textfiles/phreak/CELLULAR/cell.frd

Letter 4 of 9, 16770 chars:

From pro-snapp!pro-sol!pnet01!mtbill Fri Jul 10 00:49:45 1987 
Date: Thu, 9 Jul 87 18:49:13 PDT
Ppath: essug!chuck
From: mtbill@pnet01.CTS.COM (Mountain Bill)
To: pro-sol!pro-snapp!essug!chuck
Subject: Cellular Telephone Security

        The foolowing is fwd'd for addition to your data library.  Isn't it
wonderful that Rusty is paying the transmission costs for all these hogger
messages/files?  :-)

--------Forwarded Message--------
  From crash!hplabs.HP.COM!hp-sdd!seismo!F4.CSL.SRI.COM!GEOFF Wed Jun 17 11:36:09 1987
  Received: by crash.CTS.COM (5.54/UUCP-Project/rel-1.0/09-14-86)
        id AA15019; Wed, 17 Jun 87 11:28:37 PDT
  Reply-To: crash!hplabs.HP.COM!hp-sdd!seismo!F4.CSL.SRI.COM!GEOFF
  Received: from hplabs.HP.COM (hplabs) by hp-sdd.HP.COM; Wed, 17 Jun 87 11:27:22 PDT
  Return-Path: <hp-sdd!seismo!F4.CSL.SRI.COM!GEOFF@hplabs.HP.COM>
  Received: by hplabs.HP.COM ; Wed, 17 Jun 87 11:17:01 pdt
  Received: from [192.12.33.99] by seismo.CSS.GOV (5.54/1.14) 
        id AA17626; Wed, 17 Jun 87 00:11:57 EDT
  Date: 16 Jun 1987 16:40-PDT
  Sender: crash!hplabs.HP.COM!hp-sdd!seismo!F4.CSL.SRI.COM!GEOFF
  Subject: Re: Cellular Telephone Security
  From: the tty of Geoffrey S. Goodfellow <crash!hplabs.HP.COM!hp-sdd!seismo!csl.sri.com!Geoff>
  Ppath: pnet01!mtbill
  To: pnet01!mtbill@hplabs.HP.COM
  Message-Id: <[F4.CSL.SRI.COM]16-Jun-87 16:40:13.GEOFF>
  In-Reply-To: <8706160157.AA19395@crash.CTS.COM>
  
        
  --------------------------------------------------------------------------
  The following is reprinted from the November 1985 issue of Personal
  Communications Technology magazine by permision of the authors and
  the publisher, FutureComm Publications Inc., 4005 Williamsburg Ct.,
  Fairfax, VA  22032, 703/352-1200.
  
  Copyright 1985 by FutureComm Publications Inc.   All rights reserved.
  --------------------------------------------------------------------------
  
  
            THE ELECTRONIC SERIAL NUMBER: A CELLULAR 'SIEVE'?
                'SPOOFERS' CAN DEFRAUD USERS AND CARRIERS
  
     by Geoffrey S. Goodfellow, Robert N. Jesse, and Andrew H. Lamothe, Jr.
  
  What's the greatest security problem with cellular phones? Is it privacy of
  communications?  No.
  
  Although privacy is a concern, it will pale beside an even greater problem:
  spoofing.
  
  'Spoofing' is the process through which an agent (the 'spoofer') pretends to
  be somebody he isn't by proffering false identification, usually with intent
  to defraud.  This deception, which cannot be protected against using the
  current U.S. cellular standards, has the potential to create a serious
  problem--unless the industry takes steps to correct some loopholes in the
  present cellular standards.
  
  Compared to spoofing, the common security concern of privacy is not so severe.
  Most cellular subscribers would, at worst, be irked by having their
  conversational privacy violated.  A smaller number of users might actually
  suffer business or personal harm if their confidential exchanges were
  compromised.  For them, voice encryption equipment is becoming increasingly
  available if they are willing to pay the price for it.
  
