Is Mobile Telephony via GSM still Secure enough?

January 9, 2010 12:39 PM in Risk Management, Newsflash by Andreas Wuchner
Overview of GSM Security
 
GSM (Global System for Mobile communications: originally from Groupe Spécial Mobile) is the most popular standard for mobile phones in the world. Its promoter, the GSM Association, estimates that 80% of the global mobile market uses the standard. GSM is used by over 3 billion people across more than 212 countries and territories.

GSM was designed with a moderate level of security. The system was designed to authenticate the subscriber using a pre-shared key and challenge-response. Communications between the subscriber and the base station can be encrypted. The development of UMTS introduces an optional software application USIM, that uses a longer authentication key to give greater security, as well as mutually authenticating the network and the user - whereas GSM only authenticates the user to the network (and not vice versa).1

Recent Attacks against GSM

On 28 December 2009 the German computer engineer Karsten Nohl announced2 that he had cracked the A5/1 cipher [used for GSM]. According to Nohl, he developed a number of rainbow tables (static values which reduce the time needed to carry out an attack) and improved known plaintext attacks. He also said that it is possible to build "a full GSM interceptor ... from open source components" but that they had not done so because of legal concerns.1

Although this new attack has been published and communicated as ”Cellphone Encryption Code Is Divulged”2, similar attacks had been published earlier. Theoretically, the cipher A5/1 has been considered broken for several years. However, the first attacks required substantial resources and were very slow, and therefore were not considered relevant in practice. The newly published attack, however, required considerably fewer resources: 40 computers and only 3 months to develop the rainbow tables, passive attacks using the rainbow tables are feasible for individuals. In order to develop the rainbow tables, the attackers used modern graphic cards with CUDA support and calculated with multiple computers simultaneously.
 
Known Attacks and Future of GSM Security

GSM uses several cryptographic algorithms for security. The A5/1 and A5/2 stream ciphers are used for ensuring over-the-air voice privacy. A5/1 was developed first and is a stronger algorithm used within Europe and the United States; A5/2 is weaker and used in other countries. Serious weaknesses have been found in both algorithms: It is possible to break A5/2 in real-time with a ciphertext-only attack, and in February 2008, Pico Computing, Inc revealed its ability and plans to commercialize FPGAs that allow A5/1 to be broken with a rainbow table attack.1

The code breaker machine of the University Bochum (COPACOBANA) has possibly also the ability to break A5/1 in real-time, and can be purchased comparatively cheaply.

Potential Security Risks

The potential risk is that someone listens in on confidential information exchanged via a cell phone.

Precondition for attacks: The older (active) attacks usually required that the attacked cell phone communicates with a simulated basis station of the attacker. Therefore the attacker’s basis station must be near to the attacked phone and the phone must connect itself to this simulated basis station (a kind of man-in-the-middle attack). This is more challenging if the phone, or rather the user, is moving. However, the newer attacks are passive attacks; means that the attacked cell phone connects to the regular base station and the attacker simply eavesdrop on the radio data and crack it using the rainbow tables.
 
Alternative attacks: Note that only the connection between the user and the first basis station is encrypted. The basis stations usually communicate between each other unencrypted. Therefore it is possible to tab the wire and listen in (easy for all agencies). Of course, the same also applies to landline phone calls.
 
Recommendation and Alternatives
 
Warning (Risk Acceptance): In general, phones, especially cell phones and cordless phones, shall not be considered as secure communication devices.
 
Alternative Communication: Sensitive information can be exchanged via secure e-mail.

Secure Phones: Use special end-to-end voice encrypted mobile phones or adapters (e.g. from Rohde & Schwarz3,4) which are being used by the Federal Government of Germany5.
 
Using UMTS: As UMTS can replace GSM and is also more secure, UMTS should be used instead of GSM whenever possible. The phones then must be configured to use UMTS only. This would work fine for regions with well-established UMTS networks, but can produce problems in regions with weak UMTS infrastructure, or in countries with cryptography restrictions like Australia.
 
Using other cipher e.g. A5/3: The GSM system supports multiple algorithms (not only A5/1 and A5/2). The currently used weak algorithms can be replaced with more secure ciphers, e.g. A5/3 which is also used in UMTS. However, the mobile network operator determines which cipher is used, and configures the base stations accordingly. The user cannot influence this decision-making process.
 
Conclusion

Currently, the risk is still acceptable and from a technical point of view, the situation is under control. However, this might change very soon and therefore risk must be continuously monitored. Nevertheless, for business areas with increased confidentiality requirements, the usage of encrypted mobile phones is strongly recommended.

Sources and Further Links
 
Sources:

1 Wikipedia article about GSM, 06 January 2010, http://en.wikipedia.org/wiki/GSM

2 The New York Times, Karsten Nohl, 29 December 2009, “Cellphone Encryption Code Is Divulged” http://www.nytimes.com/2009/12/29/technology/29hack.html?_r=2

3 Product info, Rohde & Schwarz “TopSec GSM“, http://www2.rohde-schwarz.com/en/-products/secure_communications/voice_and_data_encryption/TopSec_GSM.html

4 Product info, Rohde & Schwarz “ TopSec Mobile“, http://www2.rohde-schwarz.com/en/-products/secure_communications/voice_and_data_encryption/TopSec_Mobile.html

5 Heise.de, 20 October 2009, „Bundesregierung investiert 21 Millionen in Krypto-Handys“

http://www.heise.de/ix/meldung/Bundesregierung-investiert-21-Millionen-in-Krypto-Handys-841693.html
 
Further Links:

Heise.de, 28 December 2009, “26C3: GSM-Hacken leicht gemacht“

(German) http://www.heise.de/newsticker/meldung/26C3-GSM-Hacken-leicht-gemacht-892911.html
 
(English) http://www.h-online.com/open/news/item/26C3-GSM-hacking-made-easy-893245.html

Heise.de, 30 December 2009, “26C3: CCC fordert stärkere Verschlüsselung des GSMMobilfunks“ (German)

http://www.heise.de/newsticker/meldung/26C3-CCC-fordert-staerkere-Verschluesselung-des-GSM-Mobilfunks-893739.html

Spiegel.de, 29 December 2009, “CCC-Congress: Sicherheitsforscher hacken Mobilfunk-Verschlüsselung“ (German) http://www.spiegel.de/netzwelt/netzpolitik/0,1518,669368,00.html

Paper from Phillip Suedmeyer, member of the Cryptography Competence Center, 7 November 2003, “Die Stromchiffre A5” (German)

http://www.suedmeyer.net/inhalte/pdf/a5_thesis.pdf

OpenSource project information page about the Crypto work of Prof. B. Esslinger who leads the Cryptography Competence Center http://www.cryptool.org/index.php/en.html
Tags :


Responses

Re: Is Mobile Telephony via GSM still Secure enough?

From Stefan Keller on January 9, 2010 9:28 PM
As the network doesn't authenticate to the mobile, and it is now easy and cheap (1,500 USD) to implement fake base stations, I believe that in the real world an attacker would most likely not have to crack the crypto. For me it sounds like just impersonating the base station and turning off crypto could do the trick. - And we all know that this works reliably, as such "IMSI catchers" had been around for a while now... Bonus risk: Fuzzing mobiles from the base station, might yield ugly attacks against handsets in the future.
Reply

Re: Is Mobile Telephony via GSM still Secure enough?

From Oliver on January 11, 2010 10:09 AM
Interesting analysis. I like the conclusions as they are not saying that you should not use it, but more likely to consider what information you are transmitting.
Reply

Add a comment Send a TrackBack