Slashdot Mirror
CCC Hackers Break DECT Telephones' Security
Sub Zero 992 writes "Heise Security (article in German) is reporting that at this year's Chaos Communications Congress (25C3) researchers in Europe's dedected.org group have published an article (PDF) showing, using a PC-Card costing only EUR 23, how to eavesdrop on DECT transmissions. There are hundreds of millions of terminals, ranging from telephones, to electronic payment terminals, to door openers, using the DECT standard." So far, the Heise article's German only, but I suspect will show up soon in English translation. Update: 12/30 21:27 GMT by T : Reader Juha-Matti Laurio writes with
the story in English. Thanks!
All your base station are belong to us.
In a world not ruled by morons and legacy equipment, I imagine that the DECT link would just be carrying a nice SSL session, and it wouldn't much matter.
However, I submit the following(PDF warning) as evidence that we do not live in such a world, indeed, there is some reason to suspect the exact opposite.
Personally I find it scary that people consider 'wired' communications to be 'secure' by default.
AFAIK most wireless protocols have at least some kind of 'security' and 'encryption' in their design. Granted that quite a few of these have been shown to be "incomplete", but at least there's an effort. Wired stuff on the other hand seems to be optimized for speed (and stability) only, but nobody really cares about security. When someone finds that they can eavesdrop on a wireless keyboard from an unobscured distance of say 5ft, hell breaks loose. But by my recollection there's been 'keyboardloggers' for ages, both in hardware (a "part" you had to put between the computer and the keyboard, something not quite unfeasible when you can get up to 5ft anyway) and software. (**)
Clearly, wireless is much harder to control (it simply goes through the wall to the house next door), wired isn't all that "unbreakable" either. ...
Imho, security would best be handled using software, that way at least it's easier to "upgrade" when a fault in the protocol is found. I doubt we're going to see everyone throw out their DECT phone or whatever anytime soon... Maybe they'll be able to eavesdrop on phone-conversations, and maybe they'll even manage to see what's going up & down when a payment transaction is going on, but I think (HOPE!) the latter will have at least some kind of protection in there to avoid the packets to be tampered with
(**: Frankly, I think the latter is much more widespread than most any of us think since it's so damn easy to create, but that could be me being paranoid)
If there is one thing to be learned on slashdot, it has to be sarcasm.
Es gibt Personen die Deutsch verstehen, Du unsensitiver Klumpen!
Germans are people too!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Deutsche Schraegstrichpunkter fuer den Gewinn!
English version of this article can be found here:
http://www.heise-online.co.uk/news/25C3-Serious-security-vulnerabilities-in-DECT-wireless-telephony--/112326