Forgot your password?

typodupeerror
Android

T-Mobile Wi-Fi Calling Was Vulnerable to Trivial MITM Attack 24

Posted by Unknown Lamer
from the who-do-you-trust? dept.
wiredmikey writes "A vulnerability discovered by researchers at UC Berkeley enabled attackers to eavesdrop on and modify calls and text messages sent using T-Mobile's 'Wi-Fi Calling' feature. According to Jethro Beekman and Christopher Thompson, both UC Berkeley graduate students, when an affected Android device connected to a server via T-Mobile's Wi-Fi Calling feature, it did not correctly validate the server's security certificate, exposing calls and text messages to a 'man-in-the-middle' (MiTM) attack. ... '[An attacker] could record, block and reroute SIP traffic. The attacker could change it by faking a sender or changing the real-time voice data or message content. He could fake incoming traffic and he can impersonate the client with forged outgoing traffic,' the report, released Tuesday, said. Beekman and Thompson said they notified T-Mobile of their discoveries in December 2012, and worked with the mobile operator to confirm and fix the problem. As of March 18, all affected T-Mobile customers have received the security update fixing the vulnerability, the researchers said." By 'did not correctly validate,' they mean that the certificate was self-signed and the client blindly trusted any certificate with the common name it was expecting.

Comment: Re:you are an idiot (Score 4, Informative) 173

by TimothyDavis (#42924759) Attached to: Windows 7 RTM Support Ending Soon

I can add some clarity to this.

When Windows reaches RTM, the ownership of support is handed off from the Windows team to the Windows Sustained Engineering (WinSE) team. Two code branches are opened up for creating QFEs, a Limited Distribution Release (LDR) branch, and a General Distribution Release (GDR) branch.

The GDR branch is used for updates that are going wide to all users, which include security updates and high impact updates. Depending on the severity of the QFE, it might be posted to Windows Update as a security update, or alternatively it would be provided to OEMs to preinstall on shipping systems to resolve a specific issue.

The LDR branch is used for updates that aren't going to be distributed to a wide audience. This might be something like a QFE that fixes a bug that some enterprise customer is seeing, but doesn't have much applicabilty to the majority of Winodws users. Microsoft doesn't want to distribute an update like this wide, because there is a risk that it will cause regressions for other users. Every update in the GDR branch is also put into the LDR branch, because ultimately the user is going to be running a single instance of the binary file, and so it better have all of the security updates included if it is going to also fix issues of lesser importance

When you go to Windows Update and install a QFE, the package that you install usually contains at least two versions of the applicable binaries: One from the LDR branch, and one from the GDR branch. The hotfix installer will look at what is currently on system, and if you have the LDR version of the binary already installed, the hotfix installer will update with the corresponding LDR binary. The effect is that once you install an LDR update, you are now on the LDR branch for that binary for all future updates - that is, until the next service pack release.

The service pack is a release that includes all updates from the LDR and GDR branches rolled up into one major release. Pre-release versions of service packs are provided to enterprises for testing, and to see if any of the updates that were put into the LDR branch break anything. This gives the enterprise and Microsoft time to address the issue and fix it for the final service pack release.

Since not all enterprises participate in full testing of the service pack, there may be things that end up in the final version that can break things. This is why Microsoft will continue to support the pre|prior service pack release with security updates for a time, so that these issues can be resolved. At some future time, the pre|prior service pack becomes no longer supported, which is what TFA is all about.

Comment: Meanwhile.. (Score 1) 610

by TimothyDavis (#40606689) Attached to: Steve Ballmer: We Won't Be Out-Innovated By Apple Anymore

And I am sure that Apple will soon release an Apple TV product that shakes up the market and makes Microsoft look stupid for being there already (media center, xbox), but not actually ever having a product that was compelling.

Home theaters are just begging for simplification – and I don’t expect that Microsoft will be the one to deliver.

Comment: A Microsoft interview question (Score 1) 215

by TimothyDavis (#40446281) Attached to: Google Vs. Microsoft: a Tale of Two Interviews

This question was asked to me years ago in a Microsoft interview, and has been bugging me since. I am curious as to what other people here on /. would have responded, and more importanly, the 'why' behind the response.

Here is the question:

Say I were to hire you today, and gave you the choice between two compensation packages, which one would you choose (and why)?

1: A standard salary of $100k

2: An hourly wage of 10 cents an hour - but every month that you worked here, we would double your hourly wage

Which would you prefer?

Comment: Re:Fan-fucking-tastic. (Score 4, Insightful) 108

by TimothyDavis (#40314523) Attached to: AMD and ARM Team Up
One of the problems that AMD is facing is that OEMs use their CPUs in a value system - where across the board features are cut. This hurts AMD because many of these systems lack TPMs, which pretty much blocks them from many enterprise deployments, as Bitlocker and DirectAccess pretty much require a TPM. By creating a soft TPM, AMD is working around the BOM cost of a hardware TPM.

Comment: Re:Websites (Score 1) 454

by TimothyDavis (#40262727) Attached to: How Many Seconds Would It Take To Crack Your Password?
I used to use GUIDs as passwords, but found that far too many sites had bugs in password handling. Sites would truncate the string before hashing from some passwords prompts but not others (found this out by subtracting characters one by one from the right side of the string until the site accepted the password). Other sites would not validate during password creation, but would throw errors when later logging in using the same password.

"Whom are you?" said he, for he had been to night school. -- George Ade

Working...