6 ms·

The mobile phone industry has failed security and privacy with every single technology for over 40 years. Every single layer, and every single generation, is b

The mobile phone industry has failed security and privacy with every single technology for over 40 years. Every single layer, and every single generation, is broken. Example: The encryption has been home-grown in every generation, and every generation has been broken. They keep reinventing their own shit, even though EVERYONE knows you DO NOT DO THAT. Another example: The backbone of cross-operator traffic has ZERO authentication. If you're lucky it has ACLs on IP addresses. (and if you thought BGP hijacking on the internet was lax and unmonitored...) Another: The GTP protocol on this network has a "high security" mode, where it only allows clients who set the "yes, I'm authenticated" bit in the header. Yes, really. A bit. And operationally like half the nodes in phone networks have a password of "letmein", "password", or "Secret" (capital 's', very high security). I've seen companies accidentally log in to their competitors nodes, because the both used "letmein" as password! There is NO POSSIBLE WAY anyone can be this incompetent. I give the benefit of doubt, but we're approaching half a century of EVERY SINGLE THING, standards, implementation, policies, and operations, being completely broken. At what point can we say for certain that this is malice, this is deliberate backdooring of all phone infrastructure?

teawrecks 6y ago
What you're saying might be true, I have no idea, but then why don't we see more rampant vandalism from randos (ex. War Games)? It seems like in this day and age it wouldn't take any time for someone to brute force any of these nodes and cause a ruckus.
- mikehotel 6y ago
  A combination of factors like vilification of hacking, corporate PR managing embarrassing incidents and responsible disclosure can cause most of this activity to be under-reported.
- grenoire 6y ago
  Because the 'randos' know very well that they cannot surface with any of their actions. Even the white hats are getting regularly punished for their disclosures, what makes you think someone making a living off of exploits would come clean?* * Academic researchers excl.
- xvector 6y ago
  These networks are almost certainly compromised to high hell, except the actors don't broadcast their action.
- knorker 6y ago
  What, like SS7 phone hijacks and fake base stations tracking, and such, that happen all the time? > it wouldn't take any time for someone to brute force any of these nodes and cause a ruckus. 1) Who says it doesn't happen? 2) Generally these things aren't on "the internet". They're behind firewalls and on this "other internet" I mentioned between the operators. You can legit buy access to this network for a few thousand dollars, sure. But if you're that serious you're probably not a rando after "rampant vandalism".
- heavyset_go 6y ago
  IMSI-catchers are in wide use by local law enforcement in much of North America[1], no warrant needed and law enforcement can do whatever it is they like with them with no oversight, too, except use them to present evidence in court without a warrant. [1] https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Stingray_phone_tracker
Jonnax 6y ago
The other side of this is that mobile networks are national infrastructure. The concept of "lawful intercept" is baked into the networks from a fundamental standpoint. This might be a reason why there's less care about these things.
- ampdepolymerase 6y ago
  That is correct. It is the same reason why fax machines are considered secure transmission for medical data. National infrastructure is harder to compromise at scale compared to internet channels.
- rocqua 6y ago
  The mobile interop is really good, that is because standardization is done rather well technologically and widely followed. This also means that standardization is fought over harshly. Anything that gets standardized will see wide use. What if the standardization picks a technology you are a market leader in? What if the standardization picks a technology you have a patent on? Yeah, you will be forced to let people license the patent. But you will be getting licensing fees.
- knorker 6y ago
  But this is not the way LI systems work. They have a "front door". At least for police powers. For intelligence agencies, sure.
  - Jonnax 6y ago
    Indeed. My point was more that due to things like LI. It might influence an attitude towards security of "it doesn't really matter" when it comes to properly implementing secure controls
elric 6y ago
I've wondered about this as well. There is an "innocent" explanation, aside from incompetence: there's layers upon layers of stuff, designed, owned and managed by a plethora of organizations. If no one organization is liable, they're not likely to be proactive about security. The cynic in me, of course, suspects this is no accident.
- knorker 6y ago
  I'd agree, but that doesn't explain why not only is the big picture absolutely broken, but so is every single detail. The indivisible parts are also broken.
  - Olreich 6y ago
    AT&T is the public-facing company with a ton of cash. They want to advertise the next speed bump in cellular. They hire a contractor to build it nationwide. That contractor hires 4 contractors for regions of the US and pockets some profit. Each of those contractors hires another 20 contractors to handle the rollout and pocket some profit. The 20 contractors talk to a variety of hardware integrators about deploying the new technology and start getting permits. The hardware integrators have a 90% chance of being from the world of industrial systems where closed networks and point to point runs means they get to pretend security isn’t their problem. They apply the same principles to their hardware installs. AT&T wants to be able to administrate and manage their new hardware without keeping 1000 hardware integrators on payroll, so they have their contractors’ contractors develop a manual that can be used by AT&T Network Services, but this is out of the initial CAPEX quota, so it’s done on the cheap and no one does any real work. They just grab all the default passwords and architecture estimates from the integrators and put it into a set of hundred page books for different parts of the network. The government, customers, and shareholders choose to not hold AT&T accountable for any failures in their network. They instead accept it as “the way things must be”, and AT&T is happy to buy into that story and do the exact same thing on every capital project and maintenance. This is how you get telcos failing at security every time for decades. Their incentives as a customer-facing company running the worlds largest infrastructure projects encourage them to farm out all the infrastructure work to several layers deep of contractors with no real responsibility enforced by anyone.
creato 6y ago
I don't see why we should even be trying to make base level protocols like this "secure". Focus on reliability and simplicity, leave security to another level of the stack. VOIP and web browsing services should be encrypted, who cares whether the low level protocol is encrypted or not? Anything that needs to be standardized and stable for decades needs to be simple, and it shouldn't matter whether there are vulnerabilities, because those are inevitable.
- knorker 6y ago
  Some things can't be done on the top level. E.g. anti-tracking and metering. Also because airtime is a scarce resource it's not as simple as "just give me a lower layer and I'll run VOIP". The requirements (and performance and reliability) of voice calls is higher than skype over an IP network on mobile. E.g. there's a reason SCTP is actually used here. Phone networks are in some ways rightly very different from pure packet Internet. Sometimes just for historical reasons from the olden times, but often also justifiably so. I could go on and on, but tl;dr: it's not that simple, but you're also not wrong.
m463 6y ago
5g is unblockable corporate wifi, relaying unconnected 5g devices to connected ones. by accident.
logicchains 6y ago
>There is NO POSSIBLE WAY anyone can be this incompetent. All this stuff is designed and built by hardware companies. I haven't used a single piece of software written by a hardware company that didn't suck (not counting Apple as a hardware company). If hardware companies can't (or don't care about) writing decent software even when a bad user experience can affect their bottom line, I can't imagine they're particularly likely to write secure software. This probably won't change unless hardware companies stop paying so poorly, as anyone who can code well can get a huge salary increase just by moving from a hardware company to a software company.
yencabulator 6y ago
Back in the 90s, a Nokia researcher gave a guest lecture at our university about how the intelligence community specifically and intentionally sabotaged the GSM encryption. Similarly, the backbone was kept easy to wiretap, without those pesky warrants.

