10 ms·

T-Mobile quietly hardens part of its U.S. cellular network against snooping

190 points by Libertatea 12y ago

eli 12y ago
This hardens your messages against passive eavesdropping of the wireless signal, but not a targeted attack with a bogus tower, right?
- x1798DE 12y ago
  From the article: Active attacks, involving a device called an “IMSI catcher,” may still be able to eavesdrop on individual calls by manipulating a phone’s security settings directly, without having to crack the encryption. So, just hardens against passive eavesdropping (and only by upgrading to the latest standard, not by any specially devised method).
  - rsync 12y ago
    Also, I think a tower (real or bogus) can instruct your phone to downgrade to no-encryption, in which case the cipher won't matter. If they really wanted to be "progressive" they would allow the phone to display a cipher icon for proper encryption with the tower, which was always part of the GSM spec, but was abandoned very early on. I think your SIM card needs to support that as well, IIRC ...
    - eli 12y ago
      To be fair, it's a lot easier to harden the equipment they own vs the equipment your customers own. I'm not sure such a cipher icon is even possible in iOS without Apple's help. It certainly wouldn't be easy.
      - rsync 12y ago
        It's been a while since I went down this rabbithole, but I think it is required via spec, but only if your SIM card has that feature enabled ... and no carriers anywhere (globally) enable that feature. So I would be interested to see what happens if you insert a SIM card with security checking turned on, into an iphone...
    - BuildTheRobots 12y ago
      With 2G the network verifies the handset and the handset blindly trusts the network. It's not technically a downgrade, A5/0 null cypher is a perfectly valid choice of the 4 available. Sure it screws you as a user but it's not going to cost the network so that's fine. Clarification: Notification to null encryption still exists, and iirc then it's actually mandatory. It's just that you can disable the warning by setting a bit on the simcard which it seems nearly every operator in the world does. As it was so unused the majority of even vaguely modern phones don't seem to have bothered writing the code to handle it anyway. iirc, India _only_ uses A5/0 as it's illegal for them to use crypto [someone please clarify and educate me].
  - eli 12y ago
    Thanks, don't know how I missed that.
x1798DE 12y ago
I have T-Mobile, and I have to say, I've been quite happy with it and I've been just waiting for the other shoe to drop. The only negative thing I hear about them is people don't like the coverage area - which doesn't bother me because when I switched to them they were the only company that offered wifi calling (meaning I can comfortably use my phone at work and at home, where I spend 99% of my time, for the first time in 6-8 years). Do I just have a rosy outlook, or is T-mobile's limited marketshare such a problem that they're somehow disciplined into being an actually good mobile carrier?
- qeorge 12y ago
  Same story here. Have had T-Mo for ~3 years, wouldn't ever switch to one of the other big carriers (I would move to Republic Wireless if I was going to change). My wife moved from Verizon -> T-Mobile last year after finally getting tired of the ridiculous prices from Verizon, and is also very happy. Coverage is fine. Sometimes on road trips to the beach here in North Carolina we will lose service for say 5-10 miles when we are really in the middle of nowhere (the sprawling metropolis of Elizabeth City, NC in particular gives me trouble). This is acceptable in return for nearly 50% savings and not having to do business with AT&T/Verizon.
- dopamean 12y ago
  I've been a T-Mobile customer since 2004 and I've been really happy with them the whole time. The customer service has always been what kept me there even when I (briefly) lived in poor coverage areas. My feeling is that if you live in a good coverage area and you don't do a ton of travel then theres no good reason not to use T-Mobile.
  - matwood 12y ago
    My feeling is that if you live in a good coverage area and you don't do a ton of travel then theres no good reason not to use T-Mobile. Actually if you go to the EU often t-mobiles included data and texting come in handy.
    - dopamean 12y ago
davidholmesnyc 12y ago
Good on Tmobile. I had them about 5 years ago and they was pretty good to me. I only switched because I wanted an iPhone and at the time the unlock community didn't come out with a patch. Because of that service I just opened a new line with them for my second phone and so far so good.
joshavant 12y ago
Just a reminder: TMobile is also actively chipping away at net neutrality through their 'free' music streaming feature. That is, they inspect your traffic and don't charge your bandwidth quota for network traffic with TMobile-selected music streaming services (Spotify, Google Play, etc). http://www.t-mobile.com/offer/free-music-streaming.html http://www.t-mobile.com/offer/free-music-streaming.html
- dylz 12y ago
