Don't trust satellite phones: A security analysis of two satphone standards

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2012, Pages 128-142

  Driessen, Benedikt ^a   Hund, Ralf ^a   Willems, Carsten ^a   Paar, Christof ^a   Holz, Thorsten ^a  

^a RUHR UNIVERSITY BOCHUM   (Germany)

Author keywords

Binary Analysis; Cryptanalysis; Mobile Security; Satellite Phone Systems

Indexed keywords

CELLULAR TELEPHONES; CRYPTOGRAPHY; DISASTERS; FIRMWARE; GLOBAL SYSTEM FOR MOBILE COMMUNICATIONS; NETWORK SECURITY; SATELLITE TELEPHONE; SATELLITES;

BINARY ANALYSIS; CELLULAR MOBILE; CRYPTANALYSE; GSM SYSTEM; SATELLITE PHONE SYSTEMS; SECURITY ANALYSIS; SECURITY ASPECTS; STREAM CIPHERS; UMTS SYSTEMS; WORK-RELATED;

MOBILE SECURITY;

EID: 84870578272     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2012.18     Document Type: Conference Paper

References (31)

1. Z. Wang, X. Jiang, W. Cui, X. Wang, and M. Grace, "ReFormat: Automatic Reverse Engineering of Encrypted Messages," in European Symposium on Research in Computer Security (ESORICS), 2009.
2. J. Caballero, P. Poosankam, C. Kreibich, and D. Song, "Dispatcher: Enabling Active Botnet Infiltration using Automatic Protocol Reverse-Engineering," in ACM Conference on Computer and Communications Security (CCS), 2009.
3. F. Gröbert, C. Willems, and T. Holz, "Automated Identification of Cryptographic Primitives in Binary Programs," in Symposium on Recent Advances in Intrusion Detection (RAID), 2011.
4. D. Wright, "Reaching out to remote and rural areas: Mobile satellite services and the role of Inmarsat," Telecommunications Policy, vol. 19, no. 2, pp. 105-116, 1995.
5. D. Matolak, A. Noerpel, R. Goodings, D. Staay, and J. Baldasano, "Recent progress in deployment and standardization of geostationary mobile satellite systems," in Military Communications Conference (MILCOM), 2002.
6. ETSI, ETSI TS 101 376-3-2 V1.1.1 (2001-03); GEO-Mobile Radio Interface Specifications; Part 3: Network specifications; Sub-part 2: Network Architecture; GMR-1 03.002, Std., 2001.
7. G. Maral and M. Bousquet, Satellite Communications Systems: Systems, Techniques and Technology, 5th ed. John Wiley & Sons, 2009.
8. Jim Geovedi and Raoul Chiesa, "Hacking a Bird in the Sky," in HITBSecConf, Amsterdam, 2011.
9. ETSI, ETSI TS 101 376-3-9 V1.1.1 (2001-03); GEO-Mobile Radio Interface Specifications; Part 3: Network specifications; Sub-part 9: Security related Network Functions; GMR-1 03.020, Std., 2001.
10. H. Welte, "Anatomy of contemporary GSM cellphone hardware," 2010. [Online]. Available: http://laforge.gnumonks.org/papers/gsm-phone-anatomy- latest.pdf
11. M. Briceno, I. Goldberg, and D. Wagner, "A pedagogical implementation of the GSM A5/1 and A5/2 "voice privacy" encryption algorithms," 1999, originally published at http://www.scard.org, mirror at http://cryptome.org/gsm-a512.htm.
12. J. D. Golic, "Cryptanalysis of alleged A5 stream cipher," in Proceedings of the 16th annual international conference on Theory and application of cryptographic techniques, ser. EUROCRYPT'97. Springer-Verlag, 1997, pp. 239-255.
13. S. Petrovic and A. Fuster-Sabater, "Cryptanalysis of the A5/2 Algorithm," Cryptology ePrint Archive, Report 2000/052, Tech. Rep., 2000, http://eprint.iacr.org/.
14. E. Biham and O. Dunkelman, "Cryptanalysis of the A5/1 GSM Stream Cipher," in Indocrypt, 2000.
15. A. Biryukov, A. Shamir, and D. Wagner, "Real Time Cryptanalysis of A5/1 on a PC," in Fast Software Encryption (FSE), 2000.
16. P. Ekdahl and T. Johansson, "Another Attack on A5/1," IEEE Transactions on Information Theory, vol. 49, no. 1, 2003.
17. A. Bogdanov, T. Eisenbarth, and A. Rupp, "A Hardware-Assisted Realtime Attack on A5/2 Without Precomputations," in Cryptographic Hardware and Embedded Systems (CHES), 2007.
18. E. Barkan, E. Biham, and N. Keller, "Instant Ciphertext-Only Cryptanalysis of GSM Encrypted Communication," Journal of Cryptology, vol. 21, March 2008.
19. K. Nohl and C. Paget, "GSM: SRSLY?" 2009, 26th Chaos Communication Congress.
20. O. Dunkelman, N. Keller, and A. Shamir, "A Practical-Time Related-Key Attack on the KASUMI Cryptosystem Used in GSM and 3G Telephony," in International Crytology Conference (CRYPTO), 2010.
21. OsmocomGMR. Thuraya SO-2510. [Online]. Available: http://gmr.osmocom.org/ trac/wiki/Thuraya-SO2510
22. Texas Instruments. The OMAP 5910 Platform. [Online]. Available: http://www.ti.com/product/omap5910
23. E. Barkan, E. Biham, and N. Keller, "Instant Ciphertext-Only Cryptanalysis of GSM encrypted communication," in International Crytology Conference (CRYPTO), 2003, pp. 600-616.
24. ETSI, ETSI TS 101 376-5-3 V1.2.1 (2002-04); GEO-Mobile Radio Interface Specifications; Part 5: Radio interface physical layer specifications; Sub-part 3: Channel Coding; GMR-1 05.003, Std., 2002.
25. Jose Fridman, Analog Devices. How to optimize H.264 video decode on a digital baseband processor. [Online]. Available: http://www.eetimes.com/General/ DisplayPrintViewContent?contentItemId=4016202
26. ETSI, ETSI TS 101 377-5-3 V1.1.1 (2001-03); GEO-Mobile Radio Interface Specifications; Part 5: Radio interface physical layer specifications; Sub-part 3: Channel Coding; GMR-2 05.003, Std., 2001.
27. -, ETSI TS 101 377-3-10 V1.1.1 (2001-03); GEO-Mobile Radio Interface Specifications; Part 3: Network specifications; Sub-part 9: Security related Network Functions; GMR-2 03.020, Std., 2001.
28. M. Robshaw and O. Billet, Eds., New Stream Cipher Designs: The eSTREAM Finalists, ser. LNCS. Springer, 2008, vol. 4986.
29. A. Bogdanov, G. Leander, L. R. Knudsen, C. Paar, A. Poschmann, M. J. Robshaw, Y. Seurin, and C. Vikkelsoe, "PRESENT - An Ultra-Lightweight Block Cipher," in CHES '07: Proceedings of the 9th International Workshop on Cryptographic Hardware and Embedded Systems, ser. LNCS, no. 4727. Springer, 2007, pp. 450-466.
30. B. Driessen, "Eavesdropping on Satellite Telecommunication Systems," Cryptology ePrint Archive, Report 2012/051, 2012, http://eprint.iacr.org/2012/051.
31. S. Munaut. (2012, Jan.) OsmocomGMR. [Online]. Available: http://gmr.osmocom.org/