Re: Insecurity in Finnish parlament (computers)

[Markus Jansson <markus.jansson () gmail com>]

Cruzan wrote:
>I know that there is a documented case that Russian KGB
>authorities switched GSM crypto off from base stations
>in St. Petersburg area during 2003 when there were lots
>of foreigners visiting at St. Petersburg's 300 years
>celebreations.

I guess you refer to FAPSI/GRU authorities? ;)


>But I have not seen any document about the incident that
>Markus refers below. Can you show us some evidence about
>that or is that just another urban security legend?

Finnish, sorry
http://mikropc.net/uutiset/index.jsp?categoryId=atk&day=20060215#w200602150926118974
"Ministeriö varoitti henkilöstöään välttämään arkaluontoisista asioista 
keskustelemista matkapuhelimessa viime perjantaina. 
MuroBBS-verkkopalvelussa sekä keskusteluryhmissä esiintyneiden tietojen 
mukaan Soneran gsm-salaus on kyseisenä ajankohtana ollut pois päältä. 
Nokia network monitor -työkalulla verkkoa tarkkailleet ovat raportoineet 
verkon Ciphering-arvon olleen tilassa 'OFF' esimerkiksi Elisan verkon 
näyttäessä normaalia A51-salaustietoa."

Also, it was discussed in the newsgroups I recall...


>What do you mean by "message center" ? Do you mean MSC
>(mobile service switching centre)? Encryption/decryption
>in GSM is done in between MS (mobile station) and BS
>(base station). Keys are stored in SIM and AuC
>(authentication center).

Maybe some with more expertise in english and technical terms could help 
me out here... :) Anyway, the point is that GSM encryption is NOT done 
literally between BS and user. Its done in "message center" and user. 
Sometimes MC is in same location as BS, but sometimes not (for example, 
in countryside where there are fewer BS and its impossible to physically 
secure them so tightly, so the encryption/decryption is done in more 
secure enviroment in message center, behind some datalinks).


>Anyway, can you point some vendors that provide hardware
>that supports A5/3 ?

Its been out there for almost 4 years, there is hardware support for it. 
Also, in Finland 3G networks are getting up everywhere and they ofcourse 
support A5/3. ;) For example
http://www.ttpcom.com/en/products/silicon/cbemacro.htm


--
My computer security & privacy related homepage
http://www.markusjansson.net
Use HushTools or GnuPG/PGP to encrypt any email
before sending it to me to protect our privacy.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/