  They don't DPI your traffic for this feature - if Spotfiy detects you're on .tmodns.net, they will serve you from internal Telekom network caches instead of hitting the wider internet. This is pretty much equivalent to australian ISPs' freezones. They do DPI for other purposes though, such as ensuring that you don't tether without paying (if you use a desktop browser user agent, it'll count your tethering quota separately -- even if you spoof the UA from your phone's browser), and for "caching" HTTP traffic (you'll see a 'X-Via: Harmony proxy' header on any HTTP traffic, on any port). They also hijack DNS NXDOMAIN for ad-filled pages, with no usable opt out ("opt out" uses a cookie that uses javascript to serve the page anyway, then hide it with a fake nginx 404)
  - eli 12y ago
    You can avoid the bogus DNS server by manually choosing Google's alternate server 8.8.4.4 (They intercept the primary one 8.8.8.8 as well as 4.2.2.2.)
    - jevinskie 12y ago
      They do MITM of custom DNS servers? Despicable! I wish DNSCrypt support was more widespread.
      - eli 12y ago
        Yup, that's what it looks like. I just encountered it last week: https://gist.github.com/cjp/f4dda3cc0f26ad10a3fe https://gist.github.com/cjp/f4dda3cc0f26ad10a3fe Been meaning to try to dump some traffic so I can see more of what's going on.
benguild 12y ago
Does this only affect 2G/EDGE for the most part? Because I know that T-Mobile falls back on 2G more often than AT&T does. The only time I’ve been on 2G with AT&T in the last few years was going through the BART tunnel in South Bay… haha.
- esturk 12y ago
  There's a tunnel in South Bay? Don't you mean East Bay near Oakland?
  - freshchilled 12y ago
    He probably just means he was underground. Not the Transbay tube
    - AnimalMuppet 12y ago
      IIRC, there is a fairly lengthy tunnel on the line down to SFO.
      - largote 12y ago
        That is nowhere near the South Bay though.
- largote 12y ago
  BART in the South Bay, huh? Sounds legit.
  - benguild 12y ago
    ... Yes. South San Francisco on the way to the airport. If it's South SF isn't that South Bay? Who drew the line and where :P
    - Apocryphon 12y ago
      Probably Sunnyvale. South S.F. is definitely the Peninsula at least, if not considered part of the city.
ddustin 12y ago
The Wikipedia article for A5/3 says it has been broken in a way that is repeatable with average equipment. If the Washington Post can't be bothered to do 5 minutes of fact checking before publishing it makes me distrust them more generally as a reliable news source. The headline should read "TMobile replaces bad encryption with bad encryption"
teamhappy 12y ago
Germany has great cellular network hackers. If anyone of you would like to know more about this area I'd highly recommend to search for talks by Harald Welte or Karsten Nohl.
sarciszewski 12y ago
A5/3? Where have I seen this before? Oh, right. http://eprint.iacr.org/2010/013.pdf http://eprint.iacr.org/2010/013.pdf
cooperq 12y ago
Um guys, A5/3 is completely broken. According to Wikipedia: "In 2010, Dunkelman, Keller and Shamir published a new attack that allows an adversary to recover a full A5/3 key by related-key attack.[5] The time and space complexities of the attack are low enough that the authors carried out the attack in two hours on an Intel Core 2 Duo desktop computer even using the unoptimized reference KASUMI implementation. The authors note that this attack may not be applicable to the way A5/3 is used in 3G systems; their main purpose was to discredit 3GPP's assurances that their changes to MISTY wouldn't significantly impact the security of the algorithm." Even if A5/3 weren't broken, there are still tower dumps and IMSI catchers, which are a whole lot easier to use than breaking encryption. Yes A5/3 is better than A5/1, but I call bullshit on this whole article.
- rtpg 12y ago
  >Yes A5/3 is better than A5/1, but I call bullshit on this whole article. Super pendantic, but the title is 'hardens' not 'makes hard'. If it's better, than it's been hardened. Might not be the best thing available, but that's the meaning of a comparative.
  - zaroth 12y ago
    Super-duper pedantic, but I would say broken can be considered neither hard nor hardened.
- dmix 12y ago
  > The authors note that this attack may not be applicable to the way A5/3 is used in 3G systems. This is a pretty big conditional. But I still imagine intel agencies have broken KASUMI.
  - yuhong 12y ago
    Yea, it is a related-key attack.
- AlyssaRowan 12y ago
  Indeed, I would not personally consider using KASUMI to be a positive change worthy of the title of "hardening".
cpeterso 12y ago
In other T-Mobile security news, their customer website only supports SSL3 and will stop working with Firefox 34 on November 24 (because SSL3 will disabled due to the POODLE attacks). (Their website login is currently broken in Firefox Beta, Aurora, and Nightly release channels.) https://bugzilla.mozilla.org/show_bug.cgi?id=1042380 https://bugzilla.mozilla.org/show_bug.cgi?id=1042380
joering2 12y ago
For many years I have impression that T-mobile seem to be the most user-friendly network among all of them. I also enjoy their Simple Talk Network. $40 unlimited talk, text, mms, 3G. Sometimes my friends have hard time on their $120 Sprint or $140 ATT plan to get internet fast in places where SimpleTalk (T-mobile rebrand) works like a thunder!
justignore 12y ago
T-MOBILE USED HARDEN! IT WASN'T VERY EFFECTIVE.

