June 1998:  (Mobile Europe)

GSM SECURITY BREACH

In April, headlines proclaimed that researchers in California had cracked
the SIM card authentication code, breaching the security of the GSM system,
writes Jan Lien. The researchers, working for the Smartcard Development
Association (SDA) found a weakness in the widely-used COMP128
authentication algorithm, and by using that flaw managed to extract the
secret key from a SIM. Knowing the secret key and the algorithm enabled
them to program a computer to impersonate the SIM card, and by connecting
this computer to a GSM handset they managed to make and receive calls
billed to the impersonated SIM card.

This is significant, because GSM security relies on a secret key stored in
the SIM card and in the operator's switch, and an encryption algorithm
which uses the secret key to prove that the user is actually the rightful
user. The GSM MoU and the operators keep the algorithms secret, as an added
level of security, but even if the algorithms leaked out this should not
matter - as long as the algorithms are secure, and the key is kept secret.

Marc Briceno of the SDA, and Ian Goldberg and David Wagner of the
University of California at Berkeley, managed to break the COMP128
algorithm. COMP128 is an example of how to implement the A3 authentication
algorithm (the algorithm which uses the secret key in the SIM) provided
by the GSM MoU to operators as a basis from which they can develop their
own A3 algorithm. Many operators, like Pacific Bell Mobile in California,
the supplier of the card used by the researchers, used the COMP128 example
unchanged - or did not change it sufficiently.

However, a few operators, like D1 and E-Plus in Germany, One 2 One in
Britain, and KPN in Holland, use their own A3 algorithms. Many operators
also use more than one A3 algorithm, with different ones in different SIM
cards. These algorithms are not public, which makes them more difficult to
attack. If the operators are lucky, their algorithms will be stronger than
the example COMP128.

It has been claimed that it is impossible to read the secret key directly
from the card. The Pacific Bell Mobile card was attacked by connecting it
to a computer and repeatedly challenging it with a list of numbers in order 
to monitor the responses, a process which takes 8-16 hours. Because of the
flaw in the COMP128 algorithm, it was mathematically possible to deduce the
secret key from the many responses obtained. The reseachers say that
because the algorithm was kept secret, it was not possible for independent
experts to point out the flaws in it before it entered widespread service.

No true card clones - yet

The work in the USA has been duplicated with a D2 SIM in Germany by the
Chaos Computer Club (CCC). Neither team has truly cloned the SIM card
itself, although it is not technically difficult to program one, so for the
moment the teams both use a computer connected to a handset to simulate the
card.

It is still not directly possible to clone SIMs over the air, as anyone
wanting to do this would need to transmit many challenges to the handset
and monitor the response, a much slower process than accessing the card
directly from a computer. This also means users have little to worry about
for the time being, as somebody would have to borrow or steal their card
for at least 8 hours to copy it in any way.

It may be difficult to steal a SIM card and copy it unnoticed, but it is
possible to rent a phone, copy the SIM card, and then return the phone. CCC
in Germany has already shown that two phones with the same card are allowed
to be active on the network at the same time, as long as they do not make
simultaneous calls.

A different use for cloned cards would be to hide one's location. Many GSM
operators now monitor and store the geographic location of handsets in a
database: D1 only for a few days, Swisscom for 6 months. By placing copies
of a SIM card in many phones, it could appear in many different locations,
so nobody would know exactly where the real owner had been.

The potential for large losses due to GSM cloning is low today. It is
simply too difficult to steal SIM card numbers at the moment. However, it
is also costly to improve the security, as an operator would have to
replace all existing SIM cards if they wanted to use a new algorithm. There
is no way to upgrade the algorithms over the air. They might also have to
upgrade some parts of the base stations or switching centers. But most
operators are looking into this, to improve security. Omnipoint in New York
said that it was considering adding some more algorithms.

Many operators use COMP128, but others use their own A3 algorithms. The
question is, just how secure are they? Nobody knows, as the operators keep
their algorithms very secret. Ernst Moeksis at KPN in the Netherlands
defends this secrecy, saying, "We have several algorithms, developed by our
own security experts. When you buy something from somebody else, you know
the keys are in somebody else's hands."

The security attack will affect even the better-protected operators, as
they must now consider what frauds might occur if SIM cards can be cloned.
Comviq in Sweden had considered allowing its prepaid SIM cards to be used
abroad, but spokesman Robert Hultman says, "We will have to consider these
recent findings."

The GSM MoU maintains this will not destroy customer or operator confidence
in GSM, however. "GSM was designed to be as secure as an ordinary phone
system, and it is not a military-grade system," says Charles Brookson,
chair of the MoU's security group. He continues, "GSM is still the most
secure mobile phone system".  cdmaOne uses an algorithm which is know to be
weaker, and since those phones do not use SIM cards it will be practically
impossible to upgrade old phones to better security.

One can't help wondering why two of the worlds largest mobile operators,
Pacific Bell Mobile in California and Mannesman Mobilfunk, did not write
their own algorithms, and instead used the example code, COMP128, without
having it examined by an expert.

"There is no risk for the customers," says Christian Schwolow, spokesperson
for Mannesman Mobilfunk, defending the company's use of COMP128. "It was
preferred by many GSM operators."

Flaw announced two years ago

While D2's network has been running for some time, this is not the case for
Pacific Bell Mobile, which began service less than two years ago. And yet,
says Brookson, "The COMP128 algorithm was not properly designed, it had a
flaw in it, and this was announced about two years ago to the MoU members."

Authentication consumes a network's radio resources and computer time,
reducing the number of calls it can carry. For this reason, many operators
use selective authentication to reduce the load, checking on only one call
in eight, say, or after particular events, such as the appearance of a SIM
in a different handset (indicated by its IMEI).

"There are even GSM operators doing no authentication, and no voice
privacy. Which ones? I don't want to point the finger," says Brookson.

And yet, strong authentication algorithms are available to all operators.
Some may be prevented by state security laws from using the stronger A5/1
voice privacy algorithm, but this does not in any way affect the
authentication.

"If the network operators learn their lesson from COMP128, they will shun
secret homebrew algorithms for better-scrutinized, public algorithms,"
concludes Wagner.