bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Intelligence service ensured weak GSM encryption

Summary

According to the Norwegian newspaper Aftenposten, the British intelligence service pushed in the 1980s for GSM to be only weakly encrypted. Originally the standard was to offer 128 bits, but A5/1 ended up with an effective 54 bits; the British even wanted only 48 bits. Germany, fearing espionage by the Eastern Bloc, pushed for stronger encryption.

Ideas

  • Intelligence services influence standards so that they can listen in themselves.
  • Deliberately weakened encryption weakens it for everyone.
  • German and British interests were opposed on GSM.

Insights

  • Backdoors and deliberately weak methods ultimately benefit attackers as well.
  • Political compromises in standards have effects for decades.

Facts

  • The statements come from, among others, Jan Arild Audestad, who worked on GSM.
  • A5/1 uses 64 bits, 10 of which are set to zero, i.e. effectively 54 bits.
  • Telekom upgraded its network to A5/3 by the end of 2013.
  • With equipment costing little more than 100 euros, A5/1 calls could be intercepted from around 100 metres.

References

Critique

  • The account is based on contemporary witnesses who confirm each other, but not on documents.

Remarks

  • A5/1 has long been considered practically broken; LTE and 5G use considerably stronger methods.

Recommendations

  • Do not rely on mobile network encryption for confidential conversations; use end-to-end encrypted apps.
  • Disable 2G on mobile devices where the operating system allows it.

Read the original article

Search the Web Archive

g · 2007

Network backup Bacula 2.0 with encryption

In January 2007 the free network backup software Bacula appeared in version 2.0 and could now store data encrypted on volumes. Also new were the migration of jobs between volumes, faster restores from hard disk, better support for removable media and the BWeb web interface. Scripts could be started on server and client before and after jobs.

g · 2003

Security hole in the encryption of Outlook 2002 (update)

In January 2003 Outlook 2002 sent emails unencrypted even though users had chosen encryption with a V1 Exchange Server Security certificate. The bug only affected HTML messages and only this method; PGP and S/MIME were not affected. Microsoft provided a patch, initially only in English and a few days later in German as well.

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.