Cloud Hosting

Hacking. Disinformation. Surveillance. CYBER is Motherboard's podcast and reporting on the dark underbelly of the internet.

A group of cybersecurity researchers has uncovered what they believe is an intentional backdoor in encrypted radios used by police, military, and critical infrastructure entities around the world. The backdoor may have existed for decades, potentially exposing a wealth of sensitive information transmitted across them, according to the researchers.

While the researchers frame their discovery as a backdoor, the organization responsible for maintaining the standard pushes back against that specific term, and says the standard was designed for export controls which determine the strength of encryption. The end result, however, are radios with traffic that can be decrypted using consumer hardware like an ordinary laptop in under a minute.

There's no other way in which this can function than that this is an intentional backdoor, Jos Wetzels, one of the researchers from cybersecurity firm Midnight Blue, told Motherboard in a phone call.

Do you know about other vulnerabilities in communications networks? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, or emailjoseph.cox@vice.com.

The research is the first public and in-depth analysis of the TErrestrial Trunked RAdio (TETRA) standard in the more than 20 years the standard has existed. Not all users of TETRA-powered radios use the specific encryption algorithim called TEA1 which is impacted by the backdoor. TEA1 is part of the TETRA standard approved for export to other countries. But the researchers also found other, multiple vulnerabilities across TETRA that could allow historical decryption of communications and deanonymization. TETRA-radio users in general include national police forces and emergency services in Europe; military organizations in Africa; and train operators in North America and critical infrastructure providers elsewhere.

Midnight Blue will be presenting their findings at the upcoming Black Hat cybersecurity conference in August. The details of the talk have been closely under wraps, with the Black Hat website simply describing the briefing as a Redacted Telecom Talk. That reason for secrecy was in large part due to the unusually long disclosure process. Wetzels told Motherboard the team has been disclosing these vulnerabilities to impacted parties so they can be fixed for more than a year and a half. That included an initial meeting with Dutch police in January 2022, a meeting with the intelligence community later that month, and then the main bulk of providing information and mitigations being distributed to stakeholders. NLnet Foundation, an organization which funds those with ideas to fix the internet, financed the research.

The European Telecommunications Standards Institute (ETSI), an organization that standardizes technologies across the industry, first created TETRA in 1995. Since then, TETRA has been used in products, including radios, sold by Motorola, Airbus, and more. Crucially, TETRA is not open-source. Instead, it relies on what the researchers describe in their presentation slides as secret, proprietary cryptography, meaning it is typically difficult for outside experts to verify how secure the standard really is.

The researchers said they worked around this limitation by purchasing a TETRA-powered radio from eBay. In order to then access the cryptographic component of the radio itself, Wetzels said the team found a vulnerability in an interface of the radio. From there, they achieved code execution on the main application processor; they then jumped to the signals processor, which Wetzels described as something equivalent to a wifi or 3G chip, which handles the radios signals. On that chip, a secure enclave held the cryptographic ciphers themselves. The team finally found vulnerabilities in that which allowed them to extract the cryptography and perform their analysis. The team then reverse-engineered how TETRA implemented its cryptography, which led to the series of vulnerabilities that they have called TETRA:BURST. It took less time than we initially expected, Wetzels said.

Most interestingly is the researchers findings of what they describe as the backdoor in TEA1. Ordinarily, radios using TEA1 used a key of 80-bits. But Wetzels said the team found a secret reduction step which dramatically lowers the amount of entropy the initial key offered. An attacker who followed this step would then be able to decrypt intercepted traffic with consumer-level hardware and a cheap software defined radio dongle.

This is a trivial type of attack that fully breaks the algorithm. That means an attacker can passively decrypt everything in almost real time. And it's undetectable, if you do it passively, because you don't need to do any weird interference stuff, Wetzels said.

Not all current TETRA-radio customers will use TEA1, and some may have since moved onto TETRAs other encryption algorithms. But given TETRAs long life span, its existence still means there may have been room for exploitation if another party was aware of this issue.

There's bigger fish who likely found this much earlier, Wetzels said, referring to other third parties who may have discovered the issue.

The researchers say they identified multiple entities that they believe may have used TEA1 products at some point. They include U.S. Africom, a part of the U.S. military which focuses on the continent. Multiple military agencies did not respond to Motherboards request for comment.

