- Unencrypted Connection by Les Goldsmith
His
mobile security team also found that the version of the Android OS that
comes standard on the Samsung Galaxy SIII leaks data to parts unknown
80-90 times every hour. That doesn't necessarily mean that the phone
has been hacked, Goldmsith says, but the user can't know whether the
data is beaming out from a particular app, the OS, or an illicit piece
of spyware. His clients want real security and control over their
device, and have the money to pay for it.
To show what
the CryptoPhone can do that less expensive competitors cannot, he points
me to a map that he and his customers have created, indicating 17
different phony cell towers known as “interceptors,” detected by the
CryptoPhone 500 around the United States during the month of July alone.
(The map below is from August.) Interceptors look to a typical phone
like an ordinary tower. Once the phone connects with the interceptor, a
variety of “over-the-air” attacks become possible, from eavesdropping
on calls and texts to pushing spyware to the device.
August GSM Interceptor Map
ESD
“Interceptor
use in the U.S. is much higher than people had anticipated,” Goldsmith
says. “One of our customers took a road trip from Florida to North
Carolina and he found 8 different interceptors on that trip. We even
found one at South Point Casino in Las Vegas.”
Who is running these interceptors and what are they doing with the calls?
Who
is running these interceptors and what are they doing with the calls?
Goldsmith says we can’t be sure, but he has his suspicions.
“What
we find suspicious is that a lot of these interceptors are right on top
of U.S. military bases. So we begin to wonder – are some of them U.S.
government interceptors? Or are some of them Chinese interceptors?”
says Goldsmith. “Whose interceptor is it? Who are they, that's
listening to calls around military bases? Is it just the U.S. military,
or are they foreign governments doing it? The point is: we don't
really know whose they are.”
Ciphering Disabled
Les Goldsmith
Interceptors
vary widely in expense and sophistication – but in a nutshell, they are
radio-equipped computers with software that can use arcane cellular
network protocols and defeat the onboard encryption. Whether your phone
uses Android or iOS, it also has a second operating system that runs on
a part of the phone called a baseband processor. The baseband
processor functions as a communications middleman between the phone’s
main O.S. and the cell towers. And because chip manufacturers jealously
guard details about the baseband O.S., it has been too challenging a
target for garden-variety hackers.
“The baseband
processor is one of the more difficult things to get into or even
communicate with,” says Mathew Rowley, a senior security consultant at
Matasano Security. “[That’s] because my computer doesn't speak 4G or
GSM, and also all those protocols are encrypted. You have to buy
special hardware to get in the air and pull down the waves and try to
figure out what they mean. It's just pretty unrealistic for the general
community.”
But for governments or other entities able
to afford a price tag of “less than $100,000,” says Goldsmith,
high-quality interceptors are quite realistic. Some interceptors are
limited, only able to passively listen to either outgoing or incoming
calls. But full-featured devices like the VME Dominator,
available only to government agencies, can not only capture calls and
texts, but even actively control the phone, sending out spoof texts, for
example. Edward Snowden revealed that the N.S.A. is capable of an over-the-air attack
that tells the phone to fake a shut-down while leaving the microphone
running, turning the seemingly deactivated phone into a bug. And various ethical hackers have demonstrated DIY interceptor projects,
using a software programmable radio and the open-source base station
software package OpenBTS – this creates a basic interceptor for less
than $3,000. On August 11, the F.C.C. announced an investigation into the use of interceptors against Americans by foreign intelligence services and criminal gangs.
An “Over-the-Air” Attack Feels Like Nothing
Whenever
he wants to test out his company’s ultra-secure smart phone against an
interceptor, Goldsmith drives past a certain government facility in the
Nevada desert. (To avoid the attention of the gun-toting
counter-intelligence agents in black SUVs who patrol the surrounding
roads, he won't identify the facility to Popular Science). He knows
that someone at the facility is running an interceptor, which gives him a
good way to test out the exotic “baseband firewall” on his phone.
Though the baseband OS is a “black box” on other phones, inaccessible
to manufacturers and app developers, patent-pending software allows the
GSMK CryptoPhone 500 to monitor the baseband processor for suspicious
activity.
So when Goldsmith and his team drove by the
government facility in July, he also took a standard Samsung Galaxy S4
and an iPhone to serve as a control group for his own device.
”As
we drove by, the iPhone showed no difference whatsoever. The Samsung
Galaxy S4, the call went from 4G to 3G and back to 4G. The CryptoPhone
lit up like a Christmas tree.”
Though the standard Apple
and Android phones showed nothing wrong, the baseband firewall on the
Cryptophone set off alerts showing that the phone’s encryption had been
turned off, and that the cell tower had no name – a telltale sign of a
rogue base station. Standard towers, run by say, Verizon or T-Mobile,
will have a name, whereas interceptors often do not.
Some devices can not only capture calls and texts, but even actively control the phone and send spoof texts.
And
the interceptor also forced the CryptoPhone from 4G down to 2G, a much
older protocol that is easier to de-crypt in real-time. But the
standard smart phones didn’t even show they’d experienced the same
attack.
“If you've been intercepted, in some cases it
might show at the top that you've been forced from 4G down to 2G. But a
decent interceptor won't show that,” says Goldsmith. “It'll be set up
to show you [falsely] that you're still on 4G. You'll think that you're
on 4G, but you're actually being forced back to 2G.”
So Do I Need One?
Though Goldsmith won’t disclose sales figures or even a retail price for the GSMK CryptoPhone 500, he doesn’t dispute an MIT Technology Review article
from this past spring reporting that he produces about 400 phones per
week for $3,500 each. So should ordinary Americans skip some car
payments to be able to afford to follow suit?
It depends
on what level of security you expect, and who you might reasonably
expect to be trying to listen in, says Oliver Day, who runs Securing
Change, an organization that provides security services to non-profits.
“There's
this thing in our industry called “threat modeling,” says Day. “One of
the things you learn is that you have to have a realistic sense of your
adversary. Who is my enemy? What skills does he have? What are my
goals in terms of security?”
If you’re not
realistically of interest to the U.S. government and you never leave the
country, then the CryptoPhone is probably more protection than you
need. Goldsmith says he sells a lot of phones to executives who do
business in Asia. The aggressive, sophisticated hacking teams working
for the People’s Liberation Army have targeted American trade secrets, as well as political dissidents.
Day,
who has written a paper about undermining censorship software used by
the Chinese government, recommends people in hostile communications
environments watch what they say over the phone and buy disposable
“burner” phones that can be used briefly and then discarded.
“I'm not bringing anything into China that I'm not willing to throw away on my return trip,” says Day.
Goldsmith
warns that a “burner phone” strategy can be dangerous. If Day were to
call another person on the Chinese government’s watch list, his burner
phone’s number would be added to the watch list, and then the government
would watch to see who else he called. The CryptoPhone 500, in
addition to alerting the user whenever it’s under attack, can “hide in
plain sight” when making phone calls. Though it does not use standard
voice-over-IP or virtual private network security tools, the CryptoPhone
can make calls using just a WI-FI connection -- it does not need an
identifiable SIM card. When calling over the Internet, the phone
appears to eavesdroppers as if it is just browsing the Internet.
No comments:
Post a Comment