Millions of Sim cards are 'vulnerable to hack attack'

Tuesday, July 23, 2013

 

Mr Nohl said one in eight Sim cards might be vulnerable

A flaw with mobile phones' Sim card technology is putting millions of people at risk of being spied on and robbed, according to a leading security expert.

Karsten Nohl has said he has found a way to discover some Sims' digital keys by sending them a special text message.
He warned criminals could potentially use the technique to listen in on calls or steal cash.
Industry organisation - the GSMA - said it was looking into the findings.
"Karsten's early disclosure to the GSMA has given us an opportunity for preliminary analysis," said a spokeswoman for the association, which represents global network operators,
"We have been able to consider the implications and provide guidance to those network operators and Sim vendors that may be impacted.
"It would appear that a minority of Sims produced against older standards could be vulnerable."
Mr Nohl has posted preliminary details of the vulnerability on the website of his company, Berlin-based Security Research Labs.
Intercepted calls Sim (subscriber identity module) cards effectively act as a security token, authenticating a user's identity with their network operator.
They also store a limited amount of data such as text messages, contacts' telephone numbers and details used for some applications - including a number of payment and banking services.

Mr Nohl says that mobile banking customers in Africa rely on the security offered by their Sim cards

Mr Nohl said he had found a way to discover the authentication code by sending a device a text message masquerading as a communication from the user's mobile operator.
The message contained a bogus digital signature for the network.
He said most phones cut contact after recognising the signature as being a fake - but in about a quarter of cases, the handsets sent back an error message including an encrypted version of the Sim's authentication code.
The encryption is supposed to prevent the authentication code being discovered, but Mr Nohl said that in about half of these cases it was based on a 1970s coding system called Digital Encryption Standard (DES), which was once thought secure but could now be cracked "within two minutes on a standard computer".
Once the attacker had this information, Mr Nohl said, they could upload malware to the Sim written in the Java programming language.
He said these could be used by the hacker to send texts from the device to premium rate numbers they had set up, to discover and listen in to the target's voicemail messages and to track their location.
In addition, he warned that combined with other techniques, it could act as a surveillance tool.
"Sim cards generate all the keys you use to encrypt your calls, your SMS and your internet traffic," Mr Nohl told the BBC.
"If someone can capture the encrypted data plus have access to your Sim card, they can decrypt it.
"Operators often argue that it's not possible to listen in on 3G or 4G calls - now with access to the Sim card, it very much is."
Mr Nohl said that his research suggested about an eighth of all Sim cards were vulnerable to the hack attack - representing between 500 million to 750 million devices.
Although Mr Nohl would not reveal at this time in which countries DES encryption remained most common, he did say that Africa-based users had particular cause for concern.
"Here in Europe we use a Sim card to make phone calls and texts, but many people in Africa also use them for mobile banking," he said.
"Someone can steal their entire bank account by copying their Sim card.
"That adds a certain urgency because you imagine fraudsters would be most interested in breaking into their Sim cards - especially when it can be done remotely."
Black Hat Mr Nohl said he expected network operators would not take long to act on his study, and should be able to provide an over-the-air download to protect subscribers against the vulnerability.
The GSMA said that it had not yet seen the full details of his research, but planned to study it to pinpoint any issues that could be fixed.
It added that "there is no evidence to suggest that today's more secure Sims, which are used to support a range of advanced services, will be affected".
The UN's telecoms agency - the International Telecommunications Union - said that it would now contact regulators and other government agencies worldwide to ensure they were aware of the threat.
Mr Nohl said he planned to reveal more information about the vulnerability at the Black Hat security conference in Las Vegas later this month.
However, he said he would not publish a survey showing which phone owners were most at risk until December to give operators an opportunity to address the problem.

 Source: BBC 

comments | | Read More...

Samsung reveals new Exynos smartphone and tablet chip

Samsung has unveiled its latest top-of-the-range smart device processor saying it offers more than twice the 3D graphics power of its predecessor.

The Exynos 5 Octa is the first production-ready chip to include ARM Holding's latest GPU (graphics processing unit) architecture.
Samsung's move to license the tech marks a reversal of its decision to use a GPU design by rival British chip firm Imagination in the last version.
It enters mass production next month.
In its press release Samsung highlighted the fact that GPUs are increasingly being used to handle general computing tasks and not just video games graphics.
While GPUs are typically slower at doing single calculations than CPUs (central processing units), they have the advantage that they carry many of them simultaneously.
This makes them particularly adept at handling highly "parallelisable" tasks such as applying filters to photographs, running augmented reality apps as well as speech, gesture and facial recognition.
Power efficiency While the vast majority of smart devices use ARM-designed CPUs, the firm is a smaller player when it comes to GPUs.
In February the Cambridge-based business said it accounted for about 20% of all Android phones and 50% of Android tablets. Apple's iOS devices use Imagination's GPU tech.

 

The UK version of the Galaxy S4 features an Exynos chip using a GPU designed by Imagination

Swapping one company's mobile GPU design for another is relatively easy as the companies behind them all work to the same open standards.
The Exynos 5 Octa features six ARM Mali T628 GPU cores. The chip can activate more or fewer of them depending on the complexity of a task, allowing devices to minimise power use at times when most of the cores are not needed.
"Consumers want increased functionality on their device, but battery technology hasn't increased at the same rate," a spokesman for ARM told the BBC. "Therefore power efficiency is key."
The chip also uses four of ARM's high-powered A15 CPU cores and four of its weaker A7 CPU cores, with the "big-little" combination again designed to allow devices to alter which parts are used to extend battery life.
Samsung says the CPU cores offer a 20% speed boost over those in the earlier Exynos 5410, used to power the UK version of its Galaxy S4 handset.
Chip competition In addition to using Exynos chips in most of its own Galaxy-branded products, Samsung has also sold them for use in phones and tablets sold by Lenovo, Hyundai and others.
It says the new chip will be powerful enough to offer "desktop-quality" video editing and support 1080p high definition video playback at 60 frames per second.
But the South Korean company faces competition from US firms Nvidia and Qualcomm which are now offering mobile chips capable of supporting the 4K ultra high definition video format.
Intel's new chief executive, Brian Krzanich, has also said his firm plans to accelerate development of its low power Atom chips. Samsung recently took the surprising step of including one of the components in its Galaxy Tab 3 10.1 tablet.
Google's Motorola unit has just announced it is introducing its own chip - called the X8 mobile computing system - for use in its latest handsets. There are reports, though, that this may merely be a tweaked Qualcomm product.

   

Hyundai's HD Design tablet is among third-party products to feature an Exynos processor.
 Source: BBC 

However, another firm, Texas Instruments - which had provided chips for some of Amazon's Kindle tablets - announced last year it would stop investing in the sector because of the high level of competition.
"Samsung has generally done very well at walking the difficult line of being a manufacturer of components - including memory as well as processors - as well as making devices, which can put it head-to-head with the people it is selling parts to," said Chris Green, principal technology analyst at consultants Davies Murphy Group.
"Whilst it's almost certain the primary customer for the new chip will be Samsung itself, the firm will also be looking to maximise on its investment by selling the technology to other manufacturers including big name brands as well as lesser known ones who produce unbranded devices or goods for others."

comments | | Read More...

My first post

Hello,
Welcome to my blog, I will try to introduce you newest news and technique about technology.

I will use news and content from other site, but all content will post with the name of author and co.

comments | | Read More...