Cloud Hosting

End-to-end call encryption (E2EE) is a secure communication method that prevents third parties from accessing data transferred via VoIP calls.

Most popular messaging and call service providers use this technology including Facebook, WhatsApp, and Zoom to prevent the exposure of user information. While data is transferred from one end system or device to another, the data is encrypted on the senders system or device and in motion. Only the intended endpoint can decrypt the data, with unauthorized third parties unable to listen in.

How Does End-to-end Call Encryption Work?

The technology keeps the content you share private and secure from one endpoint to another. The shared content will be unreadable if intercepted in transit. VoIP phones use digital, encrypted communication between your phone and the cellular telephone base station. Your voice is decrypted at the base station and sent over the telephone network.

End-to-end encrypted calls provide the gold standard for protecting communication.

The security behind end-to-end encryption is enabled by creating a public-private key pair. This process is also known as asymmetric cryptography, which employs separate cryptographic keys for securing and decrypting the data. Public keys encrypt the data, while private keys decrypt data. For each person that joins, individual keys are generated. The public key will be stored on a server while the private key is stored on the device.

In online communication, there is an ISP, an intermediary, or various other organizations. Their server delivers data between both parties involved in an exchange. These intermediaries cannot decrypt and eavesdrop on the data. Only recipients can decrypt data with the matching key when end-to-end call encryption is in place.

Benefits of End-to-End Call Encryption

Personal data security and sensitive information are always an issue in online communication. E2EE completely encodes data, improving the security of calling services.

It prevents unauthorized access to personal conversations. Although authorities may try to access personal or private spaces, E2EE makes it impossible because the keys to decrypt them are missing. Digital signatures can detect content manipulation during transmission or whether the recipient has authorized access.

2. It facilitates secure data exchange

A crucial advantage of end-to-end encryption is that unauthorized persons cannot access personal data. Only unidentifiable numbers and letters can be recognized if a hacker circumvents the encryption. If intercepted by hackers or service providers, private communication and other details are not easily read.

3. It maintains data integrity

Data integrity is maintained because the key system prevents unauthorized devices from gaining access. Without E2EE, outside users can gain access to a piece of data and manipulate it before it reaches the recipient. End-to-end encryption denies them this access because they do not have the necessary key to access data in transit.

4. It makes calls tamper-proof

The decryption key is not transmitted; the recipient has it already. If an encrypted data gets tampered with in transit, the recipient will not be able to decrypt or tamper with it. End-to-end encryption can help organizations protect data by making it inaccessible to those who want to tamper with information.

Example of End-to-End Call Encryption: Microsoft Teams Calling

Teams support both cell and landline calls, with built-in online meetings and audio and video calling for individuals and groups. It has a cloud-based phone system with advanced features, including call transfer, multilevel auto attendants, and a call queue. Teams secures the following features during an end-to-end encrypted call audio, video, and screen sharing content. Call participants at both ends of the Teams session must turn on the E2EE setting, and the app will secure users presence status.

Keep in mind that several advanced features are not available during end-to-end encrypted calls, such as live captions and transcription, call transfer, merge and park, call companion and transfer to another device, etc.

For end-to-end encrypted calls on Teams, an administrator must first turn on the feature, and then device users must activate the settings locally. It is also possible to configure Teams E2EE using PowerShell.

Importance of End-to-end Call Encryption for Collaboration

E2EE is designed to protect users and their privacy by default using the highest grade end-to-end encryption. End-to-end call encryption keeps communication secure by ensuring that only those in the conversation can decrypt data, even if a server or network is compromised.

As VoIP calls become increasingly important for internal and external (i.e., customer-facing) communication, maintaining data privacy is essential. Sensitive information is often shared during these exchanges, and E2EE increases stakeholder confidence in communication systems while allowing flexible information sharing from any location. For these reasons, Zoom, too, launched end-to-end encrypted phone calls in September 2021 in addition to a Bring Your Own Key (BYOK) offering that allows users to choose their encryption keys.

Read more:
What Is End-to-End Call Encryption? - UC Today

Windows and Linux systems are coming under attack by new variants of the HelloXD ransomware that includes stronger encryption, improved obfuscation and an additional payload that enables threat groups to modify compromised systems, exfiltrate files and execute commands.

