Italian Phone Taps Spur Encryption Use 176
manekineko2 writes "This article in the NYTimes discusses how a recent rash of high-profile mobile phone taps in Italy is spurring a rush toward software-encrypted phone conversations. Private conversations have been tapped and subsequently leaked to the media and have resulted in disclosures of sensitive takeover discussions, revelations regarding game-fixing in soccer, and the arrest of a prince on charges of providing prostitutes and illegal slot machines. An Italian investigative reporter stated that no one would ever discuss sensitive information on the phone now. As a result, encryption software for mobile phones has moved from the government and military worlds into the mainstream. Are GSM phones in the US ripe for a similar explosion in the use of freely available wiretapping technology, and could this finally be the impetus to for widespread use of software-encrypted communications?"
Nice thing (Score:5, Interesting)
Re: (Score:2, Interesting)
Re: (Score:2, Interesting)
Re:Nice thing (Score:5, Informative)
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:3, Informative)
OpenMoko possibilities (Score:2)
There has also been talk of encrypted call support (would be nice if compatible with cryptophone, considering the published protocol) in OpenMoko, the open GNU/Linux-based phone OS, though no real work as of yet (hopefully only because the developer sales of the Neo1973 devices haven't properly started on schedule).
It is just a question of so
Re: (Score:2)
Of course the government could probably hack your phone any time they want, but on an open source phone they would probably have to use a great d
It does! (Score:4, Informative)
It can be broken, but considering the power of early GSM handsets this was quite an effective system. One of the major factors driving G2 (digital) phones was the easy of eavesdropping on the old analogue G1 network.
Cordless phones too (Score:1, Interesting)
Re: (Score:2)
Companies first (Score:3, Interesting)
Here at Chevron we encrypt our Blackberries, both on the unit and during transmission. If the Blackberry is lost, the data is safe because of the encryption.
I don't see it happening for the public unless the carrier provides the service and then wouldn't the government just request the carrier to give them access?
Re:Companies first (Score:4, Informative)
Making the carrier the sole means of key exchange would be the only way to give them access (they could perpetrate a man-in-the-middle attack). But if you are able to meet physically with your call partner, or exchange keys through an alternate secure medium, the intermediary would have no cheap means of intercepting.
Only one-time pads are unbreakable, and using one-time pads makes key exchange *much* less secure. But public key methods are enough to make it very hard to break a single transmission. Programs like ECHELON would be utterly stuffed.
And of course, if you have a mobile data plan with more than a few kBit/s of bandwidth, this is entirely possible now, as demonstrated by these Italian chappies.
Blooming heck though - $410 for their SMS encryption package and $2,200 for the voice version. I'm willing to bet that even with patent licensing, the per unit cost is very small. I could probably write Windows Mobile software to do encrypted SMS in a day or so, and I'm no encryption whiz.
Re: (Score:3, Informative)
http://kryptext.com/faq.html [kryptext.com]
This downloadable product (£6.99 per phone) can't be very secure, as the manual has no key exchange protocol in it. I suspect that it uses hashed data to derive keys (or has a fixed key), probably phone numbers. It's very cheap, and certainly sufficient to hide data from your spouse, but a determined assault on their algorithm will probably open it up like a book.
http://www.emosecure. [emosecure.com]
Re: (Score:2)
A real OTP is mathematically unbreakable, as it's impossible to tell which particular variant of "sense" data corresponds to the plaintext. The only way you can be sure is if you have a key that corresponds to a known (by you) key generation algorithm, in which case you are not dealing with
The best way I'm aware of to generate random data (Score:2)
Re: (Score:2)
Another source of truly random numbers is atmospheric noise. (e.g. thunderstorms) You could predict this easily by constructing a 1:1 scale model of the earth and atmosphere with each atom corresponding to the original, but this would only work in a deterministic univ
Re: (Score:2)
Re: (Score:2)
I don't see why not. Should have thought of that before we started breaking things.