190 points by Libertatea 12y ago

eli 12y ago

This hardens your messages against passive eavesdropping of the wireless signal, but not a targeted attack with a bogus tower, right?

x1798DE 12y ago
From the article: Active attacks, involving a device called an “IMSI catcher,” may still be able to eavesdrop on individual calls by manipulating a phone’s security settings directly, without having to crack the encryption. So, just hardens against passive eavesdropping (and only by upgrading to the latest standard, not by any specially devised method).
- rsync 12y ago
  Also, I think a tower (real or bogus) can instruct your phone to downgrade to no-encryption, in which case the cipher won't matter. If they really wanted to be "progressive" they would allow the phone to display a cipher icon for proper encryption with the tower, which was always part of the GSM spec, but was abandoned very early on. I think your SIM card needs to support that as well, IIRC ...
  - eli 12y ago
    To be fair, it's a lot easier to harden the equipment they own vs the equipment your customers own. I'm not sure such a cipher icon is even possible in iOS without Apple's help. It certainly wouldn't be easy.
    - rsync 12y ago
      It's been a while since I went down this rabbithole, but I think it is required via spec, but only if your SIM card has that feature enabled ... and no carriers anywhere (globally) enable that feature. So I would be interested to see what happens if you insert a SIM card with security checking turned on, into an iphone...
  - BuildTheRobots 12y ago
    With 2G the network verifies the handset and the handset blindly trusts the network. It's not technically a downgrade, A5/0 null cypher is a perfectly valid choice of the 4 available. Sure it screws you as a user but it's not going to cost the network so that's fine. Clarification: Notification to null encryption still exists, and iirc then it's actually mandatory. It's just that you can disable the warning by setting a bit on the simcard which it seems nearly every operator in the world does. As it was so unused the majority of even vaguely modern phones don't seem to have bothered writing the code to handle it anyway. iirc, India _only_ uses A5/0 as it's illegal for them to use crypto [someone please clarify and educate me].
- eli 12y ago
  Thanks, don't know how I missed that.

