CDMA security?

July 28, 2009 9:03 AM

How worried do I need to be about bringing my cellphone to the DEFCON hackers security convention?

I'll have WiFi and bluetooth turned off. Treo 800w. Sprint. Not roaming.

It would be very nice to be able to bring my phone with me for web and email, etc. I know that if I do that over Sprint's data network this would normally be secure. But if someone is going to try cracking CDMA, spoofing access points, etc, DEFCON is one of the places you would find that.

Googling is not helping me get a more comfortable technical answer to this issue. I'm hoping someone who is more knowledgeable about cell phone security can give me a realistic idea of how dangerous it might be to check email in this environment (assuming no WiFi usage).

posted by y6y6y6 to Technology (28 answers total)

As an attendant of Defcon for several years, my suggestion is to pop the battery of your cellphone when you enter.

There have been several demonstrations there of sniffing, and influencing cdma networks.

If you are going to do it, keep bluetooth off always.
Keep the radio on only when you have to.
posted by digividal at 9:17 AM on July 28, 2009

Response by poster: "As an attendant of Defcon for several years, my suggestion is to pop the battery of your cellphone when you enter. "

Anything more specific? "Better safe than sorry" might be good advice, but it's also FUD.

Maybe I'm not asking right.

I think it would be stupid to pop the battery just on the assumption that bad things which no one knows about are possible. What I'm more worried about are real security risks. Unfortunately I'm not knowledgeable about this sort of security to evaluate what I'm finding online (not much).

My instincts, tempered by what little I have found, make me think it would be safe to a very reasonable level. That is, everything I'm reading indicates it would be easier to break into Sprint and tap their lines there than to pull my password out of the air. My main worry is that I'm failing to find the article with the actual exploit.
posted by y6y6y6 at 9:54 AM on July 28, 2009

bad things which no one knows about are possible. What I'm more worried about are real security risks.

Bad things which no one knows about ARE real security risks at DEFCON.

"Better safe than sorry" isn't FUD, it's computer security standard operating procedure.
posted by toomuchpete at 10:23 AM on July 28, 2009

Response by poster: No. It's not.

If your network security people are actually saying, "We have no idea what the dangers are, or even if there are any. Just turn everything off", you need to find new security people. Uncertainty is bad security.
posted by y6y6y6 at 10:47 AM on July 28, 2009

I have a friend who's given talks at DEFCON before. He said that he was wary of using anything that sends or receives a signal.
posted by reductiondesign at 10:49 AM on July 28, 2009

I have to agree with people who are saying "better safe than sorry." As others have said, of all the places some new vector might be utilized DEFCON or other security conferences seem kind of high on the list. If you have worries about the security of your device and the risk of compromise isn't acceptable to you, don't use it. If the risk of what is at heart an unknown is acceptable to you, use it. Having people speculate about what might or might not be present in that environment isn't going to make you any more or less secure.
posted by zennoshinjou at 11:15 AM on July 28, 2009

If your network security people are actually saying, "We have no idea what the dangers are, or even if there are any. Just turn everything off", you need to find new security people. Uncertainty is bad security.

That's completely unrealistic in the real world. You don't address each threat specifically because you are not smart or well connected enough to know what everyone else in the universe is going to do. You deal with as many threats as broadly as possible, and then with the specific ones that get through that defense. You don't know if a thief has a lockpick, a bump lock, a passkey or a fire axe, but you still lock your door. Seeing as you're attending a convention of hackers, some of whom are, for the first time, revealing research about new exploits you might not know about the attacks until it's too late.

Add to it the competitions for hacking devices in real world situations, (and the privately guarded libraries of hacks that the competitors use) why would you keep it on? Seriously. At least put it in airplane mode, it's just common sense.

