full-disclosure - Insecurity in Finnish parlament (computers)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed Feb 22 02:52:37 2006
From: markus.jansson at gmail.com (Markus Jansson)
Subject: Insecurity in Finnish parlament (computers)

Cruzan wrote:
 >I know that there is a documented case that Russian KGB
 >authorities switched GSM crypto off from base stations
 >in St. Petersburg area during 2003 when there were lots
 >of foreigners visiting at St. Petersburg's 300 years
 >celebreations.

I guess you refer to FAPSI/GRU authorities? ;)

 >But I have not seen any document about the incident that
 >Markus refers below. Can you show us some evidence about
 >that or is that just another urban security legend?

Finnish, sorry
http://mikropc.net/uutiset/index.jsp?categoryId=atk&day=20060215#w200602150926118974
"Ministeri? varoitti henkil?st???n v?ltt?m??n arkaluontoisista asioista 
keskustelemista matkapuhelimessa viime perjantaina. 
MuroBBS-verkkopalvelussa sek? keskusteluryhmiss? esiintyneiden tietojen 
mukaan Soneran gsm-salaus on kyseisen? ajankohtana ollut pois p??lt?. 
Nokia network monitor -ty?kalulla verkkoa tarkkailleet ovat raportoineet 
verkon Ciphering-arvon olleen tilassa 'OFF' esimerkiksi Elisan verkon 
n?ytt?ess? normaalia A51-salaustietoa."

Also, it was discussed in the newsgroups I recall...

 >What do you mean by "message center" ? Do you mean MSC
 >(mobile service switching centre)? Encryption/decryption
 >in GSM is done in between MS (mobile station) and BS
 >(base station). Keys are stored in SIM and AuC
 >(authentication center).

Maybe some with more expertise in english and technical terms could help 
me out here... :) Anyway, the point is that GSM encryption is NOT done 
literally between BS and user. Its done in "message center" and user. 
Sometimes MC is in same location as BS, but sometimes not (for example, 
in countryside where there are fewer BS and its impossible to physically 
secure them so tightly, so the encryption/decryption is done in more 
secure enviroment in message center, behind some datalinks).

 >Anyway, can you point some vendors that provide hardware
 >that supports A5/3 ?

Its been out there for almost 4 years, there is hardware support for it. 
Also, in Finland 3G networks are getting up everywhere and they ofcourse 
support A5/3. ;) For example
http://www.ttpcom.com/en/products/silicon/cbemacro.htm

-- 
???My computer security & privacy related homepage
http://www.markusjansson.net
Use HushTools or GnuPG/PGP to encrypt any email
before sending it to me to protect our privacy.