Investigators Replicate Nokia 1100 Banking Hack

Ian Lamont writes "Investigators have duplicated an online banking hack using a 2003-era Nokia mobile phone. Authorities had been aware for some time that European gangs were interested in buying the phone, and were finally able to confirm why: It can be used to access victims' bank accounts using "special software written by hackers." The hack apparently works by letting criminals reprogram the phones to use someone else's phone number and receive their SMS messages, including mTANs (mobile transaction authentication numbers) from European banks. However, the only phones that work are 1100 handsets (pictures) made in a certain factory. Nokia had claimed last month it had no idea why criminals were paying thousands of euros to buy the old handsets."

Comments

It may be illegal..

[Anonymous Coward]

It may be illegal, but the hackers deserve some credit for being able to figure this out.

Re:It may be illegal..

[OeLeWaPpErKe]

Even now clearly the over-the-air gsm protocol allows for this hack. Perhaps 1100 phones will be in short supply, but clearly the protocol itself is vulnerable.

If they found the 1100 flaw, how hard could it be to duplicate the flaw in a something like a 800 Mhz tuner + fpga ?

Re:It may be illegal..

[K. S. Kyosuke]

I guess they think as well that they deserve some credit. That's why they are breaking into a bank.

Re:It may be illegal..

[cbrocious]

You don't even need to go the FPGA route. The baseband firmware on the iPhone has been patched for an unlocking, there's nothing stopping someone from patching it to change the IMEI built into the phone or the IMSI it "reads" from the SIM. Change these and the phone can become any other.

Re:It may be illegal..

[FooAtWFU]

I guess they think as well that they deserve some credit. That's why they are breaking into a bank.

That's debit, silly.

Re:It may be illegal..

[K. S. Kyosuke]

If I am not mistaken, you already can buy and run something like that.

Re:It may be illegal..

[Z00L00K]

And if this flaw exists in those phones it also means that there may be other phones with a similar flaw.

And don't forget that the smartphones that are around can be subject to hacks that does the same thing.

Don't ever think that the operating system on the smartphones are safer than the operating system you run on your PC.

Re:It may be illegal..

[Bill, Shooter of Bul]

Depends on your definition of hard. If I were a Criminal I'd be looking at an open moko, to see if you could hack that in a similar manner. The firmware is fully open

Re:It may be illegal..

[sexconker]

It's not the phone.
A phone is nothing but a transceiver.

It's the system we have for identifying phones, and the practice of letting people bank over it (or sending authentication pins for pc banking to phones).

Using a phone number as a method of authentication is inherently flawed. The practice will continue, however, because the plebes want easy more than they want secure. After all, it'll never happen to them.

Re:It may be illegal..

[cbrocious]

That's the firmware for the application CPU, but I don't believe the GSM baseband chip's firmware is open.

Re:It may be illegal..

[fuzzyfuzzyfungus]

I'm fairly sure that the OpenMoko only achieves that level of firmware openness by integrating a separate GSM module, with which it communicates via standard AT commands. Just as, back in the bad old days of dialup, modems were closed source; and you could either get a winmodem, or a modem with a proper processor of its own.

Were I a criminal with a technical inclination, I'd be more interested in something like GNU radio, as suggested in this comment

Re:It may be illegal..

[Anonymous Coward]

I guess they think as well that they deserve some credit. That's why they are breaking into a bank.

That's debit, silly.

Actually it's debt, since money is only created in our current system when it is borrwed.

Re:It may be illegal..

[Chelloveck]

That's right. People should be required to enter their 1024-bit PGP key by hand every time they make a transaction.

Re:It may be illegal..

[Anonymous Coward]

The practice will continue, however, because the plebes want easy more than they want secure. After all, it'll never happen to them.

This trick apparently works only after the attacker already has your username and password. This was an extra layer of security on top of that. Although one those devices like Blizzard has setup for WoW accounts would probably be a better bet.

Regardless you can hardly say having to log in with a username and password, then waiting for a text and typing in the sent authentication code is super convenient.

Re:It may be illegal..

[rtfa-troll]

Bullshit. Not on any properly run network. Apart from the IMEI (which is written on the back of the phone) and the IMSI (which you can get with a special code from some phones) there's also the Ki. This is a secret which is buried in the SIM card and _never_ sent out to the phone. Without the physical SIM card in your phone you do not have the number.

Now, there have been flaws in this; it has been possible to clone the SIM card because of implementation flaws, but properly made new SIMS should not have most of these. The authentication algorithms used originally were weak and could leak the key, but modern SIMs should be using stronger ones (e.g. AES). However none of these were magically to do with one particular model of a phone.

Something different is going on here. E.g. a security company marketing scam or that the mobile can work as a short range base station and do interception or something else. Definitely not the way that it seems to be explained in the article. And definitely not that the just "changed the IMEI and the IMSI and became the other subscriber"; apart from anything else, you have no need to change the IMEI to do that.

Re:It may be illegal..

[mea37]

Cell phones don't use the phone number as a method of authentication. Cell phone users use the phone number as a method of identification (when they place a call or send a message to the number).

The network "looks for" the identified phone so it can deliver the message. Rather, the network looks for a phone that has authenticated as a match for the phone number.

The process by which the phone authenticates may well be flawed, but this has nothing to do with the end-user simplicity of "phone numbers"; the process is already decoupled from that simplicity as the phone # is not the information used to authenticate the phone on the network.

Re:It may be illegal..

[Anonymous Coward]

Well, If the European internet banking systems work like a lot of the NA ones, another possibility might be that they deliberately provide the wrong password so that the user out so that he is presented with one a "personally-identifying" question (which the user may have chosen to be their child/pet's name or high school). Some minimal research by hanging out near the home or working in the same office and/or googling gives the answer. Only really worth it if the target is relatively wealthy (low-level executive or better) but still fairly low hanging fruit.

Re:It may be illegal..

[fuzzyfuzzyfungus]

Evidence for above claim:

" CALYPSO ASIC digital baseband Unfortunately we cannot provide many details on the GSM chipset due to very tight NDAs. However, this is not neccessarily required, since it interfaces using a standard UART serial line with the S3C2442. On that interface, GSM 07.05, GSM 07.10 and other standardized protocols are used. "

Re:It may be illegal..

[trum4n]

Shit. I've been stocking these things for years. I pull the screens for micro controller hacks. I honestly have 30 of these phones. i figured they were useless.

Re:It may be illegal..

[Anonymous Coward]

Or stolen.

Re:It may be illegal..

[Bert64]

Those security questions are a pretty stupid idea, i always enter random information but then i tend to forget what i put in...
I had a friend who was getting very annoyed that her brother kept breaking into her hotmail account... It turns out that the security question was the old "mothers maiden name" one, to which she had answered honestly, and to which her brother obviously knew the answer.

Re:It may be illegal..

[Lumpy]

Oh jeebus. Go to sparkfun and buy a GSM module and have full access. A couple of the popular GSM modules have been cracked and are wide open.

you dont need a phone to hack this stuff. Plus SMS is sent in the open you can easily start grabbing the SMS stream if you have the right equipment. All of which can be bought readily on ebay.

Re:It may be illegal..

[Bert64]

Aparrently they've been selling for a lot of money, far more than they should be worth... You're in luck and might be able to make a decent profit.

Re:It may be illegal..

[Briden]

what's even more interesting is what they say on openBTS about their test operation at Burning Man. If you are looking for the now-kinda-famous Burning Man write-up, it's been moved to here. Yes, we will record your IP address. Why? Keep reading. *click* it was worth it.

Re:It may be illegal..

[sexconker]

I hate when I'm forced to use those.
So stupid.
I usually just pq3985y4qp49tgw[4tefih2g them.

Also: http://www.penny-arcade.com/comic/2006/7/12/a-wider-perspective-on-flavor/

Re:It may be illegal..

