Researchers have discovered a flaw in the GSM standard used by AT&T and T-Mobile that would allow hackers to listen in.
Researchers from BlackBerry at DefCon security conference in Las Vegas, USA, presented an attack that can intercept GSM calls as they’re transmitted over the air and decrypt them to listen back to what was said.
And the vulnerability has been around for decades.
Most mobile calls around the world are made over the Global System for Mobile Communications standard; in the US, GSM underpins any call made over AT&T or T-Mobile’s network.
Regular GSM calls aren’t fully end-to-end encrypted for maximum protection, but they are encrypted at many steps along their path, so random people can’t just tune into phone calls over the air like radio stations.
The researchers found, though, that they can target the encryption algorithms used to protect calls and listen in on basically anything.
“GSM is a well documented and analyzed standard, but it’s an aging standard and it’s had a pretty typical cybersecurity journey,” says Campbell Murray, the global head of delivery for BlackBerry Cybersecurity.
“The weaknesses we found are in any GSM implementation up to 5G. Regardless of which GSM implementation you’re using there is a flaw historically created and engineered that you’re exposing.”
The problem is in the encryption key exchange that establishes a secure connection between a phone and a nearby cell tower every time you initiate a call.
This exchange gives both your device and the tower the keys to unlock the data that is about to be encrypted. In analyzing this interaction, the researchers realized that the way the GSM documentation is written, there are flaws in the error control mechanisms governing how the keys are encoded. This makes the keys vulnerable to a cracking attack.
“It’s a really good example of how the intention is there to create security, but the security engineering process behind that implementation failed.”
As a result, a hacker could set up equipment to intercept call connections in a given area, capture the key exchanges between phones and cellular base stations, digitally record the calls in their unintelligible, encrypted form, crack the keys, and then use them to decrypt the calls.
The findings analyze two of GSM’s proprietary cryptographic algorithms that are widely used in call encryption—A5/1 and A5/3.
The researchers found that they can crack the keys in most implementations of A5/1 within about an hour. For A5/3 the attack is theoretically possible, but it would take many years to actually crack the keys.
“We spent a lot of time looking at the standards and reading the implementations and reverse engineering what the key exchange process looks like,” BlackBerry’s Murray said.
“You can see how people believed that this was a good solution. It’s a really good example of how the intention is there to create security, but the security engineering process behind that implementation failed.”
The researchers emphasize that because GSM is such an old and thoroughly analyzed standard, there are already other known attacks against it that are easier to carry out in practice, like using malicious base stations, often called stingrays, to intercept calls or track a cellphone’s location.
Additional research into the A5 family of ciphers over the years has turned up other flaws as well. And there are ways to configure the key exchange encryption that would make it more difficult for attackers to crack the keys. But Murray says that the theoretical risk always remains.
Short of totally overhauling the GSM encryption scheme, which seems unlikely, the documentation for implementing A5/1 and A5/3 could be revised to make key interception and cracking attacks even more impractical. The researchers say that they are in the early phases of discussing the work with the standards body GSMA.
The trade association said in a statement to WIRED that, “Details have not been submitted to the GSMA under our coordinated vulnerability (CVD) programme. When the technical details are known to the GSMA’s Fraud and Security Group we will be better placed to consider the implications and the necessary mitigation actions.”
Though it may not be that surprising at this point that GSM has security issues, it’s still the cellular protocol used by the vast majority of the world. And as long as it’s around, real call privacy issues remain, too.
Motorola Solutions Launches New Device Designed for SMBes in Sub Saharan Africa
Global leader in mission-critical communications, Motorola Solutions, launches a new two-way radio device specially designed for small and medium businesses in Sub Saharan Africa.
The MOTOTRBO™ DP540 two-way radio is built for cost-conscious businesses looking to transition to digital technology for reliable and efficient communications.
As demand for digital radio communication rises, small and medium businesses are looking for simple and affordable solutions for their communication needs without the need to compromise on quality.
MOTOTRBO™ DP540 is the perfect tool for users in need of an entry-level digital radio, offering ease of use and powerful digital-enabled features. The new device, available through certified Motorola Solutions resellers in Sub-Saharan Africa, is based on the ETSI Digital Mobile Radio (DMR) Standard, proven worldwide in affordable digital systems with low complexity.
“In today’s economy, small and medium businesses are constantly under pressure to deliver more, and deliver fast, all while keeping a conscious mind on reducing costs,” said Laurent Tribout, director of Motorola Solutions indirect sales for Sub-Saharan Africa. “With this in mind, we’ve developed a communication solution that holds all the necessary features in one affordable device”
Ruggedly Versatile, Digital Out-of-The-Box
One of the risks of migrating from analogue to digital technology is the transition period which can potentially interrupt business operations.
To make this transition smooth and easy, the MOTOTRBO™ DP540 can operate on both digital and analogue modes. In this way, radio users can operate and communicate on their new MOTOTRBO DP540 radios while on the job, as the business transitions to digital technology.