The new capabilities make the ransomware, first detected in November 2021 - and the developer behind it even more dangerous - according to researchers with Palo Alto Networks' Unit 42 threat intelligence group. Unit 42 said the HelloXD ransomware family is in its initial stages but it's working to track down the author.

"While the ransomware functionality is nothing new, during our research, following the lines, we found out the ransomware is most likely developed by a threat actor named x4k," the researchers wrote in a blog post.

"This threat actor is well known on various hacking forums, and seems to be of Russian origin. Unit 42 was able to uncover additional x4kactivity being linked to malicious infrastructure, and additional malware besides the initial ransomware sample, going back to 2020."

The analysts wrote that the malware author, or authors, are "now expanding into the ransomware business to capitalize on some of the gains other ransomware groups are making."

This comes as that both the ransom demands and the ransoms paid are increasing a 144 percent year-to-year increase in demanded ransom in 2021, reaching about $2.2 million, while the average ransom paid jumped 78 percent between 2020 and 2021, to $541,010 according to Unit 42's latest annual ransomware report. The incidence of stolen data being released publicly climbed 85 percent year-over-year, the report found.

The ransomware family is based on the Babuk (or Babyk) source code that was leaked on a Russian-language forum in September 2021. The group runs double extortion campaigns, exfiltrating the corporate data before encrypting it. Rather than threatening to release the files on a public leak site if the ransom isn't paid, the attackers instead directs victims to negotiate via the aTox chat service.

However, in the newer variants, the ransomware note also links to an onion domain for messaging. That said, the researchers wrote that as of now, the onion site is down, which could mean that it's currently under construction.

"The ransomware creates an ID for the victim which has to be sent to the threat actor to make it possible to identify the victim and provide a decryptor," they wrote. "The ransom note also instructs victims to download Toxand provides a Tox Chat ID to reach the threat actor. Tox is a peer-to-peer instant messaging protocol that offers end-to-end encryption."

Other ransomware groups, including those using LockBit 2.0, also use Tox Chat to communicate, they noted.

A key change to the latest version of Hello XD is the change in encryption algorithm. Unit 42 researchers wrote that they have seen two publicly available versions of HelloXD, an indication that the code is still under development. The first version uses Curve25519-Donna and a modified HC-128 algorithm to encrypt data in the files and is the least modified of the two versions from the original Babuk code.

In the most recent version dubbed by Unit 42 as HelloXD version 2 they changed the encryption algorithm, exchanging the modified HC-128 with the high-speed Rabbit symmetric cipher, also along with Curve25519-Donna. In addition, the developer changed the file marker, from a coherent string to random bytes.

"Both versions have been compiled with the same compiler (believed to be GCC 3.x and above based on the mangling of export names), resulting in very similar exports between not only the ransomware variants, but also other malware that we have linked to the potential author," the researchers wrote.

The most significant change between the two version was the introduction of the additional payload within version 2 that is a variant of the open-source MicroBackdoor and is encrypted with the WinCrypt API. The malware enables an attack to browse through the compromised file system, upload and download files and remote code execution (RCE). The malware also can remove itself from the system. The fact that the backdoor is delivered with the ransomware also is unusual.

"As the threat actor would normally have a foothold into the network prior to ransomware deployment, it raises the question of why this backdoor is part of the ransomware execution," they wrote. "One possibility is that it is used to monitor ransomed systems for blue team and incident response (IR) activity, though even in that case it is unusual to see offensive tools dropped at this point in the infection."

The researchers were able to see a hardcoded IP address that was used as the command-and-control (C2) to accelerate their hunt for the probable bad actor behind HelloXD. Through the IP address, they were able to see an email address that they linked to other domains and continued to follow the breadcrumbs through other malicious IPs, VirusTotal graphs and additional infrastructure and malware hosted on other domains, many of which used the x4k name.

The path followed through various graphs to a GitHub account, Russian-language hacking forums, other sites that referred to x4k and other aliases such as uKn0wn seen in the HelloXD samples. That was followed by the discovery of other GitHub accounts, another alias (Ivan Topor) and a YouTube account with another alias (Vanya Topor) that linked to videos in which the miscreant showed how he performed particular actions.