If you really need a phone go buy a $20 pay-as-you-go phone, don't put any info on it and forward your calls there.
posted by Ookseer at 11:15 AM on July 28, 2009

Do a risk assessment on it. The threat value is high. What is the value of the asset to you in terms of loss of Confidentiality, Integrity & Availability, both at the con & afterwards? What is the likelihood of being able to discover a compromise has occurred? What are the costs associated with compromise of your account? The answers to questions like these will guide you towards an appropriate policy of behavior at and after the event.
posted by scalefree at 11:18 AM on July 28, 2009 [1 favorite]

y6y6y6, are you looking for specific examples of cell phone attacks and exploits? I can't name any, and even if I could I wouldn't be able to prove that those are all the vulnerabilities out there.

So if you're asking "how dangerous is it", you're really asking four questions:

1. How likely is it that vulnerabilities exist?
2. How likely is it that someone at DEFCON would be aware of those vulnerabilities?
3. How likely is it that they would be practicing it at DEFCON and you would be targeted?
4. How likely is it that the attacker would use the information to harm you, and how much harm could he or she do?

I'd say (1) is very likely to be true. Wireless technologies have been designed around access, not security. What security measures exist address the low-hanging fruit. Beyond that, the networks rely on safety in numbers and the overall lack of familiarity with these technologies to provide practical security coverage.

If you agree that (1) is likely, then (2) is likely. If there are vulnerabilities, then DEFCON is a self-selected group of the people most likely to know about them.

I've never been to DEFCON, so I can't say how likely (3) is, but fortunately someone in the thread already obliged:

digividal: "There have been several demonstrations there of sniffing, and influencing cdma networks."

Now unless you're someone particularly notable, you're not likely to be individually targeted, but there's every chance you'd end up randomly sniffed. I'd assume most of the people attending will be fairly paranoid about this sort of thing, so you won't necessarily have safety in numbers like you'd expect. I'd give (3) a pretty decent likelihood as well, not as much as (1) or (2) but enough to draw concern.

Which brings us to (4). Frankly, that depends mostly on you. What information are you likely to expose with your phone use? More identifying info than you expect may be discernable from the underlying protocols, so if you'd be concerned about being identified then "better safe than sorry" is indeed your best bet and you should pop the battery out.

Beyond that you should really just assume that anything you use the phone for will be potentially compromised. You're probably okay calling your family to tell them you love them, but I wouldn't go around texting your SSN to anyone.
posted by Riki tiki at 11:20 AM on July 28, 2009

I think it would be stupid to pop the battery just on the assumption that bad things which no one knows about are possible. What I'm more worried about are real security risks

Well, it's pretty much a given that bad things which no one knows about are possible. It's also a given that DEFCON is a place where they become known about, often through demonstration on attendees. However, it is unknown if this year will include CDMA hacking, so you have to decide for yourself what 'real risk' is in this context.
posted by jacalata at 11:26 AM on July 28, 2009

Response by poster: I'm not asking about unknowns. I'm asking about knowns.

If there are no known vulnerabilities, I'm using the phone. What I'm hearing so far is that no one knows what the risk is, and no one wants to know, just turn off everything. Which frankly I find odd coming from people who care about security.

For me the reason I go to DEFCON is to learn about the vulnerabilities so I can support features in a secure way. The idea that people shouldn't care about real vulnerabilities and just turn off everything seems weird to me.
posted by y6y6y6 at 11:35 AM on July 28, 2009

Response by poster: "I'd say (1) is very likely to be true."

Based on what? Everything tangible I've found indicates very likely *not* true. This is the thing I'm wondering. I come here hoping to find people knowledgeable in CDMA security. The main vectors for attack seem to be spoofing an access point or cracking Sprint's network, meaning I'd be no more vulnerable at the convention than any else.

And yes, a risk/benefit analysis is the goal. Which is why I'm asking about the risk. If the risk is no more realistic than, "someone might have alien technology", then I'm going to rate the risk as extremely low.
posted by y6y6y6 at 11:45 AM on July 28, 2009

Response by poster: "If you are legitimately interested in actually mitigating the threat....."

