Vulnerabilities in TETRA radio networks

[neilv]

> Two of the vulnerabilities are deemed critical. One of them appears to be an intentional backdoor [...] Reading the contents of a firmware upgrade is not trivial though, as it is heavily encrypted and relies on a Trusted Execution Environment (TEE), embedded in the core processor of the radio.*

I don't know whether the backdoor allegation is correct, but unfortunately we should treat opaque ostensible security with skepticism.

By their nature, such things often can be used for our protection at the same time they are secretly used against us.

[creer]

Isn't the time for the generous qualifiers long past? Such, often, can, our protection, unfortunately, skepticism... There is a good track record by now. Something like:

"under the guise of protecting trade secrets and swear words in the code, the code encryption actually protects crappy code stuffed with vulnerabilities (i.e. future entry points available to the right friends and foes) and backdoors (some forgotten and some very much not)". And in this case "future" was a while ago.

[wyck]

The newsworthy item here is that this is an intentional backdoor. The wikipedia pages list the specific uses per country and department. https://en.wikipedia.org/wiki/Terrestrial_Trunked_Radio#Usag...

[H8crilA]

Do you remember when cryptography export was controlled? It was implemented by limiting key size to certain number of (effective) bits (of security). This suite is just a victim of that law, as it is a 1990s design.

[LocalH]

Sounds like they took the "roll your own and don't tell anyone how it works" approach. Security by obscurity is never security. History has shown that the open encryption standards are the most secure.

[ok123456]

It's more of intentionally reducing the keyspace when generating keys. You can use weakly generated keys with industry-standard encryption algorithms. When your 4096-bit key is only 32 bits, it doesn't matter how well-trusted the algorithm is.

[londons_explore]

And yet this one lasted 30 years. That's far longer than most open encryption algorithms continue to be deemed secure.

Obviously you can debate wether having it 'appear' secure for longer before someone publishes details of the flaw is more important or not...

[umvi]

Obscurity should never replace security, but it can and does augment security by increasing the cost to even study the security.

[stavros]

The bigger issue here is that there's an intentional vulnerability.

[xyzzy4747]

Security has many layers. Obscurity can be one of them.

[denysvitali]

You can't easily put backdoors in cryptographic algorithms that can be audited

[marcus0x62]

The interview that is linked[0] in the footnotes of the article with the person from ETSI is absolutely wild... Some excerpts:

> kz (interviewer): How did it go about meeting those requirements, because that's the one they're saying has a backdoor in it. Was that the condition for export?

> BM (ETSI): Backdoor can mean a couple of things I think. Something like you'd stop the random number generator being random, for instance. [But] what I think was revealed [by the researchers] was that TEA1 has reduced key-entropy. So is that a backdoor? I don't know. I'm not sure it's what I would describe as a backdoor, nor would the TETRA community I think.

...

> KZ: People ... believe they're getting an 80-bit key and they're not.

> BM: Well it is an 80-bit long key. [But] if it had 80 bits of entropy, it wouldn't be exportable.

...

> kz: You're saying 25 years ago 32 bit would have been secure?

> BM: I think so. I can only assume. Because the people who designed this algorithm didn't confer with what was then EP-TETRA [ETSI Project-TETRA is the name of the working group that oversaw the development of the TETRA standard]. We were just given those algorithms. And the algorithms were designed with some assistance from some government authorities, let me put it that way.

...

> bm: That's what we now know yeah - that it did have a reduced key length.

> KZ: What do you mean we now know? SAGE created this algorithm but the Project-TETRA people did not know it had a reduced key?

> BM: That's correct. Not before it was delivered. Once the software had been delivered to them under the confidential understanding, that's the time at which they [would have known].

...

You've really got to wonder who at ETSI gave the thumbs up on doing this interview.

0 - https://www.zetter-zeroday.com/p/interview-with-the-etsi-sta...

[sillysaurusx]

The researchers added a footnote explicitly refuting the claim that 32 bit keys were secure 25 years ago, too.

> The Midnight Blue researchers have since demonstrated real-life exploitations of some of the vulnerabilities, for example at the 2023 Blackhat Conference in Las Vegas (USA). They have shown that TETRA communications secured with the TEA1 encryption algorithm can be broken in one minute on a regular commercial laptop and in 12 hours on a classic laptop from 1998 [III].

