IT Risk Space - Risk Management category

Is Mobile Telephony via GSM still Secure enough?

Sat, 09 Jan 2010 11:39:00 GMT

As all of you most probably have heard of, on 28th of December 2009 a German computer engineer announced at the CCC in Berlin that he had cracked the A5/1 cipher used in GSM communication. This would mean that someone could eavesdrop on confidential information exchanged via a cell phone.

I have asked my Cryptography Competence Center around Prof. B. Esslinger to analyzed the risk and to provide a security report with further details and recommendations, which you can find below. More information about the work of Prof. Esslinger and the open source crypto community can be found on the project page at http://www.cryptool.org/index.php/en.html

Currently, we see the risk still as acceptable and from a technical point of view, the situation is under control. However, this might change very soon and therefore this risk area must be continuously monitored.

NOTE: In general, phones, especially cell phones and cordless phones, shall not be considered as secure communication devices. For business areas with high confidentiality requirements, the usage of encrypted mobile phones is strongly recommended.

I really like the report and therefore I wanted to share with all of you as you may have the same questions or requirements in your area of responsibility.

Cheers
-Andreas

Read full article

Open-Source project jeopardizes banking with mobile devices

Fri, 25 Sep 2009 15:06:00 GMT

In August 2009 Karsten Nohl introduced his GSM Open-Source project @ HAR 2009 (Hacking at Random http://har2009.org) in the Netherlands. In his speech “Subverting the security base of GSM” he and Sascha Krissler explained the weaknesses of the standard encryption method A5/1 used globally around the world within the GSM networks. More details can be found within the full story.

Enjoy
-Andreas

Read full article

Information Operations

Mon, 17 Aug 2009 19:42:00 GMT

During economic crisis we would like to provide you with some awareness information around information operations.

The following article has been written by Martin Rutishauser, MAS Information Security and Security Engineer at Ispin AG.

Martin and I have studied together at the University of Applied Sciences in Lucerne and are good friends since, both being IT-Security enthusiastics.

Martin is mainly working around the subjects penetration testing, forensics and information operations.

At this point I would like to thank Martin for taking time to write this article, which might be an eye opener to some.

Read full article