Cybersecurity researchers have found a backdoor in encrypted radios utilised by police, military, and critical infrastructure entities worldwide, which could have been present for decades, putting a vast amount of sensitive information transmitted across these radios at risk.
Researchers from Midnight Blue, a cybersecurity firm, have discovered at least two critical flaws in the Terrestrial Trunked Radio (TETRA) standard. The flaws, dubbed TETRA:BURST, affect all TETRA radio networks, potentially allowing an attacker to decrypt communications in real-time or after the fact, inject messages, deanonymise users, or set the session key to zero for uplink interception.
The first critical flaw (CVE-2022-24401) is an Oracle decryption attack that can reveal text, voice or data communication. The second (CVE-2022-24402) is an engineering weakness in the TEA1 encryption algorithm, leading to a backdoor that reduces the original 80-bit key to a trivial size that can be brute-forced on consumer hardware in minutes.
Three vulnerabilities of less critical nature have been uncovered: CVE-2022-24404, a high-severity vulnerability arising from the absence of ciphertext authentication on the AIE, enabling a malleability attack; CVE-2022-24403, a high-severity vulnerability allowing radio identities to be identified and tracked due to weak cryptographic design; and CVE-2022-24400, a low-severity vulnerability permitting partial compromise of confidentiality through a flawed authentication algorithm that allows the setting of the Derived Cypher Key (DCK) to 0.
Midnight Blue asserts that the backdoor follows deliberate algorithm design decisions. Secret, proprietary cryptography has been a common theme in previously identified flaws affecting other communication systems. Midnight Blue was granted funding by the non-profit NLnet Foundation to perform in-depth public security research on TETRA.
Not all TETRA users rely on TEA1, but given the standard’s long lifespan, its existence still means there may have been room for exploitation if another party was aware of this issue. The primary concern for users of TETRA networks is the potential interception and manipulation of messages. This opens the possibility of data traffic injection, severely impacting the monitoring and control of crucial industrial equipment.
Midnight Blue will present its findings at the upcoming Black Hat cybersecurity conference in August. The details of the talk have been kept under wraps due to the unusually long disclosure process, lasting over a year and a half. Midnight Blue disclosed the vulnerabilities to impacted parties to facilitate necessary fixes.
Claire Boyer, press and media officer for ETSI (European Telecommunications Standards Institute), said that the research findings do not relate to any backdoors and that the TETRA security standards were designed for and subject to export control regulations determining encryption strength.
ETSI created TETRA in 1995, which is used in products from major companies like Motorola and Airbus. The researchers encountered challenges in verifying the security of the standard due to its reliance on “secret, proprietary cryptography”.
The researchers conducted their analysis after acquiring a TETRA-powered radio from eBay. They found a vulnerability in the radio’s interface, allowing them to access the cryptographic component. After achieving code execution on the main application processor, they targeted the signals processor, which held the cryptographic cyphers. The team discovered vulnerabilities in the secure enclave for identifying the TETRA:BURST vulnerabilities.
Radio manufacturers have developed firmware updates for their products in response to some of the researchers’ findings. For TEA1, however, the researchers recommend users migrate to another TEA cypher or apply additional end-to-end encryption to their communications.
The primary concern for law enforcement, military personnel, and critical infrastructure operators using TETRA networks is the potential interception and manipulation of messages. This opens the possibility of data traffic injection, which could severely impact the monitoring and controlling of crucial industrial equipment. Patches for some of the vulnerabilities are already available.
In the News: OpenAI’s ChatGPT is coming to Android devices soon
