Slashdot Mirror
CCC Hackers Break DECT Telephones' Security
Sub Zero 992 writes "Heise Security (article in German) is reporting that at this year's Chaos Communications Congress (25C3) researchers in Europe's dedected.org group have published an article (PDF) showing, using a PC-Card costing only EUR 23, how to eavesdrop on DECT transmissions. There are hundreds of millions of terminals, ranging from telephones, to electronic payment terminals, to door openers, using the DECT standard." So far, the Heise article's German only, but I suspect will show up soon in English translation. Update: 12/30 21:27 GMT by T : Reader Juha-Matti Laurio writes with
the story in English. Thanks!
All your base station are belong to us.
In Soviet America, they wouldn't be allowed to publish this.
What's the most secure method of wireless communication (at least for home use) (besides using a hardline)?
Wow. I had no idea that people were using DECT phones to process payment cards*, but a breif Google search turned one up. I guess I've always made the assumption that there is no way to validate the security of wireless connections, so they should always be considered insecure. Do I just have a paranoid mind, or do other geeks think like that to?
* "Payment cards" includes credit, debit, gift card, etc.
Loose things are easy to lose. You're getting your hair cut. They're going there to see their aunt.
Noticed you might have to hit ebay.de to find them... Not sure if you can get hold of them outside Germany, my ebay-fu is weak today.
My PC Card cost EUR 23.50! It's USELESS!
A bit buggy (lassen sich derartige Kommunikationen leicht abhÃren, anyone?), but here it is.
It seems no one understands here it so you'll be safe from eavesdropping slashdotters anyway!
Why someone who consider us insignificant would hate us?
Failbait.
The article said that you could eavesdrop on baby-phones.
Now, this is *really* a case on Slashdot, where we should "Think of the Children!"
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
The big scandal is that the people who invented the DECT standard knew better then. Many standards have been made intentionally weak in order to (1) reduce production costs and (2) make it easier for law enforcement/intelligence agencies to eavesdrop.
http://events.ccc.de/congress/2008/wiki/Streaming
So this is what we hear when we would listen to your dect calls?
..it appears they haven't broken the cipher, but instead managed to trick the handset and base into not enabling encryption in the first place. I'd guess (without any actual information) that it's an active attack where you intentionally interfere to force a disconnect, then trace the reconnection up to the point where encryption is requested, then fake a packet with encryption not requested (it's TDMA so you know exactly when it is going to come). For cordless phones this is a problem, but for PIN terminals and other dedicated DECT devices, it should in theory be simple to refuse to make certain non-encrypted connections or transmit sensitive data over them. However, in actual practice, nothing involving DECT is simple...
Wired imply physical access, possibly leaving trace either in software or in hardware. If you leave trace you are therefore detectable and vulnerable yourself to be caught. Wireless on the other hand is another worm. You can read the comms without anyone knowing you ever accessed to it. And even if it is only from 5ft away, you can hide the material and it not be visible on you particularly on public place. Which is why hell break loose on any widely publicly used wireless communication is proved to be vulnerable to heavesdropping, whereas comms where you have to physically have access don#t do so much.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Personally I find it scary that people consider 'wired' communications to be 'secure' by default.
Back in the '90s there was a big fight in the US about the Clipper chip, and forcing every phone in the US to have an encryption chip, with the keys being escrowed and only available via a court order.
While there were many reasons to be against it, I never understood why some people used the argument that the government could always secretly access the encryption keys. Given the fact that all phone calls are in the clear to begin with, adding the Clipper would actually add some security--if not against the government, then at least against someone attaching some alligator clips to your landline.
Your landline is just a bunch of voltage fluctuations, and after the "last / first mile" a bunch of bits--both of which can be tapped very easily. Unless we all start using STU-IIIs it's simply best to assume that you're being tapped. (And even with STU-IIIs you still have to worry about traffic analysis.)
English version of this article can be found here:
http://www.heise-online.co.uk/news/25C3-Serious-security-vulnerabilities-in-DECT-wireless-telephony--/112326
With a laptop aufgebohrten [bohren is to drill] card for 23 euros, according to security experts call on the basis of the widely-used standard Digital Enhanced Cordless Telecommunication simply listen.
Who confidential telephone conversations, you should better not be one of the most popular cordless phones on the basis of the standard DECT (Digital Enhanced Cordless Telecommunication) access. As security experts at the 25th Chaos Communication Congress (25C3) in Berlin said, can easily intercept such communications. What is needed is therefore only a aufgebohrte, actually for the Internet telephony imaginary laptop card for 23 euros and a Linux computer. No problems with the interception of long-distance DECT had this device, as very often when an encryption is not activated. But even at the beginning of encrypted information exchange could plug the card base and pretends to disable encryption.