[geekoid]

If it is never sent to the phone, then how is it used?

Re:It may be illegal..

[Anonymous Coward]

as we all know, 'secret' never come together with 'security'. Once that 'secret' is 'public' then you don't have 'security' any more.

Re:It may be illegal..

[olden]

Why hide the source of the above quote? Oh yes, because the next paragraph reads:

"The NDAd documentation for the calypso, register definition (sic) and hardware definition, was leaked [...]"

Maybe not so un-hackable after all...

Re:It may be illegal..

[cheater512]

In a hash function as a challenge response.

The tower sends a chunk of data, its sent to the SIM, its then transformed by Ki and then sent back to the tower.
The tower knows what Ki is and does the same transformation and verifies that the reply is the same.

Re:It may be illegal..

[wvmarle]

I guess they think as well that they deserve some credit. That's why they are breaking into a bank.

That's debit, silly.

Not from the victim's point of view...

Re:It may be illegal..

[wvmarle]

This is actually a pretty secure way of doing transactions, far more secure than just a login and password like so many banks use. When I see fishing for online banking credentials it is virtually exclusively targeting US banks. Not European banks.

The idea is quite simple: it is the combination of something you know (un/pw to login), and something you have (the phone). This has always been argued on /. as being a good way to do authentication. It is quite similar to the ATM card: something you know (your PIN code) and something you have (the card). Having one or the other is not enough.

That these phones can be hacked to log on to the mobile network using an arbitrary number is where the problem is. That should not be possible in the first place and should be fixed. I think this is pretty much the level of adding a magnetic reader and camera to an ATM to copy victims cards and read their PIN as they enter it. Except that this hack seems to be a degree harder to pull off.

There is probably no 100% safe and secure way of doing banking business, neither online nor offline. There will ALWAYS be ways to hack them. So we have to remain vigilant, and try to detect and stop those hacks immediately.

When doing my bank business offline, all I have to do is fill in a remittance form, sign it, and hand it in to the bank (I can ask someone else to do that for me, no need to go by myself). Signatures can be forged relatively easily with practice - as long as it looks very much like the original the bank staff will accept it.

The main trick has to be to make it so hard that it becomes unprofitable. Or to improve traceability of the cash: follow the stolen money to the criminal, that the risk of getting caught becomes really big.

Re:It may be illegal..

[Anonymous Coward]

Free Kevin!!

Re:It may be illegal..

[sam0vi]

Maybe you don't even need to. From Wikipedia:

Over 200 million Nokia 1100 cellphones have been sold since its launch in late 2003, making it the world's best selling phone handset, as well as the best selling consumer electronics device in the world, beating Sony's Playstation 2 (125 million), Apple's iPod (170 million), Motorola's RAZR (120 million), and LG's Chocolate (10 million)

. So i'd guess there must be landfills full of those things. How i wish i had one to put in ob ebay, :-(

Re:It may be illegal..

[Squant]

You use the screens for micro's? Do you have a website on that? You have piqued my interest ;-)

Re:It may be illegal..

[Magada]

Card cloning. Possible. Trivial even. "Properly made new SIMs" is a small subset of all SIMs.

Re:It may be illegal..

[OeLeWaPpErKe]

I doubt this attack supposes access to the original subscriber's simcard, so if it's a cloning attack it's cloning a simcard *without* access to the Ki number.

How would that work ?

Re:It may be illegal..

[Gnavpot]

If it is never sent to the phone, then how is it used?

Are you serious? You could ask the same question for any secure password handling:

"But... If my password is never sent to the server, then how is it used?"

I said "you could". On /., you should probably not.

Re:It may be illegal..

[cheater512]

I didnt say it wasnt impossible. I only explained how Ki works.

Re:It may be illegal..

[fuzzyfuzzyfungus]

I didn't say "un-hackable", I say "closed source". As you say, the NDA-bound hardware specs for the calypso have leaked, a boon to reverse engineering efforts. The fact that the hardware specs, had to be leaked(nevermind the source for the firmware running on the thing) suggests how not open the GSM module is. My point was merely that the OpenMoko was no more open than usual, with respect to its GSM module, not that it was any less hackable than usual.

Re:It may be illegal..

[trum4n]

This one got me interested. Nothing is really documented after that. ive found various nokias ahve this and a similar color screen. very easy to interface. http://www.electronics-lab.com/projects/mcu/013/index.html

Re:It may be illegal..

[cgfsd]

That's right. People should be required to enter their 1024-bit PGP key by hand every time they make a transaction.

If you make them type in their PGP key, they will just tape it to their phone like they do with their passwords under their keyboards.

Re:It may be illegal..

[sexconker]

All the banks I use (in the US) use a similar deal. For each new pc (browser, really) you want to access their banking sites from you need to give them your user name and password AND a pin, which can be sent to your phone, email, etc.

It's better than a user name and password, sure, but it is NOT secure, and as demonstrated, it's not exactly hard to impersonate a mobile device.

The authentication piece of any security system must be as secret as possible. Ideally, only the authentication system and you know the secret.
The main problems with a typical password-only system are:

People choose shitty passwords.
People get phished/keylogged.
People forget their passwords.
People use the same password for everything.

You can mitigate shitty passwords, phishing/keylogging, and using the same password for everything with those USB dongles that display a one-time (essentially) pin.
But you still need a traditional password (or other method) to go with it, since the dongles have no authentication scheme - push a button and get a code.

You then have issues of the dongle being lost, never really knowing who has the dongle, the dongle dying, etc.

Of course there's no completely secure way of doing banking. But the online banking that relies on a pin sent to a phone number via SMS is a joke (because of the fail that is the PTN).

Why, I remember back in the day when you had to go to your bank (like, physically) in order to authorize your account for online banking and set up your login stuff. Nowadays you can setup online banking without having to enter a branch. You can even set up actual accounts completely online.
With a minimal amount of information from a person (something an employee at a cell phone store could have access to, for example) you can set up accounts as people and easily get by the stupid verification questions from Equifax that all the banks use.

(By the way, if you're trying to set up an online banking account and you get a message saying you failed the questions, it's the one about your phone. You've got a cell phone, but they think it's a land line, or vice versa. Try again and switch your answer for the phone question.)

The bottom line is that using a phone number as part of an authentication scheme is a joke in terms of security, but the banks (and users) don't really care about security, they care about easy.

Re:It may be illegal..

[rtfa-troll]

if it's a cloning attack it's cloning a simcard *without* access to the Ki number.

How would that work ?

Typically by reading the RES (a hash of RAND which is sent across the network in plaintext and the Ki which is in the SIM) sent across the network, probably repeatedly. That's not easy but not impossible. If the encryption algorithm in the SIM is bad then it will gradually leak information about the Ki (or if it's really bad, quickly) and then you could work out what the Ki was.

Generally the answer is it shouldn't and mostly wouldn't work. Direct access to the SIM will help alot (you can make queries much faster) as would some other way of knowing the Ki.

Interesting

[Lord Kestrel]

The fun little loopholes people find are always interesting to see. I'm guessing it won't take long for these phones to be outlawed in the EU though.

Re:Interesting

[Anonymous Coward]

Outlawing the phones might not do much. As far as I can gather from the article, these 1100's work because their firmware is easily modifiable because it's stored on a reflashable ROM chip.

It really wouldn't be too complicated to manufacture phones somewhere outside the EU that happen to have that feature. Whatever software steps are necessary for spoofing SIM cards clearly already exist---the only obstacle is appropriate hardware.

When people are paying thousands of Euros for the vulnerable 1100's, I really don't see them balking at paying two hundred Euros for a phone specifically manufactured to allow SIM card spoofing---no matter how illegal it might be.

