Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Researchers crack satellite encryption

Researchers at a university in Bochum, Germany claim to have cracked encryption algorithms of the European Telecommunications Standards Institute (ETSI) that are used to secure certain civilian satellite phone communications.

More news: Hacking stunt: stealing smartphone crypto keys using plain old radio

The Ruhr University Bochum's (RUB) Horst Görtz Institute for IT-security today issued an announcement detailing how researchers there have broken encryption algorithms known as A5-GMR-1 and A5-GMR-2 that are used to secure civilian communications between mobile phones and satellites based on the GMR-1 and GMR-2 satphone standards. The researchers explained that in some regions of the world standard cell phone communication is still not available, so "in war zones, developing countries and on the high seas, satellite phones are used instead."

The group of RUB scientists there said they simply used generally-available phone equipment and found the crypto key and managed to break it fairly easily by analyzing the software running on the satphones, in this case the Thuraya SO-2510 and inmarsat IsatPhone PRO.

"We have performed mathematical analysis and discovered serious weaknesses, which is documented here," the researchers note in their announcement. The RUB researchers include Benedikt Driessen, Ralf Hund, Carsten Willems, Christof Paar, and Thorsten Holz.

According to the university's announcement about their research, they used open-source software, a special antenna and a PC as part of the research to capture and demodulate speech data, and then processed the captured data through an implementation of an attack they'd conceived to break the crypto.

They did point out that in terms of real-world attacks, there were limits to their experiments. Although they say they can decrypt communications secured according to the GMR-1 standard, there were still some barriers that prevented a full disclosure of a voice conversation. Based on an experiment with the Thuraya network, which makes use of GMR-1, the researcher say they weren't able to reproduce the voice conversation in their own downlink because the speech-codec for GMR-1 is "currently unknown, we were not able to actually reproduce the conversation that took place."

The researchers said they had informed authorities well in advance of their announcement today. "Our results show that the use of satellite phones harbors dangers and the current encryption algorithms are not sufficient," said Ralf Hund, chair of system security at RUB. The researchers indicated, "There is, as yet, no alternative to the current standards."

Ellen Messmer is senior editor at Network World, an IDG publication and website, where she covers news and technology trends related to information security.

Read more about wide area network in Network World's Wide Area Network section.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: IDG, LAN, Thuraya
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: crypto; satellite;, encryption, ETSI, Ruhr University, satellite, security, Telecommunication
Latest Blog Posts
Whitepapers
  • Spear Phishing Attacks - Why they are successful and how to stop them
    There's been a rapid shift from broad, scattershot attacks to advanced target attacks that have had serious consequences for victim organisations. The increased use of spear phishing is directly related to the fact that it works, as traditional security defences simply do not stop these types of attacks. This paper provides a detailed look at how spear phishing is used within advanced attacks and the key capabilities organisations need in order to effectively combat these emerging and evolving threats.
    Learn more »
  • Virtual Certainty - Best Practices for Gaining Monitoring Clarity in VMware Environments
    The benefits of virtualisation are unassailable: increased agility, scale, and cost savings to name but a few. However, so too are the monitoring challenges posed by these environments—including complexity, lack of visibility and control, and inefficiency. This white paper reveals the best monitoring practices to employ in virtualized environments—best practices that are essential in enabling organizations to overcome their monitoring challenges so they can get the most business value from their virtualisation investments.
    Learn more »
  • Top 5 Myths of Safe Web Browsing
    There are a lot of misconceptions out there about safe web browsing. You might think you're being safe. But without the facts it’s next to impossible to stay protected against today’s changing threats. In this paper we describe the top five myths of safe web browsing, what the facts really are, and what you can do to stay secure.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.