6 ms·

Few things evoke feelings of the early internet like intercepting unencrypted communications in the wild with off the shelf hardware and software. It's some ho

Few things evoke feelings of the early internet like intercepting unencrypted communications in the wild with off the shelf hardware and software. It's some how comforting to realize this is still possible today.

charcircuit 3y ago
Considering how much progress that has been made in encrypting internet traffic radio seems painfully slow in evolving to be more secure. Edit: specifically radio protocols not carrying internet traffic
- TechBro8615 3y ago
  Aren't there FCC regulations that forbid encryption over non-military radio?
  - mirashii 3y ago
    For amateur radio, but no in general.
    - tarxvf 3y ago
      And it's not even actually illegal for amateur radio though there continues to be debate on the topic due to the phrasing. I do think that encryption is firmly outside of the amateur culture in most cases, but legality is well covered here: https://www.n5dux.com/ham/files/pdf/Data%20Encryption%20is%20Legal.pdf https://www.n5dux.com/ham/files/pdf/Data%20Encryption%20is%2...
      - Gordonjcp 3y ago
        In the UK, it's illegal to encrypt for the purposes of obscuring communication. There was a lot of noise about G3RUH modems in the olden days when 9600bps packet was starting out, because they used a "scrambler" to whiten the spectrum of the data being sent, and people assumed that meant it was using a secret key to encrypt traffic. I mean, in a sense it was - you're trying to make thing with long runs of patterns look as much like noise as possible, which is the goal of encryption - but in order for it to work as a modem both ends have to have the same "key" which was a very short LFSR that would pull into sync during the training burst. In practice, at least in the UK, you can more-or-less do what you like as long as you're not making a nuisance of yourself. You literally cannot pay Ofcom to investigate anything on the amateur bands, although you might get a lot of grumbling from daft old bastards.
    - warble 3y ago
      It's legal to encrypt as long as anyone can decrypt as I understand it.
      - warble 3y ago
        Sorry, has the means to decrypt it.
  - charcircuit 3y ago
    Well there are radio protocols like wifi and 5g which are encrypted, so I doubt it's illegal.
    - m4rtink 3y ago
      Different spectrum licensing applies to those (ISM & commercial respectively).
  - Gordonjcp 3y ago
    I wouldn't have thought so, since most DMR products are certified for use in the US by the FCC and include fairly strong encryption. Also, do bear in mind that most people don't need to care what the FCC says, or stick to their rules. I'm currently operating equipment that quite thoroughly violates FCC rules, and there's not a thing anyone can do about it :-D
- withinboredom 3y ago
  That’s because there isn’t a point. In order for encryption to work, you need to exchange keys at some point. Doing that half a world away is rather pointless. Doing it over the air, how do I know Alice won’t intercept and broadcast her keys louder than me? Or just interfere and prevent me from sending keys? As we all learned in WWII, a code is better than encryption when you need complex PKI to achieve encryption. It’s more flexible, and can even convey nuances not intended. Ah, sorry I mean a language, not a code. But still, code words and phrases are still a thing.
