how do we protect ourselves on DMR

[kayn1n32008]

We have a radio serial number. Somehow if the serial number would be transmitted, that would solve bogus operators from using our id's. The id would just be part of ouir signal, wouldn't show on the radio.

The administration of such a system would be a full time job. What happens if you buy a new radio? Or you have a portable and a mobile?

Trunking would help solve the problem, but would need to be tier 3 not Capacity+ or Connect+. It would require esn authentication of some sort to ensure that rogue radios would be kept off the system.

P25 with radio authentication or NXDN type C trunking would be better choices for network integrity.


Sent from my iPhone using Tapatalk

 

[slicerwizard]

Brandmeister will offer a solution. Look for "Air Security".
https://swissdmr.ch/wordpress/wp-content/uploads/2017/07/BM-FH2017-final.pdf

Great - so now you need to use your cellphone in order to use your ham radio. And once you're on the air, nothing stops an attacker from spoofing you. Frickin' genius!

You are wasting everyone's time. It is mathematically impossible to have a secure authentication system when all identifying information is broadcast in the clear or available publicly. You have to have non-public ID information for each user, and a secure encrypted information path between the user and the identity authenticator. Basically an RSA public/private keypair for each user, and a SSL-style secured channel to the network access authentication entity. Given the rabidly anti-encryption attitude common among hams, forget about that happening any time soon.

This is not a new problem, and it cannot be solved unless encryption is used.

I suppose you think P25/DMR/NEXEDGE/whatever authentication is done over secure RF channels?

System sends random challenge; subscriber combines random challenge with its secret data, calculates and sends response; system confirms response. Done and done. No encryption used anywhere.

 

[jonwienke]

We have a radio serial number. Somehow if the serial number would be transmitted, that would solve bogus operators from using our id's.

NO. The serial number would still be transmitted over the air in the clear, and thus susceptible to collection and misuse by anyone within range of your radio, and anyone they shares that information with.

This problem has been beaten to death over the last 30 years, and the ONLY solution is cryptographic authentication. Everything else is snake oil or window dressing, and can easily be circumvented. Go read Applied Cryptography by Bruce Schneier and you will learn why.

 

[jonwienke]

System sends random challenge; subscriber combines random challenge with its secret data, calculates and sends response; system confirms response. Done and done. No encryption used anywhere.

Actually, what you are describing is the Diffie-Hellman key exchange protocol, which is a basic component of many cryptographic systems, most notably SSL's key exchange and authentication. The data exchanged is in fact encrypted--that is why an attacker monitoring the data passing between the parties cannot extract the key or authentication token from the data exchanged.

 

[kayn1n32008]

NO. The serial number would still be transmitted over the air in the clear, and thus susceptible to collection and misuse by anyone within range of your radio, and anyone they shares that information with.

Hardware ESN. No encryption needed.



Sent from my iPhone using Tapatalk

 

[jonwienke]

That is still trivially spoofable, just like MAC addresses on networking devices.

 

[kayn1n32008]

Hard to spoof a hardware esn you can not change in a radio.


Sent from my iPhone using Tapatalk

 

[jonwienke]

You can't change the MAC address in a network card, but drivers are widely available that ignore the hardware value and allow the user to supply their own. Spoofing an ESN is trivial if you have third-party firmware with similar functionality, or a SDR.

What you are advocating falls firmly in the category of snake oil that offers an illusion of security, but nothing more.

 

[AI7PM]

It does, and always will come down to the human element. There have been A-holes since the beginning of time, and will be until humans disappear.

Sadly, our hobby attracts said orifices, sometimes above the median.

So called "secure" EDACS and P25 systems even have spoofing issues.

 

[TampaTyron]

In the radio industry, we would ask what your budget is for this "need"...... If the users are not willing to spend money on an upgrade or buy new hardware, then it is a want and not a need. TT

 

[vagrant]

- Security Theater -


Anyways, if one is accused or banned from DMR use and whomever failed to confirm it was the actual assigned user, they are slowly destroying their own user base.

DMR is a good solution for the service world. I am not convinced it is a good solution for amateur radio.

