Slashdot Mirror
Cell Phone Encryption Exploit Demonstrated
Saxophonist brings us a story from Forbes about security researchers who demonstrated a new method for breaking the encryption on GSM cellular signals. The presentation was made at the recent Black Hat conference, and it's notable for the fact that the technique only requires "about half an hour with just $1,000 in computer storage and processing equipment." The researchers also claim to have found a faster method, which they intend to market for $200,000 - $500,000. Quoting:
"Undetectable, 'passive' systems like the one that Muller and Hulton have created aren't new either, though previous technologies required about a million dollars worth of hardware and used a "brute force" tactic that tried 33 million times as many passwords to decrypt a cell signal. All of that means, Hulton and Muller argue, that their cheaper technique is simply drawing needed attention to a problem that mobile carriers have long ignored--one that well-financed eavesdroppers may have been exploiting for years. 'If governments or other people with millions of dollars can listen to your conversations right now, why shouldn't your next-door neighbor?' Muller says."
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
http://www.shmoocon.org/
The presentation will probably be available on the Shmoocon website in the not too distant future. Forbes did the standard mainstream media muddling so check with H1kari for the real deal...
Unless their patent application is kept confidential by the government for reasons of national security, it will be published within 18 months. You'll be able to learn how the trick works from it (if you're an expert in the field and you cannot make it work, no patent should be granted). You're not allowed to exploit that commercially, of course, but at least you can have fun and pull a few pranks with it. You could claim you're psychic.
I'm wondering how you ever could tune in to the correct conversation, with thousands of mobile phones transmitting at the same time.
Bert
Scanner? We used to just use a Motorola flip phone and the scanning codes that were kindly built into it by the company. *43# etc
Whenever the phone you were scanning moved from one cell to another you'd lose the signal but it would display on the screen what channel it had changed to.. in hex.. so you'd either convert the hex to decimal, enter that channel and pick up the conversation or you'd scan for another call.
And yes, it was boring as hell.
How we know is more important than what we know.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
How does this compare to the CCC crack? Can it do all of the encryption standards?
http://video.google.com/videoplay?docid=8955054591690672567&q=CCC+GSM&total=2&start=0&num=10&so=0&type=search&plindex=0
How is it that it caught on for the web (credit card payments over SSL), but still barely for personal communications (gpg, encrypted IM)?
That's a very good question.
One idea I've heard is that when SSL was first developed, the web was in its infancy and nobody really felt happy about the idea of sending their credit card details over it. The fact that it was relatively easy to eavesdrop on a computer network was fairly well known. This was no good to anyone who wanted to do business (OK, porn sites) over the web, and so SSL solved that problem by providing reassurance that nobody was eavesdropping.
The telephone system, on the other hand - that's been around so long that it's familiar technology and relatively few people are aware of how insecure it is. If you think GSM is bad (it's actually not that poor, and 3G introduces AES encryption), consider your land line. No encryption whatsoever and an analogue signal (so no computer equipment or specialised unusual codecs required to tap) between you and the telephone exchange.
...but a very big problem is the fact that people, i.e. myself, are using GSM for banking. The security of phone banking 100% relies on GSM encryption. You are just identifieing yourself via PIN, and that's it - you are fully authenticated - unlimited access to the account! This is unusable now. No skimming needed...
Imagine listening in to the CEO of a Fortune500 company in the days preceding financial reports. You may gain very valuable information. As we saw last week, it is not considered insider trading if you hacked your way to the data. Also competing firms could use this to be one step ahead, and potentially can ruin another firm.
You know there are people in the world other than you right? And most of them use cell phones and don't really think about security. People like CEOs of companies that are about to go public. People like stockbrokers who place orders that change the direction of the market. People who having an affair right now and work in some shit-kicker job for a senator now but may one day be in a position of power. The list goes on. Basically, if you can't think of a better use for cell phone hacking than stealing credit card numbers or banking logins, then you're just not trying.
How we know is more important than what we know.
Here in South Africa I haven't regarded cell phone calls as secure for quite some time. School kids figured out that if you dial the three-digit customer service number on your cell phone, and keep on waiting on the line a few minutes after the voice recording finishes, the following happens: It connects to (I presume) your local tower and you can hear the one side of random cell phone conversations. After a few minutes it switches over to another conversation. You can only hear one side of the conversation, but it proved quite entertaining for kids to listen in on conversations during school breaks (phoning customer service is a toll-free call). Luckily the cell phone company realized this and fixed the security hole after a few months.
Well, FWIW, you can detect a bug like that on your POTS line by monitoring the voltage on the line. It won't help you with a bug placed at the exchange/central office, but that vulnerability exists regardless of the technology (POTS, GSM, VoIP, etc) that you are using.
More amusing then deliberate bugs is crosstalk on old/lousy wiring. I never had POTS hooked up in my old apartment building (cellular only) but I could plug a phone into the jack and listen to other peoples conversations/DTMF/dial tones. Some of them were hard to hear (guessing the pairs were fair enough apart to reduce crosstalk) but most of them came in loud enough to be understood quite clearly -- and I suspect it would have been child's play to hook up an amplifier to boost the weak signals to a usable level.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.