Educated guess. I can also guess that you work with computers, like scifi, and are male. I'm probably wrong about at most 1 of those 4 things.
I thought it was funny to build an exact replica of the earth, atom for atom. Especially if the purpose of such
Re: (Score:2)
I've been going to this place that gives 2 pair of polycarbonate glasses, one sunglass-tinted and an eye exam for about $150. I now have lots of acceptable spares. My vision has stopped degrading violently from year to year, and I'm looking forward to needing bifocals in a few years. That'll be fantastic. Blind up close, too. It used to be that 3 year old glasses were nearly worthless, but now I can barely tell the difference.
Prescription sunglasses make me happy, p
Re: (Score:2)
Re: (Score:2)
My eyes are frequently bloodshot. I don't know why. I wore hard contacts as a kid and eventually blew out my corneas. Maybe it's the late hours, staring at a computer screen, my mild allergy to my girlfriend's cats, the heavy constant drinking, I simply don't know. In any case, hiding my eyes reduces people who stare or make comments.
Another benefit seems to be I am less approachable to bums seeking change, tourists
Re: (Score:2)
http://www.idquantique.com/products/quantis.htm [idquantique.com]
This is possibly the most impressively elegant solution for computer RNG that I've seen. High bitrate, and doesn't contain nasty radioisotopes.
Re: (Score:1)
Plus, if the carrier were providing the scrambling services, both endpoints would still be vulnerable from its physical location up to wherever the nearest base station is -- and that's typically where you'd really want to tap the conversation, especially if you knew the cellco was encrypting it from base station onwards
Re: (Score:2)
Key Exchange? (Score:1, Interesting)
Really, you need to ensure that your public keys don't get intercepted as if you sent them via SMS or otherwise. Considering the fact that you aren't trusting the network any longer, it means that you couldn't pass keys across it either.
So if you wanted a secure key exchange, you would probably have to meet someone or another trusted person and do a key exchange that way, IR would probably workk.
I guess email could work too.
Re:Key Exchange? (Score:5, Interesting)
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You don't seem to know how pgp works. If they replace your pk with their own, your secret key would not be able to decrypt the conversation.
Re: (Score:2)
You misunderstand. When the key transfer happens, they do as follows:
Then, when someone tries to send some encrypted data over the network:
PGP depends on the availability
Re: (Score:2)
Get snippy with me will you? (Score:2)
I was pointing out MITM needs to modify the data. It needs to perform key substitution. It is utterly unlike a standard phone tap. Just being able to evesdrop (sic) on the conversation is not enough. Your post was completely wrong.
There were other comments talking about an active MITM attack, gr
Re: (Score:2)
We're in progress of an active MITM attack. Fraudulent key exchange has already been made, and the 2 parties think they're talking to each other. The sender sends 00110011, which is encrypted with his private key. You decrypt with his public key, encrypt with your private key, and send 11100011 to the recipient. You have to admit that 00110011 is different from 11100011. You have changed the data. You have to admit that. Data doesn't care if it
Re: (Score:2)
Re:Key Exchange? (Score:5, Informative)
Your parent is talking about the issue of trust (Score:2)
A workable solution would be to accept public keys like you do with SSH. Once you have a connection you can verify the thumbprint (or babbleprint) with the other party using your voice, and move on to sensitive discussions if the keys check out. You'd only
Re:Your parent is talking about the issue of trust (Score:4, Insightful)
A CA is not in central control over encryption. They are only in control of authenticating keys. The only way they can subvert the encryption process is to issue matching (in details, but not in keys) certificates to you and the man in the middle. If they were to do this, it would be detected quickly, and their reputation as a trusted CA would suffer.
Re: (Score:2)
Why do you assume that it would be detected quickly?
If it was issued in secret, say via a NSL, and the people running the MITM were competent, it might take a very long time to discover.
