How to Deny Service to a Federal Wiretap

[Eugen Leitl]

http://www.pcworld.com/article/181985/how_to_deny_service_to_a_federal_wiretap.html

How to Deny Service to a Federal Wiretap

Robert McMillan, IDG News Service

Researchers at the University of Pennsylvania say they've discovered a way to
circumvent the networking technology used by law enforcement to tap phone
lines in the U.S.

The flaws they've found "represent a serious threat to the accuracy and
completeness of wiretap records used for both criminal investigation and as
evidence in trial," the researchers say in their paper, set to be presented
Thursday at a computer security conference in Chicago.

Following up on earlier work on evading analog wiretap devices called loop
extenders, the Penn researchers took a deep look at the newer technical
standards used to enable wiretapping on telecommunication switches. They
found that while these newer devices probably don't suffer from many of the
bugs they'd found in the loop extender world, they do introduce new flaws. In
fact, wiretaps could probably be rendered useless if the connection between
the switches and law enforcement are overwhelmed with useless data, something
known as a denial of service (DOS) attack.

Four years ago, the University of Pennsylvania team made headlines after
hacking an analog loop extender device they'd bought on eBay. This time, the
team wanted to look at newer devices, but they couldn't get a hold of a
switch. So instead they took a close look at the telecommunication industry
standard -- ANSI Standard J-STD-025 -- that defines how switches should
transmit wiretapped information to authorities. This standard was developed
in the 1990s to spell out how telecommunications companies could comply with
the 1994 Communications Assistance for Law Enforcement Act (CALEA).

"We asked ourselves the question of whether this standard is sufficient to
have reliable wiretapping," said Micah Sherr, a post-doctoral researcher at
the university and one of the paper's co-authors. Eventually they were able
to develop some proof-of-concept attacks that would disrupt devices.
According to Sherr, the standard "really didn't consider the case of a
wiretap subject who is trying to thwart or confuse the wiretap itself."

It turns out that the standard sets aside very little bandwidth -- 64K bits
per second -- for keeping track of information about phone calls being made
on the tapped line. When a wire tap is on, the switch is supposed to set up a
64Kbps Call Data Channel to send this information between the telco and the
law enforcement agency doing the wiretap. Normally this channel has more than
enough bandwidth for the whole system to work, but if someone tries to flood
it with information by making dozens of SMS messages or VoIP (voice over
Internet protocol) phone calls simultaneously, the channel could be
overwhelmed and simply drop network traffic.

That means that law enforcement could lose records of who was called and
when, and possibly miss entire call recordings as well, Sherr said.

Back in 2005, the FBI downplayed the Penn team's loop extender research,
saying that it applied to only about 10 percent of wire taps. The J- standard
studied in this paper is much more widely used, however, Sherr said. An FBI
representative did not return messages seeking comment for this story.

The researchers wrote a program that connected to a server over Sprint's 3G
wireless network 40 times per second, enough to flood the Call Data Channel.
They say that they could get the same results by programming a computer to
make seven VoIP calls per second or to fire off 42 SMS messages per second.

These techniques would work on mobile phones or VoIP systems, but not on
analog devices, Sherr said.

Because the researchers weren't able to test their techniques on real-world
systems they don't know for certain that they could thwart a wiretap. But
Sherr believes that "there are definitely dangers" in the way the standard is
written. "Because it's a black-box system, we don't know for sure."

Of course, criminals have plenty of easier ways to dodge police surveillance.
They can use cash to buy prepaid mobile phones anonymously, or reach out to
their accomplices with encrypted Skype calls, said Robert Graham, CEO with
Errata Security. Luckily for the cops, criminals usually don't take their
communications security that seriously. "Most criminals are stupid," he said.
"They just use their same cell phone."