[Infowarrior] - How to DDOS a federal wiretap

[Richard Forno]

(paper link@ http://micah.cis.upenn.edu/papers/calea.pdf)

How to DDOS a federal wiretap
By Robert McMillan
November 11, 2009 08:40 PM ET
http://www.computerworld.com/s/article/9140717/How_to_DDOS_a_federal_wiretap?taxonomyId=17

IDG News Service - Researchers at the University of Pennsylvania say  
they've discovered a way to circumvent the networking technology used  
by law enforcement to tap phone lines in the U.S.
The flaws they've found "represent a serious threat to the accuracy  
and completeness of wiretap records used for both criminal  
investigation and as evidence in trial," the researchers say in their  
paper, set to be presented Thursday at a computer security conference  
in Chicago.

Following up on earlier work on evading analog wiretap devices called  
loop extenders, the Penn researchers took a deep look at the newer  
technical standards used to enable wiretapping on telecommunication  
switches. They found that while these newer devices probably don't  
suffer from many of the bugs they'd found in the loop extender world,  
they do introduce new flaws. In fact, wiretaps could probably be  
rendered useless if the connection between the switches and law  
enforcement are overwhelmed with useless data, something known as a  
denial of service (DOS) attack.

Four years ago, the University of Pennsylvania team made headlines  
after hacking an analog loop extender device they'd bought on eBay.  
This time, the team wanted to look at newer devices, but they couldn't  
get a hold of a switch. So instead they took a close look at the  
telecommunication industry standard -- ANSI Standard J-STD-025 -- that  
defines how switches should transmit wiretapped information to  
authorities. This standard was developed in the 1990s to spell out how  
telecommunications companies could comply with the 1994 Communications  
Assistance for Law Enforcement Act (CALEA).

"We asked ourselves the question of whether this standard is  
sufficient to have reliable wiretapping," said Micah Sherr, a post- 
doctoral researcher at the university and one of the paper's co- 
authors. Eventually they were able to develop some proof-of-concept  
attacks that would disrupt devices. According to Sherr, the standard  
"really didn't consider the case of a wiretap subject who is trying to  
thwart or confuse the wiretap itself."

It turns out that the standard sets aside very little bandwidth -- 64K  
bits per second -- for keeping track of information about phone calls  
being made on the tapped line. When a wire tap is on, the switch is  
supposed to set up a 64Kbps Call Data Channel to send this information  
between the telco and the law enforcement agency doing the wiretap.  
Normally this channel has more than enough bandwidth for the whole  
system to work, but if someone tries to flood it with information by  
making dozens of SMS messages or VoIP (voice over Internet protocol)  
phone calls simultaneously, the channel could be overwhelmed and  
simply drop network traffic.

That means that law enforcement could lose records of who was called  
and when, and possibly miss entire call recordings as well, Sherr said.

Back in 2005, the FBI downplayed the Penn team's loop extender  
research, saying that it applied to only about 10 percent of wire  
taps. The J- standard studied in this paper is much more widely used,  
however, Sherr said. An FBI representative did not return messages  
seeking comment for this story.

The researchers wrote a program that connected to a server over  
Sprint's 3G wireless network 40 times per second, enough to flood the  
Call Data Channel. They say that they could get the same results by  
programming a computer to make seven VoIP calls per second or to fire  
off 42 SMS messages per second.

These techniques would work on mobile phones or VoIP systems, but not  
on analog devices, Sherr said.

Because the researchers weren't able to test their techniques on real- 
world systems they don't know for certain that they could thwart a  
wiretap. But Sherr believes that "there are definitely dangers" in the  
way the standard is written. "Because it's a black-box system, we  
don't know for sure."

Of course, criminals have plenty of easier ways to dodge police  
surveillance. They can use cash to buy prepaid mobile phones  
anonymously, or reach out to their accomplices with encrypted Skype  
calls, said Robert Graham, CEO with Errata Security. Luckily for the  
cops, criminals usually don't take their communications security that  
seriously. "Most criminals are stupid," he said. "They just use their  
same cell phone."