- cross-posted to:
- europe
- programmerhumor
You must log in or register to comment.
does tetra being backdoored matters if the only people that can use it are cops and such?
There is no such thing as a backdoor that can only be used by one group of people.
As soon as someone outside of that group figures out how to access it, then they have the keys to every system that uses that encryption method. And because the backdoor is there by design, they will have access in perpetuity until the system gets upgraded to use properly secure encryption.
Great, now look at the actual vulnerabilities
Zeroth of all, the people who have backdoor - EU intel agencies - don’t have any motive to attack TEA1 radios within their range. This might provide them with tools to snoop on non-EU firetruck radios, but that’s all. That’s some very limited NOBUS capability
First of all, it’s an attack on something that is transmitted most usually on 430ish MHz - you need to be within few km of target just to listen. This is enough to break TEA1 if you know about the backdoor, but if you want to do anything more - like exploit CVE-2022-24401 - you need to be close enough to receive victim’s signal, but also you need to spoof part of base station signal - remember, you don’t wanna get caught, so you have to use low power and point directional antenna at cops - and you need to be even closer, maybe even following them within line of sight for it to work reliably
Proof of concept code wasn’t published, you still need considerable resources to get to exploitation in principle in the first place and then you have to be physically close to decrypt some communications. This still doesn’t allow for sending forged messages because there’s also authentication mechanism that you’d also need to take care of. This is some state-level resources, not two dudes in a shed scale of resources
The concept still persists, normalizing stuff having backdoors shouldn’t be a thing. The government will do as government does but we shouldn’t just think it’s always safe and let them know we’re okay with it
I get what you’re saying, i’m saying that average joe hasn’t really been exposed much because distribution of this vulnerable technology is limited and actual exploitation has some serious constraints
Yeah, it’s used all over the world for not only cop radios but also control systems for things like power plants and railway switches, and ETSI’s backdoored cryptography is sometimes relied upon for authenticity as well as confidentiality. So, it is literally possible to exploit this backdoor and cause physical disasters with a radio transmission.
The conspirators should be held accountable and should never be trusted again, but instead they’re having more of their future standards written into law. You can read an interview with the chair of ETSI’s Technical Committee TETRA and Critical Communications Evolution (TC TCCE) Brian Murgatroyd here.
In addition to what others already said about the commercial version of TETRA (which is where the backdoors were discovered), the cops, by the nature of their job, do handle a lot of personal data, and transmit them over the radio. Theoretically, there should be safeguards in place to prevent misuse of the data handled by the police. In practise, this works more or less well, but at least there is some attempt at oversight. If their radio systems have a backdoor, every Tom, Dick, and Harry (and Sergeij from St. Petersburg) can get access to those data with exactly zero oversight and safeguards.
Additionally, among the noncommercial users of TETRA radios are lots of other emergency services, including ambulance services. That data concerning people’s health are of a somewhat sensitive nature, and therefore need to be protected from unauthorised access, hopefully doesn’t need any further explanation.
If I remember it correctly from the Chaos Communication Camp 23 Talk the Backdoor exists only for Not-EU-Countrys and Private Security Companys. But they are also used e.g. at Airports.
The researchers found five different vulnerabilities. The one that can most unambiguously not be called anything besides a backdoor (internally reducing what were believed to be 80-bit keys down to 32 bits) was specific to TEA1, the export cipher for use outside of Europe and the US, but the other vulnerabilities applied to other ciphers also.
The homepage for the research is https://www.midnightblue.nl/tetraburst
Yes ACAB
When it comes to the crypto-wars I assume that stands for “all cops are brain-dead”? Because that is roughly what you have to be to be for sabotaging encryption.
All Cops Are Broadcasting was the title of one of the talks the researchers did about it
