to whom you are sending a letter.  The postman can’t read the contents of the letter, but they know that you sent a letter, where from, who to and when.  In most western regimes the contents of the letter, email, voicemail, etc., is protected under civil liberties and human rights, but more and more governments are legislating so that they have a right to interrogate metadata, with ISPs and telcos legally obliged to keep these records.

Where were you – who did you speak to?

Information like your location, who you spoke to, when, for how long and how often, can give plenty away without having the details of what was said.  As a simple example, if two companies are negotiating a sensitive deal, it is fairly easy for hackers to see the calls being made and received, who they were to/from and this could be all a competitor needs to gain a commercial advantage.  There are many examples where privacy is paramount to protecting an organisation: a team of lawyers working on a corporate merger or acquisition; a defence contractor completing the final details of a supply deal; or a pharmaceutical company discussing the results of the latest drug trials.  Alternatively, for a high net worth individual, having a journalist learn that they have called a drug rehabilitation clinic could be enough to ruin their reputation.

It’s cheap and easy to find out if you are not careful!

Simply encrypting the email, voice call, attachment or text message doesn’t provide total security because metadata is still available.  Even entry level criminals or script kiddies can access technology (such as IMSI catchers/fake base stations, SS7 hacks, etc.), that enables them to harvest your call and location metadata, for just a few hundred pounds.

And that’s not all – if you use a free app, such as those that are owned and controlled by social media companies, they also control your metadata. They can, and do, use that information for their own ends, and pass it on to others.  Metadata is a valuable commodity, which is being bought and sold!

If your staff need to communicate while out on the road, from a mobile device, and you need to keep commercially sensitive information and intellectual property private, speak to us now.

 

Posted on

AES128 v AES256 encryption – What’s the difference?

Practically nothing!

It is true that a 256 bit encryption key is many times more difficult to guess (referred to as a brute force attack) than a 128 bit key. However, given that a 128 bit key takes so long to guess using such a huge amount of computing power, that for all practical purposes, it simply wouldn’t happen, how much more certain does anyone really need to be?  For an explanation of the maths try this blog

To generate this kind of brute force, a hacker would need quantum computing, which is still years away.

So, if there is practically no difference between the two in terms of ability to protect your data, are there other factors to consider?  256 bit keys require more processing power, and can take longer to execute, so on small devices where power is an issue, or where latency is likely to be an issue, users are better off with 128 bit keys.

When looking to access a system, hackers will always go for the weakest point, which isn’t going to be the encryption whether it’s a 128 bit key or a 256 bit key. Therefore, it is more important to check that the software you are considering does what you want it to do, it protects your data in the way you think it does, and that there are no weaknesses in the processes.  Also, that there are no grey areas where you are not quite sure where your data is, or who is looking after it (for example, if data is held in the cloud – do you know where the cloud actually is?).   And most important of all, the security software you choose should be easy to use, invisible to users, so that they have no need or inclination to take insecure workarounds in order to do their day to day job.

In short, don’t waste time stressing about 128 v 256 bit encryption keys.  Both do the job, and there are more important security issues to be worried about.

Posted on

Spear Phishing – How complicit are you?

Spear Phishing Hook

Spear phishing is what happens to gullible idiots who are not paying proper attention, right?

Wrong! Spear phishing mixes increasingly clever social engineering to make spoof emails appear real, and it’s all too easy to become a victim.  Even if you are way too clever to get caught, your business users, who are not necessarily thinking about technology and security every minute of their day, may fall victim to these types of attacks.

And their mobile phones could be helping…?

Here’s how. Details of supposedly private conversations between colleagues can be used to make a spear phishing scam more believable. If your business users are subject to an IMSI catcher attack, where a fake base station is used to intercept calls, forcing them down to 2G technology (which negates the stronger encryption used across 3G & 4G networks), their conversations, which they think are private, can actually be listened to.  See our previous blog for details on how this works.

Then all it takes is a phishing email addressed from a trusted colleague, referring to an earlier conversation, which gives the email credibility, a request to click a link, and a virus or Trojan could be launched. The person that has been hacked doesn’t even know.

So how can you tell if your mobile phone has been subject to interception?  Short answer, you wouldn’t, unless you are in the covert ops industry with access to some pretty heavy duty technology. Who could launch such an attack? Almost anyone that wants to – with entry level hacking skills, and a piece of kit that can be purchased online for about €300. This could be a disgruntled ex-employee, competitors looking to steal your intellectual property, or even just pranksters/script kiddies.