[k8svet]

What exactly were TETRA radios used for? I assume they were government/infra related, but then I don't understand why they'd need to backdoor the keying

[mcpherrinm]

They are used for many things, like fire, ambulance, railways, harbour operations, police, military, coast guard, and so on.

The weaker cipher mode, TEA1, is used when selling the radios to anyone who may not necessarily be an ally or highly trusted. This is the legacy of strong crypto being export-controlled.

It was public that these ciphers were weaker, but they were actually much weaker than advertised. This is the backdoor.

[tptacek]

They don't so much backdoor the keying as that they have 4 different cipher profiles, and the one approved for global rather than European use (TEA1) compresses the key from 80 to 32 bits.

It's essentially a surreptitious version of what the US did in the 1990s with "export ciphers".

[qwertox]

I think the most relevant use in the context of deliberate backdoor is its use by police and military forces. Apparently some energy providers also use it for remote controlling tasks (no voice).

[timthorn]

There was also the Dolphin network in the UK, offering a public national subscription TETRA network. It didn't prove commercially viable.

https://www.rcrwireless.com/19980309/archived-articles/dolph...

[YinSpray]

Some time ago there was a github repo online that has all teaX and hurdle algorithms code, and also ta61 identity encryption algorithm mentioned by Midnightblue. https://web.archive.org/web/20230213001503/https://github.co...

https://web.archive.org/web/20230213001335/https://github.co...

[notfed]

In 2023 you're telling me that some emergency vehicles are happily rocking encryption protocols with 80-bit, wait actually, 32-bit keys? These are all cases of systemic procrastination. We're talking about emergency vehicles here though, so: neglect.

Nobody is surprised these protocols have been broken, it should not be a surprise, and having some kind of panic reaction should be considered either a charade or a case of abysmal management.

[ajsnigrutin]

I heard about this some time ago... the timeline shows the sources should be available from august this year, but nothing yet on github ( https://github.com/MidnightBlueLabs/TETRA_burst )

[Roark66]

The fact many armies use this (including my own country's) is mind boggling. Didn't they request the technical details of the encryption and the source code and have it vetted properly before awarding the tender for these devices? /sarcasm

[freeopinion]

> The vulnerabilities were discovered during the course of 2020, and were reported to the NCSC in the Netherlands in December of that year. It was decided to hold off public disclosure until July 2023, to give emergency services and equipment suppliers the ability to patch the equipment.

Interesting discussion about responsible disclosure. It seems a strange belief that you can tell all the radio operators about the vulnerability without also telling exploiters. Aren't they often one and the same? What's a reasonable approach here?

[gwbas1c]

> It seems a strange belief that you can tell all the radio operators about the vulnerability without also telling exploiters

I suspect that there was an update (or replacement) to the radios that was generally described as an ordinary update / maintenance.

[tptacek]

Immediate public disclosure.

[denysvitali]

TL;DR: The only newsworthy vulnerability is the breaking TEA1 - which is anyways the least secure of them all and only intended for commercial use (that is, no emergency services).

https://www.tetraburst.com/

[pixl97]

The question is, did things like emergency services actually use the higher levels, or did they just use TEA1?

It's kind of like saying...

Vendor: "We support up to 1 zillion bit encryption!"

User: "What's the default out of the box?"

Vendor: "10 bit"

[riedel]

> TL;DR: The only newsworthy vulnerability is the breaking TEA1

This is IMHO a very unfair TLDR; . The news is that the researchers claim that there is deliberate backdoor, which ETSI denies. If it is true, there cannot be any further trust in other proprietary parts as well.

[opless]

Some installations have additional cryptography.

Which alone implies that the Tetra crypto security theatre is well known in that industry, and isn't a surprise to vendors in the slightest.

[matthewdgreen]

It appears to be used for infrastructure, including things like power and transportation signals here in the US.

[riversflow]

Hogwash, I think it's worth noting that this European system was intentionally backdoored.

Everybody plays the espionage game, Europe really is no exception, they just like to use the US to keep their hands (mostly) clean.