teawrecks 6y ago

What you're saying might be true, I have no idea, but then why don't we see more rampant vandalism from randos (ex. War Games)? It seems like in this day and age it wouldn't take any time for someone to brute force any of these nodes and cause a ruckus.

mikehotel 6y ago
A combination of factors like vilification of hacking, corporate PR managing embarrassing incidents and responsible disclosure can cause most of this activity to be under-reported.
grenoire 6y ago
Because the 'randos' know very well that they cannot surface with any of their actions. Even the white hats are getting regularly punished for their disclosures, what makes you think someone making a living off of exploits would come clean?* * Academic researchers excl.
xvector 6y ago
These networks are almost certainly compromised to high hell, except the actors don't broadcast their action.
knorker 6y ago
What, like SS7 phone hijacks and fake base stations tracking, and such, that happen all the time? > it wouldn't take any time for someone to brute force any of these nodes and cause a ruckus. 1) Who says it doesn't happen? 2) Generally these things aren't on "the internet". They're behind firewalls and on this "other internet" I mentioned between the operators. You can legit buy access to this network for a few thousand dollars, sure. But if you're that serious you're probably not a rando after "rampant vandalism".
heavyset_go 6y ago
IMSI-catchers are in wide use by local law enforcement in much of North America[1], no warrant needed and law enforcement can do whatever it is they like with them with no oversight, too, except use them to present evidence in court without a warrant. [1] https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Stingray_phone_tracker

Jonnax 6y ago

The other side of this is that mobile networks are national infrastructure. The concept of "lawful intercept" is baked into the networks from a fundamental standpoint. This might be a reason why there's less care about these things.

