The researcher – who goes by the name of Notrax (also the name of an anonymous web browser) – says that he has "successfully intercepted and compromised phone calls made using 12 commercially available mobile voice encryption products."
Intercepting encrypted voice transmissions on the host PC is nothing new, as the German government `floated' the idea of installing trojans back in 2007 to spy on voice and internet communications by suspected criminals.
As reported by Infosecurity at the time, the ideas were claimed as being shelved by the German government later in the year owing to a public furore – although anecdotal evidence by the Chaos Computer Club claims the trojans became reality some months later, and are allegedly being used by the German secret service.
Notrax claims that, using a $100 piece of kit and a copy of FlexiSpy – a commercial eavesdropping application for Blackberry, Symbian and Windows Mobile smartphones – plus a self-coded trojan, he can intercept the data feed from the microphone and speaker, effectively bypassing the encryption process.
Whilst Infosecurity notes this approach is similar to the use of so-called `infinity' bugs on landline phones, what is interesting about the claims is that Notrax also says he can suppress any notifications of his actions to the user of the host PC.
Notrax describes his tests extensively at www.infosecurityguard.com, where he has linked to some Youtube videos.
Encryption systems allegedly cracked through the use of Notrax' modus operandi included Caspertech, CellCrypt, Secure Voice and Phil Zimmerman's Zfone.
The three voice encryption systems that apparently passed the trojan intercept test with flying colours were Rohde & Schwarz's Bluephone-Secure, SecurStar's PhoneCrypt and Snapcell.
According to Wilfried Hafner, CEO of SecurStar, like most security breaches, Notrax went for the weakest link. He did not attempt to crack the encryption itself, but used simple wiretapping techniques," he said. "Unlike most of the vendors investigated, we recognised this potential security gap from the start and designed in measures to deliver complete end-to-end protection against eavesdropping," he added.
Hafner went on to say that PhoneCrypt provides military-level voice encryption for all types business, government, law enforcement and personal voice communication over mobile phones, landlines and internet telephony connections.