  - charcircuit 3y ago
    You are ignoring HTTPS allows people half a world awaywo exchange keys with a server and prevents other people follow interfering other than DoS attacks. >As we all learned in WWII, a code is better than encryption when you need complex PKI to achieve encryption I was never in WWII and I'm not sure what you mean by code as typically that's just encryption but less formalized.
    - withinboredom 3y ago
      Https works because there is a destination address that goes to a physical network card. Over the air, there is no 'routing'. Alice can intercept my transmission, then literally, just use a more powerful radio to 'talk over me' with her keys. Ergo, MITM. I worked with guys in the military who did this for a living... Radio is like being able to packet sniff (and modify) packets from anywhere.
      - jiggawatts 3y ago
        HTTPS is secure against man in the middle attacks and will protect transmissions even over radio.
        withinboredom 3y ago
        Yes, once you form the connection it is secure. The handshake is the part that isn't secure on open airwaves. This is how 'evil middle boxes' mitm connections from corporate networks. Edit to add: yes, there are CA's to sign the bits on a network. There is no CA for the radio, only proprietary ones. These can be reverse engineered, subpoenaed, or bought by state actors. Chances are, if you're broadcasting loud enough to be heard by them, they're going to start listening.
- ajsnigrutin 3y ago
  Most of them are pretty secure, a few really old or intentionally open (ham radio) are not, but the rest, are (wifi, 5g, ...)
  - mananaysiempre 3y ago
    Does 5G finally use some sort of viable cryptosystem? 3G and below are hopeless and IIUC LTE is theoretically possible to secure but in practice the implementations suck.
    - toast0 3y ago
      IIRC, LTE is mutually verified encryption. The SIM contains a private key for the subscriber and a public key for the network. I'd expect 5G to also have that.
- aleph_minus_one 3y ago
  > Considering how much progress that has been made in encrypting internet traffic radio seems painfully slow in evolving to be more secure. An important reason that I see is because (at least in Germany, I guess worldwide) ham radio operators are not allowed to encrypt their traffic. Commercial companies are a lot more conservative concerning encryption than "hacker people".
  - wkat4242 3y ago
    That rule is pretty much universal, not just Germany. I guess it's because it would eliminate the possibility of collaboration and also enable using it for commercial purposes without anyone being able to check. There's an exception for command and control systems like satellite control.
- ianpenney 3y ago
  The amateur radio service is not permitted to encrypt our traffic. That doesn’t mean we can’t. Theoretically (not legally tested) you could post the AES256 keys for your DMR radio to the public over the internet and then do it since you disclosed the necessary tools to decode your traffic. Modern radios sync their keys when they are within range of wifi at HQ. Also, see: https://www.cbc.ca/news/canada/toronto/toronto-police-tow-truck-radios-1.5622069 https://www.cbc.ca/news/canada/toronto/toronto-police-tow-tr...
ezoe 3y ago
If you keep emitting radio wave of these frequency for general communication purpose, the local authority will eventually catch you. If the local authority or civilization corrupted, good luck rebuilding it.

