ChaosCommunicationCongress
Latest
Hackers defeat vein authentication by making a fake hand
Biometric security has moved beyond just fingerprints and face recognition to vein-based authentication. Unfortunately, hackers have already figured out a way to crack that, too. According to Motherboard, security researchers at the Chaos Communication Congress hacking conference in Leipzig, Germany showed a model wax hand that they used to defeat a vein authentication system using a wax model hand.
Hackers planning homespun anti-censorship satellite internet
SOPA is making ordinary, decent internet users mad as hell, and they're not gonna take it anymore. Hacker attendees of Berlin's Chaos Communication Congress are cooking up a plan to launch a series of homemade satellites as the backbone of an "uncensorable (sic) internet in space." Like all good ideas, there's a few hurdles to overcome first: objects in lower-Earth orbit circle the earth every 90 minutes, useless for a broadband satellite that needs to remain geostationary. Instead, a terrestrial network of base stations will have to be installed in order to remain in constant contact as it spins past, at the cost of €100 ($130) per unit. The conference also stated a desire to get an amateur astronaut onto the moon within 23 years, which we'd love to see, assuming there's still a rocket fuel store on eBay.
Researchers eavesdrop on encrypted GSM call: all you need is a $15 phone and 180 seconds
It's hardly a fresh idea -- researchers have claimed that GSM calls could be cracked and listened in on for years. But there's a difference between being able to do something with a $50,000 machine and a warrant, and being able to do the same thing with a few $15 Motorola phones, a laptop, open source software and 180 seconds of spare time. Security Research Labs researcher Karsten Nohl and OsmocomBB project programmer Sylvain Munaut recently spoke about a new GSM hack at the Chaos Communication Conference in Berlin, and they were able to walk the audience through the eavesdropping process in a matter of minutes. According to them, it's not terribly difficult to use a $15 handset to "sniff out" location data used to correctly route calls and texts, and once you've nailed that down, you could use modified firmware to feed raw data into a laptop for decryption. Using a 2TB table of precomputed encryption keys, a cracking program was able to break in within 20 seconds -- after that, you're just moments away from recording a live GSM call between two phones. Of course, speeches like these are made to encourage security officials to beef up the layers between you and ill-willed individuals, but it's hard to say what (if anything) will change. For now, we'd recommend just flying to each and every person you'd like to speak with. Unless you live in the Greater New York area -- you're probably better off risking a hacked conversation than heading out to LGA / JFK / EWR.
GSM call encryption code cracked, published for the whole world to see
Did you know that the vast majority of calls carried out on the 3.5 billion GSM connections in the world today are protected by a 21-year old 64-bit encryption algorithm? You should now, given that the A5/1 privacy algorithm, devised in 1988, has been deciphered by German computer engineer Karsten Nohl and published as a torrent for fellow code cracking enthusiasts and less benevolent forces to exploit. Worryingly, Karsten and his crew of merry men obtained the binary codes by simple brute force -- they fed enough random strings of numbers in to effectively guess the password. The GSM Association -- which has had a 128-bit A5/3 key available since 2007, but found little takeup from operators -- has responded by having a whinge about Mr. Nohl's intentions and stating that operators could just modify the existing code to re-secure their networks. Right, only a modified 64-bit code is just as vulnerable to cracking as the one that just got cracked. It's important to note that simply having the code is not in itself enough to eavesdrop on a call, as the cracker would be faced with just a vast stream of digital communications -- but Karsten comes back to reassure us that intercepting software is already available in customizable open source varieties. So don't be like Tiger, keep your truly private conversations off the airwaves, at least for a while.
