Schneier on Security

Clive Robinson • January 7, 2011 6:38 AM

@ Seiran,

“Cellular providers have long been able to perform OTA programming and can occasionally control aspects of the handset’s operation remotely, such as setting the WAP/SMS/VM gateways, unlocking screen-lock security codes and resetting the radio…”

Some manufactures can compleatly reflash the phone over the air due to being able to download a little helper applet to do it then overwriting the existing equivalent of a PC’s BIOS & OS. There are a whole host of other tricks that can be done through the SIM using either a test SIM or the SIM Toolkit that you can get hold of fairly easily.

“I never looked into whether these commands were properly secured – signed/encrypted, protected against replay, locked to a recipient and time, etc”

Not realy the code is “signed” but due to the number of “sub-certs” around issued to network operators it realy does not have much meaning (partly because the phone can be factory reset / reflashed in most cases from an external connector). Some manufactures will optionally sell you hardware with your own PubKey in to do your own Over The Air programing on hardware you own. This is partly for development work and partly for people selling the likes of “fleet managment”, “burglar alarm”, “MediAid” systems.

“It’s been reported in the news (http:// news.cnet.com/2100-1029_3-6140191.html) that microphones can be activated remotely, with the FBI even bragging about their surveillance capabilities, on occasion.”

Yes it’s true there are commands that can be sent down the “D chan” of Signaling System 7 that enables the Mirophone. You can thank the UK Gov under Harold Wilson for that (or more correctly the security services frightened at lossing the “flooding technique” that the “Spy Catcher” book Maggie Thatcher did so much to advertise ;).

Thus the functionality was built into the original “System X” protocols and then migrated into “ISDN” and has remained in there ever since and the GSM protocols sit on top of ISDN…

[And people wonder why I bang on about protocols being the bigest security threat there is…]

In theory it is also possible to make a ‘silent’ phone call to a number and have it auto answered via SS7 (though I’ve not actualy seen it done). So if I know your number I could through an SS7 gateway quietly call you up and listen in. Then there is “three party calling” which gives limited conferance abilities, all built into the GSM switch (which is one of the features supposadly used in the Greek Olympic Wire Tapping Scandal that Vodafone got caught up in).

Though why the FBI would want to boast about these capabilites I realy don’t know, strikes me they are likely to make themselves “outsiders” to the “intel community” if they carry on like that. But then that’s their choice.

You can tell if your phone has “gone on air” ie it’s being spyed upon directly with something as simple as a small Medium Wave receiver likewise a small audio amp. The Cellphone system being a pulsed RF system actually puts out the equivalent of an envelope modulated carrier. This envelope can be detected by a simple diode detector or any amplifier. If you phone someone up and move your phone near a cheap AM transistor radio you will hear a loud continuous buzzing noise (the envelop) that won’t be there when you are not talking (it will occasionaly buzz as the phone re-registers with the cell site occasionaly).

However with modern smart phones their are “audio memo” features, that is the phone behaves like a dictaphone and can store an outstanding amount of compressed audio without having to “go on air”. And yes I’ve seen a prototype “private eye” version that interfaces to SMS and the GPS interfaces, and Internet interface to do file uploads.

“As security is a major selling features of those handhelds, I had assumed the software had been designed a little more rigorously.”

Maybe, it does however not matter as to be a GSM phone it has to pass the base phone requirments and turning the mic on (if it is fitted and connected hint, hint 😉 remotly is one of those requirments GSM has inherited…

I’d go and have a carefull look at how Android interfaces with the phone and how the air interface, and likewise how the air interface interfaces with the SIM and base phone features, you might be in for an unpleasent surprise.

Put simply most “smart phones” have two parts that talk to each other by a mediated interface (demarc). The base GSM compliant phone which contains the SIM and the rest of the phones features that can only communicate across the air through the mediated interface.

This is (supposadly) to stop uncertified software mucking up the Telco Network. In old systems this mediated interface used to be known as the “demarc” which is short for Demarcation Point.