The approval by the European Telecommunications Standards Institute (ETSI) standard DECT procedure is most widely used for cordless telephones. In addition, the standard in Babyfonen, emergency calls and door-opening systems, cordless EC-card or even in traffic management applications. The number of active DECT terminals in this country alone at 30 million. For the authentication of the base and the associated equipment and for the encryption of data using DECT standard crypto methods.
The algorithms are used in the devices and will all be wired to the public are kept secret. The network master key is not used to leave. In theory, see that everything from sound, said Erik Tews, one of the researchers involved the discovery of the TU Darmstadt. The practice, however, as various workarounds and attack surfaces.
After the hackers initially a fairly expensive and high processor performance requirements DECT sniffer had built, they found, according to Andreas fellow students with the ComOnAir card "another beautiful hardware" for the reception of data traffic. After a reverse engineering, the replica of the circuit diagram, the retrieval of Fimware and the AnlÃten some additional lines was scarce after a month of looking, for example, from a house in front of a parked car use sniffer been completed.
The inventor was quickly noticed led Tews went on to say that sometimes have no authentication or encryption process between the transmitter station and the handset will be activated. Often authenticate the phone only to the network as the GSM cellular standard, although in principle, DECT also the network to the receiving unit as it could identify. For other devices, is a successful authentication, but without encryption. In all these cases, the PCMCIA card with a special Linux driver active discussions track, extract the data on a storage medium and write an audio player such performance can. It should have been possible, in any conversation in such a poorly secured DECT network recorded.
If the handset is encrypted conversations have had the case not much more difficult, said Tews. Using a modified driver and a script you have the base issue as sniffer and data traffic, thanks to the support VoIP on an Asterisk server, and also redirect you. A breaking of keys had been necessary because when emit a signal that encryption is not supported, to communicate in plain had been converted. "It works on all systems, which we have found here", underlined the Darmstadt researchers vulnerability DECT standard implementations.
Even when encryption system itself was the first hacker sticking points. According Tews succeeded them, a reverse engineering of the central DECT Standard Authentication Algorithm (DSAA) and its four sub-models to implement. A research report on the project site dedected.org finding implementations and source code for the programming languages Java and C will follow soon. Quite the DSAA is broken so far but not yet.
On the well kept secret DECT Standard Cipher (DSC) is in accordance with Ralf-Philipp Weinmann of the research team is also still no effective attack. A paten
Always back up, never back down. ---- Think you're cool 'cos your uid is prime? Take mine, modulo the one digit integers
Does this mean we can make fun of the Germans, Mock their culture and ideals. Show how backwards they are compared to our culture. Do this while not fully understanding what their culture is or reasons why their method needs to be different then ours.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
This copypasta just isn't the same without the actual picture of the orange-tanned guido and his coked up girlfriend next to it.
You can also read it in Dutch ;) here)
But another way is ofcourse English. Full story from researchers right here
I get a prize now for finding it ;)?
You know you've lurked long enough that you see it immediately when you read the first line anyway.
http://www.heise-online.co.uk/security/
25C3: More light shed on "denial of service" vulnerabilities in TCP
25C3: Reliable exploits for Cisco routers
25C3: Cracks in the iPhone security architecture
Lars T.
To the guy who modded me down from perfect to terrible Karma - Apple haters still suck
Don't be a stranger. Just hit me with your best shot. I'm pretty much perfect. I was captain of the football team, and starter on my basketball team.
And yet, while faced with a simple problem, like for example 9 + 3, your head start to hurt, and smoke comes out of your ears.
It's normal for stupid people to hate those that are smarter than them, but you should really be grateful that there are people who does not consider sports and chicks to be the sole meaning of life.
Without us, where would your precious TV be? Where would the machines that build your sports stadium be? Where would your car be? The truth is, without us you'd still be sitting in the forest, banging two sticks together, trying to make fire.
Now shoo, go play with your balls, grown ups are talking.
is available on thier UK site: 25C3: Serious security vulnerabilities in DECT wireless telephony
First question- How many of you use encrypted passwords and secure procedures in your online transactions? Next question- do you have a lock on your mailbox? Most identity theft is done in the physical world through the simple theft of mail.
WPA2 with AES-CCMP is designed by people who actually know what they're doing.
Xenu loves you!
<sarcasm>Umm, yeah, that would work great.</sarcasm> Less facetiously, it would indeed have been possible to make things secure using SSL; but just using it isn't enough, at least as long as you use standard certificate authorities for auth. If you make your own, this particular crack probably wouldn't hit you.
But THIS is exactly the point. Wired can be as secure as a box LOCKED, under watch by a guy armed to the teeth under a nuclear bunker , IF YOU WISH. You will need access so physical access is the security layer you have in ADDITION to the normal transport protocol layer. Wireless on the other hand is a "telecom box" which is open to the public 24/7, with the added advantage that nobody will ever ask you why you are fumbling with that telecom box, because you cannot be caught snooping that communication.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org