2

A client of my company is currently using a solution where they've invented a UDP protocol that communicated with no TLS over regular 3G in small embedded devices.

Their cellular provider, KORE, ensures us that 100% of that 3G data is untouchable by the open web and lives within their VPN, unless we would like that device to touch the open web. They have also assured us that the connections between their cellular providers and their datacenter are 100% secured with private fiber runs and IPSec tunnels. I will assume this is true and secure.

We're trying to rule out the possibility of attack on their devices through the wireless protocol. We're concerned about attackers being able to read data coming across the airwaves as well as modify packets to attempt and control a device. I understand that data over 3G uses the KASUMI cipher, which has been compromised, but practical applications of that are not known to be in the wild. Is this still true? If we can trust the connection between the tower and the datacenter, can we trust the connection between the tower and the device?

If this is still true, theoretically there might still be a way to compromise that radio connection. How complex would an exploit like that have to look? Would it be able to run on a femtocell using modified firmware, or might it require more complex hardware?

2

I understand that data over 3G uses the KASUMI cipher, which has been compromised, but practical applications of that are not known to be in the wild. Is this still true?

Seems like it. But there are detailed reports and researches on the subject. (see here)

If we can trust the connection between the tower and the datacenter, can we trust the connection between the tower and the device?

No. The data between the tower and datacenter runs on physical cables and all access to any component on the infrastructure is locked in a box with access only to the technicians (This is the usual case which I assume applies in this situation). The data between the tower and the device is in radio waves which can be sniffed.

If this is still true, theoretically there might still be a way to compromise that radio connection. How complex would an exploit like that have to look? Would it be able to run on a femtocell using modified firmware, or might it require more complex hardware?

You can preform the attack with a few methods:

  1. Sniff the information being sent between the device and the tower and then decrypt it.

  2. Get close to the device with a stronger cell signal and cause the device to connect to you and then redirect the traffic to the original cell (or don't) causing you to be able to preform as a man in the middle.

Either way all attacks on cellular devices and cellular infrastructure are very hard, time consuming and expensive (a personal cell can cost around $5000), so your biggest threat is a very well funded and professional hacking team or a government of some short.

My suggestion is to stay with the encryption that exists but if you are making any TCP/UDP requests from the device you should add a private encryption that will act as another encryption level.

  • I wouldn't say it's that hard. Most systems can be trivially downgraded to 2G, which uses the far weaker A5/2, weaker even than KASUMI. Plus some systems can even be downgraded to 2G with A5/0 (plaintext)! – forest Dec 10 '17 at 5:58
  • Whoops, I meant A5/1. – forest Apr 5 '18 at 5:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.