GSM encryption code cracked wide open, leaked to the Internet

This is the headline to Boy Genius Report’s (BGR’s) article regarding a group of 5 hackers that claim to have cracked a 64 bit GSM encryption scheme. While their headline implied doom and gloom for security engineers around the world, the content of the article is more reasoned and accurate. According to BGR, “it is important to point out that the GSM algorithm that was cracked was the older and less secure 64-bit A5/1 algorithm, not the newer 128-bit A5/3 algorithm.” Other news sources also report that the cracked codes still require thousands of dollars of computer and radio equipment to access the wireless conversations they want to compromise. What is left out of the article is actually more important than what is said. Let’s cover what BGR did not.

The 64-bit A5/1 algorithm is only used to scramble voice conversations on older GSM equipment. This means that:

Good News
1) Your data transmissions are not impacted by this development.
2) Calls made with a 3G capable phone over a 3G connection are not impacted.
3) According to some sources, T-Mobile has converted its entire network to the newer encryption algorithm.
4) The same sources claim that AT&T has converted part, but not all, of its network to the newer encryption algorithm.
5) There are 3 pillars to information security. The pillar that this development impacts is Access, or the ability to listen to a voice conversation. It doesn’t impact Integrity or Identification. This means that no one can make phone calls or data transmissions posing as you. This also means that no one can alter your voice or data transmission.

Bad News
1) Because newer network equipment is designed to work with older handsets, even the latest in network equipment will accept the older algorithm. This means that any GSM user with an older handset (manufactured before 2007) may still be susceptible to eavesdropping even if the carrier (T-Mobile, AT&T, etc.) has upgraded the encryption algorithm in that area of their network.

In a nutshell, only very sophisticated and well funded criminal organizations will have the means to eavesdrop on your calls. Even if they try, they need to be very close to you to intercept your radio signal. They may need to be within feet of you in some buildings to within miles in some rural areas. They also need to catch you while your call is being handled by an older AT&T cellular site or they need to catch you while you are using an older model phone. Lastly, your conversation needs to be of such value that a very sophisticated and well funded criminal organization would want to go through all of the trouble we have outlined in order to listen in. If you regularly partake in these kinds of conversations, I would suggest you look into buying a TalkSecure Wireless phone from General Dynamics (http://www.gdc4s.com/content/detail.cfm?item=90bdc199-8775-4439-9b83-c021dc7e9e76) it runs your conversation through another 128-bit encryption algorithm on top of the one used by the carrier.

If you don’t partake in these kinds of conversations, I really wouldn’t worry about it.