Guide to breaking cell phone security revealed

Dec 30, 2009 By MATT MOORE , AP Business Writer

(AP) -- A German security expert has raised the ire of the cell phone industry after he and a group of researchers posted online a how-to guide for cracking the encryption that keeps the calls of GSM-standard cell phone users secret.

Karsten Nohl, 28, told The Associated Press this week that he, working with others online and around the world, created a codebook showing how to get past the used to keep conversations on more than 3 billion mobile phones safe from prying ears.

Nohl said the purpose was to push companies to improve . The collaborative effort put the information online through file-sharing sites.

"The message is to have better security, not we want to break you," he said of the move. "The goal is better security. If we created more demand for more security, if any of the network operators could use this as a marketing feature ... that would be the best possible outcome."

GSM, the leading cell phone technology around the world, is used by several in the U.S., with the largest being AT&T Inc. and T-Mobile USA. Verizon Wireless and Sprint Nextel Corp. use a different standard.

The GSM Association, a trade group that represents nearly 800 wireless operators, said it was mystified by Nohl's rationale.

Claire Cranton, a spokeswoman for the London-based group, said that "this activity is highly illegal in the UK and would be a serious RIPA offense as it probably is in most countries." RIPA, or the Regulation of Investigatory Powers Act, is a British law governing the interception of user logs and e-mails of suspected criminals by security and intelligence agencies.

It has already been possible to intercept GSM calls, but the equipment is generally only available to law enforcement. Regular wiretapping of cellular calls is also possible, since they travel unencrypted over standard wiring after being picked up by a cell tower.

Even with Nohl's exploit, expensive and sophisticated radio equipment placed close to the target is required to pull the calls off the air.

Sujeet Shenoi, a professor of computer science at the University of Tulsa in Oklahoma, said that while the code-breaking guide raises privacy issues, his main concern is that organized crime will take advantage of it to make money, perhaps by eavesdropping on transactions between consumers and merchants.

"It's a shot across the bow" of the wireless industry, he said.

Nohls' effort undermines the 21-year-old algorithm used to ensure the privacy of phone calls made on GSM (global system for mobile communication) cell phone networks.

That algorithm, dubbed the A5/1 and made up of 64-bit binary code, was adopted in 1988. Since then 128-bit codes have been implemented to ensure caller privacy on newer, third-generation networks. The GSM Association has developed the A5/3 algorithm, which it says is gradually being phased in to replace A5/1.

"The GSMA heads up a security working group which looks at all issues re: security and this isn't something that we take lightly at all," Cranton wrote in an e-mail to the AP. "We have a new security algorithm that is being phased (in), as the protection and privacy of customer communications is at the forefront of operators' concerns."

Nohl, who holds a doctorate in computer engineering from the University of Virginia, said that going from a 64-bit code to 128-bit code "makes it some quintillion times more difficult" to crack.

He said the codebook was compiled and posted online not for malicious intent but as a call to the industry to improve the level of security for those who use GSM phones that are found worldwide and offered through numerous network providers.

"Being security researchers one thing we can do, and what we choose to do in this case, is to show how it can be done," he told the AP on Tuesday by telephone.

"We have created a tool, a codebook, that's used to decrypt GSM packs, or the GSM encryptions," he added, noting that with the codes phone calls could be recorded using a high-end PC, a radio and some software.

"In GSM this flaw was pointed out 15 years ago and 15 years seems long enough for the cypher to be replaced with something else. No one uses a phone that is 15 years old," Nohl said. "If they had taken steps they could have replaced everything three time times over."

Nohl made the announcement Sunday at the Chaos Communication Congress in Berlin, a four-day event that ends Wednesday.

While there has been criticism, there is also some faint praise and admiration for the effort.

"We're familiar with his work. It's proper stuff," said Simon Bransfield-Garth, chief executive of London-based Cellcrypt, which sells software to keep mobile phones secure.

"People have been trying to crack GSM for a long time," Bransfield-Garth told AP. "I think the science behind it is pretty sound," he added. "Whether putting it in the public domain was wise, is an entirely different debate."

On the Net:

A5/1 Cracking Project: http://reflextor.com/trac/a51

GSMA: http://www.gsmworld.com

Cellcrypt: http://www.cellcrypt.com

Explore further: Hand out money with my mobile? I think I'm ready

4.8 /5 (14 votes)
add to favorites email to friend print save as pdf

Related Stories

GSM system about to be compromised

Dec 08, 2009

(PhysOrg.com) -- Research scientists in California and elsewhere are deliberately setting out to compromise the mobile phone system used by around three billion people. The system uses Global System for Mobile ...

Stop Big Brother listening in to your mobile phone conversation

Sep 27, 2004

A team of University of Surrey scientists led by Professor Ahmet Kondoz has developed new technology which will enable companies and organisations to ensure that their GSM mobile phone conversations are totally secure and confidential. Prev ...

In Brief: Happy 15th birthday to GSM

Jun 30, 2006

July 1 will mark 15 years since the first global system for mobile communication call was made, and some companies are celebrating the occasion.

Recommended for you

Hand out money with my mobile? I think I'm ready

Apr 17, 2014

A service is soon to launch in the UK that will enable us to transfer money to other people using just their name and mobile number. Paym is being hailed as a revolution in banking because you can pay peopl ...

Quantenna promises 10-gigabit Wi-Fi by next year

Apr 16, 2014

(Phys.org) —Quantenna Communications has announced that it has plans for releasing a chipset that will be capable of delivering 10Gbps WiFi to/from routers, bridges and computers by sometime next year. ...

Tech giants look to skies to spread Internet

Apr 16, 2014

The shortest path to the Internet for some remote corners of the world may be through the skies. That is the message from US tech giants seeking to spread the online gospel to hard-to-reach regions.

Wireless industry makes anti-theft commitment

Apr 16, 2014

A trade group for wireless providers said Tuesday that the biggest mobile device manufacturers and carriers will soon put anti-theft tools on the gadgets to try to deter rampant smartphone theft.

Dish Network denies wrongdoing in $2M settlement

Apr 15, 2014

The state attorney general's office says Dish Network Corp. will reimburse Washington state customers about $2 million for what it calls a deceptive surcharge, but the satellite TV provider denies any wrongdoing.

Netflix's Comcast deal improves quality of video

Apr 14, 2014

Netflix's videos are streaming through Comcast's Internet service at their highest speeds in the past 17 months now that Netflix is paying for a more direct connection to Comcast's network.

User comments : 1

Adjust slider to filter visible comments by rank

Display comments: newest first

designmemetic
not rated yet Dec 31, 2009
"It has already been possible to intercept GSM calls, but the equipment is generally only available to law enforcement. Regular wiretapping of cellular calls is also possible, since they travel unencrypted over standard wiring after being picked up by a cell tower."

So it's safe to say that the majority of illegal cell phone intercepting has been by government employees? They have the method. They have the motive. And they have the opportunity.

More news stories

LinkedIn membership hits 300 million

The career-focused social network LinkedIn announced Friday it has 300 million members, with more than half the total outside the United States.

Researchers uncover likely creator of Bitcoin

The primary author of the celebrated Bitcoin paper, and therefore probable creator of Bitcoin, is most likely Nick Szabo, a blogger and former George Washington University law professor, according to students ...

Impact glass stores biodata for millions of years

(Phys.org) —Bits of plant life encapsulated in molten glass by asteroid and comet impacts millions of years ago give geologists information about climate and life forms on the ancient Earth. Scientists ...