Vulnerability Development: Re: wireless woes in the triangle and beyond!

[Paul Cardon <paul () moquijo com>]

Mark Rowe wrote:
> From memory it was an APACS systems that used a wireless X.25 network
> (Paknet). From what I could see the application sent all the card data
> in the clear to the radio PAD (modem). Unfortunately this was deemed out
> of scope of the review and it was just raised as an area for further
> investigation. I never had chance to investigate this further :(
Does anybody know which packet radio protocol the Paknet PADs use?  I'm 
wondering if it is AX.25 which is the Amateur Packet Radio Link Access 
Protocol.  Linux has native AX.25 support so with the right receiver it 
is easily captured and I'm not aware of any built-in encryption 
capability.  Just ran across this myself with an RS-232 tranceiver that 
uses AX.25 for wireless transmission.
A fascinating link related to APACS and Paknet can be found at:

http://www.x25us.net/x25/X25/x25_vuln.txt

-paul