The compact, ruggedly-engineered device is built to withstand harsh conditions and resist corrosion even in the saltiest environments such as seaports and harbours. It boasts superior audio output and unique features, such as voice announcement customization, allowing users to customize the default voice announcement languages using their own audio files.
MOTOTRBO™ DP540 is also built for multi-language working environments, with special audio profiles designed to deliver enhanced audio quality when speaking languages with distinct rolled “R”s such as French or Afrikaans.
Handsfree When Sanitation is Key
As in many mission-critical work areas, healthcare workers rely on two-way radio communication for many of their daily tasks. Whether it’s coordinating patient arrivals, or briefing an ambulance team on the way to a scene. In many circumstances, such as medical staff treating COVID-19 patients, it is not ideal for personnel to be handling their radio devices.
The portfolio of MOTOTRBO devices, including the new DP540 model, is equipped with a Voice-activated Transmit (VOX) feature, which allows users to operate their radio without the need to press the Push-To-Talk (PTT) button. Along with compatible earpieces designed for handsfree operation, healthcare workers and other essential workers can keep their hands free and clean.
FI Lagos Anounces Final Admissions deadline for Cohort III
The first and second cohorts of Founder Institute Lagos saw the emergence of 45 new companies all geared towards solving various problems leveraging technology.
Cohort III kicks off from the 19th of August, 2020, and sessions take place one night per week via zoom, over a 14-16 weeks period.
If you apply today, then you will be able to take advantage of the free DNA test HERE ($50 value), or you can learn more here. Anyone building a business that is pre-funding is welcome to apply, including established businesses and teams, aspiring entrepreneurs.
It is interesting to note that leaders of some of the world’s fastest-growing startups have used the Founder Institute to raise funding, get into seed-accelerators, generate traction, recruit a team, build a product, and more.
If you enrol by 11.59 pm on Sunday’s Final Admissions Deadline, you will be eligible for a reduced course fee and have the best chance of being accepted. Get started here.
In the words of Chukwuemeka Fred Agbata Jnr., regional director, Founder Institute, startups who make the decision to join the program will be learning how to build and launch a company in a structured way plus become a part of a global network of innovators, mentors and investors.
The Founder Institute (fi.co) is the world’s largest pre-seed startup accelerator, based in Silicon Valley but with chapters in close to 200+ cities.
The program provides high-potential entrepreneurs and teams with the support network and structured process needed to build an enduring business.
MultiChoice Announces a New Way to Keep Customers Informed
As a part of its resolve to continually create innovative ways to offer customers the best service, DStv has announced the launch of Enhanced Decoder Notification (ED) functionality which aims to address communication issues for subscribers and take the admin out of viewing, so, consumers can get back to being entertained.
This new functionality will provide viewers with streamlined access to important subscription information, including rewards notifications, payable subscription amounts, methods to avoid late payment and disconnection.
This will be done by displaying icons that represent the different types of notifications on top of Live TV and will be available on the DStv decoders. The message will also be added to the Mail Messages screen.
John Ugbe, chief executive officer MultiChoice Nigeria, said “In the ever-advancing world of video entertainment, innovation is a key driver of the business.
“MultiChoice is always dedicated to delivering innovative resources to ensure continuous improvements in our products.”
Through a myriad of innovations that ensure customers satisfaction as well as guarantee a rewarding journey for all our subscribers – MultiChoice continues to position itself as one of Africa’s major entertainment sources, and now, with the introduction of the new EDN service ensures fewer interruptions during viewing.
Banks Begin to Seize Debtors’ Funds in Other Banks
Bristow Helicopters Sacks 100 Pilots
SSASCGOC Asks FG to Intervene in FIRS, NIPOST Stamp Duty Crisis
Pantami Seeks Shift to Skill, not Certificate to Boost Digital Economy
SystemSpecs Presents Prizes to Children’s Day Essay Competition Winners
Buyer Beware: NSE Issues Caveat on 13 Companies
Controversial Broadcasting Code Tears NBC Board, Management Apart
CBN Empowers Banks to Debit Accounts of Loan Defaulters
Ojobo, Former NCC Spokesman, Others Make 2020 List of 100 Most Reputable Africans
FG Says Report on 5G Deployment Ready but Needs Stakeholders Inputs
- Telecom2 days ago
NITDA Promises to Balance Concerns and Advantages of 4th Industrial Revolution
- Telecom2 days ago
Encomiums as Sonny Aragba-Akpore Bows Out of NCC
- E-Financial2 days ago
Banks Write-Off N1.9tTrillion Bad Debts in 4 Years- Report
- Broadcasting2 days ago
StarTimes Partners Brands to Reward Customers
- E-Financial2 days ago
Zenith Bank Fetes Customers in “Zenith Beta Life” Promo
- News2 days ago
LCCI Faults NIPOST Status as a Regulator, Operator in Courier Sector
- News2 days ago
Fintech1000plus Honours MTN, Glo, Others
- News1 day ago
Confusion as PR Firm Contradicts Shoprite Exit Rumour