Although this new book is on sale from January this year, we are happy to officially say our words of gratitude to Kevin Beaver and advise it to you.
In his book Kevin insists that the best way to really understand how to protect your systems and assess their security is to think from a hacker’s viewpoint, get involved, learn how systems can be attacked, find and eliminate their vulnerabilities. It all practically amounts to being inquisitive and focusing on real problems as in contrast to blindly following common security requirements without understanding what it’s all about.
In this guide Kevin communicates the gravity of ethical hacking in very plain and clear words and gives step –by- step instructions to follow. He easily combines theory and praxis providing valuable tips and recommendations to assess and then improve security weaknesses in your systems.
We want to thank Kevin for testing and including our software in his very “digestible” beginner guide to hacking and recommend our readers this book as a helpful tool to get all facts in order.
BlackBerry dominates the North American smartphone market, enjoying almost 40 per cent market share. A 20 per cent worldwide market share isn’t exactly a bad thing, too. The total subscriber base for the BlackBerry platform is more than 50 million users.
Today, we are proud to present world’s first tool to facilitate forensic analysis of BlackBerry devices by enabling access to protected data stored on users’ BlackBerries.
Ever heard of password masking problem? To be honest, I have not – until I’ve read the Stop Password Masking article by Jakob Nielsen (somewhere referred to as "usability guru"), followed by a lot of other publications, blog posts and comments (see ‘em all); so-called securityguru Bruce Schneier wrote even twoessays on that.
In brief, here is the "problem": for years (I think starting from Windows 3.0 released almost 20 years ago), the passwords are being masked as you type them (in most programs what have any kind of password protection, and an operating system itself), i.e. replaced with asterisks or black circles. What for? To prevent the password from being read by someone who stands behind you.
When we meet our customers at trade fairs in Germany, we are always asked questions about legality of our tools. The reason for this is that German law on so-called “hacking tools” is very strict. At the same time the wording of the respective paragraphs is unclear and ambiguous.
On Friday, German Federal Constitutional Court dismissed a complaint of an entrepreneur that production and distribution of tools for capturing traffic data is against the law. The judges said that the constitutional rights are not violated by the use of “hacking tools” (§202a-202b). According to the court decision, legal penalty applies only in the case when the software was developed with illegal intent in mind. “Double-purpose” tools that are designed to be used by law enforcement and IT security officers are not regarded illegal.
Today’s technologies allow staying online practically 24 hrs a day, periodically falling into a sleeping mode. The Internet became easily accessible and numerous devices can connect us to the web from everywhere, and every time when we surf the web we are being registered, at least via IP address of our devices.
I bet it was more than once that you had to fill out a sort of name-company-position-email-telephone-whatever form when registering or subscribing to something. Do you think about preserving privacy of your information when leaving such data on someone’s website? (more…)
Tom’s Hardware has tested two mainstream NVIDIA cards (GeForce 9600 GT and GeForce 9800 GTX) on several CUDA-enabled applications. The applications were:
Note to PGP legal dept: I’m not going to put the ® sign every time when I mention PGP. I’m just tired; we already did that in our press release and on our web site, and I think it’s enough. No, really? Well, I’ll repeat one more time: all names like PGP are trademarks or registered trademarks of their respective owners in the UK, USA, Russia and probably somewhere else – e.g. in Albania. There are too many countries to mention, sorry . Why should I care about (R)? Keep reading, and you’ll see the reason.
Note to PGP executive and marketing depts: thanks again for helping our marketing people to spread a word about company and our software. We have received many calls from local and international media, a nice press coverage, and a lot of people coming to our booth at InfoSecurity. Well, and several good orders – mostly from forensic/investigation people.
Now an update to my previous post. It becomes more and more funny: PGP has wrote about our ‘conflict’ in their own blog. And the author is… Jon Callas, CTO of PGP. He called his blog entry Lies, Damned Lies, and Marketing – not bad, eh? But the contents is even better. Jon starts with the words about ElcomSoft: "The company who made this has a great product, and as I said then, it’s a very cool product." Thanks Jon, but we already knew that our software is "great" and "cool" – otherwise we would not get enough sales . But Jon’s story continues with the following:
[ElcomSoft] booth said, “the only way to break into PGP®.” This is a lie, and a lie in two directions.
1.They’re not breaking into PGP, they’re doing password cracking. There’s a difference.
