FBI Denies Deliberately Removing Encryption Advice

The FBI denies deliberately removed a tip on how to enable encryption on smartphones from its own website. This week the blog came Techdirt with an article that said the security advisory to encrypt the smartphone from the FBI site had disappeared.

The weblog tied this to statements by FBI Director James Comey that rather negative about the standard encrypting smartphones had spoken by Apple and Google. The National Journal contacted the FBI and was told that there was no malice in the game. The website should be redesigned.

There were recommendations, which stems from 2013, taken from another government site, namely the Internet Crime Complaint Center. Here are the tips to find still . Furthermore, the spokesman said that the investigation service still stands behind the advice that stood on the site and that it is in favor of the use of encryption by smartphone users to protect their data.

Google Makes Encryption In Android Lollipop Not Required

Late last year announced the first-ever Google Android version that data on smartphones and tablets standard would encrypt, but now the Internet giant seems this measure does not oblige manufacturers.Android 5.0, better known as Lollipop, would "encryption by default" application.

Once users would turn on their device for the first time would be automatic data encryption. A measure that Google criticized investigators came to be, because this would complicate the fight against crime and terrorism. Ars Technica discovered that several Lollipop sets, including demonstration copies of the Samsung Galaxy S6 this week at the Mobile World Congress Barcelona can be seen, no default encryption application.

It also showed that Google earlier this year the guidelines for manufacturers regarding the proper implementation of Lollipop had adjusted devices. The document dated 11 January ( pdf ) is full-disk encryption is highly recommended, but not required.Google however, that the measure is likely to be required somewhere in future versions. One possible reason to drop the requirement is the load for the device, which would slow down by the continuous encryption. Whether this is the real reason is unknown. Namely Google has not yet written a comment.

Research: Weak Encryption In Popular Android Apps

Many of the popular free Android apps in the Google Play store use weak encryption to protect sensitive information. Which claims that the US security firm FireEye 9339 apps with more than 1 million downloads analyzed . Of these, 8261 were found to use a cryptographic functionality of the Android platform. 8261 of these apps again proved 5147 apps (62%) contain one or more cryptographic vulnerabilities.

It involves, for example using static keys for encryption. These keys can be removed from the app and then to decrypt the data. This was 21% of the apps the case. Furthermore, 58% had to use a weak encryption algorithm that the apps are vulnerable to certain attacks. For a handful of apps was also developed an attack. One of these apps accepted all dished SSL certificates, allowing attackers to perform a man-in-the-middle attack.

According to the researchers cryptographic vulnerabilities are a serious threat because they enhance the effectiveness of other attacks. Through the misuse of SSL could intercept an attacker instance sensitive information. "This problem is compounded by root exploits in which an attacker rooting a device can determine which apps are installed to send random data for offline decryption" concludes researcher Adrian Mettler.