If you’re still using a cellphone based on early digital standards, you better be careful what you say. The encryption technology used to prevent eavesdropping in GSM (Global System for Mobile communications), the world’s most widely used cellphone system, has more security holes than Swiss cheese, according to an expert who plans to poke a big hole of his own.

Karsten Nohl, chief research scientist with H4RDW4RE, a Sunnyvale, Calif.-based security research firm, is mounting what could be the most ambitious attempt yet to compromise the GSM phone system, which is used by over 3 billion people around the world. Others have cracked the A5/1 encryption technology used in GSM before, but their results have remained secret. However, Nohl, who earned a Ph.D. in computer science at the University of Virginia and is a member of Germany’s Chaos Computer Club (CCC), intends to go one big step further: By the end of the year, he plans to make the keys available to everyone on the Internet.

…

Link

…

Smartphone security business challenge and channel opportunity

Sales and support opportunities for encryption are likely to grow as smartphones use more business applications, such as SAP, and store more corporate data. As discussed earlier, the potential for antimalware sales and support is enormous when smartphones finally become subject to widespread attack.

While encryption vendors offer mobile-specific products on their own, they are also included as part of their overall corporate endpoint encryption suites. Check Point’s Svegby said PC encryption orders for, say 5,000 seats, often come with an additional 150 to 200 licenses for smartphone encryption.

Some vendors, such as Credant Technologies Inc. and Check Point offer only encryption products, others such as F-Secure Corp. and Kaspersky Lab Inc. offer only antimalware, and still others, such as Symantec and McAfee Inc., offer both encryption and antimalware. In terms of operating systems, most vendors support Windows Mobile and Symbian, and some support Palm OS and Blackberry as well. There have been reports that several vendors are working on iPhone antimalware, as well.

…

Link

by Glenn Fleishman, Macworld.com

We’re all so accustomed to having Internet access in so many places—at home, at the office, at airports, at coffee shops—that it can be infuriating to travel and find yourself with low-speed service or none at all.

Fortunately, there are six good ways to make sure you—and anyone traveling with you—can can access the Internet using your laptop’s built-in wireless networking, even when you’re nowhere near a Wi-Fi hotspot.

Note: Two of these options—cell phone tethering and using a 3G adapter—connect a laptop to the Net and then share that connection from the laptop.

To set up that sharing, first establish the Net connection to the laptop. Then open the Sharing preference pane (System Preferences -> Sharing) and select Internet Sharing. (Don’t check its box yet.) From the Share Your Connection From drop-down menu, choose the active Internet connection. In the To Computers Using list, check the AirPort box. If you want to password-protect the connection you’re sharing (an advisable thing to do), click AirPort Options and set it there. Finally, check the box next to Internet Sharing to turn sharing on. You may need to repeat these steps each time you enable the connection.

AirPort Express in a hotel room The AirPort Express () is a portable powerhouse of a base station. In hotel rooms that have only wired Ethernet for Internet access, plugging an Express into that wired connection not only lets you work on your laptop from anywhere in the room; it also lets you share that connection with other devices that have Wi-Fi but no Ethernet (such as an iPhone) and with family members or colleagues. Apple says the AirPort Express can support up to ten simultaneous Wi-Fi connections. You may first need to connect your laptop via Ethernet to register or activate the room’s connection, then plug in the AirPort Express. Make sure to activate WPA2 Personal encryption so your shared connection isn’t accessible to just anyone.

Tethering with your cell phone Tethering services for cell phones let you turn the mobile device into a modem. The phone connects to the Net over a 2.5G or 3G network; you then connect your laptop to the phone via Bluetooth or USB—voila, you’re online. You can then use your laptop as a base station to share that connection via Wi-Fi. Unfortunately, the iPhone doesn’t yet offer tethering in the United States; AT&T promises that it’s coming. If you’re using another phone, check with your cell provider. Some phones may let you tether, but the provider might slap expensive transfer fees on top of whatever data plan you already pay for.

Make your phone a hotspot A small but growing number of mobile phones have both 3G and Wi-Fi. With the right software, you can turn such phones into hotspots. Joiku’s JoikuSpot Light(free) and JoikuSpot Premium (€15) work on the Symbian S60 smartphone platform. The Light version supports the HTTP protocol alone, so the only thing you can do with it is surf the Web; the Premium version supports all Internet protocols. WalkingHotSpot ($25) works with Symbian S60 as well as many Windows Mobile phones. As with tethering, check with your carrier about extra data fees.

3G adapter for your laptop AT&T, Sprint Nextel, T-Mobile, and Verizon Wireless all offer Mac OS X drivers for a variety of 3G modems, which connect your laptop to the net over 3G data networks; many of those modems connect via the USB port, so they’ll work with any Mac portable. Unfortunately, that access comes at a high price: service plans typically cost $60 a month, with a two-year commitment and a usage limit of 5GB per month (combined uploads and downloads). (Cheaper plans, if a carrier offers them, include ludicrously small amounts of monthly use.)

A USB modem may be free with your contract, but it may cost as much as $150 to $250 without one. (If you purchase your modem up front, T-Mobile lets you pay its monthly data rate without a contract.) Fortunately, such modems can be swapped among nearly any Mac or Windows system. You can typically, but not always, share the resulting 3G service via Wi-Fi; some drivers might prevent it.

