Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Communications Hardware Hacking Security Build

CCC Hackers Break DECT Telephones' Security 116

Posted by timothy from the distibuting-dialtone dept.
Sub Zero 992 writes "Heise Security (article in German) is reporting that at this year's Chaos Communications Congress (25C3) researchers in Europe's dedected.org group have published an article (PDF) showing, using a PC-Card costing only EUR 23, how to eavesdrop on DECT transmissions. There are hundreds of millions of terminals, ranging from telephones, to electronic payment terminals, to door openers, using the DECT standard." So far, the Heise article's German only, but I suspect will show up soon in English translation. Update: 12/30 21:27 GMT by T : Reader Juha-Matti Laurio writes with the story in English. Thanks!
This discussion has been archived. No new comments can be posted.

CCC Hackers Break DECT Telephones' Security More

CCC Hackers Break DECT Telephones' Security

Comments Filter:

  • Ok, somebody has to. (Score:5, Funny)

    by fuzzyfuzzyfungus ( 1223518 ) on Tuesday December 30, 2008 @09:14AM (#26267159) Journal
    All your base station are belong to us.

  • Free speech! (Score:2, Insightful)

    by Anonymous Coward

    In Soviet America, they wouldn't be allowed to publish this.

    • Re: (Score:2)

      by cromar ( 1103585 )
      I'm glad Germany seems to have backed down from its anti-hacker legislation. Wasn't it last year we heard they were threatening their security experts and admins with legislation to take away even such benign utilities as password recovery tools?

      I was going to your right to publish such information wouldn't be violated in America, but then I remembered the subway-hack kids and the guy who took a plea bargain [nytimes.com] for distributing Hezbollah satellite feeds in NY...

      • Re:Free speech! (Score:4, Informative)

        by nem75 ( 952737 ) <jens@bremmekamp.com> on Tuesday December 30, 2008 @11:41AM (#26268195)

        I'm glad Germany seems to have backed down from its anti-hacker legislation. Wasn't it last year we heard they were threatening their security experts and admins with legislation to take away even such benign utilities as password recovery tools?

        They are far from backing down. Over here security auditing and related actions are still threatened by excessive copyright protection laws (existing or in the making). As they are in the US by e.g. the DMCA.

      • Re: (Score:1, Informative)

        by Anonymous Coward

        German Legisltive has already passed has a very strict bill (Paragraph 202c StGB) in August 2007 and we have since been sourcing out certain penetration tests for out customers to freelance developers in Switzerland and Israel.

        IT industry doesn't have a lobby in Germany and legislators behave like in a third world country in this regard. (Echt scheisse ist das!)

        You also might have noticed that many papers that where presented during 25C3 were not signed any more but anonymous submissions. In some oint

  • I had no idea (Score:5, Interesting)

    by Ender_Stonebender ( 60900 ) on Tuesday December 30, 2008 @09:25AM (#26267233) Homepage Journal

    Wow. I had no idea that people were using DECT phones to process payment cards*, but a breif Google search turned one up. I guess I've always made the assumption that there is no way to validate the security of wireless connections, so they should always be considered insecure. Do I just have a paranoid mind, or do other geeks think like that to?

    * "Payment cards" includes credit, debit, gift card, etc.

    • Re: (Score:3, Funny)

      by Yvanhoe ( 564877 )
      I am doubtful that payment terminals uses only DECT's encryption to transfer confidential data. They probably add their own layer. Don't they ?

      • Re:I had no idea (Score:5, Interesting)

        by fuzzyfuzzyfungus ( 1223518 ) on Tuesday December 30, 2008 @09:44AM (#26267367) Journal
        In a world not ruled by morons and legacy equipment, I imagine that the DECT link would just be carrying a nice SSL session, and it wouldn't much matter.

        However, I submit the following [applied-math.org](PDF warning) as evidence that we do not live in such a world, indeed, there is some reason to suspect the exact opposite.

        • I imagine that the DECT link would just be carrying a nice SSL session, and it wouldn't much matter.