The goal is to securely use the phone to check email, not remove the possibility of threat.
posted by y6y6y6 at 12:19 PM on July 28, 2009

The main vectors for attack for CDMA are the vectors you know about.

New hacks appear at DEFCON all the time. These are the unknowns (I will not descend into Rumsfeldian known knowns and known unknowns). We do not know what they are. No single person at DEFCON knows what amusing hacks might just appear. We can guess at most of the them, by looking at a presentation schedule, but that won't cover everything. Even more of them (but not all) will be known in retrospect.

How can you securely use the phone to check email without removing the possibility of threat (to the security for using the phone to check email)? You cannot; the two concepts are antithetical. If you could have security without considering threats, the world would be a very different place.

You might as well be asking "I am descending into a portion of the Amazon unknown to Western civilization; what could I catch? I would like to eat every plant I see without worrying about being poisoned." We can throw out some for-instances, but, yeah, you're heading into an area which is the very definition of new and surprising.
posted by adipocere at 12:38 PM on July 28, 2009

y6y6y6: "I'd be no more vulnerable at the convention than any else."

Think of it in terms of this analogy: I'm always vulnerable to gunshots, but I'm much more likely to be shot standing on a target range than in the supermarket.

You want a list of known exploits that apply to you, that's fine. Maybe you'll find someone in this askme with that specific knowledge. If you didn't find it on google, though, then there probably aren't enough people who do know for it to be likely that one of them will happen upon this thread.

In the meantime, people (including myself) tried to present an answer to your larger question in terms of what we see as common sense. "We don't know the risks" is not the same as "the risk is very low" despite your assertions to the contrary.

But since you seem to be offended by our non-answers, I expect you're planning to do as you said and use your phone. At that, I wish you good luck.
posted by Riki tiki at 12:41 PM on July 28, 2009

Response by poster: "You want a list of known exploits that apply to you, that's fine. Maybe you'll find someone in this askme with that specific knowledge."

That's really all I'm asking for. It's a long shot, I agree.

For the record, Since posting I've also run the question through the limited CDMA security knowledge base here at work. The person who worked with CDMA several years ago thinks it should be very safe. The network security guy thinks popping the battery is paranoid enough to go in the "stupid" category. But both of them agree they aren't the CDMA experts I'm looking for.

Those answers, what I'm hearing here, and the results of more Googling all make me confident that checking email at the convention should be fine. That is, the benefits far outweigh any added risk.
posted by y6y6y6 at 1:46 PM on July 28, 2009

"The network security guy thinks popping the battery is paranoid enough to go in the 'stupid' category."

That's pretty typical for security guys - they think everyone else is an idiot.

If you're concerned about CDMA security, read this (PDF), then think about your risk factor. It's probably low, but seriously, you're going to DEFCON. Check your email, sure, but leave the company-sensitive/personally-identifying data transmissions for later. Your statement that you'd "be no more vulnerable at the convention than any else" is not correct. Since GSM calls can already apparently be accessed with field programmable gate arrays, if I was interested in something like that, I'd certainly be looking at cracking CDMA next. What a coup that would be. I mean, how awful.
posted by HopperFan at 2:19 PM on July 28, 2009

If I were you, I would just set up my e-mail to temporarily forward copies to a newly-created gmail account with a different password, and check that mail instead, deleting them as you read them and changing the password once per day.

That way, you almost entirely bypass your concern; anyone who hacked your mail during the conference would have access to less than a day's worth of messages, which makes the cost/benefit analysis much more likely to swing toward accessing your mail (as opposed to directly checking your mail, where someone with your password could download your entire mailfile). It should be trivial to set something like this up.
posted by helios at 2:47 PM on July 28, 2009

From a few years ago:
http://video.google.com/videoplay?docid=7354315958930963090
posted by digividal at 2:57 PM on July 28, 2009

If you can use Gmail's secure connection, that might help.

