Secret mobile phone code cracked

[MikeWB]

Secret mobile phone code cracked
By Maija Palmer, technology correspondent
Published: December 29 2009 15:11 | Last updated: December 29 2009 16:17
Computer hackers this week said they had cracked and published the secret code that protects 80 per cent of the world's mobile phones. The move will leave more than 3bn people vulnerable to having their calls intercepted, and could force mobile phone operators into a costly upgrade of their networks.

Karsten Nohl, a German encryption expert, said he had organised the hack to demonstrate the weaknesses of the security measures protecting the global system for mobile communication (GSM) and to push mobile operators to improve their systems.

EDITOR'S CHOICE
O2 apologises for snags in London network - Dec-28

Mobile operators square off in network envy - Dec-29

"This shows that existing GSM security is inadequate," Mr Nohl told an audience of about 600 people at the Chaos Communication Congress in Berlin, a four-day conference of computer hackers.

"We have given up hope that network operators will move to improve security on their own, but we are hoping that with this added attention, there will be increased demand from customers for them to do this," he told the Financial Times.

"This vulnerability should have been fixed 15 years ago. People should now try it out at home and see how vulnerable their calls are."

Mr Nohl was due to run a practical demonstration of the code book at the conference on Wednesday, but has postponed it while he takes advice from lawyers on whether the exercise would be legal. However, the code is already being widely circulated on the internet.

Mr Nohl, a widely consulted cryptography expert with a doctorate in computer engineering from the University of Virginia, waged a similar campaign this year which caused the DECT Forum, a standards group based in Bern, to upgrade the security algorithm for 800m cordless home phones.

The hacked GSM code could compromise more than 3bn people in 212 countries. It does not affect 3G phone calls, however, which are protected by a different security code.

The GSM Association, the industry body for mobile phone operators, which devised the A5/1 encryption algorithm 21 years ago, said they were monitoring the situation closely.

"We are concerned but we don't believe it will result in widespread eavesdropping tomorrow, or next week or next month," said James Moran, security director of the GSMA.

"The reality is that a practical attack is beyond the capabilities of the vast majority of people," he said.

However, security experts disagreed, saying that cracking the code significantly lowered the bar for intercepting calls.

"A year ago it would have required equipment costing hundreds of thousands of dollars, and serious expertise to listen in to a call," said Simon Bransfield-Garth, chief executive of Cellcrypt, a mobile phone encryption company.

"Today it is going to require $1,500 of network equipment and a computer. It is getting down to a mainstream price tag and moving to the point when it will be straightforward to do," he continued.

"A skilled computer engineer can now build this," said Mr Nohl.

Mr Moran said that if the hack was thought to pose a serious practical threat, the GSM Association could force all GSM operators to upgrade their security systems to use a stronger form of encryption.

The GSMA has done this once before, in 2004, when security flaws were discovered in another security code, known as A5/2, and operators across Latin America, Asia and Africa were forced to upgrade their networks.

A security upgrade could prove very costly, however, as some operators would have to replace their old base stations completely, Mr Moran said. The A5/2 upgrade, for example, took about 18 months.

A decision on whether to upgrade to a stronger code could be taken at the next meeting of the GSMA security group in February.

[mgt23]

http://reflextor.com/trac/a51

A5/1 Cracking Project ¶

This project aims at publicizing cryptographic weaknesses found in today's cellular networks. We are not advocating to exploit these weknesses but rather want to inform about the fact that GSM calls are already being intercepted and decrypted using commercial tools.
Latest News ¶

We presented the  current state of the project ( Slides) at the 26C3 conference in Berlin. The main take-aways were:

    * The community has computed a large number of rainbow tables (Thank you!)
    * We found new sources of known plaintext which allows decryption with a smaller subset of the codebook than previously thought
    * A full GSM interceptor to collect GSM data could hypothetically be built from open source components. We have not done so as it may be illegal in some countries.

The latest updates are communicated through the  mailing list.

Stay up to date with the NewsAndChanges, and find a common answers in the FAQ
Sorting and Sharing Rainbow Tables ¶

If you already computed rainbow tables using the tools provided below, then it is time to make your tables usable through sorting them. Please also share the tables through Bittorrent. The sort process is explained in this quick tutorial (and requires this  program). Currently there is no working source code to compile to other architectures. We are working on this.
Technical Background ¶

The attack on the A5/1 cipher this project implements, is a reimplementation of the THC work  THC, which was done in early 2008 but never released.

The Time/Memory Trade-off framework is still in its early stage of development. Comments and bug reports through the  mailing list are greatly appreciated.

Our approach differs slightly in that we use more common hardware to generate the tables, namely, NVidia and ATI graphics cards with GPGPU capability, and attempt to build a distributed infrastructure of nodes. In this distributed effort each node donates computing power for the generation and disk spacefor the storage of a piece of the rainbow table code book. The combined distributed code book can be used to decrypt GSM voice calls and text messages in seconds.

For information on generating the data needed for decryption please visit  http://airprobe.org.
Creating A5/1 Rainbow Tables ¶

Announcement: In case you are using a software revision earlier than September, please upgrade to increase the efficiency of the table generation

To start contributing computing time, please  get unique table parameters here.

Get a working copy of the table generator by either:

A) Downloading binaries  (linux 32bit)  (linux 64bit)  (windows 32bit)  (windows 64bit). (revision 58 from October 25 2009) -or-

B) CompilingTheProgram

Then, RunningTheProgram