Researcher finds major encryption flaw in older mobile SIM cards

Hundreds of millions of mobile handsets using older SIM cards are vulnerable to a flaw that allows attackers to gain complete control over affected handsets, German security expert Karsten Nohl has reported.

What Nohl has spent two years researching could turn out to be the most significant flaw in SIMs in many years when he reveals its full details at a presentation scheduled for the Black Hat security conference at the end of this month.

Nohl's briefings to the media and short website description have so far been light on detail, but the teasers he has been willing to put out sound alarming enough.

According to the Security Research Labs chief scientist, a quarter of 1,000 SIMs tested by his team had proved vulnerable to a weakness in the older DES (Data Encryption Standard) encryption used to secure them.

This made it possible to take control of a handset using a binary SMS text message to upload malware. This piggybacked on the carrier over-the-air (OTA) process through which SIMs are transparently updated via the JavaCard programming interface.

Attackers could use the method to eavesdrop on calls, sent premium text messages, and even in some circumstances, conduct payment fraud.

Only a proportion of the world's handsets used DES in its vulnerable form but this still amounted to 750 million, overwhelmingly older handsets, he said. Not all SIMs using DES seemed to have the flaw, but enough batches to cause major concern.

The size of the issue could define its seriousness with carriers unsure about Nohl's estimates. Most SIMs from recent years would use a different standard, Triple DES (3DES), and be immune to the attack.

The research had been sent to the GSM Association so it could be passed on to carriers, Nohl told media outlets.

"Cards need to use state-of-art cryptography with sufficiently long keys, should not disclose signed plaintexts to attackers, and must implement secure Java virtual machines," he wrote in a blog. "While some cards already come close to this objective, the years needed to replace vulnerable legacy cards warrant supplementary defenses."

Nohl has form when it comes to sniffing out mobile handset issues. Between 2009 and 2011 he publicised a number of security flaws in the GSM standard, most famously in its A5/1 encryption cipher, which could allow call interception between the handset and the network base station.

SIM cards vulnerable to hacking, says researcher

Millions of mobile phones may be vulnerable to spying due to the use of outdated, 1970s-era cryptography, according to new research due to be presented at the Black Hat security conference.

Karsten Nohl, an expert cryptographer with Security Research Labs, has found a way to trick mobile phones into granting access to the device's location, SMS functions and allow changes to a person's voicemail number.

Nohl's research looked at a mobile phones' SIM (Subscriber Identification Module), the small card inserted into a device that ties it to a phone number and authenticates software updates and commands sent over-the-air from an operator.

More than 7 billion SIM cards are in use worldwide. To ensure privacy and security, SIM cards use encryption when communicating with an operator, but the encryption standards use vary widely.

Nohl's research found that many SIMs use a weak encryption standard dating from the 1970s called DES (Data Encryption Standard), according to a preview posted on his company's blog.

DES has long been considered a weak form of encryption, and many mobile operators have upgraded now to more secure forms. It is relatively easy to discover the private key used to sign content encrypted with DES.

In its experiment, Security Research Labs sent a binary code over SMS to a device using a SIM with DES. Since the binary code wasn't properly cryptographically signed, it would not run on the device.

But while rejecting the code, the phone's SIM makes a crucial mistake: it sends back over SMS an error code that carries its own encrypted 56-bit private key, according to the company. Because DES is considered a very weak form of encryption, it's possible to decrypt the private key using known cracking techniques.

Security Research Labs did it in about two minutes on a regular computer with the help of a rainbow table, a mathematical chart that helps convert an encrypted private key or password hash into its original form faster.

With the private DES key in hand, it is then possible to "sign" malicious software updates with the key, and send those updates to the device. The device believes the software comes from a legitimate source and then grants access to sensitive data.

The company outlined an attack scenario against SIM cards that run some form of Java virtual machine, a software framework for Java applications.

Using the SIM's private key, an attacker could force the SIM to download Java applets, which are essentially very small programs that perform some function. Those applets would be "allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions."

"These capabilities alone provide plenty of potential for abuse," the company wrote.

Possible remedies to the problem including ensuring SIM cards use state-of-the-art cryptography and also using Java virtual machines that restrict applets' access to certain information.

Nohl's presentation, "Rooting SIM cards," will take place at the Black Hat security conference in Las Vegas on July 31.

Porn, wine and kazoos on IRS worker charge cards

The IRS is in the spotlight again, this time for employees using IRS charge cards improperly.

Like a lot of big companies, the Internal Revenue Service allows some of its 90,000 employees to use company charge cards to buy work-related items, such as office supplies.

However, employees made a host of "improper" purchases -- ranging from a dinner averaging $140 per person to Thomas the Tank Engine rubber wristbands -- according to the Treasury Inspector General for tax administration. The report was released as part of a regular audit of IRS budget expenses.

The report comes at a particularly bad time for the IRS, whose employees have recently been in the spotlight for singling out political groups, including Tea Party conservatives, for extra tax scrutiny over the years.

Related: IRS targeting included liberal groups

The inspector general said the IRS has been negligent when it comes to catching employees who circumvent $3,000 caps on transactions, by splitting purchases into several transactions. The agency also doesn't have a good record at turning off credit cards as soon as employees depart or retire.

"The IRS purchase card program lacks consistent oversight to identify and address inappropriate use," the report found.

The IRS spent $50,000 on a week's worth of meals, parties and meetings for a five-day International Executive Conference, the report said. During that week, IRS paid for a dinner, which averaged $140 a person.

 

The IRS also hosted a lunch that averaged $100 a person and included 28 bottles of wine for 41 guests. The IRS defended the purchases by saying that alcohol purchases are allowed by law when entertaining foreign officials, as happened at the conference. But the watchdog said the expenses were too high.

The report also said that employees had spent some $4,000 on buying kazoos, Thomas the Tank Engine rubber wristbands and Nerf footballs.

IRS disagreed with the findings, saying that federal law allowed those purchases, since they were meant for training, decoration, fundraising or team-building exercises.

Related: IRS to pay $70 million in bonuses

The watchdog also found two instances where IRS charge cards had been used to buy online pornography. In both cases, the cardholders reported their cards were stolen or compromised. But the report said the employees in question had also reported other charge cards stolen or compromised, leading auditors to question whether employees lied about losing cards with porn charges.

IRS chief Danny Werfel promised to get to the bottom of the findings.

"Clearly, any inappropriate card use impacts our bottom line and is cause for concern," Werfel said in a statement. "Wasteful spending cannot be tolerated, and any employees found to be abusing the system will be held accountable."

It wasn't all bad news. The watchdog said that despite these findings, most IRS employees "appear to use their purchase cards properly."

Twitter: @sajilpl