          <sarcasm>Umm, yeah, that would work great [slashdot.org].</sarcasm> Less facetiously, it would indeed have been possible to make things secure using SSL; but just using it isn't enough, at least as long as you use standard certificate authorities for auth. If you make your own, this particular crack probably wouldn't hit you.

      • They probably add their own layer. Don't they ?

        Shall I let go the tumbleweed and start the wind machine now?

    • Re:I had no idea (Score:5, Informative)

      by Chep ( 25806 ) on Tuesday December 30, 2008 @09:38AM (#26267325)
      those terminals are here *everywhere* (France). Drive up to McD's, order stuff, you get handed the terminal, put your card in, punch your PIN, there you are.

      Nowadays those terminals tend to get upgraded to GPRS/EDGE though, but DECT units are still quite popular. Not for that long I guess.

      Although, snake oil wireless security is not much of a worry, if there is another layer of end-to-end crypto between the terminal and the billing&processing authority! I wouldn't bet too much on this though...

      (on the other hand, even CCC-cracked DECT is still not too bad... was apalled to see coupla weeks ago in Geneva, they still print the whole card number and time on receipt slips... OOPS!)

      • I have seen these things a lot in restaurants in France, Italy, Spain and Portugal.

        I can't recall ever seeing one in Germany. They usually just take your card, and return it with the receipt.

        Now, if that is any securer?

        • at least there you know it's always just the waiter who walks away with your credit card info, and not someone snooping through your trash.

          • And if they are the same person?

            You know, the poor guy who barely has enough money to live because the only job he can get is as a waiter.
            If he manages to clone the data, and get some money to another account (perhaps with the help of a friend).

            Besides: I wonder whey credit cards are in use at all. They are obviously the worst security concept in history (until Windows 95's user login, circumvented by pressing ESC).

            • You know, the poor guy who barely has enough money to live because the only job he can get is as a waiter. If he manages to clone the data, and get some money to another account (perhaps with the help of a friend).

              Sound a little paranoid to me. Plus, if ithis did happen, you'd call your bank and they would reverse the charges. Better to have someone steal your Bankcard then yoru Check book.

              • I'm not so sure that checkbook theft is any worse than ATM/credit card theft. If you've a record of the check numbers in your checkbook, you can have the bank pre-emptively void those checks.

                • True,

                  But that does not stop Target from accepting those checks in a different state and then reporting that you are a bad check writer. Sure, you can clear the matter up after writing a letter and showing proof that you were nto the one to write the check. Btu when someone steals your check book and then goes around writing checks to 10 different stores, it's a bit annoying.

                  Once you make the phone call for the Debit/Credit card it does not matter where they go, your worry is over.

                  • I had always thought that checks travelled through a check clearing house or houses. If they do, wouldn't your bank tell the clearing house(s) to not accept the voided checks?

                    • To be honest, things may have changed in the last 6 years since I've had my check book stole (Can't you tell I'm bitter?). I called the checks in stolen and no money was ever taken out of my account. However, I've run into problems because they wrote bad checks at a lot of places (Target beign one), who have tried to come after me for the money.

                    • Man. That sucks about Target and other places. I suppose that this is yet another reason to not have a checkbook. :)

                      TBH, I don't have a checkbook. I haven't had one ever since the USPS lost my $60 order in the mail many, many years ago. (Can you tell that *I'm* bitter? ;) )

        • Now, if that is any securer?

          That's a very good point. In all of the electronic transactions that my wife and I have ever made, we've never had our card swiped. Yet, a cashier once swiped her number at a brick-and-mortar store and used it to buy gas and have a pizza delivered, among other things.

        • Re: (Score:3, Insightful)

          by jonbryce ( 703250 )

          No, because while they are swiping it, they can also take a clone copy of the card to sell to criminals. At least that's what happens in Britain, and for that reason we are advised not to let our cards be taken out of sight.

          Don't you have chip & pin yet? France has had it for about 15 years now, and Britain has had it for a few years.