charcircuit 3y ago

Considering how much progress that has been made in encrypting internet traffic radio seems painfully slow in evolving to be more secure. Edit: specifically radio protocols not carrying internet traffic

TechBro8615 3y ago
Aren't there FCC regulations that forbid encryption over non-military radio?
- mirashii 3y ago
  For amateur radio, but no in general.
  - tarxvf 3y ago
    And it's not even actually illegal for amateur radio though there continues to be debate on the topic due to the phrasing. I do think that encryption is firmly outside of the amateur culture in most cases, but legality is well covered here: https://www.n5dux.com/ham/files/pdf/Data%20Encryption%20is%20Legal.pdf https://www.n5dux.com/ham/files/pdf/Data%20Encryption%20is%2...
    - Gordonjcp 3y ago
      In the UK, it's illegal to encrypt for the purposes of obscuring communication. There was a lot of noise about G3RUH modems in the olden days when 9600bps packet was starting out, because they used a "scrambler" to whiten the spectrum of the data being sent, and people assumed that meant it was using a secret key to encrypt traffic. I mean, in a sense it was - you're trying to make thing with long runs of patterns look as much like noise as possible, which is the goal of encryption - but in order for it to work as a modem both ends have to have the same "key" which was a very short LFSR that would pull into sync during the training burst. In practice, at least in the UK, you can more-or-less do what you like as long as you're not making a nuisance of yourself. You literally cannot pay Ofcom to investigate anything on the amateur bands, although you might get a lot of grumbling from daft old bastards.
  - warble 3y ago
    It's legal to encrypt as long as anyone can decrypt as I understand it.
    - warble 3y ago
      Sorry, has the means to decrypt it.
- charcircuit 3y ago
  Well there are radio protocols like wifi and 5g which are encrypted, so I doubt it's illegal.
  - m4rtink 3y ago
    Different spectrum licensing applies to those (ISM & commercial respectively).
- Gordonjcp 3y ago
  I wouldn't have thought so, since most DMR products are certified for use in the US by the FCC and include fairly strong encryption. Also, do bear in mind that most people don't need to care what the FCC says, or stick to their rules. I'm currently operating equipment that quite thoroughly violates FCC rules, and there's not a thing anyone can do about it :-D
withinboredom 3y ago
That’s because there isn’t a point. In order for encryption to work, you need to exchange keys at some point. Doing that half a world away is rather pointless. Doing it over the air, how do I know Alice won’t intercept and broadcast her keys louder than me? Or just interfere and prevent me from sending keys? As we all learned in WWII, a code is better than encryption when you need complex PKI to achieve encryption. It’s more flexible, and can even convey nuances not intended. Ah, sorry I mean a language, not a code. But still, code words and phrases are still a thing.
- charcircuit 3y ago
  You are ignoring HTTPS allows people half a world awaywo exchange keys with a server and prevents other people follow interfering other than DoS attacks. >As we all learned in WWII, a code is better than encryption when you need complex PKI to achieve encryption I was never in WWII and I'm not sure what you mean by code as typically that's just encryption but less formalized.
  - withinboredom 3y ago
    Https works because there is a destination address that goes to a physical network card. Over the air, there is no 'routing'. Alice can intercept my transmission, then literally, just use a more powerful radio to 'talk over me' with her keys. Ergo, MITM. I worked with guys in the military who did this for a living... Radio is like being able to packet sniff (and modify) packets from anywhere.
    - jiggawatts 3y ago
      HTTPS is secure against man in the middle attacks and will protect transmissions even over radio.
      - withinboredom 3y ago
        Yes, once you form the connection it is secure. The handshake is the part that isn't secure on open airwaves. This is how 'evil middle boxes' mitm connections from corporate networks. Edit to add: yes, there are CA's to sign the bits on a network. There is no CA for the radio, only proprietary ones. These can be reverse engineered, subpoenaed, or bought by state actors. Chances are, if you're broadcasting loud enough to be heard by them, they're going to start listening.
ajsnigrutin 3y ago
Most of them are pretty secure, a few really old or intentionally open (ham radio) are not, but the rest, are (wifi, 5g, ...)
- mananaysiempre 3y ago
  Does 5G finally use some sort of viable cryptosystem? 3G and below are hopeless and IIUC LTE is theoretically possible to secure but in practice the implementations suck.
  - toast0 3y ago
    IIRC, LTE is mutually verified encryption. The SIM contains a private key for the subscriber and a public key for the network. I'd expect 5G to also have that.
aleph_minus_one 3y ago
> Considering how much progress that has been made in encrypting internet traffic radio seems painfully slow in evolving to be more secure. An important reason that I see is because (at least in Germany, I guess worldwide) ham radio operators are not allowed to encrypt their traffic. Commercial companies are a lot more conservative concerning encryption than "hacker people".
- wkat4242 3y ago
  That rule is pretty much universal, not just Germany. I guess it's because it would eliminate the possibility of collaboration and also enable using it for commercial purposes without anyone being able to check. There's an exception for command and control systems like satellite control.
ianpenney 3y ago
The amateur radio service is not permitted to encrypt our traffic. That doesn’t mean we can’t. Theoretically (not legally tested) you could post the AES256 keys for your DMR radio to the public over the internet and then do it since you disclosed the necessary tools to decode your traffic. Modern radios sync their keys when they are within range of wifi at HQ. Also, see: https://www.cbc.ca/news/canada/toronto/toronto-police-tow-truck-radios-1.5622069 https://www.cbc.ca/news/canada/toronto/toronto-police-tow-tr...

ezoe 3y ago

If you keep emitting radio wave of these frequency for general communication purpose, the local authority will eventually catch you. If the local authority or civilization corrupted, good luck rebuilding it.