German researchers discover flaw that could let anyone listen to cell calls
washingtonpost.com
washingtonpost.com
The main function of SS7 is call setup. All the switches along the route get their switching commands over SS7, not over the circuit-switched channel. (That went out with SS5, the old audio-tone based system). Call setup is preceded by "translation", turning a destination phone number into a route. That's done with query messages over SS7.
This allows outsourced wiretapping. Verisign offers this as a service for telcos, so they don't have to deal with law enforcement themselves.
http://www.verisign.com/static/001927.pdf
Verisign, which also runs much of the US SS7 network (http://www.verisign.com/stellent/groups/public/documents/dat...) is well placed to do this. All they have to do for a wiretap is to have the translations for a source or destination number reroute to a wiretap point, which then records while forwarding to the desired destination. As an SS7 provider, they already have all the call metadata.
Vulnerabilities come in because more parties now have SS7 access. Cellular roaming and VoIP to landline routing are managed over SS7. So a large number of computers other than dedicated telco switches now have SS7 connections. A break-in at any of those points has wiretapping potential.
It is pretty cute, you can do most of the stuff just in the visual packet editors / flow editors and where necessary revert to python snippets.
To get the feel of it, and see some pics: http://docs.linkbit.com/
edit: and basically yes. as a protocol engineer and somebody very familiar with SS7/C7/GSM/.., once you have the access to the network (which can be done over IP!) I wouldn't be at all surprised, you could misuse it.
SS7 is one of those revered buzzphrases from my teen years, even getting to play with it for a weekend would really sweeten my Christmas.
http://blog.pt.com/vendors-eol-announcement
The 3G/4G segment of subscribers will have a distribution of 3.4 billion using 3G (SS7) services and .9 billion using 4G services. The total outcome of this research indicates that a total of 7.65 billion subscribers, out of a total of 8.5 billion subscribers, will remain on SS7-based networks in 2017.
Verizon went on to further explain that a final 2G/3G (SS7) sunset timeframe decision has not been made.
The good news is vendors are not happy considering the availability of hardware is will decrease significantly over the same time period, hopefully speeding the sunset for this technology.
Some service providers are planning on a strategy of consolidating their network, having no support and cannibalizing existing spare equipment for hardware support.
Edit: phones are forbidden due to the recent spying events.
I'm assuming a GSM (or equivalent) baseband is the only thing separating smartphone from smartablet and smartlaptop nowadays, correct? If they allow 3G tablets, then this is a security-theater kind decision, aimed to appease "management", and we must make fun of them.
If they ban all baseband-carrying devices, then this is a consistent policy that is paranoid about a very specific thing that, quite frankly, invites a lot of healthy paranoia.
I wonder what it'll take to open up those baseband processors.
Project OsmocomBB: http://bb.osmocom.org/trac/
The hack of belgium telco Belgacom sees more light day by day.
This system is broken beyond repair. We need to build it up from the ground, safe.
They can interoperate with regular Android phones if those phones have their app installed. I don't know what happens, if one calls a phone that does not support encryption.
Boeing is, or will soon be making such a phone, specifically intended for classified communication. I don't know whether they will be sold to the public.
The good ones are open source, such as RedPhone: https://github.com/WhisperSystems/RedPhone
(source: http://heise.de/-2503376 - sorry, German)
Yes, but numerous people participating in the Osmocom projects have that expertise. Fortunately, they're interested in building an open-source baseband processor (among other cool things), and not in hacking into anyone's private communications.
Besides, base stations are available openly on the market now at pretty reasonable prices. It's why I never talk about anything truly private on a mobile phone.
1. Alexandria needs to communicate with Bilbo. Alexandria has the privilege of being trusted by whatever organization she belongs to (be that her country, company, etc) and as such is unmonitored AFAsheKs. Biblo on the other hand is some fugitive-type and is unable, or perhaps unwilling, to enter direct communication with Alexandria for fear of compromising himself or his beloved Alexandria. Bilbo could then monitor Alexandria's calls for an encoded message via a protocol they predetermine. This protocol could take the form of linguistic or audio steganography. One could image all sorts of information being leaked by Alexandria.
2. More realistically this could be tool for bribery. Monitor a set of vulnerable targets, wait until they reveal something, take a bribe to stay quite.
3. Or, for the Machiavellian-minded leak information that was supposedly confidential between two parties.
Interview: Telecom Security Expert Philippe Langlois on GCHQ Spying (http://www.spiegel.de/international/europe/interview-telecom...)
Vulnerabilities and Possible Attacks against the GPRS Backbone Network (http://critis06.lcc.uma.es/files/Vulnerabilities%20and%20Pos...)
Getting in the SS7 kingdom: hard technology and disturbingly easy hacks to get entry points in the walled garden (http://www.hackitoergosum.org/2010/HES2010-planglois-Attacki...)
Telecom Signaling Attacks on 3G and LTE networks (http://www.slideshare.net/p1sec/telecom-security-from-ss7-to...)
GSM and 3G Security (https://webcache.googleusercontent.com/search?q=cache:WlEd4H...)
Locating Mobile Phones using Signalling System #7 (http://events.ccc.de/congress/2008/Fahrplan/attachments/1262...)
SCTPscan - Finding entry points to SS7 Networks & Telecommunication Backbones (https://www.blackhat.com/presentations/bh-europe-07/Langlois...)
LTE Pwnage: Hacking HLR/HSS and MME Core Network Elements (http://www.slideshare.net/p1sec/p1security-lte-pwnage-v21)
Map of mobile network security (https://srlabs.de/gsmmap/)
Rooting The HLRs Mobile And Critical Infrastructure Insecurity (https://archive.org/details/D3T202201308021200RootingTheHlrs...)
AURORAGOLD Working Group - Shaping understanding of the global GSM/UMTS/LTE landscape - from the Snowden leaks (government employees should probably not click this) (https://s3.amazonaws.com/s3.documentcloud.org/documents/1374...) (https://firstlook.org/theintercept/2014/12/04/nsa-auroragold...)
I don't know what authentication is required. I expect that it was designed so that only your cell carrier could enable it, however whatever may have been secret about it, quite likely has leaked out by now.
If you don't want to be listened-to, don't have _any_ cell phones anywhere near you. Not just your own - say you want a private conversation in a public place; the phones of other people in your general vicinity could be switched on to listen to you.
I learned this from a well-known left-wing radical organization known as the United States Air Force, when I applied for the USAF Cyber Command. Their site had a recruiting video, that depicted a couple officers locking their phones into a grounded metal box - a faraday cage - before entering a secure area, that is, a room where secrets were openly discussed.
"How many internet-connected microphones are in the same room as you?"
It's astonishing how big that number gets. For me right now, it's ~50. And so many of them are made by different companies, assembled in different countries, etc. The chance that someone, somewhere, can listen to you is nearly 100% if you're in a semi-public space. We're living in a dramatically more invasive surveillance society than 1984 ever predicted (that was just street cameras & one 'telescreen' in your home).
And then, add into this mix that we have new market acceptance for devices that intentionally open this behaviour: XBox One, Moto X, Amazon's...whatevertheycallit. There's not only technical capability, but also increasing consumer desire. It's crazy.
Further edits: There's a lot more at stake here, too, if you extrapolate from their[1] known capabilities and combine with actors who may also have motives at large scale. Take Facebook's mood-altering study, for example. We know that someone/Facebook has the ability to alter the moods and opinions of large groups of populations. The same actors can also listen/watch those people in real time. Dystopian scenarios of totalitarian governments exercising total population thought-control is more and more plausible as we all trade our privacy and security to giant corporations in exchange for mere convenience in our daily lives.
[1]: Who is 'they'? I don't know, but there are many possible 'they's and it might be many of them.
However there is nothing at all to indicate that the computer has its audio microphone in use.
However in that case it was for a legitimate purpose.
I can't imagine an IRB-approved research study that requires a software solution (developed under an NDA) to a hardware problem that couldn't be solved with a one-inch square of black electrical tape.
For the price of a contracted software developer, you could simply buy a model of laptop (or smart phone), in which the bezel can be pried open without substantial damage, and behind the LED's transparent aperture (but obscuring the LED), you fix a tidbit of black tape or whichever opaque material you may prefer.
Or, better yet, for pretty much every situation that doesn't involve eye-movement tracking, simply install a hidden security camera at an opportunistic vantage point.
The issues for the IRB would only be the fact that the subjects are not consented to covert surveillance and whether the nature of the information collected presents a risk to the subject if accidentally disclosed.
It's not just that I am still bound by my NDA, but telling anyone what the application actually did, would result in bad things happening to completely innocent people.
However, it turns out that it is unlawful to do that in such countries as Japan.
Asking how to silence the iphone camera on stackoverflow resulted in 20,000 views of my post, several people saying you can't do that, and several people telling me it's against the law, that it would be a bad idea and so on.
Nevertheless, I have a completely legitimate reason to do so.
I expect Apple would reject it from the App Store. I may do it for Android, as well as for jailbroken iOS devices, but then sell it through the Cydia App Store.
It's just like Apple to be a corporate nanny.
I've done some Android Platform Development, but not yet any real Android App Development. I'll do that after I ship the iOS App I'm working on.
There's a lot of stuff that at one time would only work on jailbroken devices, only for Apple to "add support" for it as a result of some App becoming a huge hit at the Cydia App store.
At first one could not even take still photos programmatically, the user had to use Apple's own App for that. But Snapture - if I remember correctly - was able to do it on jailbroken devices, so Apple added the public API so that Snapture would be sold on the App Store, rather than through Cydia.
> Perhaps Apple added a silent mode so as to compete with
> Android.
It doesn't have to be Objective-C and Cocoa Touch. I'd be completely cool with C and system calls.
As others have mentioned, if you put your iphone in silent mode there is no click sound except in Japan. I'm not sure if a) phones sold in Japan have disabled this feature or b) the phone knows when it is located in Japan and then disables silent mode.
Yes, typically, but sometimes not when used by parties who want to obscure their use of the camera [1].
[1] http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/18...
Well OK...
More or less like writing any kind of virus.
Apple likes to claim that OS X is more secure. In reality, most of those who write malware own Windows boxen.
Which is of course an utter joke.
But they forgot firmware is software too, and is hackable too. (Now that's a 'leaky abstraction' for ya).
http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/18...
Turns out security is hard. Even compared to just 5 years ago, I think a lot more engineers are realizing how hard security actually is.
Security is hard in software because from the undecidable halting problem it immediately follows that any non-trivial property of software (such as "does the micro firmware turn the LED on when the camera is on") can also not be decided.
There is no halting problem in hardware. But I hear they have very, very cheap switches nowadays that could easily control the power to the camera and a parallel LED.
I've seen advertisements for automated circuit design tools that will convert a C program into the schematic for a chip that does the same thing, only in hardware.
That leads me to believe that hardware must have the halting problem as well. However I only have a passing understanding of the halting problem. Can you enlighten me?
> immediately follows that any non-trivial property of software (such as "does the micro firmware turn the LED on when the camera is on") can also not be decided.
Any non-trivial property of arbitrary software, you mean.
It is entirely possible to prove that some software is or isn't "secure", for however you define secure. It's just not possible to do that for arbitrary software.
It is entirely possible to (for example) write your micro firmware with an integrated proof that non-trivial properties (like the LED/camera thing you mention) are satisfied.
Second:
> There is no halting problem in hardware.
Actually, there is, kind of. Have you heard of the arbitrator problem? Long story short, analog behavior may propagate arbitrarily far into any digital system. You can make it less common, but you cannot get rid of it. Also: any non-trivial property of arbitrary hardware is also isn't provable. (Otherwise you could solve the halting problem, again)
It's bad enough that Amazon would know what ebooks I've purchased. The Kindle will tell Amazon what pages I've read and when I read them.
There is a damn good reason I don't even own an ebook reader.
I might buy the reader that Portland's Powells City of Books sells, but have not yet looked into whether it phones home.
On my Kobo Aura HD I was able to disable the snitching and with the sideloading working so great I had no reason to turn on the wi-fi since I bought it.
After "baby boomers", "Gen X", etc., I think the most appropriate name for today's kids is "the selfie generation". They're flattered if you stalk them. I wish I was kidding.
I asked a friend who recommended a firewall product whose name escapes me just now. Most coders think of a "firewall" as a way to keep bad packets out. This firewall would also keep bad packets _in_.
It identified the miscreant as the Welchia worm. What Welchia does is to install some completely legitimate Win2k security updates, as well as installing itself on some other Win2k box.
The only really _bad_ thing it did was to slow down my network.
That means, watches, phones, laptops, pedometer and just about anything that has circuits.
How do you know that a pedometer is really just a pedometer?
That's how Bradley Manning made off with 800,00 diplomatic cables. He used a CD label printer to print CD-R blanks so that they looked like the albums from all his favorite bands, put the CD-R media into a portable player, then burned the CDs at his PC after downloading the cables over the Internet.
Oddly, he was always searched on the way in, never on the way out.
Internet Protocol packets have a field for the security classification - unclassified, confidential, secret, top secret, there are other classifications that are themselves classified, as top secret ultra once was - as well as the compartment.
I expect Bradley Manning had a top secret clearance, but I doubt he had the same compartment as was required to read diplomatic cables.