          • Re: (Score:3, Informative)

            by KillerBob ( 217953 )

            Don't you have chip & pin yet? France has had it for about 15 years now, and Britain has had it for a few years.

            It's been around in Canada for about a year... my last Visa card, which expired in November, didn't have it. My current Visa card does. My current Mastercard, which was issued in December 2007, doesn't have one.

            I still sign receipts "Check ID". But I've only ever been asked once.

            • *opens can of worms* That's because they can get in trouble with Visa if they demand ID. And it annoys customers besides.

              • Re:I had no idea (Score:4, Informative)

                by sangreal66 ( 740295 ) on Tuesday December 30, 2008 @12:13PM (#26268489)
                They can also get in trouble for accepting a card that reads "Check ID" instead of a valid signature. The merchant agreement stipulates that in these cases the cashier must check ID and have the customer sign the card in their presence. If the customer won't agree to this, the transaction should be refused. The link below is to a picture of the relative portion of Visa's acceptance criteria: http://i41.tinypic.com/v2vb49.gif [tinypic.com]

                • Re: (Score:3, Interesting)

                  by KillerBob ( 217953 )

                  Interesting reading. My card is signed with my real signature, which matches the one on my passport (which I carry when overseas) and my drivers' license. It's the receipt which I sign as "Check ID". I haven't yet called Visa on them, but I'm tempted to after reading that agreement. If nothing else, it means that they aren't actually checking the signature against the card.

                • Interesting; I wasn't aware of the extra process involved in the case of a card signed like that.

          • Chip & PIN? Doesn't matter much, unless they make it mandatory *or* if you can disable other ways of using your credit card. I've just looked it up for the Netherlands: everybody uses swipe & PIN over here. Not so safe, but better than just handing over the card and "signing" (or drawing a nice puppet, hence the quotes) a bill. Of course, this doesn't matter much because you can STILL use the card in other places in Europe without using the swipe.

            As long as you can use your credit card without suppl

        • Re: (Score:2)

          by hughk ( 248126 )
          In Germany, there are a lot of bars & restaurants that don't take credit or debit cards. Two reasons, first the card processing companies take up to 6% and second, they prefer cash.

        • Re: (Score:2)

          by hughk ( 248126 )
          In Germany, most bars and restaurants don't take credit or debit cars because processing is too expensive (up to 6%) and they prefer cash anyway. Many bars and restaurants work in a grey area as far as tax is concerned.

        • Re: (Score:1)

          by KDR_11k ( 778916 )

          In Germany they hand you that if the system insists on a PIN entry as opposed to a signature. Not sure about the exact pattern.

      • Re: (Score:3, Interesting)

        by owlstead ( 636356 )

        "Nowadays those terminals tend to get upgraded to GPRS/EDGE though, but DECT units are still quite popular. Not for that long I guess."

        Oh, yes, now I do feel so much safer. Trust me if I say that at least in the GSM world, security is rather haphazard. There have been many issues, including broken SIM's etc. etc. If I take a look at the specs, I don't feel safe against eavesdropping *at all*. I don't know if GPRS is any better, but my guess is that it is not.

        Anyway, even if it is safe, the chances of listen

    • Re:I had no idea (Score:4, Insightful)

      by uffe_nordholm ( 1187961 ) on Tuesday December 30, 2008 @09:39AM (#26267331)
      Unfortunately I don't think it the geeks thinking like you do who are the problem. I think the problem is the managers who make decisions based on what can be sold to the public, as long as the public doesn't find out some small dark secret...

      As for me, I consider wireless communication insecure, but I don't always bother about it. It boils down to a balance of potential damage and cost (not only money but also time/impracticality...) of securing the communication.

      • I think the problem is the managers who make decisions based on what can be sold to the public, as long as the public doesn't find out some small dark secret...

        Diebo^H^H^H^H^H, er!, Premier Solutions anyone, cough, cough ?

    • Payment cards with a chip use complicated standards to communicate (EMV [wikipedia.org]). Everything is done encrypted so, even if they can take a peek at a conversation, they still have to break the card security mechanisms.

