Hackers Can Hack Your Phone:-
Millions of mobile phones may be vulnerable to spying due to the use of outdated, 1970s-era 56 DES cryptography, according to new research due to be presented at the Black Hat security conference.
Karsten Nohl , an expert cryptographer with Security Research Labs, has found a way to trick mobile phones into granting access to the device's location, SMS functions and allow changes to a person's
voicemail number. Nohl's research looked at a mobile phones' SIM (Subscriber Identification Module),the
small card inserted into a device that ties it to a phone number and authenticates software updates and commands sent over-the-air from an operator. More than 7 billion SIM cards are in use worldwide. To ensure privacy and security, SIM cards use encryption when communicating with an operator, but the encryption standards use vary widely.
A mobile communication trade group, the GSM Association, said in a statement that only a "minority" of SIM cards that use older encryption standards would appear to be vulnerable.
"There is no evidence to suggest that today's more secure SIMs, which are used to support a range of advanced services, will be affected,"
GSMA said. Nohl's research found that many SIMs use a weak encryption standard dating from the 1970s called DES (Data Encryption Standard), according to a preview posted on his company's blog.
DES has long been considered a weak form of encryption, and many mobile operators have
upgraded now to more secure forms. It is relatively easy to discover the private key used to sign content encrypted with DES.
We all know that there are 4 classes of sms(s).
CLASS 0: Flash sms
CLASS 1: Normal sms
CLASS 2: This is the one used to send binary sms.
CLASS 3: A computer device connected to the modem can send commands to ask to only receive class 3 messages,
telling the modem to push class 3 messages directly to the device without storing them in the modem first.
(It can also ask for all messages to be pushed directly to the device without storing them in the modem first.)
In its experiment, Security Research Labs sent a binary code over SMS to a device
using a SIM with DES. Since the binary code wasn't properly cryptographically signed, it would not run on the device.
But while rejecting the code, the phone's SIM makes a crucial mistake: it sends back over SMS an error code that carries its own encrypted 56-bit private key, according to the company. Because DES is considered a very weak form of encryption, it's possible to decrypt the private key using known cracking techniques.
Security Research Labs did it in about two minutes on a regular computer with the help of a rainbow table, a mathematical chart that helps convert an encrypted private key or password hash into its original form faster.
With the private DES key in hand, it is then possible to "sign" malicious software updates with the key, and send those updates to the device.The device believes the software comes from a legitimate source and then
grants access to sensitive data. GSMA said that it has not seen the full details of Nohl's
research but that use of the DES algorithm has been "discontinued in over the air (OTA) standards for several years."
Security Research Labs outlined an attack scenario against SIM cards that run some form of Java virtual
machine, a software framework for Java applications. Using the SIM's private key, an
attacker could force the SIM to download Java applets, which
are essentially very small programs that perform some function. Those applets would be "allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions." "These capabilities alone provide plenty of potential for abuse," the company wrote.
Possible remedies to the problem including ensuring SIM cards use state-of-the-art cryptography and also using Java virtual machines that restrict applets' access to certain information.
GSMA said it has already provided guidance to network operators and SIM vendors that might be affected by Nohl's findings.
Nohl's presentation, "Rooting SIM cards," will take place at the Black Hat security conference in Las Vegas on July
31.
Millions of mobile phones may be vulnerable to spying due to the use of outdated, 1970s-era 56 DES cryptography, according to new research due to be presented at the Black Hat security conference.
Karsten Nohl , an expert cryptographer with Security Research Labs, has found a way to trick mobile phones into granting access to the device's location, SMS functions and allow changes to a person's
voicemail number. Nohl's research looked at a mobile phones' SIM (Subscriber Identification Module),the
small card inserted into a device that ties it to a phone number and authenticates software updates and commands sent over-the-air from an operator. More than 7 billion SIM cards are in use worldwide. To ensure privacy and security, SIM cards use encryption when communicating with an operator, but the encryption standards use vary widely.
A mobile communication trade group, the GSM Association, said in a statement that only a "minority" of SIM cards that use older encryption standards would appear to be vulnerable.
"There is no evidence to suggest that today's more secure SIMs, which are used to support a range of advanced services, will be affected,"
GSMA said. Nohl's research found that many SIMs use a weak encryption standard dating from the 1970s called DES (Data Encryption Standard), according to a preview posted on his company's blog.
DES has long been considered a weak form of encryption, and many mobile operators have
upgraded now to more secure forms. It is relatively easy to discover the private key used to sign content encrypted with DES.
We all know that there are 4 classes of sms(s).
CLASS 0: Flash sms
CLASS 1: Normal sms
CLASS 2: This is the one used to send binary sms.
CLASS 3: A computer device connected to the modem can send commands to ask to only receive class 3 messages,
telling the modem to push class 3 messages directly to the device without storing them in the modem first.
(It can also ask for all messages to be pushed directly to the device without storing them in the modem first.)
In its experiment, Security Research Labs sent a binary code over SMS to a device
using a SIM with DES. Since the binary code wasn't properly cryptographically signed, it would not run on the device.
But while rejecting the code, the phone's SIM makes a crucial mistake: it sends back over SMS an error code that carries its own encrypted 56-bit private key, according to the company. Because DES is considered a very weak form of encryption, it's possible to decrypt the private key using known cracking techniques.
Security Research Labs did it in about two minutes on a regular computer with the help of a rainbow table, a mathematical chart that helps convert an encrypted private key or password hash into its original form faster.
With the private DES key in hand, it is then possible to "sign" malicious software updates with the key, and send those updates to the device.The device believes the software comes from a legitimate source and then
grants access to sensitive data. GSMA said that it has not seen the full details of Nohl's
research but that use of the DES algorithm has been "discontinued in over the air (OTA) standards for several years."
Security Research Labs outlined an attack scenario against SIM cards that run some form of Java virtual
machine, a software framework for Java applications. Using the SIM's private key, an
attacker could force the SIM to download Java applets, which
are essentially very small programs that perform some function. Those applets would be "allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions." "These capabilities alone provide plenty of potential for abuse," the company wrote.
Possible remedies to the problem including ensuring SIM cards use state-of-the-art cryptography and also using Java virtual machines that restrict applets' access to certain information.
GSMA said it has already provided guidance to network operators and SIM vendors that might be affected by Nohl's findings.
Nohl's presentation, "Rooting SIM cards," will take place at the Black Hat security conference in Las Vegas on July
31.