2.They’re not the only people who do it. As I’ve said before there are plenty of other password crackers, both commercial and open source.
In short, the sign was factually incorrect, and lies about PGP.
If we lie, please sue us. If we don’t, better be quiet, please. But PGP marketing people have selected the 3rd way: complained to Reed Exhibitions and asked to destroy [a part of] our booth. Well done.
About [1]: from my personal point of view, "breaking into PGP" can mean "password cracking" as well. Do we provide the tool to get access to password-protected PGP disk? Obviously we do. Did we say that it works in 100% cases, or that we cracked PGP encryption/algorithms? No we did not. Oh well, our English is definitely not perfect, but I think it is still better than your Russian, Jon
About [2]: yes, there is a lot of password crackers around. But I’m aware of just a single one (except ours, of course) for PGP Disk – and it is commercial; supports old versions of PGP Disk only; moreover, it is distributed only as a part of very expensive commerial e-discovery package – and it is MUCH slower than ours (because it does not use GPU acceleration). Sorry, I will not mention the vendor name here, simply because it is our competitor – and it did not pay us for an advertisement . Jon, I’d appreciate if you can name the other ones (commercial or open-source). If you cannot, YOU lie. But I like your wording "as I’ve said before"; I think I should used it myself, too (e.g. "as I’ve said before, PGP is not secure and can be cracked" – without reference, for sure ).
I recall how I talked to PGP representative a year ago – on previous InfoSecurity UK. The first question he asked was: "Have you received an e-mail from our legal department?". I replied "Should I?"; he said "Yes", and explained the reason: there was no (R) sign (near "PGP") in our press release (Elcomsoft Distributed Password Recovery Unlocks PGP Protection). Well, see the note at the beginning of this post
Another note: in fact, we were strictly prohibited (by Reed, but that’s definitely not their own initiative, but for sure PGP’s one) from printing anything about PGP on our booth. It’s a pity that I did not have a voice recorder handy. So if we wrote something like The only way to break PGP passwords, or The most cost-effective way to crack PGP passwords etc, such panel will be removed as well. We’ll probably try this next year. But we reserved the other place for InfoSecurity 2010 – not so close to PGP; I think it is a good idea anyway, because every half an hour they’re doing very loud (but not very smart) presentations telling people that PGP is #1 in this and that (nothing really interesting/technical/innovative).
Oh, I forgot to mention that we received a document from Reed explaining why they’ve removed our wall paper, finally – at the end of the first day, i.e. about 8 hours after removal. The official Regulations (sorry, I’m too lazy to scan it – but I will, if you wish) say that it should be done in advance (and no action can be made without prior notice in writing), but who cares? Anyway, for those who interested – here is how it looks like:
But I should also mention that Reed keeps their word: our panel has been replaced this morning (at their own cost). Have a look (the second panel from the right; the color is slightly different from the original one, but still better than nothing):
Lessons learned? You guess yourself. I would not say anything bad about PGP and/or Reed – they really helped us a lot. And I would NOT recommend PGP to send smarter people to the exhibition next year – so we’ll be able to save a significant part of our marketing budget
After all… All of the above (as well as my other posts) is my personal view, and not an official position of ElcomSoft. Yeah, I’m the CEO of ElcomSoft, and I’m the person who approved the design of our booth (btw, only two days before the show: we were really busy doing technical stuff), but anyway.
Oh, almost forgot to share one more picture – with ElcomSoft people:
From left to right:
Andrey Belenko, IT Security Analyst (and an inventor of GPU acceleration; well-known person in ‘crypto’ world)
Olga Koksharova, Marketing Director (doing real and smart marketing and PR, much better than PGP’s one)
Vladimir Katalov, CEO/co-owner (me; ex-programmer – not a stupid ‘manager’ hired by expensive headhunters)
And finally, thanks to all who made the comments to my previous post. As you can see, our blog is NOT MODERATED – in contrary to PGP’s one (which is actually premoderated, try it yourself; we made some comments there, but they have not appeared – at least in about two hours after writing). Censored?
Although this new book is on sale from January this year, we are happy to officially say our words of gratitude to Kevin Beaver and advise it to you.
.jpg)
Ever heard of password masking problem? To be honest, I have not – until I’ve read the 
. Why should I care about (R)? Keep reading, and you’ll see the reason.
. But Jon’s story continues with the following:
