Security

I read this CNET article headline with a bit of concern...

Demos to show spying on mobile IP calls

However, that concern was greatly reduced after I read this in the article: ...listen to the conversation of someone talking on an iPhone over an unsecured wireless network. The exploit targets smartphones that are using the SIP (session initiation protocol) for VoIP. Yes, this is definitely a problem if you are using SIP to condut a VoIP session in an open public hotspot. But, quite frankly, would you really conduct a sensitive conversation somewhere where real live human beings are nearby and can hear what you say with their flesh and blood ears?

That said, UCSniff is an interesting and important development. It is also open source and available to anyone from SourceForge.net:

UCSniff ip video & voip sniffer

Here's what its overview notes it is capable of:

- Allows targeting of VoIP Users based on Corporate Directory and/or extensions
- Support for automatically recording private IP video conversations
- Automatically re-creates and saves entire voice conversation to a single file that can be played back by media players
- Support for G.729, G.723, G.726, G.722, G.711 u-law, and G.711 a-law compression codecs
- Support for H.264 Video codec
- Automated VLAN Hop and VLAN Discovery support
- A UC Sniffer (VoIP and Video) combined with a MitM re-direction tool
- Monitor Mode
- Sniffs entire conversation if only one phone is in source VLAN
- Gratuitous ARP Disablment Bypass support
- TFTP MitM Modification of IP Phone features
- Realtime VoIP and Video Monitor

I've mentioned the Bluetooth technology...

Phoenix Freeze

...(of Phoenix BIOS) that locks a computer based on the proximity of a paired Bluetooth enabled phone. The limitation this product presents is that its enabling technology. I've never seen a Windows desktop PC with Bluetooth (although all current iMacs have it). And, even many netbooks and notebooks are Bluetooth-less.

Stephen Tarzia presents an alternative (and apparently Open Source) solution based on sound, specifically very high frequency sound...

Stephen P. Tarzia: Sonar Power Manager

Sonar Power Manager requires a notebook computer capable of emitting sound above 20kHz. Most humans can't hear this high frequency sound. The software uses this high frequency sound and the notebook's microphone like a sonar. The sound is emitted through the notebook's speakers, is bounced off of the human body (you), and detected by the notebook's microphone. Its function is to shut off the notebook's screen as soon as you move away from the notebook (echo reflection off of you stops).

There are a couple of problems with this though:

- As the author notes, note all notebooks are capable of creating 20+ kHz frequency sounds
- He also notes that some people hear annoying lower frequency harmonics of the 20 kHz wave

To this I will add this speculation:

- I wonder if animals that can hear very high frequency sounds (like dogs) will be annoyed by this?
- I wonder if teenagers and young children who may also be capable of hearing this frequency or its harmonic will be annoyed by the sound?

Sonar Power Manager is available as a free Windows installation file as well as in source code form for compilation under Linux or Windows.

Via SlashDot

Have you ever read an article from what appears to be a reliable source of news and wonder if it is a hoax? Here's one that's puzzling me from CRN Australia...

Safety first for IT executives in China

The report says that: Senior executives in US IT companies have been advised by the US Government to follow extremely strict policies for visits to China which extend far beyond standard software protection. These polices including buying notebook computers that are only used in China and not while in the U.S. and throwing away phones after returning from China. Here's what puzzles me...

- Why is this being reported in an Australian publication?
- The article mentions "senior executives" (plural) being advised by the US Government. Only one executive (Symantec CTO Mark Bregmam) is quoted
- And, who in the US Government is doing the advising? The State Department, Homeland Security, one of the three-letter agencies?
- And why would Bregman, the CTO of a large well-known cyber-security company be caught saying something like this as a quote: However, he said he was "pretty relaxed" when it came to following the security policies. "I don't let my IT department near my laptop," he said.

The story sounds plausible. But, things don't seem to add up.

Via Geek.com

I get really irritated by sensationalistic scare headlines like this one...

New attack cracks common Wi-Fi encryption in a minute

And, based on what I read in the article (which is completely factual to my understanding), I'm going to guess the article's author didn't write the article's headline.

Here's the thing, as the article clearly states, this particular crack to an old WiFi encryption late last Fall 2008. The news here is that it can now be done faster. But, here's the good news, you are probably safe if you use a reasonably modern WiFi Access Point that supports WPA2 And, if you have a WiFi AP that only is only certified for WPA (no "2"), check if you can change from the TKIP to AES protocol and all should be well.

If you are interested in the gory technical details of the WPA TKIP hack, I strongly recommend listening to or reading the transcription for this Security Now podcast from November 13, 2008...

The TKIP Hack Episode 170

Steve Gibson gives an excellent overview of the whole wireless LAN security alphabet soup. You should have a good idea of what is what when you hear and read about WEP, WPA, WPA2, TKIP, AES and CCMP after listening to this podcast.

While reading Randy Cohen's piece in The New York Times...

Jam Session: More Text on Texting

...I came across the usual comment made in such articles that The law notwithstanding, these gizmos are widely available on the Internet. Cohen's article points to a URL name that looks like it is an online store for phone jamming equipment. But, it didn't have anything directly available for purchase and looked more like a spam-link site than anything else to me.

So, how hard is it to find a legitmate source of phone and GPS jamming equipment in the U.S.? I had never looked for this kind of product myself although friends and I have had many discussions about the dangers of deploying such equipment even for something that sounds "good" like reducing distractions in theaters and classrooms.

I went to the place I usually go in search of "stuff": Amazon.com. Searching for the phrase "cell phone jammer" resulted in a bunch of what looks like relevant results. Prices range from just below $50 to near $200. The devices jam cell signals and often GPS reception as a "bonus" with radii ranging from a low of 10 meters to high of 75 meters. The devices can block both CDMA and GSM voice frequencies as well as 3G data. And, yep, there are ratings and comments available for some of the products so you might be able to gauge how effective these blockers are.

So, the answer is: It is pretty easy to find a cell phone (and GPS as it turns out) jammer in the U.S.

Image courtesy of Phoenix Technologies

Phoenix Technologies (they of the Phoenix BIOS fame) released an interesting utility for Windows XP & Vista based notebooks and netbooks with a Bluetooth radio...

Phoenix Freeze

It is one of those products that implements a simple idea that no one else has apparently bothered to do (or at least make widely known and widely available): The ability to lock your Windows XP or Vista based Bluetooth enabled notebook or netbook by pairing it with a Bluetooth enabled phone and using proximity to lock or unlock your computer.

This is how it works: You use Phoenix Freeze to pair a Bluetooth-enabled phone with your Bluetooth-enabled notebook or netbook. Then, when you walk away from the notebook, Phoenix Freeze detects the Bluetooth signal loss and locks your notebook. It also has the option to suspend it to reduce power use.

The current download lets you evaluate the product on a 14-day trial basis. I don't see a price associated with the product.

Phoenix notes that they are working on versions to support Windows 7 and Mac OS X in the future.