"The videos found gave us insight into x4koperations before moving into ransomware activity specifically," the researchers wrote. "We learned how this threat actor leverages Cobalt Strike for his operations, including how to set up Beacons as well as how to send files to compromised systems. In one of the videos, we actually observed the threat actor performing a DNS leak test on his Android phone."

The bad actor also often alluded to a "ghost" theme, similar to what the researchers saw in some earlier HelloXD ransomware samples. Most of the videos and written content are in Russian. Given that and some mistakes that he made convinced Unit 42 that the x4k is from Russia.

The rest is here:
HelloXD ransomware bulked up with better encryption, nastier payload - The Register

Urian B., Tech Times 14 June 2022, 11:06 am

An open-source email application will finally be making its way to Android. Users of the iOS alternative will finally gain access to the Thunderbird Android email app, an open-sourced application that supports end-to-end encryption.

According to the story byZDNet, thanks to the K-9 Mail Android email app project, users will finally be able to use the Thunderbird app not just on the desktop but also on Android devices. The project resulted in an app for the open-sourced email project to be used on Android devices.

The Mozilla Foundation moved Thunderbird to its subsidiary two years ago. The open-sourced email solution came under MZLA Technologies Corporation, just like how Firefox was moved under the foundation's subsidiary, Mozilla Corporation, from the initial Mozilla Foundation.

Moving Thunderbird to its subsidiary allowed the project to create its own path. On top of this, the project added new features, including OpenPGP end-to-end encryption along with a mobile app that ZDNet described as "long-awaited."

The email service's team revealed that talks of an email app version of the service started as far as 2018. The talks were held between Ryan Lee Sipes, the product manager of Thunderbird, and Christian Ketterer, K-9's lead maintainer.

K-9 Mail is an already existing email app on theGoogle Play Storewith five million downloads. Instead of building the app from scratch, both parties plan on merging Thunderbird's systems and features with the existing app.

Four years later, the best decision, according to the two, was to simply have K-9 join the open-sourced service instead of having to build an app from the start. As perThunderbird, a lot of users have asked them for a mobile experience for the open-sourced email service.

Read Also:Telegram Founder Takes a Swipe on Apple's iOS Limitations! Here's What He Says

The team then announced that they plan to do this by helping K-9 provide an Android version of the Thunderbird email open-source service. K-9 is tasked with supplementing the open-sourced service and improving the email experience for mobile users.

As per the Thunderbird team, their commitment toward the desktop version of the email service remains the same, and the team is committed to making the most out of both worlds. As per ZDNet, this means that K-9 will be in charge of taking the name and branding of the original service.

Before this becomes possible, K-9 will still have to align with the visual appearance and feature set of Thunderbird. In order to do this, the team says that they are devoting finances and development in order to improve K-9 Mail continually.

Related Article:Apple and Google's 'Duopoly' over Mobile Markets is Anti-Competition - UK Regulator Claims

This article is owned by Tech Times

Written by Urian B.

2021 TECHTIMES.com All rights reserved. Do not reproduce without permission.

The rest is here:
Android Users are Getting the Thunderbird Email: Open Sourced with End-to-End Encryption - Tech Times

Background

Following complaints from the NOYB association regarding the use of the Google Analytics audience measurement solution, the French Data Protection Authority (CNIL) had issued several formal notices to French companies using this solution on their websites. These decisions were issued in the context of other decisions from European data protection authorities like the Austrian one, and following the Schrems II ruling of the ECJ invalidating the Privacy Shield that has imposed to implement additional measures to Standard Contractual Clauses to cover transfer of personal data outside the EU.

The CNIL had made public only one of these decisions in February 2022 in an anonymized way. In this decision, the CNIL considers that the use of the Google Analytics audience measurement solution is not GDPR compliant because personal data collected through the cookies of the solution are transferred to the United States without sufficient measures applied to prevent any possible access from the authorities to the personal data. Although efforts were made by Google to deploy additional measures in consideration of the Schrems II ruling, the CNIL considers that this is still not sufficient.

The CNIL recommends anonymizing personal data collected through audience measurement cookies. That way, the solution can benefit from the consent exemption applicable to audience measurement cookies in France. The consent exemption is only applicable to tools complying with a set of cumulative criteria published by the CNIL, one of them being to produce only statistic anonymous data. The controller must, however, still ensure that transfers outside the EU are compliant.