Quite likely everyone was using commodity routers, such as one can purchase at Fry's. It must be expensive to purchase routers that enforce what has been in the Internet Protocol since the 1970s.
I'm not sure how these would have helped contain Manning. The access-control part of this infosec failure was on a higher level (Manning's admin access crossed compartments). "Server-side" access control didn't fail, it functioned as expected. Monitoring did fail, but that's another story.
Zooming out a bit to the security bits of IP packets, that I had completely forgotten about - are those actually used/useful in this Layer 7 era? How?
I can't think of a single use case. I would expect even the sensitive/non-sensitive routing decisions to happen on a per-host/subnet basis (e.g. 30.x.x.x stuff goes through this pipe, other stuff goes through the outside-world pipe)
For one thing, you don't permit information that has different classifications, or is in different compartment to be stored together on one computer.
So if he has access to top secret information, he shouldn't also be able to download Easy CD Creator with Internet Explorer, nor should he have been permitted to put what appeared to be audio CDs into the burner.
While one could argue his PC should not have a burner, there are good reasons for top secret computers to have them, however one should not be permitted to insert any but top secret CDs, and after burning there should be a way to enforce that they are stamped "top secret", and finally he should have been searched on the way out.
So a sys-admin wouldn't have full access to install software on his own machine? Which they wouldn't have been able to override, even given long periods of time alone with the hardware?
It is hard to imagine that the tools provided by the factory image (however heavily modded and supplemented that may be) would enable him to do everything he needs to do, without needing this or that approved by someone all the time. They are the guys who, in most other organizations, would approve or reject the third-party application. It is certainly a curious concept to me, to have a sysadmin without admin privileges (on his client, at least). I guess you could pull it off if you reduced the sysadmin's job to "look at some status output -> press GUI button. occasionally, call someone", but I'm fairly certain that you can't do that with everyone. What about the DB admins?
In any case. I dare say that you couldn't have stopped him. You may have contained his information access to a more limited scope[1], you may have limited his "bandwidth/throughput", but you just can't stop a dedicated whistleblower. You can't stop data exfiltrations, period. After all is said and done, and you remove all tools that could have been used to exfiltrate data (everything), the guy will memorize the document, go into the toilet, and write it on his thigh, or whatever[2]. Even though I suppose that at that time, it is info exfiltration, and it has less press value.
Manning's method was almost 0 risk to him (at the time, and "considering...") and offered 740MB bandwidth per round trip (if it wasn't actually DVDs). That's a pretty good bandwidth/risk ratio. Some more extreme alternatives would include SDs, micro SDs, tiny USB drives, and.. well, I don't need to paint you a picture - just look at drug mule tricks for inspiration.
[1] Snowden, not Manning. Analysts need info.
[2] There are several hundred steps between the current status quo and that extreme I just mentioned, but at the end of the day - you can't plug the analog hole that is the human brain unless we start wiping memories. And even then...
In every cell phone? Without more details I call BS on this. It might be possible, but stating that every cell phone has it, sounds unlikely to me. I don't think it is part of the GSM specification, so what would be the reason that EVERY cell phone (Also non-GSM phones) has it?
I don't think the Air Force would just make something like that up. It's not just a USAF policy, not to permit cell phones in secure areas. I know lots of people with clearances, none of them are permitted to bring cell phones into their offices.
I applied to the Cyber Command in the Summer of 2008. What kinds of phones were in use at the time, in the United States?
And the video did specifically say "every cell phone".
People with clearances all know about this maintenance mode. None of them ever explain the error of my ways, when I discuss it with them.
This just seems like outdated and paranoid policy to me.
The real reason you have to turn your phone off on a plane is so that you can't record the takeoff and landing. That way, if there's a crash, there's no evidence to dispute the airline's black box version of the story.
Pretty sick, no?
Send me your bill in the mail.
What's the REAL reason credit card companies don't keep backups?
Airlines are not allowed to comment on the investigation (including interpreting black box data) so the only official version is that of the NTSB.
I've never heard of an airline accident in the US where public or passenger video (cellphone or otherwise) contradicted the black box data.
However, the idea that an unmodified or unhacked phone can be made to behave this way is sheer tinfoil hattery. You're not allowed to bring anything even vaguely electronic into a SCIF, but that's because the whole idea behind a SCIF is to have a room in an otherwise-unsecure facility where even the vaguest potential security risks are aggressively countered.