x1798DE 12y ago

I have T-Mobile, and I have to say, I've been quite happy with it and I've been just waiting for the other shoe to drop. The only negative thing I hear about them is people don't like the coverage area - which doesn't bother me because when I switched to them they were the only company that offered wifi calling (meaning I can comfortably use my phone at work and at home, where I spend 99% of my time, for the first time in 6-8 years). Do I just have a rosy outlook, or is T-mobile's limited marketshare such a problem that they're somehow disciplined into being an actually good mobile carrier?

qeorge 12y ago
Same story here. Have had T-Mo for ~3 years, wouldn't ever switch to one of the other big carriers (I would move to Republic Wireless if I was going to change). My wife moved from Verizon -> T-Mobile last year after finally getting tired of the ridiculous prices from Verizon, and is also very happy. Coverage is fine. Sometimes on road trips to the beach here in North Carolina we will lose service for say 5-10 miles when we are really in the middle of nowhere (the sprawling metropolis of Elizabeth City, NC in particular gives me trouble). This is acceptable in return for nearly 50% savings and not having to do business with AT&T/Verizon.
dopamean 12y ago
I've been a T-Mobile customer since 2004 and I've been really happy with them the whole time. The customer service has always been what kept me there even when I (briefly) lived in poor coverage areas. My feeling is that if you live in a good coverage area and you don't do a ton of travel then theres no good reason not to use T-Mobile.
- matwood 12y ago
  My feeling is that if you live in a good coverage area and you don't do a ton of travel then theres no good reason not to use T-Mobile. Actually if you go to the EU often t-mobiles included data and texting come in handy.
  - dopamean 12y ago

davidholmesnyc 12y ago

Good on Tmobile. I had them about 5 years ago and they was pretty good to me. I only switched because I wanted an iPhone and at the time the unlock community didn't come out with a patch. Because of that service I just opened a new line with them for my second phone and so far so good.

joshavant 12y ago

Just a reminder: TMobile is also actively chipping away at net neutrality through their 'free' music streaming feature. That is, they inspect your traffic and don't charge your bandwidth quota for network traffic with TMobile-selected music streaming services (Spotify, Google Play, etc). http://www.t-mobile.com/offer/free-music-streaming.html http://www.t-mobile.com/offer/free-music-streaming.html

dylz 12y ago
They don't DPI your traffic for this feature - if Spotfiy detects you're on .tmodns.net, they will serve you from internal Telekom network caches instead of hitting the wider internet. This is pretty much equivalent to australian ISPs' freezones. They do DPI for other purposes though, such as ensuring that you don't tether without paying (if you use a desktop browser user agent, it'll count your tethering quota separately -- even if you spoof the UA from your phone's browser), and for "caching" HTTP traffic (you'll see a 'X-Via: Harmony proxy' header on any HTTP traffic, on any port). They also hijack DNS NXDOMAIN for ad-filled pages, with no usable opt out ("opt out" uses a cookie that uses javascript to serve the page anyway, then hide it with a fake nginx 404)
- eli 12y ago
  You can avoid the bogus DNS server by manually choosing Google's alternate server 8.8.4.4 (They intercept the primary one 8.8.8.8 as well as 4.2.2.2.)
  - jevinskie 12y ago
    They do MITM of custom DNS servers? Despicable! I wish DNSCrypt support was more widespread.
    - eli 12y ago
      Yup, that's what it looks like. I just encountered it last week: https://gist.github.com/cjp/f4dda3cc0f26ad10a3fe https://gist.github.com/cjp/f4dda3cc0f26ad10a3fe Been meaning to try to dump some traffic so I can see more of what's going on.

benguild 12y ago

Does this only affect 2G/EDGE for the most part? Because I know that T-Mobile falls back on 2G more often than AT&T does. The only time I’ve been on 2G with AT&T in the last few years was going through the BART tunnel in South Bay… haha.

