Subject: [NEXTEL-1] Wireless Phones Will Never Be Secure-

From: [email-masked]
Date: Mon, 19 May 2003 19:50:08 -0400

Wireless Phones Will Never Be Secure-

The mobile office: Spying a gap in the security of cyberspace:
Mobile phone security is becoming more sophisticated, but data
will never be totally secure - and intelligence agencies want to
keep it that way, writes Conal Walsh

Source: "Observer, The; London (UK)"
Publication date: 2003-05-18
Arrival time: 2003-05-19

HOW SECURE are mobile phones? It is a question that will become ever
more pressing as the new 2.5G and 3G phones take over in the next few
years, providing their owners with powerful internet facilities and full
access to their corporate intranets while out of the office. But there is also
the risk that they will be vulnerable to attack from hackers.

More and more businesses, especially those with itinerant sales forces,
such as insurance companies, have 'virtual private networks' (VPNs),
allowing employees to view their corporate intranets from anywhere.

But the new mobile phones will multiply the number of people logging on.
And with so much sensitive commercial information suddenly hurtling
through cyberspace, a big concern will be to keep it out of the hands of
saboteurs and corporate spies.

Security breaches are already thought to cost US businesses $500m a
year, and safeguarding sensitive information is at the top of many 'to-do'
lists in the IT departments of large companies.

'The true potential for generating revenue from mobile data services will
only be realised if network operators guarantee delivery of the level of
security their customers demand,' said a recent study by Lucent
Technologies.

But Mark Blowers, an analyst at the Butler Group, fears that an
industry-wide accepted strategy to combat security breaches is many
years away.

'The new phones from Nokia, Siemens and others are basically little PCs.
They are based on Java, or on the Symbian operating system, and they
transport data around in "packets". So they're vulnerable to hackers or
viruses in a way that phones never were previously,' he said.

Of course, internet technologies have their own security features, many
with a good record. Secure socket layer (SSL), the encryption facility
originally designed by Netscape, allows surfers to make credit card
payments over the net. But it doesn't always work. And with new mobile
technology bringing large volumes of sensitive corporate information on to
the web, even one major leakage could be disastrous.

As it happens, the new mobile phones will use not SSL but newer security
standards such as IPsec (short for IP security), which provide easy
access to a greater variety of applications and folders on the corporate
server and also transmit data faster.

But however effectively confidential information is encrypted, there is still
no guarantee that the right person is receiving or sending it. Sometimes all
a hacker has to do is get hold of the right password.

'Authentication is the biggest problem,' says Blowers. 'How do you really
know who's logging on to your corporate system? Are passwords really
the way forward? Maybe we should be focusing more on authentica tion
technology. There are sophisticated voice- recognition and biometric
identification systems out there, but the mobile industry hasn't shown
much interest.'

At least mobile phone users are usually more easily identified than PC
users, because of the SIM cards in the handsets. But there are still a
thousand ways in which a phone and its Pin number could fall into the
wrong hands.

In the absence of any more futuristic alternatives, businesses are being
urged not to forget an old-fashioned system of passwords and usernames
to give added layers of protection to their VPNs.

The likes of McAfee and Texas Instruments are busy developing
security-enhancement products for mobile operators and the
manufacturers of mobile phone devices, as well as large businesses with
highly developed remote access systems.

But ultimately, the next generation of mobiles will offer no absolute
guarantees of security from hackers, and it will remain the responsibility of
companies to decide how much money they want to spend on keeping
their systems secure.

Mike Gerdes, research director for the security firm Red Siren, has
expressed a fear that unwise skimping might even extend to certain
network operators reluctant to pay for the extra servers required to
safeguard their clients' security.

On the other hand, the added security benefits of 3G and 2.5G phones are
designed not only for phone users, but for the mobile phone companies
themselves. Second-generation mobiles have always been vulnerable to
hackers who set up their own transmitters, known in the trade as 'rogue
base stations', to intercept or misdirect traffic or hop on to a carrier
network for free.

Few, if any, mobile phone operators admit how much money they are
losing through this practice, but many experts estimate that 'piracy' is
costing them more than 10 per cent of total revenues. The new technology
is designed to thwart it.

With encryption becoming ever cheaper, more powerful and more difficult
to crack, a halt to progress may come from an unlikely source: our
intelligence agencies. Correspondence between the British and US
governments, obtained recently by the Guardian under America's freedom
of information laws, reveals concern about encryption at the highest levels.

In May 1999, Janet Reno, then US Attorney General, wrote to Jack Straw,
then Home Secretary, saying: 'I believe that the difficulties that encryption
will pose for law enforcement are among the greatest challenges we will
face in the coming years.' Straw replied: 'I fully share your concern at the
threat posed by criminal use of encryption.'

Since then, the 11 September attacks have added urgency to official
eavesdrop ping, and new laws make it easier for law enforcement agencies
to confiscate encryption codes. They are unlikely to countenance any
technology that makes it more difficult to catch terrorists.

http://cnniw.yellowbrix.com/pages/cnniw/Story.nsp?story_id=38887492&ID=cnniw&scategory=Telecommunications%3AWireless&

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Get A Free Psychic Reading! Your Online Answer To Life's Important Questions.
http://us.click.yahoo.com/Lj3uPC/Me7FAA/uetFAA/61FxlB/TM
---------------------------------------------------------------------~->

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/