P25 Security Weaknesses VIDEO

[ntnahed]

I read DJX's thread with great interest, and I'd just like to mention that the subject is P25, not trunking or DES... One of the points made in this vid is that it IS possible to jam encrypted P25 transmissions, forcing users to transmit in the clear, thus making encryption moot. Denial of Service attacks have also proven feasible. As in, it's been done.

This is a VERY interesting video of a powerpoint presentation by Matt Blaze at the 20th USENIX Security Symposium (USENIX Security '11), held August 8--12, 2011, in San Francisco, CA. Blaze is one of the Penn U team who wrote the paper on P25 Security Weaknesses that was posted in this forum by DJX.

A Security Analysis of the APCO Project 25 Two-Way Radio System - YouTube

"Abstract: We found a number of protocol, implementation, and user interface weaknesses that routinely leak information to a passive eavesdropper or that permit highly efficient and difficult to detect active attacks. We introduce new selective subframe jamming attacks against P25, in which an active attacker with very modest resources can prevent specific kinds of traffic (such as encrypted messages) from being received, while emitting only a small fraction of the aggregate power of the legitimate transmitter. We also found that even the passive attacks represent a serious practical threat."

Apparently, P25 is not nearly as secure as it was advertized to be. This vid covers jamming by forcing users to transmit in the clear by garbling encrypted traffic and denial of service attacks using the Girltech IMME toy instant messenger priced at $15. There's a unicorn on the box...
To quote Blaze,
" We developed our own P25 jamming firmware... It turns out to work ENTIRELY EFFECTIVELY."
(14:45 on the vid)

Using one of these:
Amazon.com: Radica IM Me Wireless Handheld Device: Toys & Games

And, BTW, instructions for re-flashing the toy are already on the 'net:

Travis Goodspeed's Blog: IM ME GoodFET Wiring Tutorial

So - A girl's toy, linear amp and some basic computer skills can jam an entire P25 system? This kind of reminds me of the stories about the Serbs in Yugoslavia using modified microwave ovens to trick NATO aircraft into firing $100,000 anti-radar missiles at phony anti-aircraft sites...

 

[greenthumb]

I don't know that P25 was ever advertised to be a secure protocol. If you use 256 bit AES, that will secure your voice transmissions from being decoded. Nothing about AES or P25 has ever been touted as the all-encompassing end-all for public safety two-way wireless communications security. Any RF protocol (including analog) is subject to DoS via jamming. On the subject of jamming - what is described is more of a social engineering attack since they are jamming the encrypted communications, but not the communications in the clear. Thus, when the users try and switch to clear mode to see if the digital transmissions go away and they do, the result is that the un-educated user took the action because they were tricked.

 

[OCO]

Pretty well covered here at RR already (right down the page)...

Security Weakness in P25
P25 encryption hacking
Security Flaw

 

[kb0uxv]

Great, now people can start messing with P25 systems like the old analog ones.

Our old VHF system was plagued by a man who would break in on calls, play music on our main, swear on the radio, etc. My guess is he moded a ham radio or programmed a commercial radio with the info on this website. Maybe if he reads this thread he will figure out how to mess with our TRS.

My opinion: posting info on how to interfere with P25 systems, break DES-OFB, make system keys and put a radio on a TRS, etc in public forums is irresponsible. This is good info to know about, for people in the industry, but does it need to be in the clear?

 

[krokus]

Wirelessly posted (BlackBerry8530/5.0.0.973 Profile/MIDP-2.1 Configuration/CLDC-1.1 VendorID/105)

Knowledge is a tool. Any tool can be put to nefarious use.

 

[com501]

How to build a nuclear weapon is on the 'net too, but not many people build them (we hope).

Information is what the Internet was build for. How you use it is your moral dilemma....