In the interest of public safety, we do not share detailed information on our cybersecurity infrastructure, Lenis Valens, a spokesperson for PANYNJ which manages JFK airport, said in a statement when asked if the organization used TETRA radios when contacted by Motherboard. The agency has robust protocols in place and employs the latest technologies and best practices. Safety for our passengers and customers always comes first, the statement said.

Most law enforcement agencies contacted by Motherboard did not respond to a request for comment. Swedish authorities declined to comment.

Several radio manufacturers directed Motherboard to ETSI for comment. Claire Boyer, press and media officer for ETSI, told Motherboard in an email that As the authority on the ETSI TETRA technology standard, we welcome research efforts that help us further develop and strengthen the security of the standard so that it remains safe and resilient for decades to come. We will respond to the report when it has been published.

Specifically on the researchers claims of a backdoor in TEA1, Boyer added At this time, we would like to point out that the research findings do not relate to any backdoors. The TETRA security standards have been specified together with national security agencies and are designed for and subject to export control regulations which determine the strength of the encryption.

The researchers stressed that the key reduction step they discovered is not advertised publicly.

Intentional weakening without informing the public seems like the definition of a backdoor, Wouter Bokslag from Midnight Blue told Motherboard in an email.

In ETSIs statement to Motherboard, Boyer said there have not been any known exploitations on operational networks of the vulnerabilities the researchers disclosed.

Bokslag from Midnight Blue said in response that There is no reason ETSI would be aware of exploitations in the wild, unless customers reach out to ETSI after detecting anomalies in their network traffic. Then with the TEA1 issues specifically, since it can be passively intercepted and decrypted, there is no detectable interference, and ETSI not knowing any concrete cases seems like a bit of a meaningless statement with this regard.

In response to some of the researchers findings, radio manufacturers have developed firmware updates for their products. For TEA1, however, the researchers recommend users migrate to another TEA cipher or apply additional end-to-end encryption to their communications. Wetzels said that such an add-on does exist, but that hasnt been vetted by outside experts at this time.

Bart Jacobs, a professor of security, privacy and identity, who did not work on the research itself but says he was briefed on it, said he hopes this really is the end of closed, proprietary crypto, not based on open, publicly scrutinised standards.

Subscribe to our cybersecurity podcast,CYBER. Subscribe toour Twitch channel.

Read more from the original source:
Researchers Find 'Backdoor' in Encrypted Police and Military Radios - VICE

Jul 24, 2023THNMobile Security / Privacy

Google has announced that it intends to add support for Message Layer Security (MLS) to its Messages service for Android and open source implementation of the specification.

"Most modern consumer messaging platforms (including Google Messages) support end-to-end encryption, but users today are limited to communicating with contacts who use the same platform," Giles Hogben, privacy engineering director at Google, said. "This is why Google is strongly supportive of regulatory efforts that require interoperability for large end-to-end messaging platforms."

The development comes as the Internet Engineering Task Force (IETF) released the core specification of the Messaging Layer Security (MLS) protocol as a Request for Comments (RFC 9420).

Some of the other major companies that have thrown their weight behind the protocol are Amazon Web Services (AWS) Wickr, Cisco, Cloudflare, The Matrix.org Foundation, Mozilla, Phoenix R&D, and Wire. Notably missing from the list is Apple, which offers iMessage.

MLS, as the name implies, is a security layer for end-to-end encryption that facilitates interoperability across messaging services and platforms. It was approved for publication as a standard by IETF in March 2023.

"MLS builds on the best lessons of the current generation of security protocols," IETF noted at the time. "Like the widely used Double Ratchet protocol, MLS allows for asynchronous operation and provides advanced security features such as post-compromise security. And, like TLS 1.3, MLS provides robust authentication."

Central to MLS is an approach known as Continuous Group Key Agreement (CGKA) that allows multiple messaging clients to agree on a shared key that caters to groups in size ranging from two to thousands in a manner that offers forward secrecy guarantees regardless of the individuals who join and leave the group conversation.

"The core functionality of MLS is continuous group authenticated key exchange (AKE)," the standard document reads. "As with other authenticated key exchange protocols (such as TLS), the participants in the protocol agree on a common secret value, and each participant can verify the identity of the other participants."

"That secret can then be used to protect messages sent from one participant in the group to the other participants using the MLS framing layer or can be exported for use with other protocols. MLS provides group AKE in the sense that there can be more than two participants in the protocol, and continuous group AKE in the sense that the set of participants in the protocol can change over time."