  Thus, even though technology is available now to prevent an interloper from
  overhearing sensitive conversations, cellular systems cannot--at any
  cost--prevent pirates from charging calls to any account. This predicament is
  not new to the industry.  Even though cellular provides a modern,
  sophisticated quality mobile communications service, it is not fundamentally
  much safer than older forms of mobile telephony.
  
  History of Spoofing Vulnerability
  
  The earliest form of mobile telephony, unsquelched manual Mobile Telephone
  Service (MTS), was vulnerable to interception and eavesdropping.  To place a
  call, the user listened for a free channel.  When he found one, he would key
  his microphone to ask for service: 'Operator, this is Mobile 1234; may I please
  have 555-7890.'  The operator knew to submit a billing ticket for account
  number 1234 to pay for the call.  So did anybody else listening to the
  channel--hence the potential for spoofing and fraud.
  
  Squelched channel MTS hid the problem only slightly because users ordinarily
  didn't overhear channels being used by other parties.  Fraud was still easy
  for those who turned off the squelch long enough to overhear account numbers.
  
  Direct-dial mobile telephone services such as Improved Mobile Telephone
  Service (IMTS) obscured the problem a bit more because subscriber
  identification was made automatically rather than by spoken exchange between
  caller and operator.  Each time a user originated a call, the mobile telephone
  transmitted its identification number to the serving base station using some
  form of Audio Frequency Shift Keying (AFSK), which was not so easy for
  eavesdroppers to understand.
  
  Committing fraud under IMTS required modification of the mobile--restrapping
  of jumpers in the radio unit, or operating magic keyboard combinations in
  later units--to reprogram the unit to transmit an unauthorized identification
  number. Some mobile control heads even had convenient thumb wheel switches
  installed on them to facilitate easy and frequent ANI (Automatic Number
  Identification) changes.
  
  Cellular Evolution
  
  Cellular has evolved considerably from these previous systems.  Signaling
  between mobile and base stations uses high-speed digital techniques and
  involves many different types of digital messages.  As before, the cellular
  phone contains its own Mobile Identification Number (MIN), which is programmed
  by the seller or service shop and can be changed when, for example, the phones
  sold to a new user.  In addition, the U.S. cellular standard incorporates a
  second number, the 'Electronic Serial Number' (ESN), which is intended to
  uniquely and permanently identify the mobile unit.
  
  According to the Electronic Industries Association (EIA) Interim Standard
  IS-3-B, Cellular System Mobile Station--Land Station Compatibility
  Specification (July 1984), 'The serial number is a 32-bit binary number that
  uniquely identifies a mobile station to any cellular system.  It must be
  factory-set and not readily alterable in the field.  The circuitry that
  provides the serial number must be isolated from fraudulent contact and
  tampering.  Attempts to change the serial number circuitry should render the
  mobile station inoperative.'
  
  The ESN was intended to solve two problems the industry observed with its
  older systems.
  
  First, the number of subscribers that older systems could support fell far
  short of the demand in some areas, leading groups of users to share a single
  mobile number (fraudulently) by setting several phones to send the same
  identification.  Carriers lost individual user accountability and their means
  of predicting and controlling traffic on their systems.
  
  Second, systems had no way of automatically detecting use of stolen equipment
  because thieves could easily change the transmitted identification.
  
  In theory, the required properties of the ESN allow cellular systems to check
  to ensure that only the correctly registered unit uses a particular MIN, and
  the ESNs of stolen units can be permanently denied service ('hot-listed').
  This measure is an improvement over the older systems, but vulnerabilities
  remain.
  
  Ease of ESN Tampering
  
  Although the concept of the unalterable ESN is laudable in theory, weaknesses
  are apparent in practice.  Many cellular phones are not constructed so that
  'attempts to change the serial number circuitry renders the mobile station
  inoperative.'  We have personally witnessed the trivial swapping of one ESN
  chip for another in a unit that functioned flawlessly after the switch was
  made.
  
