Security Flaws Allow Wiretaps to be Evaded

An anonymous reader writes "The New York Times is reporting that a team of researchers led by Matt Blaze has discovered that technology used for decades by law enforcement agents to wiretap telephones has a security flaw that allows the person being wiretapped to stop the recorder remotely. It is also possible to falsify the numbers dialed. The flaws are detailed in a paper being published by the IEEE. Someone who thinks he's being wiretapped can apparently just send a low tone down the line that turns off the recorder. The link has a demo."

Re:In other news...

[The Snowman]

Seriously, if I were planning a crime or terrorist act, you bet your ass I would encode all communication in some way -- whether it be encrypted emails or just a word code system over the phone that changes each time. This is similar to the Cold War days, when spies would leave innocent-looking messages in public places. Essentially, a non-computerized version of steganography.

Where there is a will, there is a way. Where there is a stupid or lazy criminal, there is a prison sentence.

Re:RTFA and all that

[bhsx]

RTWFA... The tried to force the Calea networks to keep the C-tone timeout. Congress didn't allow the force, but most Calea networks keep it anyway. Those that keep the C-tone are vulnerable to the same exploit.
In other words: Most of the time, in current conditions, this will work.

Re:I, for one, welcome security flaws

[Cecil]

The FBI inadvertently taps my phone and learns that someone at the company I work for has just invented something that will make the company a ton of money. Do you really think those agents aren't going to call up their stock-brokers and say, "BUY! BUY! BUY!"

Listen, I hate the concept of a police state and wiretapping as much as the next guy, but this is a dumb defense. The SEC investigates transactions like that for a reason. "Gee, these two FBI agents who've never bothered to invest more than $10,000 in any single company, suddenly bought $400,000 worth of shares of this company at the perfect time and made $15,000,000. They might've been ridiculously lucky. Or more likely they might've had insider information. Let's look a little closer, shall we?"

The stock market is like the world's biggest casino, and the SEC is certainly no less watchful and no less hesitant to break your legs if you try to cheat them.

Re:In other news...

[Phil Karn]

You don't understand the problem. Extremely incriminating evidence can be obtained through traffic analysis, knowing who you talk to and when, without acquiring the actual content of your communications. That's what a "pen register" is -- traffic analysis of a telephone. Encrypting your calls or your emails won't help much if, for example, they can see you're talking to known terrorists.

URLs for the REAL papers say lots more.

[billstewart]

The shorter HTML version [nyud.net] mainly talks about attacks on the voice eavesdropping parts, while the Longer PDF paper for IEEE [nyud.net] has even more technical detail and talks about attacks on dialed-number-recording Pen Registers and CallerID, which the Feds and Local Police are able to wiretap without the same level of court order that a voice wiretap requires. (I've done the NYUD-automatic-caching versions of the URLs, rather than the raw URL, to protect against Slashdotting.)

Basically, there's a fairly high proportion of the wiretapping gear that's actually deployed is vulnerable, in spite of what the police PR folks say, and it's much easier to hack the pen-register technology (though probably impossible to prevent the phone company from giving a direct billing database feed to the Feds, which you probably can't hack.)

Re:In other news...

[dorkygeek]

For the sake of free communication, I hope this stays like that in the UK then.

On a sidenote, there were some interesting papers published at this years Cyber Safety conference [ox.ac.uk]. Especially interesting in our context: Prepaid Mobile Phones: the Anonymity Question [ox.ac.uk] by Gordon Gow.

Wiretapping is mostly done by Verisign

[Animats]

It's not well known, but most wiretapping in the US is actually done by Verisign. [verisign.com] It's a commercial service they sell. Verisign runs most of the SS7 signalling network used to control the phone system. So they put in a back door that lets them route calls to or from specific phones to their wiretapping center in Northern Virginia. From there, the wiretapping is fed out to law enforcement, the intelligence community, and other interception customers, using T1 lines.

Since this works through SS7, and full call-control information is available, it's immune to any in-band tones.

See this old Slashdot article [slashdot.org] with more links.