The security and IT press has been talking about ‘protecting the endpoint’ for years, now the endpoint includes mobile phones. If your business users have intellectual property to protect, commercial secrets that you’d rather remained a secret, then perhaps now is a good time to start looking at protecting your ultimate endpoint – the mobile phone!

 

Posted on

Your calls may be secure, but are they private?

What’s the difference between security and privacy – well, quite a lot actually.

When it comes to making calls or sending texts from your mobile phone, there are a myriad of ways that eavesdroppers can listen in.  From colleagues simply being nosy and overhearing your conversations, to various over-the-air attacks, intercepting your calls via a rogue base station, cracking the encryption or exploiting vulnerabilities within the GSM network protocols, mobile conversations or texts are not that secure.  There are a number of apps now available, some of them free to download, that claim to provide encryption and security.  However, a word of caution when it comes to free services from Tim Cook, CEO of Apple.  As he so eloquently put it; “A few years ago, users of Internet services began to realise that when an online service is free, you’re not the customer. You’re the product!”

But is the content of your communication the only part that needs to be secure? What about privacy too?

Let me explain.  Imagine you are communicating with someone or an organisation that you don’t want anyone else to know about.  For example, applying for a new job.  They call you to arrange an interview using standard GSM technology (any mobile phone).  That is like sending the details on a postcard.  The address and the contents of the communication can be read by anyone in Royal Mail.

If you use a more secure method, say a free to download encrypted messaging solution, that is like asking a social media company to deliver your message.  It may well be encrypted (in the previous example the contents would now be in a sealed envelope rather than on a postcard) so they don’t know what it says, but they know who you are talking to, when and how frequently, and where both of you are. If they have this information, they can make their own deductions, for example, you are either applying for a job, or already work for the organisation in question. So even without knowing the contents, they can piece together some intelligence, and they might share this information – your privacy is compromised and you have no control.

The ultimately secure method is for a courier that works for the organisation to deliver the letter to you personally, and you then reply, using the courier.  This way, no one knows that you are communicating except for you and the organisation in question.  Not only do any potential eavesdroppers not know what is going on, they don’t even know that anything is going on, and therefore maybe are less suspicious, keeping your activities under the radar – and private.

These three scenarios I have just described are the difference between using GSM, an encrypted messaging solution (like WhatsApp, Facebook Messenger, Snapchat, Telegram, Viber, Threema, WeChat and Line), and an on-premises secure communications solution, that you control, so that you know where your data is held at all times.

Sometimes security and privacy sound like the same thing, and sometimes it doesn’t much matter, if for example, you are arranging a surprise party. On the other hand, depending on your work, it can matter a great deal, and if you are operating in an oppressive regime, where it is imperative that your communications remain private, even covert, it can be the difference between life and death.

Posted on

Armour Comms selected by Huckworthy for secure communications for US Govt, finance and legal sectors

Huckworthy

Armour Mobile meets stringent criteria required by noted commercial off the shelf wireless specialist and US Department of Defence Mentor Protégé Program Participant

London, 19 October 2017: Armour Communications, a leading provider of specialist, secure communications solutions, has announced that Armour Mobile has been selected by Huckworthy, a HUBZone certified small business and US Department of Defence Mentor Protégé Program Participant under The Boeing Company, to be an integral part of Huckworthy’s technology solutions. As a small business government contractor in the US, Huckworthy specialises in developing and providing communication solutions in advanced cellular technology, partnering with leading technology innovators to deliver certified and proven commercial products. The company selected Armour Mobile for its ability to be offered as a private or cloud hosted solution, its ability to deliver voice, video, messaging and data transfer security with internationally recognised certifications, and a trusted UK based pedigree.

Armour Mobile enables secure collaboration between trusted colleagues when discussing commercially sensitive information such as corporate intellectual property, financial transactions and customer details. Armour Mobile prevents mobile communications including voice, messaging, file transfers, video or even conferencing from being intercepted by illicit or unwarranted surveillance, keeping both conversations and associated metadata private. Importantly, Armour Mobile can provide this not just in a local environment, but also across for the global corporate traveller.

David Howgill, President of Huckworthy said; “Working for both government and high value clients in the financial and legal sectors, our focus is on finding, evaluating and integrating the latest, and most trusted, technology solutions. We have offered commercially encrypted communications for some years, and after thorough research and due diligence we have now selected Armour Mobile as best in class when offered as part of our integrated solutions.  We’re proud to offer Armour Mobile in the USA for both our government end clients, and commercially through our reseller partner networks.”