Hell, manufacture them in a country where goods counterfeiting is already endemic, like China. It'd be a real trick to enforce a law banning phones capable of this kind of trick when they look externally like half a dozen various garden variety phones.

I suspect this particular fun little loophole will require a technical solution---or a shift away from using SMS for sensitive data.

Re:Interesting

[e4g4]

I'm guessing it won't take long for these phones to be outlawed in the EU though.

Yeah, legal prohibition is an excellent way to prevent people from using something. It works so fantastically well for drugs, guns and pirated music/movies.

Re:Interesting

[johnsonav]

It works so fantastically well for drugs, guns and pirated music/movies.

Hasn't stopped people from trying though, has it?

Re:Interesting

[Lord Kestrel]

That's kind of my point. It'll be illegal for normal users to have them, but the criminals will keep doing what they always do, ignore the law. People who have one because it's old and they can't afford a new one, or like a limited feature-set or whatever would be screwed by the law, but the criminals who are already breaking the law would continue to do so.

Re:Interesting

[knight24k]

Yeah, legal prohibition is an excellent way to prevent people from using something. It works so fantastically well for drugs, guns and pirated music/movies.

A little bit different here though. The device in question requires a service in order to work. If all the carriers discontinued service to these models they would render them useless. You could find them anywhere you wanted, but without a way to connect, it is just another paper weight. Almost like in the Matrix when Agent Smith tells Neo "What good is a phone call, when you are unable to speak?"

What good is a hackable phone, if you are unable to get a dial tone?

Now, they may or may not go down that route, but I think if they choose to do so, they will have a much more successful time removing them from use than with consumable items.

Re:Interesting

[Anonymous Coward]

GSM is already a government-protected standard in most parts of the world. Touching it is illegal without the blessing of your local radio regulatory agency.

Re:Interesting

[codegen]

If all the carriers discontinued service to these models they would render them useless.

I wasn't aware that the model of the phone was part of the GSM protocol. Even if it was, if you can program the phone to lie about the IEMI or IMSI, then you can program the phone to lie about the phone model to the provider.

Re:Interesting

[knight24k]

I wasn't aware that the model of the phone was part of the GSM protocol. Even if it was, if you can program the phone to lie about the IEMI or IMSI, then you can program the phone to lie about the phone model to the provider.

Maybe, maybe not. It is a particular model made in a particular factory. Changing the model may break the hack since the provider may talk to the device differently since it now thinks it is a different handset. There is something very specific about the phones in question and reprogramming the model type/number may or may not work. Frankly, I don't know one way or the other.

My point was that since these devices require an outside service to operate it is far easier to target them for bans than other types of prohibitions which target mainly consumables that require no outside entity to function as desired.

Re:Interesting

[mdielmann]

I'm guessing it won't take long for these phones to be outlawed in the EU though.

Yeah, legal prohibition is an excellent way to prevent people from using something. It works so fantastically well for drugs, guns and pirated music/movies.

Don't forget hookers. I think it's illegal to mention drugs and guns without mentioning hookers. And just to be safe, let's mention blackjack.

Re:Interesting

[lorenzino]

WOOOOOOOOOOOOOOOOOSH

Re:Interesting

[Magic5Ball]

A single component or step substitution on a single production line can expose unintended capabilities when supplies are commodities only to an extent. Recall the interesting modifications enabled by a single line of graphite.

Re:Interesting

[ppanon]

According to the other posts earlier in this thread, the critical thing about this phone is that the firmware is a flashable ROM that can be easily reprogrammed. So the critical thing is that you can easily get this phone to lie, about the phone account used, and about anything else that would be transmitted over the standard GSM protocols. So the GP is correct: locking out the phone type - assuming it was possible, wouldn't do any good because the phone could be reprogrammed to impersonate something else.

It is extremely unlikely that the existing cell tower/receiver infrastructure could be used to determine that a phone is an 1100 impersonating some other model (or even upgraded to do so). It would be better to spend the development costs on revamping GSM to use a secure handshake protocol with large asymmetric key sizes and non-removable private keys, and securing OOB control channels with AES. Good luck getting police forces and spook agencies to roll over for that one though.

Re:Interesting

[digitalchinky]

The Nokia 1100 does happen to be one of the best selling products of modern times. 200 million units sold. I'm thinking it might be a little bit difficult to shut that barn door.

Re:Interesting

[Anonymous Coward]

Wouldn't it be better to stop banks from sending this type of information over SMS?

Re:Interesting

[Anonymous Coward]

I'm guessing it won't take long for these phones to be outlawed in the EU though.

Better yet, let's put little STOP-stickers on all pictures of these phones. According to the German government that's enough to stop illegal acts.

Re:Interesting

[austinpoet]

looking at europe as a whole you can easily find legal drugs, hookers and gambling.

Re:Interesting

[mdielmann]

There go my plans for a moon casino.

Re:Interesting

[Anonymous Coward]

You forgot the theme park. Ah, screw the theme park.

Damn...

[Jaysyn]

I think I had one of those & gave it to my 4 yr old nephew to play with / destroy it.

Re:Damn...

[ObsessiveMathsFreak]

You've turned him to a life of crime!!

Re:Damn...

[Anonymous Coward]

It'll take more than just another 4 year old AC to destroy /.

Re:Damn...

[gringofrijolero]

Check your bank statement. He may have moved a couple of million into your account...Or emptied it into his trust fund

Re:Damn...

[Nikkos]

Now you know where he got the diamond-encrusted tricycle.

Re:Damn...

[Anonymous Coward]

I still have one somewhere.

How do I make sure I get a good deal on selling it?

Re:Damn...

[sznupi]

I don't actually believe he was able to destroy one of those... ;)

Re:Damn...

[Anonymous Coward]

You've turned him to a life of crime!!

Perhaps he should check if his nephew has already fled with 5 million bucks to the bahamas.

Hardware hack?

[Anonymous Coward]

"The modified firmware is then uploaded to the Nokia 1100. Certain models of the 1100 used erasable ROM, which allows data to be read and written to the chip, Becker said."

If that's the case, how hard would it be to desolder a non-flashable ROM and replace it with one that is? It would certainly be more hassle than buying a phone already built that way, but with the right tools and enough effort, why wouldn't any phone be susceptible to this type of attack?

Re:Hardware hack?

[Anonymous Coward]

I would think that any phone could be screwed with,.

From the article, it says they reprogram the phone so they can alter the IMSI(which I'm pretty sure is related to the SIM card in the phone and not the phone itself), IMEI (phone identifier), and then they clone a SIM card.

I'm not entirely sure what they are doing then. If they are cloning the SIM card (which I would want to guess includes the IMSI) then why do they need to modify the IMSI in the phone? (unless they are cloning a different SIM card and have the phone lie about the IMSI).

Of course, I don't know about cloning SIM cards or anything like that. My most interesting experience with SIM cards was when they activated it and gave us someone else's number (my sister's phone, the number's owner's girlfriend was very annoyed. (and it was a Texas rather than WA state number))

Re:Hardware hack?

[Anonymous Coward]

you're assuming that each ic is independant, most times custom ic's are ordered for production runs to prevent exactly the kind of hack that you propose.

that and all the chips are Ball Grid Array contacts,ever tried to replace one? without a good workstation its damn near impossible.

Re:Hardware hack?

[dave562]

It probably isn't so much just the ROM, but also the code on the phone itself, and the amount of available room in the memory to work with. The hackers probably developed their code specifically for that phone, and are counting on memory addresses being in a particular place, and all sorts of other variables that have to be considered when writing assembly code for a specific piece of hardware.

Back in the day, everyone wanted an Oki 900 because it could store between 5 and 99 ESN/MIN pairs AND swap them on the fly. In theory, you could just use G2 and reprogram a Motorola flip phone, but that required a laptop and a loader phone. So sure, you could do the same with with a Motorola, but it was a lot easier to use an Oki. In the end though, the result was the same. You were able to make calls and not pay for them.

