Encryptsolutions

Working in IT Security I receive and get to read lot of security related articles. I will list here a summary of the ones I found the most interesting, the idea is to try publishing this list on a weekly basis… not sure I will always have the time to do so, hence why the subject of those posts will be numbered, and we start with week #1:

-          Safari Vulnerability
An Autofill vulnerability in the Safari browser which allows attackers to get info from your personal contact details.
Reading the comments on that article, it is not clear if this could also affect other WebKit based browsers such as Chrome.
It may be best practise anyway to disable the auto fill option in any browsers you are using.
http://jeremiahgrossman.blogspot.com/2010/07/i-know-who-your-name-where-you-work-and.html

-          New GSM-cracking software release… the call of Kraken!
A software called Kraken has recently been released and claims to crack the A5/1 encryption algorithm used by some GSM networks. Although this algorithm had been subject to attacks before, this is a new and very efficient method. According to that article, the GSM network is also the fall-back network for the 3G network, thus maybe exposing the security of 3G users too (but not of the 3G network per say)!
http://www.networkworld.com/news/2010/072210-new-kraken-gsm-cracking-software-is.html

-          Simple and safe password
A recent Microsoft research has described a new password policy scheme using simple but safe passwords. Instead of enforcing a complex password policy, the policy is based on password popularity… if a password is too popular it becomes a forbidden password.
Now I can see two requirements for this to work: a) (as mentioned in the article) A large user base population and b) (not mentioned in the article) for the system to have access to users’ clear text passwords, or for a unique “salt” to be used in the hash algorithm… not sure it would be a good thing!

The idea is that if all the passwords used are not “popular”, then it doesn’t really matter as much if they are complex as they would not be part of the “popular” passwords list. This however, would not protect you against a brute force attack!
Anyway, this is a refreshing take on a very old IT security issue…
http://msmvps.com/blogs/donna/archive/2010/07/21/passwords-that-are-simple-and-safe.aspx

- Who cares about encryption?
An interesting poll study showing there is a consensus for most people that encryption is required, especially for mobile devices/users, but technical difficulties go in the way… something which has been associated with encryption technologies for a long time and although a lot has been done in recent years to simplify encryption implementation there is still some way to go.
http://www.theregister.co.uk/2010/07/20/who_cares_about_encryption/

Truecrypt is a tool I have been using for a while, it is a great product and… free!

It allows for full disk encryption, being your desktop hardisk or a USB stick.

A new version has just been released, version 7, and it now provides:
- Hardware acceleration
- Automount (windows)
- Security improvements related to windows hibernation files

Its main features are:
- Creates a virtual encrypted disk within a file and mounts it as a real disk.
- Encrypts an entire partition or storage device such as USB flash drive or hard drive.
- Encrypts a partition or drive where Windows is installed (pre-boot authentication).
- Encryption is automatic, real-time (on-the-fly) and transparent.
- Parallelization and pipelining allow data to be read and written as fast as if the drive was not encrypted.
- Encryption can be hardware-accelerated on modern processors.
- Provides plausible deniability, in case an adversary forces you to reveal the password:
- Hidden volume (steganography) and hidden operating system.

More info can be found on the following website: http://www.truecrypt.org/

This morning I checked my spam folder related to this website/domain name and noticed there had been no new spam for about a week… not that I am missing it but this did not sound quite right!

Indeed, it looks like my service provider recently had some issues with one of their site being compromised and used to host some malicious software and as a result their back-end domain was blacklisted by Google. Something they did not like too much…

They took the drastic decision to change their back-end domain, it seems to have worked. But in the process they have messed up some accounts. They have now fixed the issue with my domain but if you have sent me an email recently then, I am afraid, that email is lost and you probably did not receive any error message either!

I never thought spamming could be useful to the receiver of it, but in this case the lack of noise highlighted another issue :)

For over 3 years this website has not been updated and it was time to give it a face lift!

It is actually quite astonishing to think this website has existed since 1998, 12 years! I guess I am getting older, my hair are getting greyer and there is less of it! One thing that hasn’t change though is my interest in Cryptography.

Because of a busy professional life in the IT Security world I haven’t been able to work on the BUGS algorithm for many years. However, I have recently completed a Master in Information Security at the London Royal Holloway University. I logically chose to work on a cryptography subject for my Master Thesis. This allowed me to spend some time back on the BUGS algorithm and, for the first time, learn some cryptanalysis technics!

The main subject of my thesis was to give an “Overview of Modern Symmetric-Key Cipher Cryptanalysis Techniques”, as such after a general introduction on cryptography and cryptanalysis I focused on two main cryptanalysis technics:
Linear and Differential Cryptanalysis
Finally, I started to conduct a cryptanalysis of my BUGS algorithm. Although I still haven’t conducted a full cryptanalysis on BUGS, my early tests seem to indicate the BUGS algorithm, may show some weaknesses if not used with its default settings. On the other hand it seems to be quite secure when default settings are used . However, I would need to pursue those tests further to prove this is correct.

In the process I have also highlighted what I believe could be a new type of cryptanalysis attack:
Unrestricted XOR-Sum Uniqueness Cryptanalysis attack
At this stage this is just a suggested new type of attack and more work is required to find out if this attack is indeed possible and if it offers any value!

So here you have it, this is what I will try to spend some time on in the coming months/years:
- To conduct a full cryptanalysis on BUGS and publish the results
- To investigate my new type of cryptanalysis attack

My MSc Thesis document is available HERE.