Smart Card & Identity News A New Flavour for eCash

Indian GSM Phone Networks Fail to Meet
Basic Encryption Standards
Eli Hizkiyev
The recent revelations from an Indian company that it can ‘tumble’ and clone the
credentials of mobile phone SIM cards over the airwaves will make anyone in security
give a sigh. But when they hear that it is apparently because certain Indian GSM
carriers are using the A5/0 minimal encryption system on their cellular networks, then
the only response is frustration. Once again, we have to face the fact that GSM voice
calls can no longer be considered secure.
What adds insult to injury is that it appears that the Indian cellular networks are switching off most of their
encryption to ease the load on their networks.
The problem is that, even if A5/1 encryption is switched on, it can be cracked and facilitate eavesdropping - as
researcher Karsten Nohl and his team started demonstrating some 18 months ago. If the cellular networks only
use the more basic A5/0 encryption, it also becomes possible to clone SIM card identities and make calls
charged to the legitimate user's account.
What makes the Indian network issue relevant and concerning, is that many of the UK GSM carriers are also
hitting digital gridlock on their networks in city areas at peak time, raising the question as to whether they too are
lowering the encryption technology used on their calls to cope with the demand?
It is interesting to note that none of the Indian cellular carriers were prepared to comment on the report, despite
the news appearing in The Hindu newspaper, which has a circulation of 1.5 million amongst the English
language speakers of India, as well as a global audience via its web site of many millions more.
The problem for the carriers - as one of the researchers commented on in the report - is that the cracked calls
appear to be coming from the subscriber's number, so it's difficult to see how they can stop these calls, apart
from looking for excessive usage and/or calls to international/premium rate destinations that may be flagged as
suspicious or unusual.
The takeout from this story - and from previous reports of the A5/1 encryption system on GSM calls being
cracked - is to switch to using 3G cellular services when making business and/or sensitive calls. However, since
the A5/3 encryption mechanism used on 3G calls is a derivative of the MISTY Feistel crypto methodology - and
some carriers are reportedly lowering the level of encryption - there is a danger that the diluted 3G encryption
system can be cracked in a few hours, as was reported at the start of 2010 (http://bit.ly/xAOpeA).
The real bottom line is that cellular calls - in common with all wireless transmissions - are inherently less secure
than wired telephony, for the simple reason that the mobile device can only automatically authenticate itself over
the airwaves.
Put simply, this means that all of the data transmitted can also be eavesdropped by hackers who - if they are able
to crack the underlying encryption system, all variants of which have clearly been found to be wanting - can
monitor the data stream and eavesdrop on the voice plus data transmissions.
This Indian newspaper report raises a number of security questions on several fronts, and this is before we even
start to discuss the number of people using their smartphone for Internet banking...
Smart Card & Identity News • March 2012
16