This evolving membership is realized by means of a data structure called an asynchronous ratcheting tree, which is used to derive shared secrets among a group of clients. The goal is to be able to efficiently remove any member, achieving post-compromise security by preventing group messages from being intercepted even if one member was breached at some point in the past.

On the other hand, forward secrecy, which enables messages sent at a certain point in time to be secured in the face of later compromise of a group member, is provided by deleting private keys from past versions of the ratchet tree, thereby averting old group secrets from being re-derived.

Mozilla, which is hoping to see a standardization of a Web API to leverage the protocol directly via web browsers, said MLS is designed such that "the legitimacy of new members entering a group is checked by everyone: there is nowhere to hide."

See more here:
Google Messages Getting Cross-Platform End-to-End Encryption with MLS Protocol - The Hacker News

If youd been quietly chasing down cryptographic bugs in a proprietary police radio system since 2021, but youd had to wait until the second half of 2023 to go public with your research, how would you deal with the reveal?

Youd probably do what researchers at boutique Dutch cybersecurity consultancy Midnight Blue did: line up a world tour of conference appearances in the US, Germany and Denmark (Black Hat, Usenix, DEF CON, CCC and ISC), and turn your findings into a BWAIN.

The word BWAIN, if you havent seen it before, is our very own jocular acronym thats short for Bug With An Impressive Name, typically with its own logo, PR-friendly website and custom domain name.

(One notorious BWAIN, named after a legendary musical instrument, Orpheuss Lyre, even had a theme tune, albeit played on a ukulele.)

This research is dubbed TETRA:BURST, with the letter A stylised to look like a shattered radio transmission mast.

TETRA, if youve never heard of it before, is short for Terrestrial Trunked Radio, originally Trans-European Trunked Radio, and is widely used (outside North America, at least) by law enforcement, emergency services and some commercial organisations.

TETRA has featured on Naked Security before, when a Slovenian student received a criminal conviction for hacking the TETRA network in his own country after deciding that his vulnerability reports hadnt been taken seriously enough:

Trunked radio needs fewer base stations and has a longer range than mobile phone networks, which helps in remote areas, and it supports both point-to-point and broadcast communications, desirable when co-ordinating law enforcement or rescue efforts.

The TETRA system, indeed, was standardised back in 1995, when the cryptographic world was very different.

Back then, cryptographic tools including the DES and RC4 ciphers, and the MD5 message digest algorithm, were still in widespread use, though all of them are now considered dangerously unsafe.

DES was superseded at the start of the 2000s because it uses encryption keys just 56 bits long.

Modern computers are sufficiently fast and cheap that determined cryptocrackers can fairly easily try out all possible 256 different keys (whats known as a brute-force attack, for obvious reasons) against intercepted messages.

RC4, which is supposed to turn input data with recognisable patterns (even a text string of the same character repeated over and over) into random digital shredded cabbage, was found to have signficant imperfections.

These could be used to used to winkle out plaintext input by performing statistical analysis of ciphertext output.

MD5, which is supposed to produce a pseudorandom 16-byte message digest from any input file, thus generating unforgeable fingerprints for files of any size, turned out to be flawed, too.

Attackers can easily trick the algorithm into churning out the same fingerprint for two different files, annihilating its value as a tamper-detection tool.

End-to-end encryption for individual online transactions, which we now take for granted on the web thanks to secure HTTP (HTTPS, based on TLS, short for transport layer security), was both new and unusual back in 1995.

Transaction-based protection relied on the brand-new-at-the-time network-leve protocol known as SSL (secure sockets layer), now considered sufficiently insecure that youll struggle to find it in use anywhere online.

Unlike DES, RC4, MD5, SSL and friends, TETRAs 1995-era encryption remains in widespread use to this day, but hasnt received much research attention, apparently for two main reasons.

Firstly, even though its used around the world, its not an everyday service that pops up in all our lives in the way that mobile telephones and web commerce do.

Secondly, the underlying encryption algorithms are proprietary, guarded as trade secrets under strict non-disclosure agreements (NDAs), so it simply hasnt had the levels of public mathematical scrutiny as unpatented, open-source encryption algorithms.

In contrast, cryptosystems such as AES (which replaced DES), SHA-256 (which replaced MD5), ChaCha20 (which replaced RC4), and various iterations of TLS (which replaced SSL) have all been analysed, dissected, discussed, hacked, attacked and critiqued in public for years, following whats known in the trade as Kerckhoffs Principle.

Auguste Kerckhoff was a Dutch-born linguist who ended up as a professor of the German language in Paris.

