Researcher plans distributed GSM crack
August 26, 2009 | 15:15
Companies: #karsten-nohl #open-source
A security researcher has launched a project which aims to use technology originally developed to find signs of alien intelligence to crack the encryption scheme used by GSM mobile 'phones.
As reported over on CNet, researcher Karsten Nohl announced an open-source project at the Hacking at Random conference which aims to use distributed computing technology to develop a rainbow table for the decryption of A5/1 encrypted traffic - as used by 'phones in the UK and worldwide.
The project is in many ways similar to the popular Folding@Home distributed computing system, except instead of using spare CPU cycles on volunteers' computers to fold proteins and analyse possible new cures for various ailments Nohl is hoping to crack the encryption scheme used in around three billion mobile 'phones worldwide. Once complete, the rainbow table created as a result would allow anyone to decrypt captured traffic and listen in to mobile conversations in a matter of seconds.
While you might argue with his methodology, Nohl believes he's started the project for all the right reasons. Security flaws in the implementation of the A5/1 encryption algorithm have been known about for years, but previous attempts to highlight them - including a similar volunteer cracking project - have been swept under the rug, allegedly following pressure from a large mobile provider. Despite this, commercial products - aimed at law enforcement agencies - containing proprietary and jealously guarded A5/1 code books exist, and are openly sold.
As the creation of a code book involves a not-inconsiderable amount of number crunching, Nohl decided that a distributed computing project was the way to go. Despite the large amount of data involved, the keyspace for A5/1 is small enough at just 54 bits that Nohl estimates the project could have attained its goal in under two months with a mere 160 volunteers.
The other reason for the distributed paradigm - and for the open source nature of the code behind it - is to prevent any possibility of individual project members being targeted to prevent the release of any code book generated. Nohl explained that the files would be available to all project contributors, and expected them to be uploaded to BitTorrent trackers within three months of the project starting.
While the generation and possession of a rainbow table for the A5/1 algorithm is thought to be legal - although certainly likely to get you some interesting questions from local law enforcement should they want to make your life awkward - the use of same to actually decrypt mobile 'phone traffic would be against the law in most countries.
Do you believe that Nohl's efforts to get mobile providers to move to something with substantially stronger encryption - such as is available with 3G connectivity - is laudable, or is he simply putting sensitive information into the hands of undesirables with his latest project? Share your thoughts over in the forums.
As reported over on CNet, researcher Karsten Nohl announced an open-source project at the Hacking at Random conference which aims to use distributed computing technology to develop a rainbow table for the decryption of A5/1 encrypted traffic - as used by 'phones in the UK and worldwide.
The project is in many ways similar to the popular Folding@Home distributed computing system, except instead of using spare CPU cycles on volunteers' computers to fold proteins and analyse possible new cures for various ailments Nohl is hoping to crack the encryption scheme used in around three billion mobile 'phones worldwide. Once complete, the rainbow table created as a result would allow anyone to decrypt captured traffic and listen in to mobile conversations in a matter of seconds.
While you might argue with his methodology, Nohl believes he's started the project for all the right reasons. Security flaws in the implementation of the A5/1 encryption algorithm have been known about for years, but previous attempts to highlight them - including a similar volunteer cracking project - have been swept under the rug, allegedly following pressure from a large mobile provider. Despite this, commercial products - aimed at law enforcement agencies - containing proprietary and jealously guarded A5/1 code books exist, and are openly sold.
As the creation of a code book involves a not-inconsiderable amount of number crunching, Nohl decided that a distributed computing project was the way to go. Despite the large amount of data involved, the keyspace for A5/1 is small enough at just 54 bits that Nohl estimates the project could have attained its goal in under two months with a mere 160 volunteers.
The other reason for the distributed paradigm - and for the open source nature of the code behind it - is to prevent any possibility of individual project members being targeted to prevent the release of any code book generated. Nohl explained that the files would be available to all project contributors, and expected them to be uploaded to BitTorrent trackers within three months of the project starting.
While the generation and possession of a rainbow table for the A5/1 algorithm is thought to be legal - although certainly likely to get you some interesting questions from local law enforcement should they want to make your life awkward - the use of same to actually decrypt mobile 'phone traffic would be against the law in most countries.
Do you believe that Nohl's efforts to get mobile providers to move to something with substantially stronger encryption - such as is available with 3G connectivity - is laudable, or is he simply putting sensitive information into the hands of undesirables with his latest project? Share your thoughts over in the forums.
RELATED ARTICLES
MSI MPG Velox 100R Chassis Review
October 14 2021 | 15:04
Want to comment? Please log in.