Encrypted Phone Firm Encrochat Used Signal Protocol - VICE

Posted: 23 Mar 2021 06:18 AM PDT

Image: Wanit Nantasuk / EyeEm

Hacking. Disinformation. Surveillance. CYBER is Motherboard's podcast and reporting on the dark underbelly of the internet.

Encrypted phone firm Encrochat, whose customer base was primarily serious organized criminals, used the Signal protocol as part of its encrypted messaging application, according to a law enforcement document obtained by Motherboard.

The news highlights what law enforcement agencies may increasingly do when confronted with robust, end-to-end encryption like that of Signal: unable to read the content of intercepted messages, authorities may turn to hacking the end-point device, or phone, itself to siphon communications. In the Encrochat case, French police deployed malware to Encrochat phones and obtained the content of users' messages.

"EncroChat encrypt their messages with the Signal Protocol. This is a commonly used encryption protocol that is freely available. I am unaware of any capability to decrypt messages encrypted using the Signal protocol," the document, written by a technical employee from the UK's National Crime Agency (NCA), reads.

Did you work for Encrochat? Do you have any more documents related to Encrochat arrests? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.

Many people know Signal as a free encrypted messaging app. But the eponymous organization behind the app also makes the underlying cryptographic protocol's libraries available for anyone to use. Companies, like WhatsApp, also use the protocol in their products. The hacking operation against Encrochat does not present any security issues for the Signal app or protocol itself.

Encrochat took stock Android devices and loaded them with the company's own applications. The phones had a feature that would wipe the device's contents if the user entered a specific PIN, and also ran two operating systems side-by-side. One appeared innocuous and resembled a normal version of Android. The other contained the Encrochat messaging application. Like other companies in the encrypted phone space, Encrochat's devices could cost thousands of dollars for an annual subscription.

A section of the law enforcement document mentioning the Signal protocol. Image: Motherboard.

For years British hitmen have used the devices, as well as drug gangs across the UK.

Last year, authorities managed to push a malicious update from Encrochat's server down to individual Encrochat devices, according to other law enforcement documents obtained by Motherboard. The malware could harvest the phone's GPS location, stored messages, passwords, and more information, Motherboard previously reported. In the wake of that large scale hacking operation, French police shared the collected data with multiple international law enforcement agencies, including the NCA as well as Dutch authorities. Police then carried out wide ranging raids and arrests, uncovering large scale drug trafficking operations, serious threats to life, and even a so-called torture chamber inside a sound-proofed shipping container with a dentist's chair.

A person in control of an Encrochat email address previously told Motherboard they shut down the network after discovering the hacking operation against their company.

Signal declined to comment about Encrochat's use of the Signal protocol. The NCA declined to comment. Encrochat did not respond to a request for comment.

Update: This piece has been updated to include a response from the NCA.

Subscribe to our cybersecurity podcast CYBER, here.

Encrypted Phones — iPhone and Android Encryption - Reader's Digest

Posted: 11 Jan 2021 12:00 AM PST

Don't let the term "encrypted phone" intimidate you. It's a feature you probably already have and use on your phone without knowing it—and that's a good thing.

Encryption may sound like a tech buzzword, but even if you're not tech-savvy, encryption is probably a very important part of your life. More than likely, your bank, credit card companies, and even some social media sites that you may use, including WhatsApp, incorporate encryption to protect your data. Your phone probably has this capability, too. Here's what an encrypted phone means and how to use it to protect yourself from identity theft.

What is encrypted data?

Encrypting your device means that the data (such as credit card info, social security numbers, addresses, or any other extremely personal information) that is entered into the phone will be jumbled up, making it indecipherable to anyone who might be trying to steal your information. To unjumble the information, it has to be unlocked using a password, PIN, or another key that identifies you as the owner of the information, according to Tom Kirkham, founder and CEO of IronTech Security.

"When you set a pin or passcode on your device and set up fingerprint or facial recognition, this is used to generate the key for encrypting and decrypting your device," says Jack Mannino, CEO at nVisium, a Virginia-based application security provider.

Want to be extra safe? Here are eight apps security experts would never have on their phones.

Why to encrypt your phone

Encrypted phones make it much harder for cybercriminals to gather your personal information because it is very difficult to decode encryption. Is encryption foolproof? "Device encryption is an added layer of security and a necessary step to keep hackers away; more often than not, cybercriminals are going to see a device is encrypted and just move on because it's too much work," says Kirkham. That said, "nothing is 100 percent foolproof when it comes to cybersecurity," he reminds us.

There are a couple of downsides to cell phone encryption. "An important thing to keep in mind is that it does slow down your phone, depending on the amount of data and the age/speed of the phone," says Tim Koster, tech expert and founder of CleverCreations.

A bigger caveat is that should you ever forget your PIN/password to your phone when it is encrypted, it is impossible to retrieve your data, Koster says. A backup would be the only way to retrieve the data.

Both Android and iPhone devices fully support encryption out of the box nowadays, so there isn't much need for third-party encryption apps, advises Koster.

iPhone Encryption

When your iPhone is locked, personal information is automatically encrypted, as is any data on the iCloud. Find out how to do it and the other iPhone privacy settings you should check right now.

Android Encryption

Setting up encryption on your Android device is easy, even for those that don't usually change the default setting on their phones. While there are many different types of Android phones and the menu options vary, these directions should get you to where you need to go without a lot of steps.

Open the "Settings" app.
Tap the search bar and type in "encrypt."
Choose the encryption option
Follow the onscreen instructions

Some Android devices, such as certain models from Vivo, Huawei, and OPPO can't be encrypted. If you try the steps and you can't find an encryption option, contact your service provider. They will be able to determine if your phone can be encrypted or not.

Encryption can take up to an hour and can't be interrupted, so you won't be able to use your phone. Make sure your phone is plugged in while it is encrypting to prevent it from dying, too. If your phone dies while it is finishing the process you may lose all of your data.

Make your password strong

Since the data on your phone can be viewed as unencrypted when your phone is unlocked, it is important to make sure the method to unlock your phone is strong, just in case it ever gets lost or stolen. For example, a weak password like 123456) or PIN like 0000 may put a device at risk regardless of the encryption's strength. Make the password or PIN more complex, or use face recognition, your fingerprint, or a pattern to unlock your phone. Even with encryption, hackers can still do these four things with just your phone number.

Sources:

Search This Blog

Android Full Encryption