CCC Talk: All cops are broadcasting Obtaining the secret TETRA primitives [video]
1–10 of 22 posts
Re: CCC Talk: All cops are broadcasting Obtaining the secret TETRA primitives [video]
#2In this talk we will discuss the radio jailbreaking journey that enabled us to perform the first public disclosure and security analysis of the proprietary cryptography used in TETRA (Terrestrial Trunked Radio): a European standard for trunked radio globally used by government agencies, police, prisons, emergency services and military operators. Besides governemental applications, TETRA is also widely deployed in industrial environments such as factory campuses, harbor container terminals and airports, as well as critical infrastructure such as SCADA telecontrol of oil rigs, pipelines, transportation and electric and water utilities.
For over two decades, the underlying algorithms have remained secret and bound with restrictive NDAs prohibiting public scrutiny of this highly critical technology. As such, TETRA was one of the last bastions of widely deployed secret proprietary cryptography. We will discuss in detail how we managed to obtain the primitives and remain legally at liberty to publish our findings.
This journey has involved reverse-engineering and exploiting multiple zero-day vulnerabilities in the highly popular Motorola MTM5x00 TETRA radio and its TI OMAP-L138 trusted execution environment (TEE) and covers everything from side-channel attacks on DSPs, through writing decompilers headache-inducing DSP architectures, all the way to exploiting ROM vulnerabilities in the Texas Instruments TEE.
Re: CCC Talk: All cops are broadcasting Obtaining the secret TETRA primitives [video]
#3In this talk we will discuss the radio jailbreaking journey that enabled us to perform the first public disclosure and security analysis of the proprietary cryptography used in TETRA (Terrestrial Trunked Radio): a European standard for trunked radio globally used by government agencies, police, prisons, emergency services and military operators. Besides governemental applications, TETRA is also widely deployed in ind…
Wouldnt be able to do this in the UK, interception of any radio signals are illegal.
The UK makes China, North Korea, Russia and [Insert most hated country here] look positively amateur.
I wonder where George Orwell got his inspiration for 1984 from?
Re: CCC Talk: All cops are broadcasting Obtaining the secret TETRA primitives [video]
#4We need open standards for radio protocols, including encryption.
Outside of 802.11, it's a bleak landscape.
Re: CCC Talk: All cops are broadcasting Obtaining the secret TETRA primitives [video]
#5In this talk we will discuss the radio jailbreaking journey that enabled us to perform the first public disclosure and security analysis of the proprietary cryptography used in TETRA (Terrestrial Trunked Radio): a European standard for trunked radio globally used by government agencies, police, prisons, emergency services and military operators. Besides governemental applications, TETRA is also widely deployed in ind…
Wouldnt be able to do this in the UK, interception of any radio signals are illegal. The UK makes China, North Korea, Russia and [Insert most hated country here] look positively amateur. I wonder where George Orwell got his inspiration for 1984 from?
Nazi Germany and the Soviet Union under Stalin. And apparently was inspired by the superpowers divvying up the world at the Teheran Conference. HTH.
Re: CCC Talk: All cops are broadcasting Obtaining the secret TETRA primitives [video]
#6In this talk we will discuss the radio jailbreaking journey that enabled us to perform the first public disclosure and security analysis of the proprietary cryptography used in TETRA (Terrestrial Trunked Radio): a European standard for trunked radio globally used by government agencies, police, prisons, emergency services and military operators. Besides governemental applications, TETRA is also widely deployed in ind…
Great work! Can you post a photo of your lab? I'd love to see what gear you get to play with.
Re: CCC Talk: All cops are broadcasting Obtaining the secret TETRA primitives [video]
#7We need open standards for radio protocols, including encryption. Outside of 802.11, it's a bleak landscape.
In the two-way radio world, most protocols are open (P25, DMR, LMR, etc.) but almost every digital protocol uses the AMBE[1] voice codec, which is not.
Re: CCC Talk: All cops are broadcasting Obtaining the secret TETRA primitives [video]
#8We need open standards for radio protocols, including encryption. Outside of 802.11, it's a bleak landscape.
In the two-way radio world, most protocols are open (P25, DMR, LMR, etc.) but almost every digital protocol uses the AMBE[1] voice codec, which is not. [1] - https://en.wikipedia.org/wiki/Multi-Band_Excitation
Is it completely closed or only source-available?
Re: CCC Talk: All cops are broadcasting Obtaining the secret TETRA primitives [video]
#9In this talk we will discuss the radio jailbreaking journey that enabled us to perform the first public disclosure and security analysis of the proprietary cryptography used in TETRA (Terrestrial Trunked Radio): a European standard for trunked radio globally used by government agencies, police, prisons, emergency services and military operators. Besides governemental applications, TETRA is also widely deployed in ind…
Wouldnt be able to do this in the UK, interception of any radio signals are illegal. The UK makes China, North Korea, Russia and [Insert most hated country here] look positively amateur. I wonder where George Orwell got his inspiration for 1984 from?
> I wonder where George Orwell got his inspiration for 1984 from?
Stalin's USSR and Nazi Germany.
Re: CCC Talk: All cops are broadcasting Obtaining the secret TETRA primitives [video]
#10Earlier quoted context omitted.
In the two-way radio world, most protocols are open (P25, DMR, LMR, etc.) but almost every digital protocol uses the AMBE[1] voice codec, which is not. [1] - https://en.wikipedia.org/wiki/Multi-Band_Excitation
Is it completely closed or only source-available?
It's completely closed (not even source available) but there's unlicensed software implementations available from third parties. E.g. libmbe.
AMBE in most equipment was provided in a physical chip for protection however some firmware implementations existed in hardware from big players and they were reverse-engineered.
Most of the Chinese B-brand (AliExpress stuff) radios use this reverse-engineered software implementation. They're not licensed but a Chinese company pretends to license this on behalf of DVSI though it's totally illegal. The A-brands like hytera use the official one of course.
See the popup warning on this page: https://www.dvsinc.com/soft_products/software.shtml
Since the closed nature of this codec goes counter to ham radio principles some open source codecs were also developed. The best example is codec2.