If there is a vulnerability, no matter how obscure it is, there will be someone ready to make use of it.

If the CDMA stream is recorded, too, the crypto cracking could be done at leisure later.
posted by Pronoiac at 4:21 PM on July 28, 2009

A nice new SMS vulnerability was just made public today.

Two security researchers, Charlie Miller and Collin Mulliner, have discovered a serious security vulnerability affecting SMS messaging on the iPhone that will be unveiled later today at the Black Hat security conference in Las Vegas. This flaw affects all iPhones and can allow an attacker to gain complete control of an iPhone, including the ability to make calls, browse the web and access the camera. This exploit is caused by corruption in the iPhone's memory handling and is executed by sending a burst of text messages by using a uncommon text character or by sending a hidden message. http://www.tuaw.com/2009/07/30/security-researchers-to-unveil-iphone-sms-vulnerability-later-to/

Granted it only affects the iPhone in this case, but it helps to illustrate the point the other commenters were trying to make...
posted by Redmond Cooper at 11:27 AM on July 30, 2009

I've read that they found a similar bug for Windows Mobile.
posted by Pronoiac at 12:40 PM on July 30, 2009

Response by poster: "...but it helps to illustrate the point the other commenters were trying to make..."

No. It doesn't. GSM has was hacked long ago, and since then has been hacked several more times. CDMA, to the best of my knowledge, has never been hacked. So if I ask if anyone here knows more about CDMA, and if there are any new vulnerabilities, telling me about GSM issues isn't even relevant.

And if the advice is that anything can be hacked and I should never turn on any device that can receive a signal, that's dumb. There are risks. But exaggerating them all out of proportion is silly, especially at a conference dedicated to educating people about real security.

I understand the argument people are making - Being paranoid is a better option than trying to understand what the real risk is. But that's not what I was asking, and not advice I find useful at all.
posted by y6y6y6 at 2:48 PM on July 30, 2009

You're conflating risk with threat. They're separate (but related) things. Threat is the likelihood of a harmful event happening (expressed as a probability). Risk is the impact on an asset of a threat happening (expressed as a value amount, which could include dollars, time and sentimental value). Multiply threat by risk and you get risk severity. That combined value will guide your response. If the threat is high but the risk is low, you can afford to lose the value of your asset. But if the value of the asset at risk is high enough, even a low probability of compromise makes strong defensive measures worthwhile.

In this case the threat is unknown but much higher than almost anywhere else on the planet. Only you can assign a value to the asset at risk, the data & account information stored on your phone. If that value is high, take whatever measures you deem necessary to protect the value of the asset. If it's not that valuable to you after all, leave your phone on & have fun.
posted by scalefree at 4:48 PM on July 30, 2009

Response by poster: Since the only threat anyone (including me) has come up with is SMS or browser hacks, I'm having trouble understanding how you think the con is physically any more dangerous than my livingroom.
posted by y6y6y6 at 9:23 AM on July 31, 2009

Response by poster: Posted from DEFCON of course.
posted by y6y6y6 at 9:25 AM on July 31, 2009

Because the density of people with the capability & motivation to discover, develop & execute the sort of attacks you envision is higher there than anywhere else, with the possible exception of CCC or HOPE.

Again you're imprecise with your terminology. What you're describing is either a vulnerability, which is a threat that has a known value, or an exploit, which is the practical implementation of a vulnerability. I'll take your word that there are no known vulnerabilities in either the CDMA protocol or its implementation in any handsets, but that doesn't diminish the potential for undiscovered ones or ones that've been discovered & developed in private. These are things you don't know, won't know until they're made public.

There's always a degree of uncertainty in the security field. You're never going to eliminate that. The best you can do is fill in as many of the blanks as you can & hedge your bets against the parts you still can't see.
posted by scalefree at 11:42 AM on July 31, 2009

Turns out it's your ATM card you should've left behind, not your phone.
posted by scalefree at 4:44 PM on August 2, 2009