The cracking of GSM "encryption" has been making the inter-rounds lately, and this week on the Security Now! Podcast, Steve Gibson takes a look at how badly it's broken, and what the potential risks are. In simple terms, it means what you say on your iPhone -- or any GSM phone, which includes all phones on AT&T, T-Mobile, Rogers, and almost all phones internationally -- can be intercepted, decrypted, and listened to if a person has several thousand dollars worth of equipment and the motivation to do it. In more complex terms:
So again, we're now at the hobby level. We're at the level where the hobbyist with a couple thousand dollars can - needs to know nothing about radio and even hardware. And even all of the preprocessing steps for demultiplexing the data and analyzing it and performing spectrum analysis and finding the channels and everything, all of that's been done. There's even some people have taken - they're not at the GPL licensing, but they are - so they're proprietary licenses, but free, but they're open source and free for personal use, where turnkey packages to pull all this data together have been produced. There's even one which abstracts this USRP, this Universal Software Radio Peripheral, making it look like a network device so that Wireshark, our favorite packet capture utility, is able to capture GSM packets and decode them and show you all the bits and all the protocols and everything going on in a stream that you capture.
So, I mean, we're way far along in making this possible. In my opinion, this GSM Alliance is - they're saying what they have to say politically; but, if they really believe what they're saying, that they're in serious denial because this is no longer James Bond government-level sci-fi stuff. It would be entirely possible for a company who wanted to do some surveillance of a competitor to equip a van with some of this equipment, spending only tens of thousands of dollars, park it across the street from a competitor, aim their antennas at the competitor's building, and spend a day just streaming in, sucking in all of the cellphone traffic that is being transacted by the employees within the building, and then drive the van off and decrypt those conversations offline afterwards and find out what was being said. I mean, it is no longer difficult to do. It's entirely possible.
It should be noted that the GSMA (GSM Alliance) seems to consider this attack theoretical and impractical for now. If you're interested in more, check out the audio podcast [MP3 link] or the transcript.
Tim Cook agrees to testify before House antitrust committee
Tim Cook has agreed to testify before a house antitrust committee alongside the CEOs of Google, Facebook, and Amazon.
Display analyst pours cold water on iPhone 12 Pro 120Hz display claims
Will iPhone 12 Pro have a 120Hz display? We thought so, but display analyst Ross Young says not.
Enhance Recording & more coming to Voice Memos in iOS 14 and macOS Big Sur
Apple announced plenty of new iOS 14 and macOS Big Sur features during WWDC, but one that didn't get any screen time was a new Enhance Recording feature in the Voice Memos app.
Keep your teapot warm and cozy (and cute) with these cozies
Slip one of these sweet tea cozies onto your teapot to keep your tea warm. Tea cozies also add a homey flair to your kitchen, since you can choose a tea cozy to match your style.