DECT phones and POS terminals are vulnerable
And so is son of DECT, the super-digital CAT-iq
By Peter Judge | Techworld | Published: 14:37, 05 January 2009
German security experts have built a cheap laptop-based sniffer that can break into cordless phones, debit card terminals and security door mechanisms - and the same gear will also work on the next generation of DECT, known as CAT-iq.
The attack on DECT, demonstrated at the 25th Chaos Communications Congress in Berlin on 29 December, used a Linux laptop with a modified €23 laptop card. It can intercept calls and information directly, recording it in digital form. Even if encryption is switched on, the system can bypass encryption - simply by pretending to be a base station that doesn't support it.
The DECT protocol is used in many millions of cordless phones, as well as in wireless debit card readers, security doors and traffic management systems. It has encryption built in, but the protocol is kept secret. At one time DECT was expected to be replaced by Wi-Fi, but it is being built into broadband routers, and a new generation of DECT is being prepared under the CAT-iq brand.
"CAT-iq merely adds new features such as wideband codecs and audio/video streaming to the existing DECT standard," said Ralf-Philipp Weinmann, a a cryptographer working in the LACS group at the University of Luxembourg, and part of the Dedected group that demonstrated the DECT problems. "It does not change anything security-wise. Hence our attacks apply to products implementing CAT-iq as well."
If they can't get encryption to work, all the most popular phones will happily revert to unencrypted communications, said Andreas Schuler, from the Dedected group: "A phone should break the connection if the encryption is rejected, but the priority from the manufacturer lies on interoperability not on security, so this is accepted to make the phones work with more (unsecure) stations."
It is not clear whether the same method would work on debit card reading systems, since these may enforce the use of encryption, or employ higher level encryption such as SSL, said Weinmann. "We haven't been able to verify whether any POS terminals actually do reject unencrypted communications," said Weinmann. "If however the UAK - the master secret shared between the base station and the terminal - generated during the pairing of the POS terminal with the base station is weak, then all communications can be decrypted anyway."
More fundamentally, DECT's use of a secret encryption algorithm is wrong, warned Weinmann: "Both the DECT encryption algorithm (DSC) and the DECT authentication algorihm (DSAA) were unpublished and have hence not been subject to scrutiny by outside experts. [Telecoms standard maker] ETSI really should be using peer-reviewed algorithms, and I hope that in future standards DSC and DSAA will be replaced with published and peer-reviewed algorithms."
The Dedected group has partially reverse-engineered the DECT encryption system, which should be replaced, said Weinmann, much as already happened with GSM and 3G encryption.
One positive note is that the move to integrated DECT into devices like broadband routers will make it easier to secure individual systems, said Weinmann. "Integrated boxes and higher-end telephone systems allow for flash upgrades of their DECT stack. This allows the most blatant security issues to be given at least some band aid."