3G as you go Virgin Mobile (now owned by Sprint Nextel) has a pay-by-the-byte 3G plan. TheBroadband2Go USB modem costs $99; you then buy blocks of usage (in megabytes or gigabytes) as you need them. Pricing starts at $10 for 100 MB (must be used within 10 days) up to $60 for 1 GB (expires in 30 days). For those who travel and need access less frequently, this plan makes great sense. As with other 3G adapters, you can share your Virgin Mobile access via Wi-Fi, too.

3G Wi-Fi router The Novatel MiFi 2200 () isn’t the first hardware to combine 3G data access with a wireless router in one box. But such gateways—the Kyocera KR2, for example—have typically been the size of regular desktop routers. The MiFi, by contrast, can fit in your pocket. It allows up to five simultaneous connections and has an internal rechargable battery, so it can continue to provide that access even you’re away from a power outlet.

The MiFi is sold by Verizon Wireless and Sprint Nextel. Both firms charge $100 for it (after rebates, with a contract). Verizon offers data plans (with a two-year contract) for $40 for 250MB per month or $60 for 5GB per month. Sprint Nextel only offers a $60 plan (for 5GB per month, with a two-year contract). The MiFi can be purchased separately for about $250 and used with Verizon’s network at a $15-per-day rate for on-demand usage.

Glenn Fleishman is editor of Wi-Fi Networking News and author of Take Control of Your 802.11n AirPort Network (TidBITS Publishing Inc., 2009).

http://www.macworld.com/article/144012/makeyourownhotspot.html

Skype uses SSL which uses electronic certificates and 128 bit encryption (standard for credit card transactions online also) This level of encryption is NOT appropriate for even top secret level communications. How many times have credit card numbers been stolen online?

http://en.wikipedia.org/wiki/Transport_Layer_Security

128-bit 2^128 2 multiplied by 2 128 times over. = 339,000,000,000,000,000,000,000,000,000,000,000 (give or take a couple trillion…).

Gold Lock Enterprise uses 4 different encryption methods. One of which is 16,384 Bit Authentication. That is 2 multiplied by 2, 16,384 times over (not just 128 times). This method IS appropriate for top secret level communications. Enterprise uses 16,384 Bit Authentication Elliptic Curve 384 Bits (RSA 7680 Bits Equivalent) AES 256 Bits Diffie Hellman 4096 Bits

AES – http://en.wikipedia.org/wiki/Advanced_Encryption_Standard Top Secret appropriate

RSA – http://en.wikipedia.org/wiki/RSA Top Secret appropriate

Diffie Hellman – http://en.wikipedia.org/wiki/Diffie-Hellman_key_exchange Top Secret appropriate

In addition to this technical “stuff” the facts remain that Skype provides a key to governments for lawful interception (which means all the security in the world in now a mute point) and  Skypes 128 bit encryption has been broken, and hackers now easily intercept their calls.

http://sigillu.wordpress.com/category/technologies/skype/

As you can see Enterprise has significantly higher encryption capabilities than Skype. Skype encrypts just enough to satisfy their customers. Gold Lock takes pride in having the best and highest encryption software on the market. Gold Lock Enterprise is a military grade encryption software. No military uses Skype to relay orders or pass top secret information.

This screen shot shows the user interface of UCSniff. The user can listen in on a conversation and see the video of two people talking on an IP-based video phone. The two video screens show what each of the video phones is displaying.

(Credit: Viper Lab, Sipera Systems)

<link>

…

“As the private call is in progress, we can see and hear what is happening,” said Jason Ostrom, a developer of UCSniff and director of Viper Labs, the research arm of security firm Sipera Systems. “There’s real-time violation of confidentiality.”

In addition to monitoring voice conversations as they happen, UCSniff can also bug video conferences in real time. Ostrom said he and fellow Viper Labs researcher Arjun Sambamoorthy plan to show those capabilities at Toorcon as well.

With the proliferation of iPhones and other smartphones, plenty of businesses and individuals have sought to save money on roaming charges by routing calls over the internet instead of over carrier networks. Adam Boone, a vice president at Sipera, said one large, unnamed client logs more than 1 million minutes per month in such VoIP calls.

The problem, he added, is that many of the iPhone apps for VoIP calls don’t provide encryption capabilities, making the conversations ripe for eavesdropping. (Sipera plans to unveil a new product to protect such users next week).

…

<link>

A software developer who designed a way to tap and record calls made on Skype and other VoIP networks has made the source code of the spying program public, a move he said will allow other programmers to build workarounds to the potential threat. The programmer, Ruben Unteregger, was tasked by his former company ERA IT Solutions to write a Trojan horse program that could tap VoIP calls for the Swiss government.

Apparently, the program bypassed Skype’s heralded encryption process, one that has vexed security officials in Europe multiple times.

In a translated interview, Untregger discussed his rationale for releasing the code.

“The code will be published, it will get analyzed as soon as the binaries got uploaded, signature patterns will be created by anti-virus companies, the malware will be detected, blocked and deleted, if it tries to infect a system,” Untregger said.

Untregger’s motives appear to be genuinely in the interest of private citizens and enterprises that use VoIP services like Skype, as the publicizing of the code makes its use by security agencies redundant, according to a Computer World report. However, making this code available could have negative repercussions if hackers can use it to build even more powerful tapping programs. Other instances of Skype hacking, such as China’s purported monitoring of dissident communication via VoIP programs, gives one pause when considering the public availability of such information.

<link>