esturk 12y ago
There's a tunnel in South Bay? Don't you mean East Bay near Oakland?
- freshchilled 12y ago
  He probably just means he was underground. Not the Transbay tube
  - AnimalMuppet 12y ago
    IIRC, there is a fairly lengthy tunnel on the line down to SFO.
    - largote 12y ago
      That is nowhere near the South Bay though.
largote 12y ago
BART in the South Bay, huh? Sounds legit.
- benguild 12y ago
  ... Yes. South San Francisco on the way to the airport. If it's South SF isn't that South Bay? Who drew the line and where :P
  - Apocryphon 12y ago
    Probably Sunnyvale. South S.F. is definitely the Peninsula at least, if not considered part of the city.

ddustin 12y ago

The Wikipedia article for A5/3 says it has been broken in a way that is repeatable with average equipment. If the Washington Post can't be bothered to do 5 minutes of fact checking before publishing it makes me distrust them more generally as a reliable news source. The headline should read "TMobile replaces bad encryption with bad encryption"

teamhappy 12y ago

Germany has great cellular network hackers. If anyone of you would like to know more about this area I'd highly recommend to search for talks by Harald Welte or Karsten Nohl.

sarciszewski 12y ago

A5/3? Where have I seen this before? Oh, right. http://eprint.iacr.org/2010/013.pdf http://eprint.iacr.org/2010/013.pdf

cooperq 12y ago

Um guys, A5/3 is completely broken. According to Wikipedia: "In 2010, Dunkelman, Keller and Shamir published a new attack that allows an adversary to recover a full A5/3 key by related-key attack.[5] The time and space complexities of the attack are low enough that the authors carried out the attack in two hours on an Intel Core 2 Duo desktop computer even using the unoptimized reference KASUMI implementation. The authors note that this attack may not be applicable to the way A5/3 is used in 3G systems; their main purpose was to discredit 3GPP's assurances that their changes to MISTY wouldn't significantly impact the security of the algorithm." Even if A5/3 weren't broken, there are still tower dumps and IMSI catchers, which are a whole lot easier to use than breaking encryption. Yes A5/3 is better than A5/1, but I call bullshit on this whole article.

rtpg 12y ago
>Yes A5/3 is better than A5/1, but I call bullshit on this whole article. Super pendantic, but the title is 'hardens' not 'makes hard'. If it's better, than it's been hardened. Might not be the best thing available, but that's the meaning of a comparative.
- zaroth 12y ago
  Super-duper pedantic, but I would say broken can be considered neither hard nor hardened.
dmix 12y ago
> The authors note that this attack may not be applicable to the way A5/3 is used in 3G systems. This is a pretty big conditional. But I still imagine intel agencies have broken KASUMI.
- yuhong 12y ago
  Yea, it is a related-key attack.
AlyssaRowan 12y ago
Indeed, I would not personally consider using KASUMI to be a positive change worthy of the title of "hardening".

cpeterso 12y ago

In other T-Mobile security news, their customer website only supports SSL3 and will stop working with Firefox 34 on November 24 (because SSL3 will disabled due to the POODLE attacks). (Their website login is currently broken in Firefox Beta, Aurora, and Nightly release channels.) https://bugzilla.mozilla.org/show_bug.cgi?id=1042380 https://bugzilla.mozilla.org/show_bug.cgi?id=1042380

joering2 12y ago

For many years I have impression that T-mobile seem to be the most user-friendly network among all of them. I also enjoy their Simple Talk Network. $40 unlimited talk, text, mms, 3G. Sometimes my friends have hard time on their $120 Sprint or $140 ATT plan to get internet fast in places where SimpleTalk (T-mobile rebrand) works like a thunder!

justignore 12y ago

T-MOBILE USED HARDEN! IT WASN'T VERY EFFECTIVE.