Slashdot Mirror
Italian Phone Taps Spur Encryption Use
manekineko2 writes "This article in the NYTimes discusses how a recent rash of high-profile mobile phone taps in Italy is spurring a rush toward software-encrypted phone conversations. Private conversations have been tapped and subsequently leaked to the media and have resulted in disclosures of sensitive takeover discussions, revelations regarding game-fixing in soccer, and the arrest of a prince on charges of providing prostitutes and illegal slot machines. An Italian investigative reporter stated that no one would ever discuss sensitive information on the phone now. As a result, encryption software for mobile phones has moved from the government and military worlds into the mainstream. Are GSM phones in the US ripe for a similar explosion in the use of freely available wiretapping technology, and could this finally be the impetus to for widespread use of software-encrypted communications?"
It would be really nice if that came standard in cellphones (Properly just a empty dream). But maybe a plugin for windows mobile and symbian handsets could be possible.
Visit http://www.crunzh.com/ for free software. Mac/Lin/Win
Under US law, such a tap is illegal. There are some encrypted channels for cel phone conversations in America, but they have been mostly phased out because of the lack of consumer demand. In the US, such a tap is illegal. Even if such inflamatory behaviors were discovered, the person who did the tap would not disclose it as it would highlight personal illegal activities. Note that there is nothing that the technology is doing to prevent it.
On the other hand, wireless phones in the US typically do use encryption because they operate in the same frequency range as other devices (cel phones have their own dedicated frequency range). When baby monitors started picking up the conversations down the street, people took notice.
Why would it be a problem? Only private keys ca be used to decrypt data. Unless you were concerned about the man-in-the-middle just rewriting the data to say something else, but it's hard to imagine how they'd do that to a live voice conversation.
== Jez ==
Do you miss Firefox? Try Pale Moon.
It's a fundamental feature of public key encryption that public keys can be exchanged in the clear without compromising security.
An Italian investigative reporter stated that no one would ever discuss sensitive information on the phone now.
Why on Earth would you ever discuss sensitive information on the phone before? There's always been phone tapping tech. It's only the laws for that technology's usage that protected anyone from it. You never say anything on the phone that you wouldn't say to a cop. If you don't know that rule, you're a pretty inept criminal.
http://en.wikipedia.org/wiki/A5/1
It can be broken, but considering the power of early GSM handsets this was quite an effective system. One of the major factors driving G2 (digital) phones was the easy of eavesdropping on the old analogue G1 network.
Quite simply, one of two things would prevent encrypted cell phones from becoming successful in the US:
1. The government would simply make it illegal (don't want to give the terrorists any new tools).
2. The government would require a backdoor be built in by manufacturers, defeating the purpose.
Watch the Teaser Trailer for "The Lightning Thief" Her
Law enforcement has had the ability to tap in and monitor cellular communications.
In the days of AMPS and NAMPS it was a piece of cake. Friend of mine worked in IT for the local PD and was able to get a scanner that wasn't 800-900 blocked, and a little card and software for the computer that allowed us to follow calls as they went from cell to cell.
CDMA and GSM just throw a little wrinkle in.
If the carrier is just that, a carrier of data, it doesn't matter what the carrier does, you can establish an encrypted link without it's involvement beyond moving the data.
Making the carrier the sole means of key exchange would be the only way to give them access (they could perpetrate a man-in-the-middle attack). But if you are able to meet physically with your call partner, or exchange keys through an alternate secure medium, the intermediary would have no cheap means of intercepting.
Only one-time pads are unbreakable, and using one-time pads makes key exchange *much* less secure. But public key methods are enough to make it very hard to break a single transmission. Programs like ECHELON would be utterly stuffed.
And of course, if you have a mobile data plan with more than a few kBit/s of bandwidth, this is entirely possible now, as demonstrated by these Italian chappies.
Blooming heck though - $410 for their SMS encryption package and $2,200 for the voice version. I'm willing to bet that even with patent licensing, the per unit cost is very small. I could probably write Windows Mobile software to do encrypted SMS in a day or so, and I'm no encryption whiz.
Though in the acedmic circles, serious flawa with GSM encryption
have been found they are still not all that trivial to implement.
The main work on attacking GSM in a practicle scenario was done by
Elad Barkan with the help of Eli Biham and Nathan Keller.
to briefly explain the security you must notice there are diffrent variants for
GSM encryption the weak one being A5/2 anf A5/1 and A5/3 being considarbly stronger.
breaking A5/1 in a passive attack requires a significant amount of precomputation and storage
that though one could buy of the self, I find it unlikely any private citizen will set up
a cluster of two dozen computers to crack GSM for the fun of it, though obviously a large
evil corparation or a small company would easily have the resources.
an active attack could convince a cell phone to use A5/2 even if it prefers A5/1 or a diffrent variant,
this requires more specialized equipment and it easier to catch the attacker as he must be sending out
radio signals, these may also interfere with normal cellphone traffice.
This is just to put the threat into proportion,
your own govement can wiretap without breaking encryption,
A serious enemy can probably muster up the resources to wiretap by breaking GSM encryption
but your next door neighboor will probablby find it exremly difficult to listen in on encrypted GSM cell
phone traffic.
Me.
We seem to have a fundamental misunderstanding of PKE here.
Person A wants to talk to person B using encryption.
A sends B his public Key, B sends A her public key. They each then use the combination of the other's public key and their own private key to encode and decode messages to and from each other.
Let's say A goes to send B his key, but it's intercepted by C, and C sends B a modified key (man in the middle attack). Then B will not be able to initiate communication with A because the key won't match. This is how and why PKE works. If it was possible to capture and send a modified key and have the conversation still function then PKE wouldn't be very useful, would it?
Official Heretic from the "Church of Global Warming". Proven right thanks to whistle blowers. AGW = Flat Earth Theory
I'veway eenbay usingway oicevay encryptionway orfay earsyay.
It'sway easyway andway otallytay onfusescay anyway
eavesdroppersway.
A CA is not in central control over encryption. They are only in control of authenticating keys. The only way they can subvert the encryption process is to issue matching (in details, but not in keys) certificates to you and the man in the middle. If they were to do this, it would be detected quickly, and their reputation as a trusted CA would suffer.
It looks like a firm in Germany already offers a AES-256 bit encrypted mobile and POTS phone, as well as a softphone. Although their hard phones aren't cheap, the softphone is free to give to your contacts. http://www.cryptophone.de They alse include source code for "full independent review" with their products.
Similarly, Phil Zimmermann, the creator of PGP has released his Zphone to make encrypted VoIP calls. Also, the Asterisk project offers an encrypted IAX channel.
Are GSM phones in the US ripe for a similar explosion in the use of freely available wiretapping technology, and could this finally be the impetus to for widespread use of software-encrypted communications?"
Unless I'm missing something, there certainly is not any freely available wiretapping technology for GSM phones and networks. There are a few vendors that sell very expensive GSM tapping and over the air capture devices and platforms, but they are extrememly expensive and only for sale to authorized buyers (law enforcement, military, and feds)
Lindsay Blanton
RadioReference.com