GSM Cracked, Falls to German Engineer

Posted 12/28/2009 at 1:58pm | by Bart Salisbury

5

Comments

Print

Twenty-one years is nearly an eternity in the code world, and GSM’s code has survived that long intact. But, if the claims of Karsten Nohl, a German computer scientist, prove credible, 21 years is the extent of GSM’s invulnerability.

GSM (or for you techies out there: the A5/1 privacy algorithm), was developed way, way back in 1988, and currently protects the privacy of 80% of mobile calls worldwide. Nohl, at the Chaos Communication Congress, announced he had cracked GSM, in an effort to demonstrate security weaknesses in global wireless systems. “This shows that existing GSM security is inadequate,” Nohl stated.

“Oh no he didn’t,” the London-based GSM Association quickly responded. Claire Cranton, a spokesperson for GSM, said, “This is theoretically possible but practically unlikely.” GSM also claimed that Nohl’s actions were illegal (but only in Great Britain and the Untied States). Channeling Alicia Silverstone’s Cher Horowitz in Clueless, Cranton added, “To do this while supposedly being concerned about privacy is beyond me.”

While GSM is panning Nohl’s achievement, security experts are a bit more fatalistic. The disclosure itself, they say, is not a big deal. But, if true, it does portend problems for the unprepared. Stan Shatt, vice president for health care and security at ABI Research, said, “Organizations must now take this threat seriously and assume that within six months their organizations will be at risk unless they have adequate measures in place to secure their mobile phone calls.”

If you are insanely curious, Nohl released the algorithm’s codebook on the Internet. He’s not saying where you can find it--he’s worried about legal repercussions. But he does say word-of-mouth in the hacker community is a good place to start your search.

Image Credit: Rakka/Flickr