To provide more background on these decisions and providing possible solutions, the CNIL has released a Q&A on June 7, 2022 on the use of Google Analytics as well as guidance on the use of a compliant audience measurement solution.

The Q&A is short and does not provide much more information than already provided in the anonymized decision published in February 2022. All French companies among the 101 complaints of the NOYB association have now received a formal notice from the CNIL regarding the use of Google Analytics and they have 1 month (renewable) to comply.

The goal of this Q&A is for the CNIL to make clear that the prescription of the only published decision (February 2022 - anonymized) must be understood as being applicable to all companies using the solution and not only to the companies having received a formal notice.

The CNIL considers that any additional legal, organisational and technic safeguards deployed by Google like Standard Contractual Clauses and additional measures will still be not sufficient to prevent access by non-EU authorities as Google remains subject to US jurisdictions.

The CNIL categorically refuses a risk-based approach and consider that the risks remain as long as an access to the data is possible: according to the CNIL, even if access by US authorities to data collected through the Google Analytics solution is unlikely (i.e. in practice authorities are not making such data access requests), as long as an access is technically possible, then technical measures are necessary to make such access impossible or ineffective.

Several options are raised in the Q&A for a compliant use of the Google Analytics audience measurement solution, but most of them are considered as not sufficient by the CNIL and it seems that only the proxy solution is considered acceptable by the CNIL:

Modifying the settings of the Google Analytics solution (e.g. changing the characteristics of the processing of the IP address, only hosting personal data within the EU, , etc.) is not sufficient according to the CNIL as long as possible access by non-EU authorities is still possible and enable to identify the user and track his/her navigation from one website to another.

The CNIL highlights that encryption is only an acceptable solution if the encryption keys are kept under the sole control of the data exporter or by other entities established within the EU or in adequate countries.

Regarding Google Analytics, the CNIL considers that encryption of data is not sufficient as in practice Google LLC is the entity that:

The CNIL concludes that since Google LLC still has the possibility to access the data in clear, the encryption measures cannot be considered effective in case of requests from the US authorities. Conclusion to be drawn is therefore that encryption would be an appropriate measure if Google LLC did not have access to clear data or access to the encryption keys.

Collecting consent of users for data transfers is not sufficient as, although this is one of the safeguard listed by Article 49 of the GDPR, this is considered by the EDPB as only applicable to single and non-recurring transfers, and cannot be used as a permanent solution for systematic transfers of personal data.

The CNIL seems to only identify as a possible solution the use of a proxy. Indeed, as per the CNIL, the main issue relates to the direct contact, through a HTTPS connection, between the devices of the users and the Google servers, which enables to collect the IP address of the users as well as many other information that conduct to the re-identification of the user. Only solutions that break this contact between the device and the server, like a proxy, can address this issue, as data would be pseudonymized before being transferred outside the EU.

The proxy, or similar solution, must comply with the EDPB criteria, and in particular:

In addition, in the guidance on the use of a compliant audience measurement solution published together with the Q&A, the CNIL also underlines that the use of a proxy requires specific measures (e.g. absence of transfer of the IP address to the servers of the measurement tool, replacement of the user identifier by the proxy server, absence of any collection of cross-site identifiers, etc.) to be deployed and that the proxy server must be hosted in conditions that guarantee that the data it will be processing will not be transferred outside the EU.

In practice, all this criteria make it difficult from a technical standpoint to apply. The CNIL itself recognizes that this may be very costly and complex in practice, and eventually recommend using alternative solutions to Google Analytics.

The CNIL has published on its website a list of cookies solutions exempted from consent and that it considers as being compliant when properly configured. There are currently 18 certified solutions. The CNIL, however, indicates that such solutions have not been assessed on the issue of international transfers, which would means that, although they are listed by the CNIL as compliant, they cannot be used as such but first require to verify data transfers and apply Schrems IIs safeguards.

Solutions offered by the CNIL remain in practice difficult to apply and no workable solution is eventually offered to companies. As next steps, this Q&A should be seen as a reminder for Companies to assess their audience measure solution and consider whether the measures put in place to limit access to data by authorities are sufficient.

See the original post:
French Data Protection Authority publishes Q&A regarding use of Google Analytics - JD Supra