David Holman, a director at Armour Communications commented; “This partnership reinforces our proven experience in delivering secure mobile communications against the most demanding certification and performance criteria. Huckworthy has a noteworthy background in delivering communications solutions that ensure security of the highest level for its clients, both government and commercial, and we are delighted to have met their stringent requirements.”

Armour Mobile provides secure voice calls, video calls, one-to-one and group messaging, voice and video conference calls, file attachments and sent/received/read message status. It is FIPS-140-2 validated and has been awarded many other certifications including CPA (Commercial Product Assurance) from the National Cyber Security Centre (NCSC) and is included in the NATO catalogue.

Posted on

Armour Communications showcases flagship product Armour Mobile at NATO Cyber event, NIAS 2017

Leading innovator showcases the first fully secure communications app to provide Push To Talk features  

NIAS, 17 – 19 October, Lotto Mons Expo, Belgium

                                                                  Stand No: B23 

London, 12 October, 2017: Armour Communications, a leading provider of specialist, secure communications solutions for iOS and Android smartphones/tablets and Windows 10 Desktop will be showing its flagship solution Armour Mobile, which provides all the functionality of consumer- grade free apps but with the benefit of significantly greater security. Also being exhibited at NIAS is Armour Blue, a sector specific variant of Armour Mobile which incorporates Mission Critical Push To Talk (PTT) functionality, providing features for emergency services and other agencies that need to maintain usability and compatibility with 3GPP MCPTT standards.

Armour Communications delivers collaboration solutions that enable people to communicate securely, using their everyday devices. Armour Mobile delivers secure voice, video and conference calls, plus secures messages and file attachments. The solution protects mobile communications from being intercepted by devices such as IMSI catchers or hacks exploiting security vulnerabilities in SS7 and other protocols. This ensures secure collaboration between trusted colleagues when discussing sensitive and/or classified information.

The entire portfolio of higher assurance solutions has been specifically designed for the unique needs of Government, Defence, covert communities and security conscious enterprise organisations.

David Holman, a director at Armour Communications commented; “Governments, defence and security agencies across the globe are seeking robust, high-assurance solutions to ensure the security and confidentiality of their communications. Armour Mobile protects sensitive and secret communications from eavesdroppers or hackers – without the requirement or costs of a special phone or hardware. The software solution is easily deployed, centrally managed and is available either on the Armour secure cloud, or as a complete on-premises solution where every element of communication is completely locked down and controlled.”

Armour Mobile is the first fully secure communications app to connect to Skype for Business (previously called Lync) using standard Cisco SIP-based technology. This enables Armour users in the field or overseas to communicate securely using voice and video with corporate Skype for Business installations. Jointly, Armour Mobile, Skype for Business and Armour Desktop enable users inside and external to the organisation to communicate transparently within a secure and private environment, while taking advantage of the reduce costs and increased flexibility provided by Voice over IP corporate communications.

Armour Mobile is FIPS 140.2 validated and has been awarded many other certifications including CPA (Commercial Product Assurance) from the National Cyber Security Centre (NCSC) and is approved for use at NATO Restricted.

 

Posted on

Is someone listening in on your confidential calls?

The rogue cell/IMSI catcher hack and how 4G won’t necessarily solve the problem

You’re travelling, working on a new deal that’s just about to close.  You’re involved in the final negotiations. You need to check a few points with colleagues back at base.  You call them from a quiet place, away from eavesdroppers, from your mobile. But what about electronic eavesdroppers?

These days a voice call is just another piece of data, and it can be easily intercepted, and you’d never know.

The services and apps you use might claim to be encrypted, but what does that mean?  Exactly what is encrypted? Do you have control of your data/voice call and can you guarantee its integrity through to the receiving end?

How can you prevent it being intercepted by an IMSI-catcher attack, for example?

An IMSI catcher or a rogue cell as it is sometimes referred to, hoovers up details of callers’ International Mobile Subscriber Identity, hence the name. IMSI catchers are used by legitimate law enforcement to catch serious criminals and terrorists, as well as by criminals for malicious purposes.

IMSI catcher – The way it works

One of the issues with the original GSM network (often referred to as 2G) specification is that it required the handset to authenticate to the network but not vice versa. This meant that it was relatively easy to set up a base station pretending to be the network for nefarious reasons. There are various terms for this including Stingray, as US term, IMSI is more generally used, and the term rogue cell which can cover a wide range of things.

The IMSI catcher attracts mobile phones in close proximity to connect to it, thinking that it is a legitimate base station. It then logs the mobile’s details and location by use of the International Mobile Subscriber Identity.  If the IMSI catcher has its own SIM, it can log into the network which enables it to do much more.  For example, it can listen into or record calls by breaking the much weaker encryption used by the GSM network.