      • Re: (Score:2, Interesting)

        by gzunk ( 242371 )

        Not necessarily, there are two modes that you can use the EMV cards in. Plaintext offline PIN, and Encrypted offline PIN. In plaintext offline PIN the card reader presents the PIN to the card in plaintext.

        Guess which mode most of the UK cards use, Go on, Guess. (Hint: it's not encrypted.)

      • EMV is a good step in the right direction, but still has its flaws. The biggest flaw is, of course, systems that don't use the chip. "The door is locked but I was never given a key". "Oh, come on in".

        The second is just a subset of the first: More chip-n-pin systems, if they detect a damaged chip, will default to the standard swipe method. This is because a small number of chips will be damaged-- magnets, static shock, wear and tear, etc. If they don't flip to the swipe method, the customer is SOL at th

    • I assume there is a second layer of encryption/authentication ... they couldn't be that stupid, right?

    • Re: (Score:3, Funny)

      by Opportunist ( 166417 )

      "What do you mean, 'can be hacked'? There's a law against it, right? It's illegal, right? See, it can't be hacked!"

    • Re:I had no idea (Score:5, Interesting)

      by deroby ( 568773 ) <deroby@yucom.be> on Tuesday December 30, 2008 @09:53AM (#26267427)

      Personally I find it scary that people consider 'wired' communications to be 'secure' by default.

      AFAIK most wireless protocols have at least some kind of 'security' and 'encryption' in their design. Granted that quite a few of these have been shown to be "incomplete", but at least there's an effort. Wired stuff on the other hand seems to be optimized for speed (and stability) only, but nobody really cares about security. When someone finds that they can eavesdrop on a wireless keyboard from an unobscured distance of say 5ft, hell breaks loose. But by my recollection there's been 'keyboardloggers' for ages, both in hardware (a "part" you had to put between the computer and the keyboard, something not quite unfeasible when you can get up to 5ft anyway) and software. (**)

      Clearly, wireless is much harder to control (it simply goes through the wall to the house next door), wired isn't all that "unbreakable" either.
      Imho, security would best be handled using software, that way at least it's easier to "upgrade" when a fault in the protocol is found. I doubt we're going to see everyone throw out their DECT phone or whatever anytime soon... Maybe they'll be able to eavesdrop on phone-conversations, and maybe they'll even manage to see what's going up & down when a payment transaction is going on, but I think (HOPE!) the latter will have at least some kind of protection in there to avoid the packets to be tampered with ...

      (**: Frankly, I think the latter is much more widespread than most any of us think since it's so damn easy to create, but that could be me being paranoid)

      • As I get the article, the DECT system has pretty good security. The problem is, it can be disabled almost on request! It's pretty easy to attack sloppy implementations of any security system, no matter how secure. I may be wrong, the version I read was pretty mangled...

      • Wired imply physical access, possibly leaving trace either in software or in hardware. If you leave trace you are therefore detectable and vulnerable yourself to be caught. Wireless on the other hand is another worm. You can read the comms without anyone knowing you ever accessed to it. And even if it is only from 5ft away, you can hide the material and it not be visible on you particularly on public place. Which is why hell break loose on any widely publicly used wireless communication is proved to be vuln

        • Re: (Score:3, Interesting)

          by Alpha830RulZ ( 939527 )

          Wired is only as secure as the door on the phone equipment room, which in my building is shared by several businesses, and is often open as I walk by.

          • This sounds like a Doctor! Doctor! problem to me. :D

          • But THIS is exactly the point. Wired can be as secure as a box LOCKED, under watch by a guy armed to the teeth under a nuclear bunker , IF YOU WISH. You will need access so physical access is the security layer you have in ADDITION to the normal transport protocol layer. Wireless on the other hand is a "telecom box" which is open to the public 24/7, with the added advantage that nobody will ever ask you why you are fumbling with that telecom box, because you cannot be caught snooping that communication.

      • Clipper chip (Score:2, Interesting)

        by Anonymous Coward

        Personally I find it scary that people consider 'wired' communications to be 'secure' by default.