  Where can ESN chips be obtained to perform such a swap?  We know of one recent
  case in the Washington, D.C. area in which an ESN was 'bought' from a local
  service shop employee in exchange for one-half gram of cocaine.  Making the
  matter simpler, most manufacturers are using industry standard Read-Only
  Memory (ROM) chips for their ESNs, which are easily bought and programmed or
  copied.
  
  Similarly, in the spirit of research, a west coast cellular carrier copied the
  ESN from one manufacturer's unit to another one of the same type and
  model--thus creating two units with the exact same identity.
  
  The ESN Bulletin Board
  
  For many phones, ESN chips are easy to obtain, program, and install.  How does
  a potential bootlegger know which numbers to use?  Remember that to obtain
  service from a system, a cellular unit must transmit a valid MIN (telephone
  number) and (usually) the corresponding serial number stored in the cellular
  switch's database.
  
  With the right equipment, the ESN/MIN pair can be read right off the air
  because the mobile transmits it each time it originates a call.  Service shops
  can capture this information using test gear that automatically receives and
  decodes the reverse, or mobile-to-base, channels.
  
  Service shops keep ESN/MIN records on file for units they have sold or
  serviced, and the carriers also have these data on all of their subscribers.
  Unscrupulous employees could compromise the security of their customers'
  telephones.
  
  In many ways, we predict that 'trade' in compromised ESN/MIN pairs will
  resemble what currently transpires in the long distance telephone business
  with AT&T credit card numbers and alternate long-distance carrier (such as
  MCI, Sprint and Alltel) account codes.  Code numbers are swapped among
  friends, published on computer 'bulletin boards' and trafficked by career
  criminal enterprises.
  
  Users whose accounts are being defrauded might--or might not--eventually
  notice higher-than-expected bills and be reassigned new numbers when they
  complain to the carrier.  Just as in the long distance business, however, this
  number 'turnover' (deactivation) won't happen quickly enough to make abuse
  unprofitable.  Catching pirates in the act will be even tougher than it is in
  the wireline telephone industry because of the inherent mobility of mobile
  radio.
  
  Automating Fraud
  
  Computer hobbyists and electronics enthusiasts are clever people.  Why should
  a cellular service thief 'burn ROMs' and muck with hardware just to install
  new IDs in his radio?  No Herculean technology is required to 'hack' a phone
  to allow ESN/MIN programming from a keyboard, much like the IMTS phone thumb
  wheel switches described above.
  
  Those not so technically inclined may be able to turn to mail-order
  entrepreneurs who will offer modification kits for cellular fraud, much as
  some now sell telephone toll fraud equipment and pay-TV decoders.
  
  At least one manufacturer is already offering units with keyboard-programmable
  MINs.  While intended only for the convenience of dealers and service shops,
  and thus not described in customer documentation, knowledgeable and/or
  determined end users will likely learn the incantations required to operate
  the feature.  Of course this does not permit ESN modification, but easy MIN
  reprogrammability alone creates a tremendous liability in today's roaming
  environment.
  
  The Rolls Royce of this iniquitous pastime might be a 'Cellular Cache-Box.'
  It would monitor reverse setup channels and snarf ESN/MIN pairs off the air,
  keeping a list in memory.  Its owner could place calls as on any other
  cellphone.  The Cache-Box would automatically select an ESN/MIN pair from its
  catalog, use it once and then discard it, thus distributing its fraud over
  many accounts.  Neither customer nor service provider is likely to detect the
  abuse, much less catch the perpetrator.
  
  As the history of the computer industry shows, it is not far-fetched to
  predict explosive growth in telecommunications and cellular that will bring
  equipment prices within reach of many experimenters.  Already we have seen the
  appearance of first-generation cellular phones on the used market, and new
  units can be purchased for well under $1000 in many markets.
  
  How High The Loss?
  