Some of the confusion probably arises from the distinction between power-down and standby modes. If anything but the supervisory processor that monitors the power button were active with the phone turned all the way off, it would be noticed, and give rise to a substantial (and well justified) outcry. Under normal conditions, that can happen only if the phone has been hacked.
there is NO power switch in phones. My first GSM phone was something like Nokia 2110, and even that had no power switch.
Cellphones have a SLEEP mode, they NEVER turn off. Just like laptops (there is always at least one processor running, EC) and PCs (since ATX).
You can compare it to a turned off PC. In principle its off, but network card is still linked with ethernet switch and listening for WoL packets.
The baseband chip.. it runs its own RTOS (separate from Android/ios/etc): http://en.wikipedia.org/wiki/Baseband_processor
Rather than explaining, I think this link is a pretty good example: a chip from qualcomm that was sold at least through 2012:
http://www.osnews.com/story/27416/The_second_operating_syste...
It was demonstrated at BlackHat in 2011 on an iPhone 4 and HTC Dream (android):
https://www.blackhat.com/html/bh-dc-11/bh-dc-11-briefings.ht...
http://www.infoworld.com/article/2625180/smartphones/coming-...
Edit: Slides from a talk at DeepSec:
http://2010.hack.lu/archive/2010/Weinmann-All-Your-Baseband-...
Edit: video: https://www.youtube.com/watch?v=fQqv0v14KKY
edit: I think this is the paper: https://www.usenix.org/system/files/conference/woot12/woot12...
I quite commonly experience the phenomenon that when others don't agree with me, they make up reasons that I must be wrong, completely out of the blue.
For example, I'm working on a Conway's Game of Life implementation for iOS. It's taking a long time, so some joker published a web page that lists all the other members of our site, who have already shipped Conway's Life implementations.
So I pointed out that I shipped my own Life game for the Classic Mac OS in 1997, and that it was particularly fast because it set the bit-depth of the screen to 1 (black and white, no color, no greyscale), then drew directly into the video card memory. My old website where I published its source has been available in the wayback machine this whole time.
The response? Two other people pointed out that they knew how to draw directly to the screen decades ago.
No one is willing to acknowledge that I shipped my own Life implementation fourteen years ago, long before that site even existed.
For example I told her that I am a webmaster, and that it costs me money to register my domains and host my sites.
She regards such statements as evidence that I have not been taking my medicine, and will, from time to time, call the police to get me involuntarily held in a psychiatric hospital, whose staff will agree that I must be delusional, because I claim to be a webmaster.
Oddly, I am considered not notable enough for wikipedia, because someone made the argument that I am only known at k5, despite being widely published, having led the development of some protocols, invented things, written a whole bunch of highly regarded software products.
Google around, there are plenty of public media stories indicating that the capability exists. In one case, the FBI arrested a mafia leader based on covert capture of all conversations that happened in a rental car equipped with OnStar.
I once tried that using a metal lunchbox, with a tight fitting metal lid - the phone rang anyway.
Anyone else ever tried it?
And as a side note, be sure and turn off (or airplane mode) your phone if you do put it in an effective faraday cage, or you will rapidly drain the battery as the phone constantly tries - at full power - to find a base station.
Electromagnetic waves penetrate a conductor to a depth comparable to their wavelength, with an intensity that decreases exponentially.
Sounds tin-foily, any references? This conspiracy theory has been making the rounds for a long time and there's no evidence for it so far. Some problems immediately come to mind:
- would eat phone battery quickly to keep radio listening for these things
- would be vulnerable to discovery, eg leaks from phone industry engineers, reverse engineering by tinkerers, etc - yet has stayed secret for a long time (assuming this isn't a new thing)
More realistic would be exploiting a bug in the phone baseband firmware to get remote code execution, and then reprogramming the phone to do what you want. And reason enough to treat phones like you observed.
your phone already listens for incoming call signal, this would be just another type of signal.
I wasn't claiming that this maintenance mode turns on the power to a phone, rather that if the phone is already powered on, the maintenance mode silently and invisibly turns on the phone's microphone, then transmits audio back to the cell tower.
So if you leave your cell powered on, anyone who knows how to activate that maintenance mode can listen to what you are saying, without your knowledge.
Or using baseband as intended to get remote code execution, and then on the cell company side wrap it up in a nice GUI or set of scripts, and voilà - you have the "maintenance mode" mentioned.
I have been for DV clearnce job interviews (The FO at Milton keynes) and you can have NO electronics on your person past the reception area.
Your anecdotal USAF story does not prove anything either.
The story in the link has nothing to do with surveillance at the cell phone level. Its about interception/rerouting in the global phone network.