Eavesdropping technology

EVEN as mobile phones are becoming a cheap utility hundreds of thousands of people continue to part with a pretty penny to talk to others in parts of the world that lack network coverage. Callers are prepared to pay as much as $14 to connect to a satellite phone in exchange for secure, reliable connections. (Ringing landlines from such devices can be less than one-tenth that.)

Security is often paramount, especially for souls dispatched to far-flung corners of the globe which are often war-torn, controlled by unsympathetic regimes, or both. No surprise, then, that like modern mobile phones, satellite gubbins come with built-in encryption. This makes it practically impossible for anyone monitoring the airwaves to eavesdrop on the calls. 

Or does it? Researchers at Ruhr University Bochum, in Germany, think they have managed to crack two popular encryption protocols, known as A5-GMR-1 and A5-GMR-2. These are commonly used in the Thuraya satellite phones used across swathes of Africa, the Middle East and North Asia. (Thuraya has yet to respond to the revalations.) The researchers hope that their paper, published on their website, will help interested parties fix the flaw. More importantly, perhaps, it might prompt phone-makers to act. 

"We can assume that this has probably been known about since the beginning of this century," says Benedikt Driessen, one of the authors of the new paper. He and his colleagues say that it takes about $2,000 worth of gear and half an hour to decipher a satellite phone call. With more computing power, it could be done in real time. Indeed, an Israeli company already offers just such a service commercially.

Those Thuraya customers particularly concerned with security can install end-to-end encryption software that adds one more layer of security, using another protocol, known as AES. (Government agencies, especially those dealing with security and intelligence, tend not to rely on commercially available encryption.) Alternatively, a Berlin-based company, Cryptophone, promises "end-to-end encrypted calls from and to mobile, fixed-line and satellite networks" and claims to be the only firm to provide secure phones that come with full source code available for independent review. No doubt someone will be flogging a crack for these tweaks soon.