Don't Trust Satellite Phones: A Security Analysis of Two Satphone Standards

Abstract

There is a rich body of work related to the security aspects of cellular mobile phones, in particular with respect to the GSM and UMTS systems. To the best of our knowledge, however, there has been no investigation of the security of satellite phones (abbr. satphones). Even though a niche market compared to the G2 and G3 mobile systems, there are several 100,000 satphone subscribers worldwide. Given the sensitive nature of some of their application domains (e.g., natural disaster areas or military campaigns), security plays a particularly important role for satphones.In this paper, we analyze the encryption systems used in the two existing (and competing) satphone standards, GMR-1 and GMR-2. The first main contribution is that we were able to completely reverse engineer the encryption algorithms employed. Both ciphers had not been publicly known previously. We describe the details of the recovery of the two algorithms from freely available DSP-firmware updates for satphones, which included the development of a custom disassembler and tools to analyze the code, and extending prior work on binary analysis to efficiently identify cryptographic code. We note that these steps had to be repeated for both systems, because the available binaries were from two entirely different DSP processors. Perhaps somewhat surprisingly, we found that the GMR-1 cipher can be considered a proprietary variant of the GSM A5/2 algorithm, whereas the GMR-2 cipher is an entirely new design. The second main contribution lies in the cryptanalysis of the two proprietary stream ciphers. We were able to adopt known A5/2 ciphertext-only attacks to the GMR-1 algorithm with an average case complexity of 2 32 steps. With respect to the GMR-2 cipher, we developed a new attack which is powerful in a known-plaintext setting. In this situation, the encryption key for one session, i.e., one phone call, can be recovered with approximately 50-65 bytes of key stream and a moderate computational complexity. A major finding of our work is that the stream ciphers of the two existing satellite phone systems are considerably weaker than what is state-ofthe-art in symmetric cryptography.

A Review of Cyber Threats and Defence Approaches in Emergency Management

“…Driessen et al [31] have recently reverse-engineered the encryption algorithms used in the GMR-1 and GMR-2 satellite phone standards and showed that their stream ciphers are considerably weaker than the current state of the art in symmetric cryptography. They have also developed a mechanism for recovering the encryption key of a GMR-2 phone call with approximately 50-65 bytes of key stream and moderate computational complexity.…”

An experimental security analysis of two satphone standards

“…The four topmost functions in this ranking turned out to implement the different linear feedback shift registers (LFSR) of the cipher . The interested reader is referred to the original publication [Driessen et al 2012] for more details.…”

“…In this paper, we build on our previous work [Driessen et al 2012], which reverseengineered the stream ciphers A5-GMR-1 and A5-GMR-2, used in the respective standards. In contrast to the original publication, we focus less on the process of reverseengineering itself, but rather collect all relevant information regarding security and configuration aspects of the system: We describe the network architecture of satellite telecommunication systems and, to some degree, how they operate on the physical and protocol level.…”

“…Recently also technologies that are only used under more specific circumstances have come into the spotlight of academic research and the hacker scene alike. A striking example of this is recent work [Driessen et al 2012] that analyzed the security of the over-the-air encryption in the two existing ETSI satphone standards GMR-1 and GMR-2. The firmware of handheld devices was reverseengineered and the previously unknown stream ciphers A5-GMR-1 and A5-GMR-2 were recovered.…”

WG-8: A Lightweight Stream Cipher for Resource-Constrained Smart Devices

“…While the IoT provides new and exciting experience for end users, it also opens up new avenues to hackers and organized crime. Recent attacks to a wide range of smart devices [12,39] have emphasized that without adequate security the IoT will only become pervasive nightmare.…”