Cell Phone Hacking Attacks – A Real and Present Danger (Part 4)

It has been possible to scramble telephone calls since the early 1920’s. Originally, artificial noise was superimposed over a voice call to prevent eavesdroppers, with a suitably equipped receiver duplicating the noise on the signal enabling it to be cancelled out. Technology advanced during the Second World War, enabling secure communications in support of the war effort. The 1980’s saw the availability of STU-III telephones that have been in regular use for secure communications up until the recent move to VoIP on secure government networks.

Possibly the best way of protecting your cell phone voice traffic is to have in place end-to-end encryption. This is a modern version of telephone scrambling but today’s encryption technology bears no relationship to the cruder systems used in the past. Voice encryption vendors tend to take one of two routes—supplying especially designed and configured cell phones or providing software that can be downloaded onto the customer’s phone of choice, assuming that it is supported. Some vendor gateway products enable calls to be routed to standard office phones and the general phone network and still remain encrypted.

The level of encryption provided by vendors is usually very high, relying on well-known and trusted algorithms that have stood the test of time and attention from mathematicians and cryptanalysts. Key sizes are normally 256-bit for call data with some systems using a 4096-bit Diffie-Hellman shared secret exchange to establish the session keys. In some systems a private key will be generated on the cell phone when the system is installed, which is then guaranteed to be unique and exist only on that device. This key value can be derived using a seed based on a random number produced by processing audio data from the cell phone microphone. An associated public key will also be created. Other systems use a new key which is generated for each call with authentication carried out by hash-based readouts.

A phone book of trusted cell phone numbers is then built along with their associated public keys. At the beginning of a phone call a unique session key is generated between the parties that only lasts as long as the call, and is then destroyed. Users will see a graphical display informing them of the status of the encrypted call, an important way of assuring them that their call is secure.

Criticism has been levelled at some cell phone encryption systems that they introduce delay, echo or some other quality of service issue. Whilst it would be expected that some delay would occur due to the encryption/decryption process a call quality similar to that found on an international landline is the norm.

In conclusion
There is no doubt that voice data is at risk. As more and more people use their smart cell phones to run their entire lives, hackers and others will focus their efforts on getting the information they need from these devices. In many respects attitudes towards cell phone data security reflect those held 20 years ago towards the humble personal computer. Back then attacks were minimal, anti-malware was yet to become established and hacking was in its infancy. Now we are in a maelstrom of attacks against the PC using sophistication and scale we previously thought impossible.

Cast one’s mind forward 20 years and it boggles at the depth and breadth of attacks our cell phones will be subject to. In the meantime, anyone that conducts sensitive business using a cell phone should seriously consider implementing the preventative measures discussed in this series of articles alongside an industry leading cell phone encryption package without delay.