Re: (Score:2)
Because switched keys are easy to detect, and enough people are paranoid about these things that there are plenty of eyes watching for it.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The AC that replied is correct: you need an authentication step as well, or you don't know whether you are talking to the person who you thought you were (the alternative is that you are talking to them via some man-in-the-middle).
The only way that I know of to stop these attacks is to have a *trusted* public key of everyone that you want to phone. The only way to get that trust is to verify somehow (perhaps by meeting up with them) that the key you have listed for them is in fact their key.
Actually,
Re: (Score:2)
Actually, for telephone conversations it would even be possible to speak a few digits of the key and see if the person on the other end agrees. You couldn't do this for a text protocol, because it would be trivial for the man-in-the-middle to subs
Re: (Score:2)
You do know that if you have their public key stored, a man can't place himself in the middle? It would require tapping at the endpoints, where the encryption/decryption is being done.
Re: (Score:2)
Re:Key Exchange? (Score:5, Informative)
Person A wants to talk to person B using encryption.
A sends B his public Key, B sends A her public key. They each then use the combination of the other's public key and their own private key to encode and decode messages to and from each other.
Let's say A goes to send B his key, but it's intercepted by C, and C sends B a modified key (man in the middle attack). Then B will not be able to initiate communication with A because the key won't match. This is how and why PKE works. If it was possible to capture and send a modified key and have the conversation still function then PKE wouldn't be very useful, would it?
Re: (Score:2)
With a man-in-the-middle attack, this PKE assumption is broken because the public key exchange typically happens in the same transaction, which is bad. This is why ssh will ask confirmati
Re: (Score:2)
The danger is that a "man in the middle" (in this case your person C) might intercept person A's key on its way to person B, and replace it with their own key. C can now decrypt person A's transmissions to person B, since person A will be encrypting messages using C's key rather than B's key. C simply decrypts the message, listens to it, and re-transmits it to person B using B's real (intercepted) key. The man in the middle can
Re: (Score:2, Informative)
Sending someone a public key that decrypts YOUR transmission is Authentication, not Encryption. Key transmission must be done in t
Re: (Score:2)
But if C can intercept and modify communications in both directions, C can send his own keys to both A and B, then decrypt and re-encrypt traffic going in both directions. A and B never see traffic from each other, only from C. And I should not that this situation is more common than you might realize; f
Parent is misinformation mod down (Score:2)
The usual method of verifying the public keys is with a certificate authority like Verisign, who each party contacts to verify the key is the correct one for the party they're communicating with. Even then you hav
Re: (Score:3, Interesting)
Re: (Score:2)
You send me your public key. There are thousands more, but this one is yours. I can encrypt something with your public key, and only our secret key will be able to decrypt that something I've sent you. If, when you send me your pk, someone replaces that key with their own, you will not be able to decrypt what I have encrypted for you with that replaced key. Thus, we well not be able to talk, and the man in the middle attack is worthless.
Re: (Score:2)
The attacker compromises both the initial key exchange and all subsequent communications. They swap each party's public keys during the initial exchange for their own, and then transparently decrypt (snoop), and re-encrypt the traffic during the communication.
It's certainly possible, I've seen demos of it with SSH. The only defense you have against it is key fingerprinting, where you are very religious about checking the key fingerprint that's reported at your
Re: (Score:1)
ahem, there is a reason they are called public keys.
Re: (Score:2)
Over ten years ago a colleage and I were asked to propose just such an encrypted phone, using what was then a new technique, public/private key pairs for the key exchange. The phones were to be "seeded" with an intial public-key repository's key.
--dave
Re: (Score:2)
Public Key not spoofable; here's how: (Score:3, Informative)
mod parent up (Score:2)
With respect to making talk of PKE easier to understand, I've never understood why, other than history, they use the term "public key". It seems a "public key" is more analagous to a physical lock than a physical key. When you apply a public key, you are, in essence
there's A REASON why they're called PUBLIC KEYS (Score:2)
Of course, securing your private key is your problem.