He published a pair of seminal papers in the 1880s under the title Military Cryptography, in which he proposed that no cryptographic system should ever rely on what we now refer to as security through obscurity.

Simply put, if you need to keep the algorithm secret, as well as the decryption key for each message, youre in deep trouble..

Your enemies will ultimately, and inevitably, get hold of that algorithm

and, unlike decryption keys, which can be changed at will, youre stuck with the algorithm that uses those keys.

Commercial NDAs are peculiarly purposeless for keeping cryptographic secrets, especially for successful products that end up with ever more partners signed up under NDA.

There are four obvious problems here, namely:

The Dutch researchers in this story took the last approach, legally acquiring a bunch of compliant TETRA devices and figuring out how they worked without using any information covered by NDA.

Apparently, they discovered five vulnerabilities that ended up with CVE numbers, dating back to 2022 because of the time involved in liaising with TETRA vendors on how to fix the issues: CVE-2022-24400 to CVE-2022-24404 inclusive.

Obviously, theyre now holding out on full details for maximum PR effect, with their first public paper scheduled for 2023-08-09 at the Black Hat 2023 conference in Las Vegas, USA.

Advance information provided by the researchers is enough to remind us of three cryptographic must-follow rules right away:

Fortunately, it looks as though CVE-2022-24401 has already been quashed with firmware updates (assuming users have applied them).

As for the rest of the vulnerabilities

well have to wait until the TETRA:BURST tour kicks off for fuill details and mitigations.

Read the original:
Hacking police radios: 30-year-old crypto flaws in the spotlight - Naked Security

When I contemplate the return of the crypto warsattempts to block citizens use of encryption by officials who want unfettered spying powersI look back with dread on the late Middle Ages. I wasnt alive back then, but one feature of those times lingers in my consciousness. Starting around 1337 and all the way until 1453, England and France fought a series of bloody battles. The conflict went on so long it was immortalized by its centenarian length: We know it as the Hundred Years War.

The crypto wars havent yet reached that mark. (In this column I will be reclaiming the term crypto from its more recent and debased usage by blockchain enthusiasts, too many of whom havent read my 2001 book called, um, Crypto.) Dating from the publication of the groundbreaking 1976 paper that introduced public key cryptographya means of widening access to encryption that was developed just in time for the internetthe skirmish between encryption advocates and their foes in officialdom is only just approaching 50 years.

From the start, government efforts to constrain or outlaw secure encrypted communications were vigorous and persistent. But by the turn of the millennium it appeared the fight was over. Encryption was so obviously critical to the internet that it was built into every browser and increasingly included in messaging systems. Government snooping didnt endcheck out Edward Snowdens revelationsbut certain government elements around the world never got comfortable with the idea that citizens, including the most rotten among us, could share secrets safe from the eyes of surveillants. Every few years, theres a flareup with proposed new regulations, accompanied by scary scenarios from the likes of FBI directors about going dark.

The arguments of the anti-crypto faction are always the same. If we allow encryption to flourish, they plead, were protecting terrorists, child pornographers, and drug dealers. But the more compelling counterarguments havent changed, either. If we dont have encryption, no one can communicate securely. Everyone becomes vulnerable to blackmail, theft, and corporate espionage. And the last vestiges of privacy are gone. Building a back door to allow authorities to peek into our secrets will only make those secrets more accessible to dark-side hackers, thieves, and government agencies operating off the books. And even if you try to outlaw encryption, nefarious people will use it anyway, since the technology is well known. Crypto is toothpaste that cant go back in the tube.

The good news is that so far encryption is winning. After a long period where crypto was too hard for most of us to use, some extremely popular services and tools have end-to-end encryption built in as a default. Apple is the most notable adopter, but theres also Metas WhatsApp and the well-respected standalone system Signal.

Still, the foes of encryption keep fighting. In 2023, new battlefronts have emerged. The UK is proposing to amend its Investigatory Powers Act with a provision demanding that companies provide government with plaintext versions of communications on demand. Thats impossible without disabling end-to-end encryption. Apple has already threatened to pull iMessage and FaceTime out of the UK if the regulation passes, and other end-to-end providers may well follow, or find an alternative means to keep going. Im never going to willingly abandon the people in the UK who deserve privacy, says Signal president Meredith Whittaker. If the government blocks Signal, then we will set up proxy servers, like we did in Iran.

Originally posted here:
Almost 50 Years Into the Crypto Wars, Encryption's Opponents Are ... - WIRED