Slashdot Mirror
Security Researchers Crack APCO P25 Encryption
An anonymous reader writes "Two Australian security researchers, Stephen Glass and Matt Robert, have published a paper that details flaws in the encryption implementation (PDF) in the APCO Project 25 digital radio standard, used by emergency services and police departments world-wide. The paper details flaws in the DES-OFB and ADP encryption that enable the encryption key to be recovered by traditional brute force key searching. Also detailed is a DoS attack that makes use of unauthenticated radio inhibit mechanism. The research is part of the OP25 project, which uses GNUradio to implement a P25 stack using software defined radio. With this solution in place, the researchers were able to do detailed analysis of the traffic coming from various radio systems and to transmit and receive to P25 radios in their lab."
But they cost $1700! No thank you. How many people are even using them at that price?
Only the State obtains its revenue by coercion. - Murray Rothbard
The article seems to cover two things here: - Brute force "vulnerability". - Unauthenticated DoS. The former seems to be the focus, but it is hardly the most shocking of the two. You can always do a brute force key search with any captured data, and one would assume that, being DES, it is at least 56 bits. The unauthenticated DoS, however, presents a serious flaw.
The others weren't australians ?
I was afraid you were going to tell me there were five researchers, but you don't even *look* Cardassian.
> Once a radio has been stunned by the receipt of an inhibit command the standard requires that it remains in-operational and unresponsive to the operator console or device programming interface until it receives an “uninhibit” XFC on the frequency it received the inhibit. The attack exploits the lack of any guarantee of authenticity for the frame Inhibit/Uninhibit types. [...] Note that the XFC message payload may be sent either encrypted (P=1) or un-encrypted (P=0).
Not a desirable property in a supposedly secure crypto system!
Comparable equipment has traditionally cost in the 10s of thousands. Only in the last two or three years has it been in the home hobbyist range. Granted its not cheap, but its about the same as a good gaming rig. And its far less than car or shooting enthusiasts tend to spend. That said, the $1700 only includes the motherboard (fpga and ADC/DAC) and enclosure, not the receiver. The receivers range from a hundred to almost five hundred depending on what you need. Same API to control all of them though. If you want to mess with the fpga instead of doing it all on the PC you probably want the slightly cheaper motherboard so you can use the free xilinx webpack ise instead of the crazy expensive one.
Comblocks also has a nice SDR offering but getting it to the PC at a decent speed is still around $800 at least, and I don't know how clean the software interface is.
Slapping an fpga and highspeed ADC onto a custom PCB is easy enough, you can get such things from knjn prebuilt, but you really need gigabit ethernet or faster to do software processing on significant bandwidth and those sorts of interfaces tend to need five and six layer PCBs which aren't DIY and jack up the price. Perhaps the USB3 interfaces will be more hobby friendly. You still need a software controlled wideband receiver too, maybe heathkit will step up on that one.
All in all, the USRP is reasonable, though its been getting more expensive due to more features, and NI buying them might be involved too, NI doesn't tend to make cheap stuff.
refactor the law, its bloated, confusing and unmaintainable.
http://it.slashdot.org/story/11/08/10/2113246/Feds-Radios-Have-Significant-Security-Flaws
APCO 25 doesn't seem to be very well thought through. Easily jammed at multiple levels and vulnerable in many ways.
--Paul
It's pretty much only used in America. Everyone else uses TETRA, or if they don't want trunking DMR or iDAS.
FUNcube Dongle- A radio thats out of this world!
64MHz to 1,700MHz Software Defined Radio
funcube.org.uk
Quoth shoc.ch :