In the case of the Nokia phone, whoever developed the hack developed it for the Nokia 1100. They probably spent a lot of time reverse engineering/disassembling the original EEPROM and a lot of time hacking the code together to make it work.

Re:Hardware hack?

[citizenr]

EVERY SINGLE Nokia phone uses flash rom to store firmware. That alone makes me think its a hoax.

Its trivial to change IMEI. Its trivial to get IMSI. You CANT just use someone elses IMSI, you need at least ki.

and who the F is Ultrascan KPO?

This looks like a big fat scam to sell old stock of Nokias 1100 and this nobody Ultrascan is riding the scam wave trying to establish some good PR.

Re:Hardware hack?

[citizenr]

It probably isn't so much just the ROM, but also the code on the phone itself

erm the code is in the rom, FLASHROM

They probably spent a lot of time reverse engineering/disassembling the original EEPROM and a lot of time hacking the code together to make it work.

Except user authentication on GSM network is between Network and SIM card, PHONE is just a dump data pipe during that phase. This is just a scam.

Re:Hardware hack?

[dave562]

The code is in the ROM, but the code is specific to the phone. The user auth might happen on the GSM network, and sure it's between the network and the SIM, but the phone has to run the authentication code. The hacker obviously knows how the code runs on the Nokia 1100. To go back to the Oki 900 example, the Oki 900 was the phone of choice because of the hardware architecture of the phone. The Oki 910 was almost the exact same phone, but it couldn't do what the 900 could do. Similarly, while there are dozens of Nokia models and hundreds of GSM phones, the code that is being used to intercept SMS information from the banks was obviously developed for the Nokia 1100 and probably only works on the Nokia 1100. What makes you think it's a scam? Have you ever written assembly code for cell phones? Do you have any idea what you are talking about?

Is it possible that other phones could do the same thing? Sure it is. Someone even said that the iPhone might be able to do it. Does the guy who wrote the code originally want to redevelop it on another platform? Probably not. Do the people who purchased the code from some underground website have the expertise to port the code to another phone? More than likely not. They just know that they have some code and the only works on a Nokia 1100. That has nothing to do with being a scam, and everything to do with the way market forces work.

Re:Hardware hack?

[citizenr]

The user auth might happen on the GSM network, and sure it's between the network and the SIM, but the phone has to run the authentication code.

No, phone just pushes data between SIM and network, encrypted data.

Re:Hardware hack?

[digitalchinky]

And the cell tower microwave link pushes all of that 'decrypted' data in one neat little muxed up package over the same bit of air you're fighting with to figure out the GSM encryption key. If these phones are selling for 25 grand, it shows people have far more money than brain cells, though more than this, it shows just how far behind the curve criminals actually are. For that kind of outlay you can buy your own spectrum analyser, microwave receive gear, modems, down converters, data capture cards, and a nice server to suck it all in to. (Most of it second hand) Maybe not quite as easy to lug around as these little Nokia 1100's, but if your purpose in life is stealing money, then you're doing it wrong.

Just for starters:

More than a few (hundred thousand) ATM's are satellite or microwave linked. You might be a little bit surprised (in an angry kind of way) at just how chatty these beasts actually are too. Encrypted? Would you call plain old ebcdic buried in a simple ad-hoc packet switched network 'encryption'? Hell, there are plenty of banks that link their dumb terminals straight in to HQ, this is far worse than waiting for an ATM to fire out its daily sitrep. 97.4% of bald headed bank managers seem to think that if their data is passing through a feed horn at some point on its journey, then it must be secure there too, right? Right? Well, sure why not, whatever you say sir. Now lets just watch in real time exactly what your bank babe is typing in to her terminal over there, all with some cheap off the ebay shelf equipment.

Banks love to make a show of security to the customer, and they are pretty good at it in general, but they let themselves down on the back end. For someone with a bit of an interest in radio and basic networking, though in particular for someone with no moral guidance unit, I guess you could say there is money to be stolen at every turn.

The things people would know, if they only knew :-) It's good to be a consultant sometimes. Money for nothing.

Re:Hardware hack?

[Anonymous Coward]

This guy wins. A very complex hack was written for a specific eeprom. The author could make it work on other phones, however, his code was leaked/stolen and the script kiddie gangsters buying the 1100s can't.

Correct use of the term

[kidde_valind]

It's nice to see an example of correct use of "hacker" by the mainstream media, even if it's just by chance

still using one

[jaroslav]

I've got one of these in my pocket right now. Do you think it would raise any suspicion if I posted it on eBay now?

Nokia 1100 L000000K! RARE! HACK BANKS!!!

Re:still using one

[Acer500]

LOL I have one too.

My newer phones have all been stolen :( - I've been mugged for a bad camera/mp3 phone over here, it's pathetic, so I refuse to buy a new one.

I thought I was safe carrying this old phone, now it might be even more of a target than a new phone, how ironic (though this kind of stuff is not happening here in Uruguay - we're still 5-10 years behind Europe as always).

Re:still using one

[baka_toroi]

Someone already took care of it (link in spanish): http://articulo.mercadolibre.com.ar/MLA-52568423-vendo-2-por-1-nokia-1100-_JM They're selling 2 Nokia 1100 at ~$1300

Re:still using one

[Squeeonline]

Wonder how much I could get for my old phone sitting in the drawer next to me. couple of grand wouldnt go a miss!

Re:still using one

[syousef]

Do you think it would raise any suspicion if I posted it on eBay now? Nokia 1100 L000000K! RARE! HACK BANKS!!!

A++++++ thief. Would steal with him again!

Re:still using one

[rMortyH]

THIS IS the Best Phone EVER!
    I have two. They're awesome.

    4+ years of continuous use,
    3 DAYS of battery on ONE HOUR of charge,
    NO features except a flashlight,
    EXCELLENT sound and reception.
    Tons of free chargers and headsets all over

    It's just a phone. It just works.
    They let me take it into secure places.
    I love it.

    The only bummer about this story is that now I'll have trouble getting replacements!

    Damn.

At least this only works with the European version...

Re:still using one

[Anonymous Coward]

A little more subtle, like this ebayer.

http://tiny.cc/Hymp6

Nokia: 1 - Apple: 0

[Jonas Buyl]

Smart move from Nokia trying to outsell the iPhone

Re:Nokia: 1 - Apple: 0

[kovari]

Actually, this particular model outselled iPod. All models.

Re:Nokia: 1 - Apple: 0

[Keruo]

Trying to outsell?

Nokia's one billionth phone sold was a Nokia 1100 purchased in Nigeria.
(http://www.engadget.com/2005/09/21/nokia-crosses-one-billion-mark/)

Although something tells me that Nigeria isn't neccessarily most prominent market for apple, since price of an iphone is equal to one years salary for an average nigerian.

Re:Nokia: 1 - Apple: 0

[megamerican]

Trying to outsell?

Nokia's one billionth phone sold was a Nokia 1100 purchased in Nigeria.
(http://www.engadget.com/2005/09/21/nokia-crosses-one-billion-mark/)

Although something tells me that Nigeria isn't neccessarily most prominent market for apple, since price of an iphone is equal to one years salary for an average nigerian.

They seem to have a lot of royalty. Maybe Apple should go after them.

Re:Nokia: 1 - Apple: 0

[SydShamino]

Although something tells me that Nigeria isn't neccessarily most prominent market for apple, since price of an iphone is equal to one years salary for an average nigerian.

That's just because the average Nigerian's money is caught up in an off-shore bank account, and we aren't doing our part to help them access the funds despite the generous offer of 10% commission.

