Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Insecurity in Finnish parlament (computers)
From: Markus Jansson <markus.jansson () gmail com>
Date: Tue, 21 Feb 2006 17:18:20 +0200

Cruzan wrote:
>I know that there is a documented case that Russian KGB
>authorities switched GSM crypto off from base stations
>in St. Petersburg area during 2003 when there were lots
>of foreigners visiting at St. Petersburg's 300 years

I guess you refer to FAPSI/GRU authorities? ;)

>But I have not seen any document about the incident that
>Markus refers below. Can you show us some evidence about
>that or is that just another urban security legend?

Finnish, sorry
"Ministeriö varoitti henkilöstöään välttämään arkaluontoisista asioista keskustelemista matkapuhelimessa viime perjantaina. MuroBBS-verkkopalvelussa sekä keskusteluryhmissä esiintyneiden tietojen mukaan Soneran gsm-salaus on kyseisenä ajankohtana ollut pois päältä. Nokia network monitor -työkalulla verkkoa tarkkailleet ovat raportoineet verkon Ciphering-arvon olleen tilassa 'OFF' esimerkiksi Elisan verkon näyttäessä normaalia A51-salaustietoa."

Also, it was discussed in the newsgroups I recall...

>What do you mean by "message center" ? Do you mean MSC
>(mobile service switching centre)? Encryption/decryption
>in GSM is done in between MS (mobile station) and BS
>(base station). Keys are stored in SIM and AuC
>(authentication center).

Maybe some with more expertise in english and technical terms could help me out here... :) Anyway, the point is that GSM encryption is NOT done literally between BS and user. Its done in "message center" and user. Sometimes MC is in same location as BS, but sometimes not (for example, in countryside where there are fewer BS and its impossible to physically secure them so tightly, so the encryption/decryption is done in more secure enviroment in message center, behind some datalinks).

>Anyway, can you point some vendors that provide hardware
>that supports A5/3 ?

Its been out there for almost 4 years, there is hardware support for it. Also, in Finland 3G networks are getting up everywhere and they ofcourse support A5/3. ;) For example

My computer security & privacy related homepage
Use HushTools or GnuPG/PGP to encrypt any email
before sending it to me to protect our privacy.
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]