Italy & US (Score:3, Informative)
On the other hand, wireless phones in the US typically do use encryption because they operate in the same frequency range as other devices (cel phones have their own dedicated frequency range). When baby monitors started picking up the conversations down the street, people took notice.
Re:Italy & US (Score:5, Informative)
OpenMoko (or other communications platform with open software) + VoIP + AES encryption + Diffie-Hellman (or use RSA and public key cryptography) is the solution if you REALLY need to keep your stuff secret.
Even the NSA doesn't have enough computing power to decrypt THAT. And, the same solution could run on a PC or anything else with enough CPU power.
Re: (Score:3, Insightful)
Yes, of course. Until you realize, at the end of the conversation, that the NSA's already bugged the room you're talking in.
Re: (Score:3, Interesting)
Nextel and Sprint PCS have the servers too (Score:2)
When I worked at Nextel, the "Guys in Suits" had a server set up in our transport room (where the OC-92 and other fiber came in to the demarc). We had no real input, but one person (not me) was responsible for admin of it (in case it needed reboot, etc). It's now able to be public, but we had to keep it hush-hush that there was no way to tap Direct Connect for quite some time. It's able now, but it was more difficult with Direct Application Processors (DAP - used to process Direct connect traffic). Next
Re: (Score:3, Interesting)
Re:Italy & US (Score:4, Interesting)
The encryption is only between the handset and basestation. If people have the ability to make "legal" taps it wouldn't even help with a call between two phones connected to the same basestation.
You'd need end to end encryption which would also require you to establish a "data" call, which could well be charged differently from a "voice" call.
Re: (Score:2)
Wooohooo! (Score:2, Funny)
Re: (Score:2)
He's not just any prince. He's Vittorio Emanuele [wikipedia.org], prince of Naples (a title he holds illegally, actually, since nobility titles are no longer valid in Italy), a thoroughly idiotic fellow, a murderer (who got away with that and bragged about having "screwed the judges"), an anti-semite who said that the racial laws passed by his grandfather [wikipedia.org] "were not that terrible", an arms dealer who was friend with Shah Mohammed Reza Pahlavi [wikipedia.org], dictator of Persia.
Hookers and blackjack are peanuts in his line of business, bu
New laws? (Score:2)
Re: (Score:1)
Worried now? (Score:4, Interesting)
An Italian investigative reporter stated that no one would ever discuss sensitive information on the phone now.
Why on Earth would you ever discuss sensitive information on the phone before? There's always been phone tapping tech. It's only the laws for that technology's usage that protected anyone from it. You never say anything on the phone that you wouldn't say to a cop. If you don't know that rule, you're a pretty inept criminal.
Re: (Score:3, Insightful)
Not Gonna Happen in US (Score:5, Insightful)
1. The government would simply make it illegal (don't want to give the terrorists any new tools).
2. The government would require a backdoor be built in by manufacturers, defeating the purpose.
Re: (Score:2)
Re: (Score:2)
They may be using OSS software but they sure as hell aren't connecting an openly-developed phone to a GSM mobile network. If you can't trust your own hardware, I really don't see how you can trust software which runs on it.
Exactly. (Score:2)
Be nice...because they might name you a terrorist and then you magically lose your habeus corpus rights!
But, we're safe from terrorists!
Re: (Score:2)
Re: (Score:2)
Interestingly, this moves the target for unlawful intercepts from the user communication path to the CALEA intercept equipment itself, which is often very poorly protected.
Re: (Score:3, Interesting)
I work for a telecom provider (mostly hosting of SIP apps) and we are not required under CALEA to provide access to law enforcement. Rather, the telco carriers that _we_ use, like AT&T, Qwest, etc. are required to provide access. What that means is that we could offer customers a VPN connection to our network, give them a soft-phone and ensure that their SIP traffic remains encrypted. You'd probably have to do SIP to SIP since I don't know how you'd encrypt the PSTN leg of the call.