There are three modes of encryption for a GSM/2G network, A5/0 – which is no encryption, or A5/1 and A5/2.  Both of the latter two cyphers were reverse engineered as early as 1999. Which means that even without an IMSI catcher, it is, in theory at least, possible to listen in to calls in real time. As commercially available processing power has become exponentially greater, real time decryption of calls has been demonstrated on a number of occasions.

A 3G network offers better encryption, but the IMSI catcher base station forces the mobile back to 2G, negating the stronger 3G encryption.

How might 4G help and why doesn’t it?

Given the many years of development of telecoms networks and huge investment of time and experience it has taken to agree the specification for the 4G networks internationally, it has been assumed that there would be much better protection of privacy.  To some degree there is. However, the 4G network is based on a complex set of standards and protocols, and as with any computer system, there are going to be security holes; there always are, hence the advent of Patch Tuesday.

4G uses mutual authentication between the base station and the mobile handset. So in theory it is more secure as it is supposed to hide your IMSI, using a temporary IMSI during a call. However, in order to first connect to the base station, the phone has to give its real IMSI, so the real IMSI is always transmitted at least once and a fake base station can make use of that. Since 4G mobiles have to support 3G and 2G for areas lacking full 4G coverage, once the call has been intercepted, it can be forced back to 2G technology, and so again, the call is compromised.

Additionally, not every operator provides the same security, as the original 4G specification left it up to the service provider to decide which elements of security it implemented. This means that 4G/LTE networks cannot guarantee your calls will be transmitted safely with no interception.

Another point to keep in mind, is that we are assuming that the carrier wants to protect your call. When travelling abroad this may not be the case. Some regions are more prone to malicious attacks either by state actors or criminals; therefore you can’t afford to trust mobile networks when travelling, particularly if you are going to be discussing business deals or intellectual property.

Easy to set up and easy to conceal

These days, IMSI catchers can be set up for less than £1000, and they are small, so they are very portable. Someone could conceal an IMSI catch under clothes, with any larger components hidden in a back pack. They can be mounted on a drone, or a light aircraft or helicopter, which leaves even the most innocent-seeming locations potentially vulnerable.

As an ordinary mobile user, you would never know if your calls had been intercepted by an IMSI catcher. There is technology to enable you to check which base station you are connected to, but generally speaking they require a technically knowledgeable user and so would only really be used by law enforcement agencies.

It’s not just the secret services that suffer from these type of attacks. Misuse of base stations by oppressive governments can affect journalists or law enforcement may need to protect their operational data from the felons they wish to apprehend.  Criminals may target a specific company to steal industrial secrets, commercially sensitive information, intellectual property, or to eavesdrop on private conversations. Financial details and medical records could be compromised, and so too could high profile celebrities.

How can you keep your conversations private and secure?

There is Government certified technology available that can help mitigate this type of hack. A secure communications platform can protect against an IMSI catcher attack by securing calls and texts between two endpoints, which could be a mobile phone and a desk phone, for example. It does this by using software installed on the phone that does the encryption and decryption. Whatever is sent from the mobile using the software, be it a call, text, attachment such as a video or photo, is completely encrypted end-to-end, and therefore protected.

This type of secure platform can be integrated with existing phone systems, so that calls can be protected both inside the organisation and outside.

Posted on

Armour Communications showcases new Armour Black solutions at DSEI

DSEI Logo

Higher assurance solutions now available for high threat user groups, protecting mobile communications from eavesdroppers with Armour Mobile

DSEI, 12 – 15 September, ExCeL, London

Stand No: N7-197  

London, 18 August, 2017: Armour Communications, a leading provider of specialist, secure communications solutions for Windows 10 Desktop, iOS and Android smartphones/tablets will be showing its flagship solution Armour Mobile, which provides all the functionality seen in consumer-grade (free) apps but with the benefit of significantly enhanced security. New for DSEI is Armour Black, a range of higher assurance solutions for Government, Defence, covert communities and the security-conscious Enterprise.

Offering the most comprehensive and flexible solutions currently available, Armour Mobile provides secure voice calls, video calls, one-to-one and group messaging, voice and video conference calls, file attachments and sent/received/read message status. Armour Mobile protects mobile communications from devices such as IMSI catchers, or hacks using the SS7 protocol and others. It enables secure collaboration between trusted colleagues when discussing sensitive and/or classified information.

Armour Black provides the same great user experience as Armour Mobile, but is hardened with a range of third party products, to protect data classified up to SECRET.