Re:Nokia: 1 - Apple: 0

[Anonymous Coward]

I know plenty of millionaires in Nigeria, they email me all the time.

Re:Nokia: 1 - Apple: 0

[Anonymous Coward]

That's great! Now I can use my Nokia 1100 to finally collect the $30 million dollars promised to me by the Nigerian High Commissioner of Treasury and Banking. That's so much more convenient than sending him $4000 dollars and waiting for the check to come in the mail.

I hope the mail person hasn't picked up the mail yet.

I have that phone

[Anonymous Coward]

My fried gave me his because he got a new one and he knew I like to take stuff apart, but sadly I don't live in Europe, so I can't sell it (at least easily) for some quick cash.

i doubt it

[wjh31]

they are actually very widespread, i see that model all over the place. Not everyone wants a top of the range phone, some just want to make calls and use texts. This is one of the few dirt cheap phones available.

Re:i doubt it

[Klasyk]

This is one of the few dirt cheap phones available.

Really? If your interpretation of 'dirt cheap' is â25,000, then I'd love to have your wallet. :)

Re:i doubt it

[Achromatic1978]

Not just any Nokia 1100. One made in a certain factory in a certain date range with a certain revision of the firmware. And how long before you sold such a phone before the police came knocking on your door, wanting that money back (I'm fairly sure that 'hackers wanting a phone for its ability to easily be hacked for online banking' are not actually giving you 25,000 of their own euro...)

Re:i doubt it

[Anonymous Coward]

So you sell the Nokia you have and identify it as the expensive one from the same factory and the same time period with the same revision. Then you just guess whether the mafia is going to visit you for your money or not. Who cares if they leave negative ebay feedback? Meg Whitman already destroyed good ebay will.

I think I'll start an ebay acct as MegWhitmansA55hole and sell me some of them there phones!

Re:i doubt it

[schon]

I'm fairly sure that 'hackers wanting a phone for its ability to easily be hacked for online banking' are not actually giving you 25,000 of their own euro.

That may or may not be the case. You're assuming that they have already committed a crime, but unless you can point out exactly *which* crime they committed (eg, time, victim, place) the money could just as well be legitimate as not, and there's this thing about "innocent until proven guilty" that would make the money more legitimate than not.

After all, if they already had a phone to do this, why would they need to buy one from you?

Re:i doubt it

[mgblst]

Yeah, the probably use the phone to withdraw 25,000 euro, to pay the next person to get the phone, continuing the fun cycle for everybody!

Re:i doubt it

[Achromatic1978]

When receiving stolen property, the law looks at what a "reasonable" person would believe. A reasonable person would believe that someone selling on CL/eBay a Samsung 55" 1080p 120Hz LED TV complete with packaging, receipt for warranty purposes for say $2,500 (from an selling prize at Amazon of $3,199) was getting a good, but legitimate deal.

A reasonable person, in the eyes of the law, would not believe if I came up to them at an outdoor cafe and said "Want a 55" LED TV for $300? Meet me in the parking lot in 5 minutes" that they were buying anything other than illegally obtained or acquired property.

A reasonable person selling his Nokia 1100 (currently settling in the market for around $70) would assume that if they got, say an offer of $150, that the buyer might be an aficionado of old school cellular technology.

A reasonable person selling his Nokia 1100 would not "ask no questions" about a bidding war on their phone which saw it run into the five digit territory. A reasonable person would also have doubts about such money, and the motivations of a buyer. Whilst under no obligation to investigate either, a reasonable person, in the eyes of the law, would have "concerns" about whether the payment they were about to receive was the proceeds of a crime, or similar.

They're just reprogramming the IMEI and IMSI...

[admiralfrijole]

from tfa: That application allows a hacker to decrypt the Nokia 1100's firmware, Becker said. Then, the firmware can be modified and information such as the IMEI (International Mobile Equipment Identity) number can be changed as well as the IMSI (International Mobile Subscriber Identity) number, which allows a phone to register itself with an operator.

Uh... this ability is hardly unique to this device, I have a feeling there's something else they're not telling us.

Re:They're just reprogramming the IMEI and IMSI...

[Pinky's Brain]

They are probably eavesdropping only, if complete SIM cloning without physical access was possible with just a modified phone that would be much bigger news than this.

Re:They're just reprogramming the IMEI and IMSI...

[internerdj]

It was probably just set up so that it was easy to do compared to other phones. When I worked for LG's Cell division there was a hidden password protected menu on some models for changing any of the firmware settings, finding the menu would have been next to impossible but the default password was something similar to 8 0's. While this sounds a bit more complex my guess would be they did something stupid with the flash updater like not put any protections on the firmware downloads.

Re:They're just reprogramming the IMEI and IMSI...

[Viraptor]

Agreed - the explanation seems weird. I'm not sure about Nokia patching scene, but most of the Siemens *45, *55, *65 phones could be completely reprogrammed and were well understood. SL45 was one of the best examples - it's annotated assembler firmware was so nice to work with that people simply wrote binary patches in assembler, or used C compiler + binary patched some jump addresses. There were complete design notes circulating on P2P networks. I'm not sure what can be so specific to Nokia 1100 that they don't want to reprogram any other device.

Even better - if they're good enough to reprogram Nokia to interact directly with SIM and GSM module, why won't they just buy GSM modules themselves and clone some random SIM cards? It's not like GSM transmitters are some controlled goods available only to Nokia et al. If you can afford 100 of them, they should be quite easy to obtain.

So yeah - it seems there's something more going on here. Or they're just some script kiddies who bought a "hacking technique" from someone more advanced and now they can only replicate the issue on that one device.

Re:They're just reprogramming the IMEI and IMSI...

[bhtooefr]

Knowing the general gist of how cellular protocols work, I don't think there is anything they're not telling us. It's just that most phones don't have reprogrammable IMEIs, for very obvious reasons.

Although, I didn't think GSM phones even authenticated via the IMEI normally, just via the info on the SIM, so cloning the SIM would be enough. Guess I was wrong.

CDMA phones do authenticate via the MEID or ESN (or pESN, an encoded form of the MEID, for backwards compatibility with equipment that can't handle MEIDs,) meaning such an attack would be VERY effective on CDMA. And, a lot of older CDMA equipment has the ESN such that it's not too hard to reprogram with the right software.

Re:They're just reprogramming the IMEI and IMSI...

[jimicus]

Knowing the general gist of how cellular protocols work, I don't think there is anything they're not telling us. It's just that most phones don't have reprogrammable IMEIs, for very obvious reasons.

Although, I didn't think GSM phones even authenticated via the IMEI normally,

They certainly do as part of the initial authentication otherwise it would be impossible for the network operator to blacklist stolen phones.

Re:They're just reprogramming the IMEI and IMSI...

[citizenr]

It's just that most phones don't have reprogrammable IMEIs

Most do, its not user reprogrammable, but every corner GSM shop in Europe can do it with repair tools they use.

Although, I didn't think GSM phones even authenticated via the IMEI normally

they dont

so cloning the SIM would be enough.

good luck trying to clone sim cards now, we are long past comp128v1

Re:They're just reprogramming the IMEI and IMSI...

[Anonymous Coward]

Except it's not. That's the thing.. CDMA systems have:
        1) A-Key authentication.
        2) Back from the analog days, some systems do an RF Fingerprint, so even if everything else matches the network "knows" your phone is not the right one.

          Cloning (reprogramming a phone with another phones ESN and phone number) was a big problem in the 1980s in the US, I'm very surprised there's apparently such a lack of anti-cloning measures in Europe.

Re:They're just reprogramming the IMEI and IMSI...

[RiotingPacifist]

So yeah - it seems there's something more going on here. Or they're just some script kiddies who bought a "hacking technique" from someone more advanced and now they can only replicate the issue on that one device.

You mean somebody posted this on 4chan (alongside tome cruise's number OFC)?

