http://www.informationweek.com/story/showArticle.jhtml?articleID=206800800&cid
"Until now, however, it's been prohibitively expensive for people to get their hands on this technology. If it works, the technology Hulton and Steve are developing should be able to crack GSM encryption in less than 30 minutes with about $1,000 worth of equipment, or in about 30 seconds with $100,000 worth of equipment....." http://www.eweek.com/c/a/Security/LowCost-Attack-on-GSM-Encrytion-Demoed-at-Black-Hat/ "According to Hulton and Miller, an attacker with access to six 350GB hard drives (2TB) and one FPGA can easily recover the key of a GSM conversation (voice or sms/text) in less than 30 minutes. "'The speed is proportional to the hard drive access time and the number of FPGAs. For the cheap attack to work twice as fast, it would require twice the number of hard drives and twice the number of FPGAs,' he said." http://www.ethicalhacker.net [begin quote] Wireless Hacking & Cracking on GSM Networks Steve Davd Hulton Encryption used in GSM networks: A 5/1 Strong A 5/2 Weak In this talk to was discussed that the encryption on GSM is at best flawed. The strongest encryption used in GSM (A 5/1) was broken in 1998 and not been updated since. The encryption is based on 2 known keys (one on the sim and the other in the provider's database). The speakers showed how the cracking of GSM worked and also explained how to sniff the traffic plus other flaws in how the keys on the sim card are stored in plain-text. Another thing that was mentioned was the fact you could buy a GSM reader for around $1USD (plus $10 shipping china). The tactics to crack the A 5/1 is based on word list, rainbow tables, & brute force. A 5/1 is similar to a LM hash with it's way of a one way hash but it is 64 bits. He talked a lot on the use of rainbow tables and how to generate tables. Some of the info he discussed on rainbow tables was not 100% accurate but the basics where correct so I did not feel inclined to challenge him in a packed room with about 20 extra people standing in the back. They did a demo on how to generate a rainbowtable and explained how the indexes are made. He explained that table generation on a FPGA's is around 600 times fasted than on a standard PC. They also claimed to be releasing the tables publicly to crack GSM (tables will crack it with in 30 minutes) there faster tables they are making but they (crack 30 seconds) will be sold for commercial customers. Once you crack the key with the table it will allow you to listen to 16 calls or SMS's before you will have to crack the next generated key since the session is key is normally used about 16 times. Writing in this is hard because there is a lot of factor discussed on how to extract the correct hash to decrypt the data. They showed a live demo of a GSM stream being cracked with there customer rainbowtables. End notes… GSM is not secure and needs to be! The GSM network is very large and needs to be secured ASAP. [end quote] -- Stan Slonkosky --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "SOCALWUG" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/SOCALWUG SOCALWUG website: http://www.socalwug.org -~----------~----~----~----~------~----~------~--~---
