Secure phone app library vulnerable Users of a number of telephone apps need to upgrade, with a security researcher publishing research identifying serious vulnerabilities in ZRTPCCP, a core security library. As ThreatPost notes, the compromised library counts PGP luminary Phil Zimmerman's SilentCircle secure comms application among its users. Researcher Mark …
anyone could have found these vulnerabilities in and kept them to themselves to exploit....
Yup, but at least you stand a chance that someone picks it up (QED). The only thing that tends to be of lesser quality in open source secure phone apps is the codecs - in my experience, the commercial ones are simply better able to cope with less than perfect throughput conditions (I've reviewed numerous ones before we contracted the one we're using now).
Does anyone else find it surprising that the folks producing Silent Circle wouldn't be auditing a key library used to insure the security of their product? Why aren't they the ones finding these bugs?
Sure makes you question the overall security of their product/process when well-known bug types like buffer overflows are getting through unnoticed.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