Re:They're just reprogramming the IMEI and IMSI...

[bhtooefr]

Well, I can say for a fact that even if such authentication is in place, Sprint's network doesn't care.

And I've even got an ESN device cloned to a MEID device's pESN, so this one should be even easier to detect. (Although, I am careful to never have both phones powered on at the same time.)

(Just in case this is needed... both phones are legally owned by me, and this is not being used to steal service or intercept calls or text messages. I suspect that there may be more checks put in place if someone complains about calls being made that they never made. And, I don't know how the system responds to multiple phones with the same MEID/ESN/pESN on the network at once, and don't care to find out. The reason why I have this cloned is because I have an old pre-E911 device that cannot legally be activated on any network due to FCC mandate, and cloning is the only way to use it. If it were E911 compliant, I could just MEID/ESN swap on Sprint's website and be done with it, when I want to use it. (Although, it is nice to have a backup phone that I don't have to call Sprint or have internet access to use.))

you're not laughing now

[wjh31]

ha! now i feel better for having an ancient phone, and i thought the only good bit was being able to freely toss the phone on the floor without breaking it

A certain factory

[Hognoxious]

Is this one particular factory in China, by some chance?

Re:A certain factory

[Acer500]

Is this one particular factory in China, by some chance?

No, if you happened to read the article you'd find out it was the Bochum, Germany factory.

Re:A certain factory

[Anonymous Coward]

Is this one particular factory in China, by some chance?

Kind of what I was thinking. There has to be more to this than simply being able to reprogram the chips.

I'll hazard a guess that a manufacturing defect or design flaw required some type of hack or work-around in the bank security mechanism for this chipset to function properly.

Re:A certain factory

[Opportunist]

The late revenge of the laid off Bochum workers!

Re:A certain factory

[Hognoxious]

Presumably the items are made to a standard spec, and yet only one factory produces the ones with the feature. Shenanigans, got to be.

the real security defect

[Gary W. Longsine]

Correct. The real defect here isn't the phone, it's the system it's spoofing. This phone just makes it easier to construct the spoof.

Get them for 5.50 from ebay

[sygin]

Bidding has started ...

http://catalog.ebay.co.uk/Nokia-1100-Mobile-Phone_W0QQ_fclsZ1QQ_pidZ56002720QQ_tabZ3

Kudos to the Crooks

[alta]

Here on /. we're always bragging about find good use for old hardware. Well these guys did just that, and now you're going to chastise them for it.

You people have been asking for us to recycle our electronics for years now, bitching about throwing away cell phones, and their toxic batteries. This guys deserve some sort of award for this.

Good job
where can I get one?

Re:Kudos to the Crooks

[Farmer Tim]

This guys deserve some sort of award for this.

The cash prize should be enough.

Re:Kudos to the Crooks

[Anonymous Coward]

Mod this man insightful!

Re:Kudos to the Crooks

[Anonymous Coward]

Here on /. we're always bragging about find good use for old hardware. Well these guys did just that, and now you're going to chastise them for it.

You people have been asking for us to recycle our electronics for years now, bitching about throwing away cell phones, and their toxic batteries. This guys deserve some sort of award for this.

Good job
where can I get one?

Here on /. we're always bragging about find good use for old hardware. Well these guys did just that, and now you're going to chastise them for it.

You people have been asking for us to recycle our electronics for years now, bitching about throwing away cell phones, and their toxic batteries. This guys deserve some sort of award for this.

Good job
where can I get one?

Here on /. we're always bragging about find good use for old hardware. Well these guys did just that, and now you're going to chastise them for it.

You people have been asking for us to recycle our electronics for years now, bitching about throwing away cell phones, and their toxic batteries. This guys deserve some sort of award for this.

Good job
where can I get one?

i am having 1 piece of nokia 1100 made in germany plz provide me the best price
of what you can give the i can give the photo also to the serious
buyers my email id is sufiyanrajwani @ gmail . com, +919998152560

So who will be fired

[bugs2squash]

For implementing such a flawed banking transaction protocol.
Don't bother replying, I know the answer is no-one.

Re:So who will be fired

[jimicus]

A number of people in IT seem to believe that the only acceptable form of security - particularly as it relates to anything remotely important - is one which is not susceptible to any sort of attack, real or theoretical, until some time after the heat death of the universe.

Banks don't. They know full well that there will always be a certain amount of fraud no matter what you do.

Every change you want to make to the bank's system costs - in man hours to develop, test and deploy the fix and also in terms of the risk of something going wrong when you come to deploy, Most of these costs can be boiled down to cold hard cash. If making the necessary changes will cost more than the amount of fraud it's expected to prevent, don't be surprised to see nothing change.

Rest assured that these people count cash all day long, they can certainly work out exactly how much such changes will cost.

Re:So who will be fired

[bugs2squash]

I did not expect the bank to develop a new form of security so much as implement an established system reasonably well.
It is not as if methods for authentication, non-repudiation, encryption and key exchange need to be re-invented every time a new application shows up for them.

Re:So who will be fired

[Hatta]

Every change you want to make to the bank's system costs - in man hours to develop, test and deploy the fix and also in terms of the risk of something going wrong when you come to deploy, Most of these costs can be boiled down to cold hard cash. If making the necessary changes will cost more than the amount of fraud it's expected to prevent, don't be surprised to see nothing change.

So if you want to reduce fraud, make banks financially responsible for it. Real security can be had, if they had financial incentives to design truly secure systems.

Re:So who will be fired

[markhahn]

nah. bank people can be as short-sighted as any other human, prone to compromises without sufficient worst-case thinking. notice the economy recently?

the problem isn't just quantitative (so to speak), but rather qualitative: people who work on bank protocols need to study math and CS, not actuarial/stats/accounting. good protocols hold water and can be upgraded without disruption as components become unacceptably weak.

Re:So who will be fired

[Anonymous Coward]

Given how cartelized international banking is, I suspect there were several promotions in order for the guys who designed the system.

Re:So who will be fired

[raddan]

True, but how many banks do you think actually perform any due diligence in determining whether a protocol is secure or not? I think that as long as they can cover their asses, they think they're fine. E.g., "well, everyone else is leveraged 30:1, so we might as well be too! If it fails, it's not going to affect us, because the entire world economy is fucked!" As long as everyone else is using SecureBox 2000 too, they have a good excuse.

I really think the banks apply the bare minimum of oversight, because in the end, it's not them that gets fucked, it's us. Passing the buck is the cheapest option-- that's the problem.

Nokia 1100

[Niris]

People are paying thousands of euros for that junkie phone? I have one . YES! may actually be able to pay for this year at university

This is not possible

[Anonymous Coward]

I asked myself a few questions after reading this, as I am kinda familiar with baseband (phone modem) firmwares and mobile network security.

Why are 1100 sold that expessive? You can do the same with the iPhone baseband pretty easy, same goes for blackberry and nearly any available HTC, there are even tools for that any moron can use.

Why change IMSI? IMSI is taken from the simcard usally.

Also cloning simcards is not that trival, this works only for old sims, so the criminal needs to obtain the sim from the victim to clone it and the process of brute forcing old simcards to clone them usally breaks the original ( I done that myself ).

So where is the trick and why should this be interesting for a criminal? I donâ(TM)t get the whole story reported. Stuff needed to do this trick, including the victims simcard is that hard to get, itâ(TM)s easier for a criminal to steal a TAN block from the victims desk.

Re:This is not possible

[sexconker]

The trick is the wise guy working at the cell phone store.

what is needed for this to work...???

[broomer]

1. physical access to SIM-card to get the IMSI
2. info on bank account / phone number
3. hacking in PC/internet connection to determine if/when the code is used.
4. raise no suspicion when a code is sent and not received by the original recipient, and recipient is not able to call/being called or send/receive text because the original phone will be blocked until it is paired again with the GSM-system (power cycled)
5. you need to have a bank that does have this system. (mine does not)

so not as viable as it looks.

