Slashdot Mirror
A New Attack Allows Intercepting Or Blocking Of Every LTE Phone Call And Text (theregister.co.uk)
All LTE networks and devices are vulnerable to a new attack demonstrated at the Ruxon security conference in Melbourne. mask.of.sanity shared this article from The Register:
It exploits LTE fall-back mechanisms designed to ensure continuity of phone services in the event of emergency situations that trigger base station overloads... The attacks work through a series of messages sent between malicious base stations spun up by attackers and targeted phones. It results in attackers gaining a man-in-the-middle position from where they can listen to calls or read SMS, or force phones back to 2G GSM networks where only voice and basic data services are available...
[Researcher Wanqiao] Zhang says the attacks are possible because LTE networks allow users to be handed over to underused base stations in the event of natural disasters to ensure connectivity. "You can create a denial of service attack against cellphones by forcing phones into fake networks with no services," Zhang told the conference. "You can make malicious calls and SMS and...eavesdrop on all voice and data traffic."
[Researcher Wanqiao] Zhang says the attacks are possible because LTE networks allow users to be handed over to underused base stations in the event of natural disasters to ensure connectivity. "You can create a denial of service attack against cellphones by forcing phones into fake networks with no services," Zhang told the conference. "You can make malicious calls and SMS and...eavesdrop on all voice and data traffic."
No industry reach-out and responsible disclosure after the time needed for them to contemplate and execute a change across a 100K+-node base station network?
This is why we can't have nice things.
Hire a Linux system administrator, systems engineer,
China!
TRUMP will fix them GOOD!
We need END-to-END security. Now.
Prove it, wankers.
So often it seems that falling back to an older, less secure system or protocol is a method to circumvent newer, safer technologies (POODLE springs to mind as an example)...
Shouldn't there be an accepted practice of NOT being backwards compatible with a system that's known to be insecure? Cuz like, what's the point otherwise? At the very least perhaps new systems like TLS or systems that rely on older hash functions could have a scheduled phase-out of backwards compatibility built-right into the spec.
(okay I'm talking out of my ass here.. someone please school me on how this is already being done.)
Just because it's possible, doesn't mean it can be done.
This attack breaks multiple laws, and regulations.
As noted in another post. The equipment to do this is expensive.
It's not a targeted attack. There's no way to pin an individual, they might just get lucky and get through on the real cell.
Just alarmist ranting, for now.
You just broke 2FA.
So T-Mobile customers shouldn't notice any interruption in service.
I'm pretty sure I saw this exact same presentation at DEFCON a few months ago.
This sounds like a national security issue that any country should look into. Can be used to disseminate false information prior to an invasion?
This is why using Signal is critically important.
This is not new - it was at Defcon in august.
Isn't this pretty much what a Stingray does? Or does Stingray use weaknesses deliberately built into the networks?
As a slashdotter the only person I'd ever have to call or text is mom, and I can just yell upstairs for that!
I'd guess this is how the stingray cell phone snooping devices have been working all along.
Now, at least we understand the technical means by how they work.
My UID is prime and so is this number: 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0.
Business Setup Consultants in Dubai, United Arab Emirates
Leading business setup consultants in Dubai, On Demand Buz offers various business setup assistance at Dubai, United Arab Emirates. Learn how to setup your business at Dubai, UAE with On Demand Buz / Start Business UAE.
On Demand Buz is a pioneer business consultant brand from Dubai with strong expertise in various trade license and business setup related services at the emirate of Dubai in UAE.
Link: http://startbusinessuae.com/business-setup-consultants-dubai/
How about a DDOS against these pigfuckers!
GSM was full of holes and worthless and now its direct descendant LTE has similar holes. WHAT A SURPRISE.
And of course the industry rubbed their hands about the GSM issues and they will do so again about LTE. Everyone has spent too much money on this shit to go back now and fix it.
Apple had some major issues with their early iPhone security because they were of course GSM-only for a long time and any competitor who wanted to listen in on test calls or record everything only needed to setup a GSM eavesdropping station, would would fit in a briefcase and could be run from a car in the parking lot, and they'd have the whole thing. I have no doubt that happened. And now, it will with LTE too.
The presentation was by a woman, too. The world has changed, basement dwellers.
Sig for hire.
This isn't something that can eavesdrop on LTE calls, it just forces the phone off of LTE back onto older more insecure air interfaces. But it does make sense now why no phone I've ever owned allows me to force LTE-only mode (without resorting to rooting, jailbreaking, or other hacking), they need to make sure the TLAs can backdoor us onto their stingrays at any given moment.
Ya'see, I'm getting sick and tired of hearing this goddamn argument over and over again. "Just make it secure in the first place", like technical security is just a magical flip of a switch. "Oh, Yeah, I downloaded and installed the SECURE library into my app, things are PERFECT now!"
Actually, when it comes mobile phone networks, it is (or was) a case of flipping a magical switch. Cell phone standards were deliberately crippled, security-wise:
A5/2 is a stream cipher used to provide voice privacy in the GSM cellular telephone protocol. It was used for export instead of the relatively stronger (but still weak) A5/1.
* https://en.wikipedia.org/wiki/A5/2
Later they went with A5/3 (aka KASUMI) instead of the more secure MISTY1, or even AES (which was already available by then):
* https://en.wikipedia.org/wiki/MISTY1
And as many problems as SSL/TLS has had, if the cell industry had used it instead of the mess that they're currently using, things wouldn't be as bad as they are now. And the mobile phone operators have a lot easier in some regards: with TLS you have to have the garbage that is CAs to build trust, while with SIM cards you have a pre-existing cert/key distribution system You'd think they'd be able to leverage that to build a robust network.
So while there are many places where security is hard, the cell phone industry seems to have screwed the pooch when it comes to keeping over-the-air signals safe from attackers. I've dealt with SS7, and can understand the back-end stuff being convoluted, but there isn't as much of an excuse for the radio component of their network.
Yet another illustration that those who absolutely need to keep their communications intact need to have amateur radio for backup when the purposes are non-commercial.
1. For local communication, use VHF/UHF, possibly in conjunction with repeaters.
2. For longer distances, use the appropriate HF bands or, in some cases VHF/UHF satellite communications.
The advantage of both is that the link depends only on equipment at each end. It doesn't depend on a complex and vulnerable infrastructure.
Couldn't this be solved by most networks updating their phones with a big ol' whitelist?
DNSSEC is underused because its root certificate is only 1024-bit RSA. At least that's why DANE support in Chrome is turned off.
"Just because it's possible, doesn't mean it can be done."
Actually, that is exactly what "possible" means.
What arrogance.
has the NSA and FBI not had this technology for years?