What is on the air interface side of the phone is fully controled by the network, what is on the other side of this mediated interface the user controls.

This was originally designed to protect the Telco’s engineers from being electrocuted etc by people inadvertantly connecting one phase of the mains to the phone line (which can happen with earth faults caused by dry weather etc).

It you want to see more have a look at section 2 of the EU RT&TTE directive (you’ll find it on europa.eu) and the related standards framework that goes with it.

Clive Robinson • January 7, 2011 1:14 PM

@ zorro,

“Yes I had actually read about this hoax but the stories about SMS messages causing the phone to explode seemed different”

They may well be so, however in the hoax I pointed to you get the “number in red” and “27” people died etc.

The points you had the same “numbers in red” and 30 people.

Which just sounded to coincidental.

What we both need is a good honest report on it that can realisticaly be verified.

One of the problems with the Internet is to get readers smaller news sites are getting more and more like “The National Enquirer”. That is the more bizarre / gross / outlandish / sexed up the stories the more hits they get thus advertising revenue.

As a journalist friend of mine told me over twenty years ago,

Mrs Smith “wins cake competition” is of local interest, Mrs Smith “Gives judges food poisoning” is of regional interest, where as Beautiful Miss Smith “Kill’s cake judges with witch’s love potion in cake” is of national if not international interest.

Clive robinson • January 11, 2011 2:06 AM

@ Michael Dwyer

“Most modern air interfaces are going CDMA, which doesn’t interfere in nearly the same way.”

The TDMA-v-CDMA debate will no doubt run and run as both have differing advantages.

However without a doubt TDMA is the most anoying as far as interferance is concerned for the very same reason it is easily detected.

The problem with CDMA from the detection aspect is as you identified the need for more obvious or specialised complex equipment.

With in the case of the multimeter needing to get access within the phone usualy underneath the battery which is not just awkward it is very obvious to even the untrained eye. Wires hanging out of a mobile phone these days is likley to scream “terrorist” to many cops and plenty of others, which will get you the sort of attention you don’t want. Also how do you explain away having a mutimeter permanently attached to your phone…

In both cases of anti-surveillance equipment for CDMA “it is obvious” if you are picked up for casual search. However having your iPod in or clipped adjacent to the same pocket as you GSM TDMA iPhone just makes you look like at worst like an “Apple nerd”.

It is an aspect of surveillance “field craft” many people who put people under surveillance forget.

If you as the target look and behave like “Jo Rube” then you will get the rookie surveillance operative tripping over their feet on your tail. If however you behave like a switched on surveillance aware operative then you will get the invisable ten man team on your tail.

As a potential target you do not in any way want to appear as being “surveillance savey”. Because this can easily mean the difference between life and death or worse in many places in the world.

Also if you are aware you are being watched because you got the rookie stumbler you can change you behaviour in a number of non obvious ways.

The whole point of surveillance is gatherin intel or more pragmaticaly “giving you rope to hang yourself” and hopefully others by.

But importantly surveillance done properly is skilled manpower hungry and thus expensive, it is not something most LEO’s do well and training to do it well takes practice. It is also inordinatly noisy in the setup phase thus as a potential target a few simple non obvious techniques setup in advance will give you due warning.

However there is still the issue of random chance, or “Murphy’s law”, if you have your phone connected up to a bit of obvious anti-surveillance kit you have to be able to explain it away within your assumed persona or “legend”.

That is if the kit you are using becomes known by random event like, it snags and comes out of your pocket accidently when taking the phone out, or you get stopped and searched for a reason unrelated to your activities, or somebody you have had to get close to goes through your pockets for some reason (like doing the washing / finding a pen), etc, etc you have a problem you don’t want to have.

And don’t forget in many places anti-surveillance equipment is illegal and can be confiscated on the spot or get you into a whole world of hurt.

When it comes to field craft simple and in charecter are what you are looking for, anything and I do mean anything that looks even slightly odd (even a trailing shoe lace) will draw peoples attention to you and that’s when your carefully woven cloak of charecter or legend starts to unravel.