Re:what is needed for this to work...???

[Z_A_Commando]

Oh is that all?

I guess we now know what the ellipses is in:

• Acquire Nokia 1100 Phone made in Germany
• ...
• Profit!

All kidding aside though, it can't be considerably harder than doing it the "old fashioned way" if black hats are actually going to all that trouble

Re:what is needed for this to work...???

[Reality Master 201]

1. physical access to SIM-card to get the IMSI

Not necessarily - phones transmit the IMSI to the network, and there's known flaws in the encryption scheme GSM uses (and some carriers don't use encryption, though it's not very common, AFAIK). It's plausible that those two would get you the IMSI.

Re:what is needed for this to work...???

[Pulse_Instance]

Sure it is a lot of work, but you only need to have it work once on a targeted individual for it to be very profitable. From stories I've seen here and elsewhere these criminals have large networks so it probably isn't that hard for them to pay someone to target a specific person and steal their SIM card.

Re:what is needed for this to work...???

[Anonymous Coward]

You don't need to hack the PC and know when the code is being requested if you already know the banking information. Just pair your phone, log in using bank username and password and request the code yourself.

Re:what is needed for this to work...???

[Anonymous Coward]

That encryption problem was with sims more than 5 years old now. All poviders in Holland have been giving their users new sims since the old ones also weren't able to roam on UMTS and since the dutch market is very competitive and most users change povider at least once every 4 years. The chance that someone is still using a compromised sim is very small. With the new ones you do need physical access to bruteforce the key which is going to take a lot of time. Why not use the sim allready and just do the transactions?

Re:what is needed for this to work...???

[ilitirit]

Botnets make this procedure much simpler, and I suspect people buying these phones have access to banking data harvested by botnets. If they have the account details, they can just login themselves. No need to monitor the internet connection etc. Just spoof the number, and the code will get sent to you instead of the account holder. No flags will be raised.

crack bank accounts?

[IlluminatedOne]

There's an app for that...

Re:crack bank accounts?

[Minwee]

There's an app for that...

Yes, and it runs on an Atari Portfolio.

Easy money.

Just one question:

[Hurricane78]

What crazy bank sends *TANs to mobile phones in the first place?? Even this possibility would be a reason for me to terminate the contract.
I really recommend chipcard based systems. I use a class 2 terminal, and HBCI. It's not only much more comfortable, it's also on a completely different level in terms of security.
(In case you do not know how it works: Everything between the chipcard controller and the bank system basically only forwards encrypted packets. And if anything meddles with them, it detects this. You need the card, and a code of six numbers, and the server associates a user with that login. Every transaction that follows this, has to be accepted by the chipcard/terminal. The ones with keypads *and* displays are the most secure, because they show the details of the transaction *on* the terminal, and you have to say ok *with* that terminal. So the only open hole that I know of, is physical tinkering with the card and the terminal. Which still would be pretty hard, but not impossible. But if anyone can do this, I'm fucked anyway. ^^ [Oh, and of course, if you know of any problems with this system, I'm happy to hear them.])

Re:Just one question:

[dunkelfalke]

Sure, HBCI with a chip card is the way to go in the terms of security, but mTAN is the way to go in the terms of comfort - you can do banking from anywhere.

Re:Just one question:

[raddan]

Since this is something completely absent from the United States, can you elaborate a bit?

Re:Just one question:

[Anonymous Coward]

Real nice banks where you can login to your account from anywhere, anytime since you only need your mobile. One of them is mine (the Dutch ING) and this method is far better than carrying around some token which I need for another bank.

In some ways it is even more safe: It not only authenticates me to the bank but it informs me about the transactions I am about to do through a totally different and more secure channel. Most banks I know just give you a special calculator which does not show any transaction details. This is far easier to hack: just let some trojan intercept the site of the bank, let the user do a transaction but change the details of it and let the user authenticate himself: presto lots of money and a user that thought he did eveything right.

Bad protocol design

[Locke2005]

If the authentication protocol relies on the client not spoofing another client, then the authentication protocol if profoundly broken. I don't see why this specific phone is required; you should be able to build hardware from scratch to do this or even do most of it in software.

Re:Bad protocol design

[rtfa-troll]

The protocol does not. It has other flaws (lack of authenticaion of the network by the mobile; only the other way round), but none as basic as some people seem to be claiming.

the article says cloning a SIM is trivial

[YesIAmAScript]

But isn't that actually the tough part? That's the whole key to GSM.

Cloning a SIM is supposed to be non-trivial and should be nigh-impossible if you cannot get physical access to the person's SIM. I know there was an issue where the secret keys in the SIMs weren't random enough, but that's a long time ago now, newer SIMs are not subject to that problem.

As to the thing about erasable ROM, I thought something like the iPhone 1G had been completely pwned and should be as subject to an IMEI cloning hack as any of these phones.

Client Security

[Anonymous Coward]

You should NEVER rely on the client in a network security model.
Maybe the phone system as it was designed has no other way to work other then to rely on an existing trust relationship with the host but it could have been designed a different way, or at least one that could be revoked or challenged with a new key or mechanism if needed.

I can understand something like CSS/DeCSS where the exchange is local and a revokation being bypassed but at least there was a system that could revoke, how could a phone system that has live two way communication not have incorporated something like that?

Probably the same as the US laws that make it ilegal to listen to analog cell phones, it was easier and cheaper to beg for forgiveness and get laws changed than to implement a better secure model from the start.

asdfghjkl

[asdfghjkl__1]

Eh? Well, a Nokia is a very crappy phone to own (from first person perspective). But I guess it's finally good for something! (Disregard the "hack" only proves it's even more poorly programmed by Nokia's Finnish programmers). I doubt making the "hack" was even hard in the first place.

Nokia DCT4 security

[Mulder3]

This article is plain stupid, Nokia 1110 has nothing than other phones in the same Nokia DCT4 family don't have, while DCT4 firmwares can be decrypted, Nokia DCT3 phones(Nokia 3310, etc) are much more well suited for this job, given the fact that already exists an open source(GPL) firmware in C for this devices... And about SIM cloning, YOU CANÂT clone a GSM SIM card in seconds!!!! The most advanced software for clone SIM cards(SimScan - http://users.net.yu/~dejan/) still has to do some brute-force to extract the Ki key, witch is designed to never leave the card, while we can extract IMSI with no problems , to clone a SIM card, you need two values: IMSI and Ki, and without Ki, IMSI is worthless...

Re:Nokia DCT4 security

[citizenr]

plus you cant extract Ki from new cards, and when I write new I mean last >5 years. No one is using Comp128v1 anymore.

Re:Nokia DCT4 security

[Mulder3]

yupe, thats right :) and all native UMTS SIMs do not use COM128v1, networks still support old GSM auth algorithm(using standard 2G GSM SIMs), but when they force UMTS authentication algorithms, and they swap all 2G SIMs for 3G ones, goodbye sim cloning...

Re:Nokia DCT4 security

[Anonymous Coward]

A link to this opensource Nokia DCT3 C firmware ?

The why feature.

[anonymousNR]

I don't understand why banks want to extend their services on to every single device out there including a refrigerator.

Recently I was opening an account with Target
and asked me to send out fax of my id and ssn card.

The lady was assuring me about how secure the fax line is.

I simply withdrew from opening the account.

Clueless Nokia again

[JuniorJack]

"We have not identified any phone software problem that would allow alleged use cases,"

Nokia are completely clueless as usual. Nokia 1100 belongs to the dct4 generation of phones. Security is based on safer-k64 (symmetric algo for all important stuff) and simple vhdl logic for encrypting/decrypting instructions from Flash memory. All security, hidden bootrom - completely hacked in 2001.