Cell phones wou
Re: (Score:2)
1. Government
"Oh sure you can have a private conversation.. except we need to listen.. just in case your.. you know.. dissenting or something."
I wonder if people started using e-mail encryption enmass if they would stop that too?
For a very long time (Score:4, Interesting)
In the days of AMPS and NAMPS it was a piece of cake. Friend of mine worked in IT for the local PD and was able to get a scanner that wasn't 800-900 blocked, and a little card and software for the computer that allowed us to follow calls as they went from cell to cell.
CDMA and GSM just throw a little wrinkle in.
GSM encryption is not all that trivial (Score:4, Informative)
have been found they are still not all that trivial to implement.
The main work on attacking GSM in a practicle scenario was done by
Elad Barkan with the help of Eli Biham and Nathan Keller.
to briefly explain the security you must notice there are diffrent variants for
GSM encryption the weak one being A5/2 anf A5/1 and A5/3 being considarbly stronger.
breaking A5/1 in a passive attack requires a significant amount of precomputation and storage
that though one could buy of the self, I find it unlikely any private citizen will set up
a cluster of two dozen computers to crack GSM for the fun of it, though obviously a large
evil corparation or a small company would easily have the resources.
an active attack could convince a cell phone to use A5/2 even if it prefers A5/1 or a diffrent variant,
this requires more specialized equipment and it easier to catch the attacker as he must be sending out
radio signals, these may also interfere with normal cellphone traffice.
This is just to put the threat into proportion,
your own govement can wiretap without breaking encryption,
A serious enemy can probably muster up the resources to wiretap by breaking GSM encryption
but your next door neighboor will probablby find it exremly difficult to listen in on encrypted GSM cell
phone traffic.
Me.
Re: (Score:3, Interesting)
Re: (Score:2)
A "cluster of two dozen supercomputers"? How much is that in graphics processors on video cards?
(How about on one-generation-back video cards that the stores are sel
Voice encryption made easy (Score:3, Funny)
It'sway easyway andway otallytay onfusescay anyway
eavesdroppersway.
Are the solutions open source (Score:3, Insightful)
If not, how do we know that it doesn't have a back-door?
And if it does indeed have a back-door, how can people ever be sure that the "wrong" people (definition of "wrong" depending on the user) will not intercept and decode the communications using said back-door?
In this world of powerfull Intelligence Agencies, any kind of communications security software/hardware which is not at the very least peer-reviewed is bound to have some sort of backdoor.
Re: (Score:2)
back doors in proprietary software? that's unpossible!
Get a CryptoPhone (Score:5, Informative)
It looks like a firm in Germany already offers a AES-256 bit encrypted mobile and POTS phone, as well as a softphone. Although their hard phones aren't cheap, the softphone is free to give to your contacts. http://www.cryptophone.de [cryptophone.de] They alse include source code for "full independent review" with their products.
Similarly, Phil Zimmermann, the creator of PGP has released his Zphone [zfoneproject.com] to make encrypted VoIP calls. Also, the Asterisk project offers an encrypted IAX channel [voip-info.org].
Freely Available Wiretapping Technology? (Score:4, Informative)
Unless I'm missing something, there certainly is not any freely available wiretapping technology for GSM phones and networks. There are a few vendors that sell very expensive GSM tapping and over the air capture devices and platforms, but they are extrememly expensive and only for sale to authorized buyers (law enforcement, military, and feds)
Re: (Score:2)
What about Skype? (Score:2, Insightful)
An another point, some of the posts here seem to be missing the point - the Italian wiretaps involved not just the state, but also illegal snooping done by powerful individuals, co
American encrypted phones? (Score:2)
Re: (Score:1, Offtopic)
Not for much longer with that attitude.
Re: (Score:2)
Re: (Score:2)
Sure, an antenna will get induced, but that will show up as noise in input or output. The GHz antenna is no-where nearly in tune to resonate and amplify a 300 Hz signal!