Armour Blue, another sector specific variant of Armour Mobile, incorporates Push To Talk functionality which provides those features for emergency services and others that need to maintain usability and compatibility with 3GPP MCPTT standards.

David Holman, a director at Armour Communications commented; “We have gradually been expanding our range of specialist solutions based around Armour Mobile to cover a wide range of use cases for Government, Defence, Military, Covert and Emergency/Blue light services.

“Whether staff are using company issued devices or their own (BYOD), Armour Mobile is easily deployed and centrally managed, available either on the Armour secure cloud, or as a full on-premises solution where every element of communications is completely locked down and controlled. Armour Mobile is a software technology and protects sensitive and secret communications from eavesdroppers without the requirement or costs of a special phone or hardware.”

With its focus on interoperability Armour Mobile is the first secure communications app to connect to Skype for Business (previously called Lync) using standard Cisco SIP-based technology. This enables Armour users in the field or overseas to communicate securely using voice and video with corporate Skype for Business installations.

Also on show at DSEI will be the recently launched Armour Desktop which extends the secure mobile communications functionality of Armour Mobile and delivers it to organisations via a Windows 10 softphone.

Together Armour Mobile, Skype for Business and Armour Desktop enable users inside and external to the organisation to communicate transparently within a secure and private environment, while taking advantage of the reduce costs and increased flexibility provided by Voice over IP corporate communications.

Armour Mobile is available for download from the iOS and Android apps stores, and is also available for Armour Samsung Mobile, which provides an extra layer of hardware security by utilising the TEE (Trusted Execution Environment) for key storage and decryption.

Armour Mobile is FIPS 140.2 validated and has been awarded many other certifications including CPA (Commercial Product Assurance) from the National Cyber Security Centre (NCSC) and is approved for use at NATO Restricted.

In addition to the Armour Comms stand no: S7-197, Armour Mobile can also been seen on the following partner stands at DSEI:

  • Leonardo, stand no: S5-110
  • BAE, stand no: S3-110, ND3
  • GETAC/Serbus, stand no: S9-120
  • MilDef, stand no: S4-320
  • L3 Technologies/TRL, stand no: S7-310
  • SEA, stand no: S6-240

 

Posted on

Armour Comms demos most comprehensive Secure Communications solution with preview of new Armour Desktop

Enterprise organisations now able to protect mobile communications of all kinds held on consumer and desktop devices from eavesdroppers with Armour Mobile

InfoSec Europe, 6 – 8 June, Olympia, London

Stand No: T10a

London, 5 June, 2017: Armour Communications, a leading provider of specialist, secure communications solutions will be showing its most comprehensive range of solutions for Enterprises to date at InfoSec Europe, including a technology preview of Armour Desktop. Its flagship solution Armour Mobile provides all the functionality seen in consumer-grade (free) apps, but with considerably enhanced security. Armour Mobile prevents mobile communications whether voice, text, video or conference from being intercepted by devices such as IMSI catchers, or hacks using the SS7 protocol and others. It enables secure collaboration between trusted colleagues when discussing commercially sensitive information such as corporate intellectual property, financial transactions, and customer details.

Armour Mobile provides secure voice calls, video calls, one-to-one and group messaging, voice and video conference calls, file attachments and sent/received/read message status. In addition, Armour Mobile was the first secure communications app to provide integration with Skype for Business.

New at InfoSec is Armour Desktop. Scheduled for general release by the end of June, Armour Desktop extends the secure mobile communications functionality of Armour Mobile and delivers it to the Enterprise via a Windows 10 softphone. This enables users both inside and external to the organisation to communicate transparently within a secure and private environment, while taking advantage of the reduce costs and increased flexibility provided by Voice over IP corporate communications.

Armour Mobile is available for download from the iOS and Android apps stores, and is also available for Armour Samsung Mobile, which provides an extra layer of hardware security using Samsung Knox. Details of how to download Armour Desktop will made available on release

David Holman, a director at Armour Communications commented; “Armour Mobile is ideal for any Enterprise that has sensitive mobile communications that it needs to protect.  For years organisations have been talking about protecting the end point – the mobile phone is the ultimate end point. Whether staff are using company issued devices or their own (BYOD), Armour Mobile is easily deployed and centrally managed, enabling Enterprises to protect their sensitive communications from eavesdroppers without the requirement for a special phone.”

Armour Mobile is FIPS 140.2 validated and has been awarded many other certifications including CPA (Commercial Product Assurance) from the National Cyber Security Centre (NCSC) and is included in the NATO catalogue.