Feeds

DECT wireless eavesdropping made easy

Security bypass attack

The Essential Guide to IT Transformation

Conversations relayed through cordless household phones might be far easier to snoop upon than previously suspected.

A new attack against phones based on DECT (Digital Enhanced Cordless Telecommunication) technology - demonstrated during the Chaos Communication Congress in Berlin earlier this week - might be carried out cheaply using off-the-shelf kit, together with a little know-how. A modified $30 VoIP laptop card running on a Linux portable were used to demonstrate the attack, which relies on using specially outfitted equipment to impersonate legitimate wireless base stations.

Encryption does feature as part of the DECT standard, but even when it's enabled, it might easily be bypassed in order to allow rogue devices to pose as the real thing, heise Security reports.

The algorithm used by DECT is hardwired into devices and not publicly disclosed. However, the boffins found that DECT-based communications between a transmitting station and the hand-held device often featured no form of encryption or authentication. And even when cryptographic defences are put into play they might be defeated by diverting data to an Asterisk (Linux-based software PBX), where crypto isn't supported so that conversations default to plain text, cryptographic researchers discovered.

Having previously carried out an attack using an expensive DECT sniffer the security researchers - Erik Tews from the Technical University of Darmstadt, Ralf-Philipp Weinmann, and Matthias Wenzel - modified a ComOnAir PCMCIA card with a few additional circuit and software modifications so that once the kit was plugged into a laptop it was able to function as a sniffer. The equipment was easily small enough to be operated from a car parked outside a targeted location.

The boffins were able to extract an audio stream which could be played back or recorded even with this cut-price kit.

This approaches relies on circumventing the security built into DECT without actually defeating it head-on. The security boffins made some headway in breaking the DECT Standard Authentication Algorithm (DSAA) without successfully cracking it. Details on this work can be found on the dedacted.org project site here.

The DECT standard is used by electronic payment terminal and door opening technology as well as household telephones, so the implications of the attack might be far-reaching. The next version of the Kismet WLAN sniffer will support DECT. Wireless LANs and DECT devices operate over separate frequencies, so additional hardware will still be needed to sniff on conversations, heise Security adds. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.