4 ms·

>especially for embedded systems Do any embedded systems actually use it for sensitive phone calls? If they're just using it as data transport then they (hopef

>especially for embedded systems Do any embedded systems actually use it for sensitive phone calls? If they're just using it as data transport then they (hopefully) have TLS on top.

ale42 2y ago
> Do any embedded systems actually use it for sensitive phone calls? I hope not... > then they (hopefully) have TLS on top. I'd hope so too, especially given that many cellular modem modules have SSL/TLS support themselves (and they had already 10 years ago), so even a tiny microcontroller communicating by UART to the modem can do TLS. But reality might be different... it would actually be interesting to see some real-world data about this. I think that some systems connect to special GPRS endpoints (not the usual ones) that connect them directly to some VPN network instead of using the public internet... (if I remember well, I've read this about some automotive systems). So they might actually rely on the VPN encryption for the Internet part, but the GPRS part would then be unsecured if the GPRS crypto is broken.
- 486sx33 2y ago
  These systems used to be considered secure. Lots of things blast data out over gprs, at one time it was a backup for home security systems for example. Since throughput was limited and data was expensive, the actual communication was usually designed to be as quick and “frugal” as possible. There used to be lots of weird end points like BB PIN messages (which were encrypted on their own) but most of that is retired now. I imagine gprs will appear as an attack vector for … something
pzs 2y ago
> an attacker passively eavesdropping a GSM communication between a target and a base station can decrypt any 2-hour call with probability 0.43, in 14 min The authors give the above example in the abstract. It does not look like the typical use case for embedded systems. I would think embedded systems send and receive small amounts of non-critical data over GSM, hopefully encrypted, as the parent pointed out. But I may be wrong here - is there a real use case for attacking embedded systems using this method?
- mschuster91 2y ago
  > But I may be wrong here - is there a real use case for attacking embedded systems using this method? yeah, any IoT device that has been built with the assumption of GSM being not eavesdroppable. Cars and alarm systems come to my mind here.
Cthulhu_ 2y ago
I wouldn't make that assumption; adding TLS or HTTP on top adds more work and processing power, and if good-enough encryption was promised by the use of GSM/GPRS, why would they add it on top? That's like adding custom encryption on top of HTTPS... which isn't unheard of actually, I knew someone who built that for a banking app, and an ethical hacker got through the HTTPS layer pretty fast.
- quesera 2y ago
  > an ethical hacker got through the HTTPS layer pretty fast. Are we talking obsolete SSL ciphers?
rocqua 2y ago
TLS will protect the data, but the same encryption also does a lot on the control plane. That can still be a big issue.
rnhmjoj 2y ago
Only embedded systems? At least in Italy, ISPs have enabled VoLTE (voice over LTE) just a couple of years ago and I don't know how well-supported it is by phones. I wouldn't be surprised if the vast majority of calls still happens over GSM (3G networks have been dismantled already, here).
- iforgotpassword 2y ago
  I'm in Germany, my phone most of the time has the volte icon in the status bar, but whenever I start/receive a call and it actually starts out in that mode it usually falls back to GSM after a minute or so. Doesn't seem very stable.
yencabulator 2y ago
Many systems have been built directly on top of SMS, for very low-bandwidth messaging.
eqvinox 2y ago
> they (hopefully) have TLS on top. my sweet summer child… One, traces recorded 10 years ago can be decrypted now. Even if it's getting better now, 2014 era embedded systems barely had the capability to encrypt their traffic. Two… GSM, GPRS, … the entire telco world … is sold as secure by merit of government standards body rubberstamp. How many government-related or …-regulated embedded systems are out there you think? And how many just took the "GSM → secure" checkbox?

>especially for embedded systems Do any embedded systems actually use it for sensitive phone calls? If they're just using it as data transport then they (hopefully) have TLS on top.

ale42 2y ago

> Do any embedded systems actually use it for sensitive phone calls? I hope not... > then they (hopefully) have TLS on top. I'd hope so too, especially given that many cellular modem modules have SSL/TLS support themselves (and they had already 10 years ago), so even a tiny microcontroller communicating by UART to the modem can do TLS. But reality might be different... it would actually be interesting to see some real-world data about this. I think that some systems connect to special GPRS endpoints (not the usual ones) that connect them directly to some VPN network instead of using the public internet... (if I remember well, I've read this about some automotive systems). So they might actually rely on the VPN encryption for the Internet part, but the GPRS part would then be unsecured if the GPRS crypto is broken.

486sx33 2y ago
These systems used to be considered secure. Lots of things blast data out over gprs, at one time it was a backup for home security systems for example. Since throughput was limited and data was expensive, the actual communication was usually designed to be as quick and “frugal” as possible. There used to be lots of weird end points like BB PIN messages (which were encrypted on their own) but most of that is retired now. I imagine gprs will appear as an attack vector for … something

pzs 2y ago

> an attacker passively eavesdropping a GSM communication between a target and a base station can decrypt any 2-hour call with probability 0.43, in 14 min The authors give the above example in the abstract. It does not look like the typical use case for embedded systems. I would think embedded systems send and receive small amounts of non-critical data over GSM, hopefully encrypted, as the parent pointed out. But I may be wrong here - is there a real use case for attacking embedded systems using this method?

mschuster91 2y ago
> But I may be wrong here - is there a real use case for attacking embedded systems using this method? yeah, any IoT device that has been built with the assumption of GSM being not eavesdroppable. Cars and alarm systems come to my mind here.

Cthulhu_ 2y ago

I wouldn't make that assumption; adding TLS or HTTP on top adds more work and processing power, and if good-enough encryption was promised by the use of GSM/GPRS, why would they add it on top? That's like adding custom encryption on top of HTTPS... which isn't unheard of actually, I knew someone who built that for a banking app, and an ethical hacker got through the HTTPS layer pretty fast.

quesera 2y ago
> an ethical hacker got through the HTTPS layer pretty fast. Are we talking obsolete SSL ciphers?

rocqua 2y ago

TLS will protect the data, but the same encryption also does a lot on the control plane. That can still be a big issue.

rnhmjoj 2y ago

Only embedded systems? At least in Italy, ISPs have enabled VoLTE (voice over LTE) just a couple of years ago and I don't know how well-supported it is by phones. I wouldn't be surprised if the vast majority of calls still happens over GSM (3G networks have been dismantled already, here).

iforgotpassword 2y ago
I'm in Germany, my phone most of the time has the volte icon in the status bar, but whenever I start/receive a call and it actually starts out in that mode it usually falls back to GSM after a minute or so. Doesn't seem very stable.

yencabulator 2y ago

Many systems have been built directly on top of SMS, for very low-bandwidth messaging.

eqvinox 2y ago

> they (hopefully) have TLS on top. my sweet summer child… One, traces recorded 10 years ago can be decrypted now. Even if it's getting better now, 2014 era embedded systems barely had the capability to encrypt their traffic. Two… GSM, GPRS, … the entire telco world … is sold as secure by merit of government standards body rubberstamp. How many government-related or …-regulated embedded systems are out there you think? And how many just took the "GSM → secure" checkbox?