ampdepolymerase 6y ago
That is correct. It is the same reason why fax machines are considered secure transmission for medical data. National infrastructure is harder to compromise at scale compared to internet channels.
rocqua 6y ago
The mobile interop is really good, that is because standardization is done rather well technologically and widely followed. This also means that standardization is fought over harshly. Anything that gets standardized will see wide use. What if the standardization picks a technology you are a market leader in? What if the standardization picks a technology you have a patent on? Yeah, you will be forced to let people license the patent. But you will be getting licensing fees.
knorker 6y ago
But this is not the way LI systems work. They have a "front door". At least for police powers. For intelligence agencies, sure.
- Jonnax 6y ago
  Indeed. My point was more that due to things like LI. It might influence an attitude towards security of "it doesn't really matter" when it comes to properly implementing secure controls

elric 6y ago

I've wondered about this as well. There is an "innocent" explanation, aside from incompetence: there's layers upon layers of stuff, designed, owned and managed by a plethora of organizations. If no one organization is liable, they're not likely to be proactive about security. The cynic in me, of course, suspects this is no accident.

knorker 6y ago
I'd agree, but that doesn't explain why not only is the big picture absolutely broken, but so is every single detail. The indivisible parts are also broken.
- Olreich 6y ago
  AT&T is the public-facing company with a ton of cash. They want to advertise the next speed bump in cellular. They hire a contractor to build it nationwide. That contractor hires 4 contractors for regions of the US and pockets some profit. Each of those contractors hires another 20 contractors to handle the rollout and pocket some profit. The 20 contractors talk to a variety of hardware integrators about deploying the new technology and start getting permits. The hardware integrators have a 90% chance of being from the world of industrial systems where closed networks and point to point runs means they get to pretend security isn’t their problem. They apply the same principles to their hardware installs. AT&T wants to be able to administrate and manage their new hardware without keeping 1000 hardware integrators on payroll, so they have their contractors’ contractors develop a manual that can be used by AT&T Network Services, but this is out of the initial CAPEX quota, so it’s done on the cheap and no one does any real work. They just grab all the default passwords and architecture estimates from the integrators and put it into a set of hundred page books for different parts of the network. The government, customers, and shareholders choose to not hold AT&T accountable for any failures in their network. They instead accept it as “the way things must be”, and AT&T is happy to buy into that story and do the exact same thing on every capital project and maintenance. This is how you get telcos failing at security every time for decades. Their incentives as a customer-facing company running the worlds largest infrastructure projects encourage them to farm out all the infrastructure work to several layers deep of contractors with no real responsibility enforced by anyone.

creato 6y ago

I don't see why we should even be trying to make base level protocols like this "secure". Focus on reliability and simplicity, leave security to another level of the stack. VOIP and web browsing services should be encrypted, who cares whether the low level protocol is encrypted or not? Anything that needs to be standardized and stable for decades needs to be simple, and it shouldn't matter whether there are vulnerabilities, because those are inevitable.

knorker 6y ago
Some things can't be done on the top level. E.g. anti-tracking and metering. Also because airtime is a scarce resource it's not as simple as "just give me a lower layer and I'll run VOIP". The requirements (and performance and reliability) of voice calls is higher than skype over an IP network on mobile. E.g. there's a reason SCTP is actually used here. Phone networks are in some ways rightly very different from pure packet Internet. Sometimes just for historical reasons from the olden times, but often also justifiably so. I could go on and on, but tl;dr: it's not that simple, but you're also not wrong.

m463 6y ago

5g is unblockable corporate wifi, relaying unconnected 5g devices to connected ones. by accident.

logicchains 6y ago

>There is NO POSSIBLE WAY anyone can be this incompetent. All this stuff is designed and built by hardware companies. I haven't used a single piece of software written by a hardware company that didn't suck (not counting Apple as a hardware company). If hardware companies can't (or don't care about) writing decent software even when a bad user experience can affect their bottom line, I can't imagine they're particularly likely to write secure software. This probably won't change unless hardware companies stop paying so poorly, as anyone who can code well can get a huge salary increase just by moving from a hardware company to a software company.

yencabulator 6y ago

Back in the 90s, a Nokia researcher gave a guest lecture at our university about how the intelligence community specifically and intentionally sabotaged the GSM encryption. Similarly, the backbone was kept easy to wiretap, without those pesky warrants.