Secret Mobile Phone Codes Cracked

A German computer scientist has published details of the secret code used to protect the conversations of more than 4bn mobile phone users. Karsten Nohl, working with other experts, has spent the past five months cracking the algorithm used to encrypt calls using GSM technology. GSM is the most popular standard for mobile networks around the world. The work could allow anyone - including criminals - to eavesdrop on private phone conversations. Mr Nohl told the Chaos Communication Congress in Berlin that the work showed that GSM security was "inadequate". "We are trying to inform people about this widespread vulnerability," he told BBC News. "We hope to create some additional pressure and demand from customers for better encryption." The GSM Association (GSMA), which devised the algorithm and oversees development of the standard, said Mr Nohl's work would be "highly illegal" in the UK and many other countries. "This isn't something that we take lightly at all," a spokeswoman said. Mr Nohl told the BBC that he had consulted with lawyers before publication and believed the work was "legal". Mr Nohl, working with a "few dozen" other people, claims to have published material that would crack the A5/1 algorithm, a 22-year-old code used by many carriers. The code is designed to prevent phone calls from being intercepted by forcing mobile phones and base stations to rapidly change radio frequencies over a spectrum of 80 channels. It is known to have a series of weaknesses with the first serious flaw exposed in 1994. Mr Nohl, who describes himself as an "offensive security researcher", announced his intention to crack the code at the Hacking at Random (HAR) conference in The Netherlands in August this year. "Any cryptographic function is a one way street," he told BBC News. "You should not be able to decrypt without the secret key". To get around this problem, Mr Nohl, working with other members of the encryption community, used networks of computers to crunch through "every possible combination" of inputs and outputs for the encryption code. Mr Nohl said there were "trillions" of possibilities. All of the outputs are now detailed in a vast table, which can be used to determine the encryption key used to secure the conversation or text message. "It's like a telephone book - if someone tells you a name you can look up their number," he said. Using the codebook, a "beefy gaming computer and $3,000 worth of radio equipment" would allow anyone to decrypt signals from the billions of GSM users around the world, he said. Signals could be decrypted in "real time" with $30,000 worth of equipment, Mr Nohl added.