        Back in the '90s there was a big fight in the US about the Clipper chip, [slashdot.org] and forcing every phone in the US to have an encryption chip, with the keys being escrowed and only available via a court order.

        While there were many reasons to be against it, I never understood why some people used the argument that the government could always secretly access the encryption keys. Given the fact that all phone calls are in the clear to begin with, adding the Clipper would actually add some security--if not against the

        • Re: (Score:2)

          by hughk ( 248126 )
          The issue was that with access to the LEA (Law Enforcement Authority) keys, all your communications were interceptable. Although it was proposed that the LEA key would be partitioned, skeleton keys can always be copied. That is, the LEA key could/would leak.

        • Re: (Score:3, Insightful)

          by Kadin2048 ( 468275 )

          The Clipper chip concept, as applied to telephones, had several big issues. First (as someone else points out), the mere existence of Law Enforcement / NSA keys, held somewhere in a vault, is a security risk. Those keys could leak at some point, and then the entire infrastructure is worse than useless.

          Second, a lot of privacy-minded, government-distrusting people saw the situation Clipper would create as being worse than having no security at all. At least with insecure POTS phones, people of average int

      • Re: (Score:3, Insightful)

        by Archangel Michael ( 180766 )

        "Personally I find it scary that people consider 'wired' communications to be 'secure' by default."

        No, you misunderstand. Nothing is "secure". It is a grades of security. In this case, wired communication is MORE secure than wireless.

        Anyone suggesting perfect security is either a fool, selling something, or a liar ... or all three.

      • When someone finds that they can eavesdrop on a wireless keyboard from an unobscured distance of say 5ft, hell breaks loose.

        Already done, I guess you haven't been reading slashdot well enough:
        http://hardware.slashdot.org/article.pl?sid=08/10/20/1248234 [slashdot.org]

        It's from 20 meters and through walls.

      • Re: (Score:1)

        by mseidl ( 828824 )
        Snooping in on wireless is easier, (IMHO) than wired. You can sniff traffic easily if you're on the same hub/switch, but outside of that it gets more difficult.

        But, there lies the limit of my wired hacking.

        Wireless, can be hacked, and with a crappy can-tenna and a recycled sat dish you can get a really far range on the cheap.

    • The article said that you could eavesdrop on baby-phones.

      Now, this is *really* a case on Slashdot, where we should "Think of the Children!"

    • You're not the only one. I'd already assumed DECT encryption had been broken some time ago and that it was already considered insecure, so other strong tunnel encryption should be required for anything sensitive. I'm rather surprised it's taken this long to MitM it.

    • Re: (Score:2)

      by taniwha ( 70410 )
      My banker here in NZ uses one to call head office to get an OK every time I do a large international transaction ....
  • My PC Card cost EUR 23.50! It's USELESS!

  • Videos and streams here: (Score:1, Informative)

    by Anonymous Coward

    http://events.ccc.de/congress/2008/wiki/Streaming

  • Based on the mangled translation... (Score:5, Informative)

    by russotto ( 537200 ) on Tuesday December 30, 2008 @10:35AM (#26267687) Journal

    ..it appears they haven't broken the cipher, but instead managed to trick the handset and base into not enabling encryption in the first place. I'd guess (without any actual information) that it's an active attack where you intentionally interfere to force a disconnect, then trace the reconnection up to the point where encryption is requested, then fake a packet with encryption not requested (it's TDMA so you know exactly when it is going to come). For cordless phones this is a problem, but for PIN terminals and other dedicated DECT devices, it should in theory be simple to refuse to make certain non-encrypted connections or transmit sensitive data over them. However, in actual practice, nothing involving DECT is simple...

