Don't underestimate the power of the source

Looks like all that GSM code-cracking is progressing faster than we thought. Soon after the discovery of the 64-bit A5/1 GSM encryption flaw last month, the geniuses at Israel's Weizmann Institute of Science went ahead and cracked the KASUMI system -- a 128-bit A5/3 algorithm implemented across 3G networks -- in less than two hours.

I totally called this one. Sometime later this year there is going to be a quiet panic about how exactly to deal with this problem, if that isn't already happening.

Perhaps one day listening in on cell phone frequencies will be as easy as it is to listen in to others conversations on a raido... or over WiFi.

Filed under  //

Comments [0]

Hacking the cell phone

BERLIN — A German computer engineer said Monday that he had deciphered and published the secret code used to encrypt most of the world’s digital mobile phone calls, saying it was his attempt to expose weaknesses in the security of global wireless systems.

And with that, the encryption key for all GSM handsets will find its way into open source repositories around the world. It's funny, reading the New York Times article, because it's almost as if the GSM Association is taunting hackers.

“This is theoretically possible but practically unlikely,” said Claire Cranton, an association spokeswoman. She said no one else had broken the code since its adoption.

As with every other major security crack ever (CSS, Fairplay, AACS, etc.), whenever you start taunting the audience that is trying to teach you something, they respond with tools that put exploiting security cracks in the hands of even more people. Streisand effect, anyone?

It's just a matter of time now before a Kismet-style application is developed that lets you listen in other people's conversations. And a few months after that someone else will release a version with a user-friendly GUI.

Filed under  //

Comments [0]