 

[razorseal]

I just came to this thread because someone with ID 6662226 was transmitting bs over the air on North America. The only annoyance with this over conventional is, when he keys up to troll, he is waking up every single repeater in north america. It can be Guadalupe from mexico, or Vlad Donokov from russia tapping into a repeater nearby and opening up all the repeaters in NA. not limited to the range of him to the repeater, or only waking up that single repeater.

****ty downfall.

Is there a website to see what repeater a certain caller ID is waking up? I looked on hoseline, but doesn't show. I assume that only shows repeaters connected via the BM network. Not sure

 

[razorseal]

- Security Theater -


Anyways, if one is accused or banned from DMR use and whomever failed to confirm it was the actual assigned user, they are slowly destroying their own user base.

DMR is a good solution for the service world. I am not convinced it is a good solution for amateur radio.

Very true.

 

[paulears]

Isn't the real problem that the system was never designed for thousands and thousands of users from all over the world? Insufficient safeguards exist to protect the system. Anyone with a stolen, or to be honest, simply mistyped ID, gets to use the entire system? It can only get worse once the idiots spot the havoc they can cause. A free access system with thousands of RF nodes. Why are we even surprised? It's even worse because hardly any users know how the system backbone works, all they know is their local access point and a load of groups they wish to use - the magic behind the scenes is unimportant to them.

 

[Project25_MASTR]

Isn't the real problem that the system was never designed for thousands and thousands of users from all over the world? Insufficient safeguards exist to protect the system. Anyone with a stolen, or to be honest, simply mistyped ID, gets to use the entire system? It can only get worse once the idiots spot the havoc they can cause. A free access system with thousands of RF nodes. Why are we even surprised? It's even worse because hardly any users know how the system backbone works, all they know is their local access point and a load of groups they wish to use - the magic behind the scenes is unimportant to them.

That's a part of the problem. The main problem is that DMR grew too quickly to properly redesign to a more efficient arrangement. Another problem is amateur development has really only encompassed two manufactures on the infrastructure side, Motorola and Hytera both of which are in direct competition with one another compared to the lesser known manufacturers who have features such as talk group whitelisting, ID white and black listing. But yes, Tier II was never really designed to be expanded to such a large footprint with hundreds or thousands of sites. That was always the job of Tier III.

 

[N4GIX]

A few weeks ago I was testing out a newly programmed GD-77 and noticed that when I tried testing #3118 (Indiana Statewide), my callsign/name showed up on #3 (North America)...

It took several minutes for me to finally notice that "I" was showing up even when I wasn't even transmitting. That's when I took a closer look and discovered that some nitwit on a damn dongle was using my MARC ID #... <sigh>

 

[SCPD]

Digital

I just came to this thread because someone with ID 6662226 was transmitting bs over the air on North America. The only annoyance with this over conventional is, when he keys up to troll, he is waking up every single repeater in north america. It can be Guadalupe from mexico, or Vlad Donokov from russia tapping into a repeater nearby and opening up all the repeaters in NA. not limited to the range of him to the repeater, or only waking up that single repeater.

****ty downfall.

Is there a website to see what repeater a certain caller ID is waking up? I looked on hoseline, but doesn't show. I assume that only shows repeaters connected via the BM network. Not sure

Yeah but I am sure they blacklisted that ID code.
Heres a weird question, how come they don't only allow legit assigned to your callsign codes ?
Then morons who put weird codes in won't be messing up DMR reeaters.
It is a computer run system so it should't be hard to implement!

 

[jonwienke]

Some of those "weird" callsigns are valid non-US callsigns. Not all foreign countries have easily searchable FCC-style callsign databases that can be used to validate callsigns.

 

[razorseal]

Yeah, making it so only valid IDs can transmit would be nice.

You guys talk alot about mistyped IDs, or weird IDs... you can transmit as anyone. 1111111, 222222, 123456, 66622266 or whatever. Just simply make up a number.

 

[Project25_MASTR]

Yeah, making it so only valid IDs can transmit would be nice.

You guys talk alot about mistyped IDs, or weird IDs... you can transmit as anyone. 1111111, 222222, 123456, 66622266 or whatever. Just simply make up a number.

There's no centrally managed databases for Tier II (granted some Tier II repeaters are capable of it but not Motorola or Hytera repeaters). That's something you would see in a trunking application.