[ISN] New Attack Intercepts Wireless Net Messages

From: InfoSec News (isnat_private)
Date: Wed Mar 13 2002 - 01:17:48 PST

  • Next message: InfoSec News: "[ISN] Terrorist Pilots' Student Visas Arrive"

    March 11, 2002 
    By Dennis Fisher and Carmen Nobel 
    It's the stuff of Popular Science. A group of security researchers has
    discovered a simple attack that enables them to intercept Internet
    traffic moving over a wireless network using gear that can be picked
    up at any electronics store and an easily downloadable piece of
    The attack, accomplished by @Stake Inc., a security consulting company
    in Cambridge, Mass., affects a popular consumer version of Research In
    Motion Ltd.'s BlackBerry devices as well as a variety of handhelds
    that send unencrypted transmissions over networks such as Mobitex.
    By design, the Mobitex specification, like other wireless standards
    such as Global System for Mobile Communications and General Packet
    Radio Service, sends packets in unencrypted form. The network, which
    handles data transmissions only, has been in operation since 1986 and
    has a large base of installed devices, with customers using it for
    everything from point-of-sale verification to e-mail.
    "The attack is fairly simple," said Joe Grand, one of the researchers
    who perfected the technique. "The problem is, this isn't a bug. It's
    part of the spec that data is transmitted in the clear, just like it's
    part of the spec that Internet data is transmitted in the clear. The
    risk depends on who is using the network and when and what data
    they're sending."
    Using a scanner with a digital output, an antenna and freely
    downloadable software, the researchers were able to intercept traffic
    destined for BlackBerry Internet Edition devices. And, because the
    packets aren't encrypted, the attackers can read the messages they
    intercept without further work.
    The Internet Edition handhelds are sold mainly through co-branding
    relationships with ISPs such as AOL Time Warner Inc.'s America Online
    service, EarthLink Inc. and Yahoo Inc.
    Executives at RIM said they don't see the attack as a problem because
    they have never touted the Internet Edition devices as being secure.
    "Internet traffic isn't supposed to be secure," said Jim Balsillie,
    chairman and co-CEO of RIM. "It's kind of like a company making beer
    and cola and someone saying that there's alcohol in the company's
    drinks when the children are drinking cola."
    However, the attack serves as a reminder to users that e-mail and
    other Internet traffic is open to snooping and is inherently insecure.
    "I always figure that anything that's sent via e-mail can be read by
    at least hundreds of people which have either legitimate or
    compromised access to systems sitting between me and my recipient;  
    this just adds another potential access point," said Christopher Bell,
    chief technology officer of People2People Group, a relationship
    services company in Boston, and a user of the BlackBerry Internet
    Edition. "I am disappointed that they didn't make at least a modest
    attempt to obscure the content."
    Balsillie said the messages are only as secure as the networks of the
    ISPs that relay them, none of which provide encrypted e-mail.
    Chris Darby, CEO of @Stake, said RIM has done a thorough job including
    security in its other devices, which use a server that sits behind
    corporate firewalls.
    "RIM is incredibly progressive about the way they're addressing
    security in their Enterprise Edition," Darby said.
    The attack also applies to other devices on the Mobitex network, many
    of which are proprietary solutions developed for in-house corporate
    This attack does not work on the BlackBerry Enterprise Edition, which
    uses Triple Data Encryption Standard encryption in addition to other
    security features, @Stake officials said.
    "Typically, Mobitex operators will advise customers that they should
    choose the security scheme that fits their particular needs," said
    Jack Barse, executive director of the Mobitex Operators Association,
    based in Bethesda, Md. "It was a conscious decision not to put
    network-level security in because customers have said that they don't
    want the overhead associated with security if they're just doing
    things like instant messages. Customers can absolutely add on their
    own encryption to whatever application they're using [the network]
    for. And we encourage that."
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY
    of the mail.

    This archive was generated by hypermail 2b30 : Wed Mar 13 2002 - 04:28:17 PST