German Researcher Cracks GSM Codes – Offensive Security Research Illegal?

This is big news, and falls in line with mobile security research to be executed during the first part of 2010. A German researcher has made eavesdropping on GSM phone conversations post-facto (not real time) as easy as a beefy computer and $3,000 of radio equipment. The key to all of this, however, is the code book that this German researcher has access to. Karsten Nohl, the German scientist, made his presentation available here. The beefy computer is to crack the GSM codes and create the lookup table. The radio equipment is for tracking the spread spectrum signal.
The most interesting thing about this article is the infantile response from the GSM Association – that this research is illegal in the UK  and most other countries. Really? An outdated, twenty-year old encryption scheme that supposedly protects billions of phone conversations, gets hacked in about three months (Karsten Nohr announced that he and the team would commence the research in September 2009), and this is illegal? Not. This kind of research is what keeps vigilance in place, makes manufacturers and standards organizations be more responsive, and helps to secure against blackhat exploitation. Of course, there is a social responsibility when delivering such research results, but in most cases here, GSMA, phone manufacturers, and mobile service providers are very aware of the issues related to GSM security. Wonder what Bruce Schneier has to say about this revelation?
Fortunately for most Japan subscribers, the whole country has been converted to 3G, so there is less of a concern here than most of the United States, major parts of Europe, and China.

Leave a Reply