Even latest Nokia models (BB5 generation) running OMAP trust zone are fully cracked, except for a small issue of making fully blank boards running without IMEI certificate. All the rest - spaggeti mix of soft implemented AES, SHA and badly implemented RSA1024 have been hacked/circumvented.

Red Mercury?

[mikeee]

Further, police have announced that Nokia phones other than the 1100s with prime serial numbers contain no red mercury.

Oh they do, do they?

[hellfire]

Rest assured that these people count cash all day long, they can certainly work out exactly how much such changes will cost.

I would have had faith in that statement before the credit crisis of 2008 took hold.

Re:Oh they do, do they?

[complete loony]

Yeah, their biggest problem is they assumed market prices changed randomly, and started basing all their risk assessment on models that completely ignore events that might affect the whole market.

The other side of the coin

[Kabuthunk]

Wow, what you describe is exactly the 'other side of the coin' from the security theater that is... well... security nowadays.

In most other fields, people are forced to (or even choosing to) inconvenience the hell out of themselves in the name of some extremely minor (or only just perceived) increase in their security.

I applaud the fact that after hearing this, companies didn't immediately slam the door shut on banking over the phone. Personally, I'd FAR rather be able to check my bank account by phone when standing next to something expensive that I want, rather than no longer have that infinitessimally small chance that my bank account information will be gleaned by having done so.

coincidental captcha: victims

Re:The other side of the coin

[sexconker]

You get captchas when logged in?

Had one of those

[chord.wav]

That's the best phone I ever had. Sure, it only did calling + SMS (it also had a flashlight). Then I stupidly wanted to listen to mp3 and wanted the phone to look nice, so I've change it for a *newer*, *more advanced* one... And that's when my problems started...

Re:Had one of those

[Locke2005]

Think you've got problems after that transition? Wait 'till you make the transition from watching porn online to living with a real live woman!

Re:Had one of those

[Anonymous Coward]

Wish I had mod points today. You'd get a +1 Insightful from me.

Re:Had one of those

[sznupi]

So...why not go back? Heck, there are even newer, currently produced models in style of 1100: 1200 and 1208.

ING Bank, The Netherlands, for one (optionally!)

[Animaether]

The ING Bank, formerly Postbank, in The Netherlands does a TAN over phone, for one, but only optionally*; you have to sign up for it.

It's actually reasonably secure. You need to log in with username/password first, then you have to set up the transaction, then you have to wait for the TAN by phone, and then enter that. It's quite nice when, say, abroad and you do need to do some banking while abroad. If you're away for a month or more, you might have rent to pay, for example; not everybody accepts 2 months' rent, or allow you to pay upon your return.
Odds are that you'll have your phone with you - so why lug around another (USB) device, a card, etc. Worse yet, who says you can actually plug a USB device into the internet cafe you happen to be at?

Combine that convenience with the odds that somebody 1. has your username/password and 2. has a copy of your phone in terms of what would be needed to pull this off, are so tiny that - as per other replies - I think there's something more going on here than just duping the network and getting the TANs intended for another person, somehow; it would be far -more- likely a burglar took your actual phone and found your username/password written down on it or something.

The networks don't just authenticate the phones here, they will simply -not- allow a second copy of an IMEI on the networks. If that happens, they -will- investigate, triangulate, and send in the forces to find out wtf happened that they got a duplicate IMEI. Obviously that may be different outside of the nl-be region (i.e. I'm not even sure how they handle it in germany; but it was my understanding that practically all networks only allow a single ID and red flags get raised when a duplicate pops up)

* That said, I don't use it. My phone could die, and I would be f'n stuck until I got a new phone to drop the SIM in. Worse yet, I could lose my phone - which is always a possibility for any goods you take with you everywhere, all the time.

I just work with the long list of TAN numbers printed out on a sheet of paper** The bank asks me for the TAN number corresponding to a given index, I type it in, transaction completed. The only way for that to be intercepted is for it to be done so somewhere along the snailmail line, and any tampering with the envelope/etc. would be glaringly obvious.
Yes, that paper can be stolen (which would be noticeable) or even copied, and -if- they then have my login information as well, I'm still screwed. But at least there's no possibility of some manner of 'eavesdropping', short of a high powered telescope aimed at my window from an undisclosed location, and I can't easily 'lose' it as I might a phone, as I'm not carrying that list with me all the time. Slight sacrifice of convenience, but I'll live.

** Ideally they would send two pages, one with the indices randomized, one with the TAN numbers, that could then be kept in separate locations and simply overlaid to find the TAN corresponding to an index, but this can be done manually if one were just shy of a tinfoil hat.

=====

I have yet to be convinced by anybody that one of those 'calculators' / USB devices + a card + lord knows what else is actually more secure without being glaringly less convenient, than what I'm working with now. But maybe I haven't heard the right arguments yet.

Still using one of these

[Anonymous Coward]

I'm still using one of these in New Zealand. Who knew I could get paid thousands of dollars for my old phone, I thought I would have to give it away it's so old.

Disclaimer. I've no idea what factory it's from

It was obvious

[zLaSh]

You can only expect evil from a phone with a flashlight.

Great piece of corporate history there...

[Anonymous Coward]

> Nokia's one billionth phone sold was a Nokia 1100 purchased in Nigeria.

I wonder if they'd record that in their corporate history if they were to find out that their one billionth phone was used in some kind of scam, whether this banking hack or some 419 scam...

I mean, I'm sure there are plenty of decent Nigerians out there, but given that this phone is best known for its popularity with scammers and it's being sold to Nigeria, well...

Tracfone

[kriston]

It's one of the most popular Tracfone models, but those can't be hacked.
It's one of the most popular AT&T GoPhone models, and AT&T (then Cingular) had to restrict purchase.
They didn't really restrict them... the "quantity" drop-down menu was "restricted" to a mere 10 units per order.
Now we know why the restriction existed. And we thought it was for export to drug dealers. Turns out it was something else entirely.

Not here they don't

[upside]

We have one-time pads.

Wanha!

[Anonymous Coward]

Isn't this exactly the same trick that Gene Hackman's character did in 'Enemy Of The State'?

Be skeptic to Ultrascan's claims

[Anonymous Coward]

Nobody has demonstrated anything. Ultrascan, if the company even really exists, only claims they have demonstrated the Nokia 1100 hack. Frank Engelsman can find his way to the media and even Slashdot now, but he cannot keep his story straight about his alleged employer Ultrascan. In the Dutch media Frank claims to be liaison of a British (or sometimes American) company operating world wide with "3200 experts", with offices in Amsterdam and Paris. In the international media he claims to represent a Dutch company. No companies named Ultrascan are registered with the Dutch Chamber of Commerce however and the Dutch Justice Department even let a statement out in 2007 doubting the existence of Ultrascan. In fact Ultrascan is so secret nobody knows where it's located and all traces of Ultrascan on the web point to Frank Engelsman's website and his press releases parroted in the media.

Well... fuck.

[nhytefall]

I recently just terminated a part-time gig with a major US Retailer (low prices always anyone?), and went rounds and rounds with management over the sheer stupidity of having a physical person from Security to escort all AT&T Go Phone purchases from register to front door for the last six months.

Since the Nokia 1100 was our most popular seller (and stolen, but w/e), things make a bit more sense now. Because, regardless of whether or not the hack is viable, or ever was in the US, chances are some script kiddie heard about it on a warez/ l334 haxors site (sarcasm fully intended), and tried to get their hands on a few to WOW their idiot friends. Enter mommy/daddy, game over.

Seems I feel like a bit of ass now... nah. I was still right more times than not. But, when arguing with idiots, don't. They drag you down to their level and beat you with experience.