Wow, so that's... 4 days after full disclosure that they announce their response.
"Could be here as soon as this weekend", which is still more than a week from the exploit being published. That's swell.
Anyone else grateful MSFT doesn't run the fire department?
All your attacks depends on being able to steal credentials and be able to impersonate the phone at a later stage, but the way I've been told it works is that after the initial Location Update, the phone never talks to the network as itself. That is, after the initial connection, the phone is handed a set of temporary IDs (one time pad-style), so each subsequent page is to a different number that only the phone and the network is supposed to know. Once the phone is running low on these temporary IDs it retrieves a set of new ones.
#2 is the most blatant flaw in terms of interception: GSM never authenticates who it's talking to, if there's a network in range it is assumed to be friendly.
Who says they hold the data?
Both the summary and the first paragraph of TFA suggests the malicious code simply intercepted the data that passed the infected servers these past 3 months.
I guess/. is moving from not reading TFA, to not reading TF summary, to simply commenting on headlines...
Slashdot Mirror
Wow, so that's... 4 days after full disclosure that they announce their response.
"Could be here as soon as this weekend", which is still more than a week from the exploit being published. That's swell.
Anyone else grateful MSFT doesn't run the fire department?
I believe the official explanation is that "it seemed like a good idea at the time."
Well at least the second comment got modded correctly, 50% accuracy isn't too bad.
+5 Insightful? Really?
Disclaimer: I could be totally wrong ;D
All your attacks depends on being able to steal credentials and be able to impersonate the phone at a later stage, but the way I've been told it works is that after the initial Location Update, the phone never talks to the network as itself. That is, after the initial connection, the phone is handed a set of temporary IDs (one time pad-style), so each subsequent page is to a different number that only the phone and the network is supposed to know. Once the phone is running low on these temporary IDs it retrieves a set of new ones.
#2 is the most blatant flaw in terms of interception: GSM never authenticates who it's talking to, if there's a network in range it is assumed to be friendly.
Who says they hold the data?
/. is moving from not reading TFA, to not reading TF summary, to simply commenting on headlines...
Both the summary and the first paragraph of TFA suggests the malicious code simply intercepted the data that passed the infected servers these past 3 months.
I guess
Heading down under to file for life insurance on a certain "person"!