GSM encryption code cracked wide open, leaked to the Internet

This is the headline to Boy Genius Report’s (BGR’s) article regarding a group of 5 hackers that claim to have cracked a 64 bit GSM encryption scheme. While their headline implied doom and gloom for security engineers around the world, the content of the article is more reasoned and accurate. According to BGR, “it is important to point out that the GSM algorithm that was cracked was the older and less secure 64-bit A5/1 algorithm, not the newer 128-bit A5/3 algorithm.” Other news sources also report that the cracked codes still require thousands of dollars of computer and radio equipment to access the wireless conversations they want to compromise. What is left out of the article is actually more important than what is said. Let’s cover what BGR did not.

The 64-bit A5/1 algorithm is only used to scramble voice conversations on older GSM equipment. This means that:

Good News
1) Your data transmissions are not impacted by this development.
2) Calls made with a 3G capable phone over a 3G connection are not impacted.
3) According to some sources, T-Mobile has converted its entire network to the newer encryption algorithm.
4) The same sources claim that AT&T has converted part, but not all, of its network to the newer encryption algorithm.
5) There are 3 pillars to information security. The pillar that this development impacts is Access, or the ability to listen to a voice conversation. It doesn’t impact Integrity or Identification. This means that no one can make phone calls or data transmissions posing as you. This also means that no one can alter your voice or data transmission.

Bad News
1) Because newer network equipment is designed to work with older handsets, even the latest in network equipment will accept the older algorithm. This means that any GSM user with an older handset (manufactured before 2007) may still be susceptible to eavesdropping even if the carrier (T-Mobile, AT&T, etc.) has upgraded the encryption algorithm in that area of their network.

In a nutshell, only very sophisticated and well funded criminal organizations will have the means to eavesdrop on your calls. Even if they try, they need to be very close to you to intercept your radio signal. They may need to be within feet of you in some buildings to within miles in some rural areas. They also need to catch you while your call is being handled by an older AT&T cellular site or they need to catch you while you are using an older model phone. Lastly, your conversation needs to be of such value that a very sophisticated and well funded criminal organization would want to go through all of the trouble we have outlined in order to listen in. If you regularly partake in these kinds of conversations, I would suggest you look into buying a TalkSecure Wireless phone from General Dynamics (http://www.gdc4s.com/content/detail.cfm?item=90bdc199-8775-4439-9b83-c021dc7e9e76) it runs your conversation through another 128-bit encryption algorithm on top of the one used by the carrier.

If you don’t partake in these kinds of conversations, I really wouldn’t worry about it.

Lies, Damn Lies, and Statistics

This blog is about statistics.

On page 23 of a recent Wireless Week there is a chart of PDA shipments by operating system. The market share numbers look something like this:
Windows CE - 45.7%
Research In Motions - 23.2%
Palm OS - 18.8%
Symbian - 7.6%
Linux - .8%
Others - 3.9%

On page 24 there is a chart of operating system market share. It presents the following figures:
Symbian - 76%
Linux - 14%
Palm OS - 4.6%
Windows CE - 4.5%

What the heck? Did the market change that drastically in the time it took me to turn the page?

Actually, the subject of this blog has to do with this discrepancy. If you read the notes under the first chart, it tells you that devices like the Treo and BlackBerry 7100 are not considered PDAs, but smartphones, and do not count for the purposes of this study. Who reads the notes to a chart? I do, for this reason. The second chart did not have any notes, but it should have. There is no mention of the BlackBerry OS in the second chart. The reason is because the BlackBerry is manufactured by only one vendor (RIM) and therefore is considered a "proprietary" OS. Even though the BlackBerry would have had equal market share with Windows and Palm, it was left out.

So, what are the real numbers? There is only one real number I can speak to; the percentage of people who believe these numbers = 100% too many. Know what these studies say, and know why they are wrong. People should never buy a solution based on percentages. Where they see the Palm OS languishing in a distant third place, the reality is that the Treo, the number 2 selling wireless phone (see another chart on page 23) isn't being counted in this figure. Where Symbian looks to be dominating the pack, understand that that study includes almost every phone manufactured by Nokia because Symbian is the operating system for many of their phones. Understand that these numbers will do nothing more than taint a buyer's view of reality. Buyers should make sure that their choices and decisions are based on hard facts. Don't let these statistics get in the way of buying the right PDA, er. I mean smartphone, um I mean wireless PDA, or was that a … too heck with it.

Don't let the statistics get in the way, period.