I'll make no bones about this. I work for SecurStar's British subsidiary developer, I own a very small shareholding but my opinions expressed here are MY own not SecurStars.
At the end of the day were the flaws exposed REAL ?
As far as they go, the tests do appear to find a legitimate weakness in the programs under test even if a connection to one of the companies involved would represent a huge conflict of interest and discredit them in the eyes of the security community. Pietrosanti is certainly correct to say that researchers are normally keen to be identified with their testing, something ‘Notrax' has avoided doing so far.
I do not currently know if anyone within SecurStar did this or not We are in the UK and quite "divorced" from other German parent company activities such as PhoneCrypt which we have had no involvment in whatsoever..
No doubt I will get to know. Having said that, if a flaw has been exposed in a competitors software, then surely it will now get fixed ? It WILL get fixed won't it ? Would it have got fixed before ?
I do know that Wilfried Hafner is passionate about security, and IS a gifted hacker. After nine years working for this company, (nine wonderful and happy years I might add) I never cease to be amazed when he refutes some of my own ideas, regarding things we should do with the software we develop, or the bugs he has found in the past. If he indeed did find the Phone encryption security problem and he went public with it, under the company banner what would people think then ? Would it be worse still ? Should he have just kept completely quiet ? It is certainly not his voice in the Notrax video (which I have now seen) that's for sure.
What really needs to happen FIRST of all, is that the companies concerned need to review the assertions made, and if necessary address the flaws in the software, however they've been identified.
In any case. personally if there was a serious issue with our software, then I would *expect* competitors to try and make some milage from it. At the end of the day, isn't that what business is all about ? It's one of the reasons I am not a business man and never could be I am simply not 'hard nosed' enough.
In the longer term, I am sure their products will be fixed, and that can ONLY be to the advantage of their customers however the flaws were revealed. The authors of the software concerned should make it a priority to fix the problems instead of bleating on how horrible the company is. If indeed the company is at all responsible.
Perhaps Wilfried did try and make some milage out of these flaws I honestly do not know. He is a good hacker and has often found issues of this kind. BUT he is, at the end of the day, a business man as well.
Now, ask me about my iPhones, (3g and 3Gs) my 09 reg Ford C-Max car with Sony CD/Radio and USB connection, and how neither iphone works anymore with the car's USB port.. On the older iphone I could play the tracks back via the console, until OS 3 was installed. The thing won't even recognise the 3Gs phone at all.
Ask me who, of the four companies concerned (including the garage) really even cares about my problem, instead of just playing pass the parcel instead of helping me get it sorted. That's bad and horrible practice as well, but we consumers simply have to put up with it.