  • Heise UK (Score:5, Informative)

    by Anonymous Coward on Tuesday December 30, 2008 @11:00AM (#26267855)

    English version of this article can be found here:
    http://www.heise-online.co.uk/news/25C3-Serious-security-vulnerabilities-in-DECT-wireless-telephony--/112326 [heise-online.co.uk]

  • Article in English (Score:3, Informative)

    by cheftw ( 996831 ) on Tuesday December 30, 2008 @11:19AM (#26268007)

    With a laptop aufgebohrten [bohren is to drill] card for 23 euros, according to security experts call on the basis of the widely-used standard Digital Enhanced Cordless Telecommunication simply listen.

    Who confidential telephone conversations, you should better not be one of the most popular cordless phones on the basis of the standard DECT (Digital Enhanced Cordless Telecommunication) access. As security experts at the 25th Chaos Communication Congress (25C3) in Berlin said, can easily intercept such communications. What is needed is therefore only a aufgebohrte, actually for the Internet telephony imaginary laptop card for 23 euros and a Linux computer. No problems with the interception of long-distance DECT had this device, as very often when an encryption is not activated. But even at the beginning of encrypted information exchange could plug the card base and pretends to disable encryption.

    The approval by the European Telecommunications Standards Institute (ETSI) standard DECT procedure is most widely used for cordless telephones. In addition, the standard in Babyfonen, emergency calls and door-opening systems, cordless EC-card or even in traffic management applications. The number of active DECT terminals in this country alone at 30 million. For the authentication of the base and the associated equipment and for the encryption of data using DECT standard crypto methods.

    The algorithms are used in the devices and will all be wired to the public are kept secret. The network master key is not used to leave. In theory, see that everything from sound, said Erik Tews, one of the researchers involved the discovery of the TU Darmstadt. The practice, however, as various workarounds and attack surfaces.

    After the hackers initially a fairly expensive and high processor performance requirements DECT sniffer had built, they found, according to Andreas fellow students with the ComOnAir card "another beautiful hardware" for the reception of data traffic. After a reverse engineering, the replica of the circuit diagram, the retrieval of Fimware and the AnlÃten some additional lines was scarce after a month of looking, for example, from a house in front of a parked car use sniffer been completed.

    The inventor was quickly noticed led Tews went on to say that sometimes have no authentication or encryption process between the transmitter station and the handset will be activated. Often authenticate the phone only to the network as the GSM cellular standard, although in principle, DECT also the network to the receiving unit as it could identify. For other devices, is a successful authentication, but without encryption. In all these cases, the PCMCIA card with a special Linux driver active discussions track, extract the data on a storage medium and write an audio player such performance can. It should have been possible, in any conversation in such a poorly secured DECT network recorded.

    If the handset is encrypted conversations have had the case not much more difficult, said Tews. Using a modified driver and a script you have the base issue as sniffer and data traffic, thanks to the support VoIP on an Asterisk server, and also redirect you. A breaking of keys had been necessary because when emit a signal that encryption is not supported, to communicate in plain had been converted. "It works on all systems, which we have found here", underlined the Darmstadt researchers vulnerability DECT standard implementations.

    Even when encryption system itself was the first hacker sticking points. According Tews succeeded them, a reverse engineering of the central DECT Standard Authentication Algorithm (DSAA) and its four sub-models to implement. A research report on the project site dedected.org finding implementations and source code for the programming languages Java and C will follow soon. Quite the DSAA is broken so far but not yet.

    On the well kept secret DECT Standard Cipher (DSC) is in accordance with Ralf-Philipp Weinmann of the research team is also still no effective attack. A paten

    • Re: (Score:2)

      by cnvogel ( 3905 )

      With a laptop aufgebohrten [bohren is to drill] card for 23 euros

      aufgebohrt means pimped. So they used a laptop and a improved version of the DECT card.

  • Does this mean we can make fun of the Germans, Mock their culture and ideals. Show how backwards they are compared to our culture. Do this while not fully understanding what their culture is or reasons why their method needs to be different then ours.

  • http://www.heise-online.co.uk/security/ [heise-online.co.uk]

    25C3: More light shed on "denial of service" vulnerabilities in TCP

    25C3: Reliable exploits for Cisco routers

    25C3: Cracks in the iPhone security architecture

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close