  Subscribers who incur fraudulent charges on their bills certainly can't be
  expected to pay them.  How much will fraud cost the carrier?  If the charge is
  for home-system airtime only, the marginal cost to the carrier of providing
  that service is not as high as if toll charges are involved.  In the case of
  toll charges, the carrier suffers a direct cash loss.  The situation is at its
  worst when the spoofer pretends to be a roaming user.  Most inter-carrier
  roaming agreements to date make the user's home carrier (real or spoofed)
  responsible for charges, who would then be out hard cash for toll and airtime
  charges.
  
  We have not attempted to predict the dollar losses this chicanery might
  generate because there isn't enough factual information information for anyone
  to guess responsibly.  Examination of current estimates of long-distance-toll
  fraud should convince the skeptic.
  
  Solutions
  
  The problems we have described are basically of two types.  First, the ESN
  circuitry in most current mobiles is not tamper-resistant, much less
  tamper-proof.  Second and more importantly, the determined perpetrator has
  complete access to all information necessary for spoofing by listening to the
  radio emissions from valid mobiles because the identification information
  (ESN/MIN) is not encrypted and remains the same with each transmission.
  
  Manufacturers can mitigate the first problem by constructing mobiles that more
  realistically conform to the EIA requirements quoted above.  The second
  problem is not beyond solution with current technology, either.  Well-known
  encryption techniques would allow mobiles to identify themselves to the
  serving cellular system without transmitting the same digital bit stream each
  time.  Under this arrangement, an interloper receiving one transmission could
  not just retransmit the same pattern and have it work a second time.
  
  An ancillary benefit of encryption is that it would reasonably protect
  communications intelligence--the digital portion of each transaction that
  identifies who is calling whom when.
  
  The drawback to any such solution is that it requires some re-engineering in
  the Mobile-Land Station Compatibility Specification, and thus new software or
  hardware for both mobiles and base stations.  The complex logistics of
  establishing a new standard, implementing it, and retrofitting as much of the
  current hardware as possible certainly presents a tough obstacle, complicated
  by the need to continue supporting the non-encrypted protocol during a
  transition period, possibly forever.
  
  The necessity of solving the problem will, however, become apparent.  While we
  presently know of no documented cases of cellular fraud, the vulnerability of
  the current standards and experience with similar technologies lead us to
  conclude that it is inevitable.  Failure to take decisive steps promptly will
  expose the industry to a far more expensive dilemma.  XXX
  
  
  Geoffrey S. Goodfellow is a member of the senior research staff in the
  Computer Science Laboratory at SRI International, 333 Ravenswood Ave., Menlo
  Park, CA 94025, 415/859-3098.  He is a specialist in computer security and
  networking technology and is an active participant in cellular industry
  standardization activities.  He has provided Congressional testimony on
  telecommunications security and privacy issues and has co-authored a book on
  the computer 'hacking' culture.
  
  Robert N. Jesse (2221 Saint Paul St., Baltimore, MD 21218, 301/243-8133) is an
  independent consultant with expertise in security and privacy, computer
  operating systems, telecommunications and technology management.  He is an
  active participant in cellular standardization efforts.  He was previously a
  member of the senior staff at The Johns Hopkins University, after he obtained
  his BES/EE from Johns Hopkins.
  
  Andrew H. Lamothe, Jr. is executive vice-president of engineering at Cellular
  Radio Corporation, 8619 Westwood Center Dr., Vienna, VA 22180, 703/893-2680.
  He has played a leading role internationally in cellular technology
  development.  He was with Motorola for 10 years prior to joining American
  TeleServices, where he designed and engineered the Baltimore/Washington market
  trial system now operated by Cellular One.
------End Forwarded Message------


UUCP: {cbosgd, hplabs!hp-sdd, sdcsvax, nosc}!crash!pnet01!mtbill
ARPA: crash!pnet01!mtbill@nosc.mil
INET: mtbill@pnet01.CTS.COM

m: