News for hackers. Stuff that matters.

A comment on Ea­ves­drop­ping En­cryp­ted LTE Calls With Re­VoL­TE.

Re:Ea­ves­drop­ping En­cryp­ted LTE Calls With Re­VoL­TE by mNovak on Wednesday August 12, 2020 @01:15PM (#24134278)
Seems like an awfully large oversight to reuse the encryption key between subsequent calls.

I wonder if this works when leaving voicemail in the second call? Since the approach requires a long call for a long decryption, dialing straight to voicemail would be non-cooperative and avoid alerting the victim until after.

[ Parent | on HN ]
Re:Ea­ves­drop­ping En­cryp­ted LTE Calls With Re­VoL­TE by jschwartzi on Wednesday August 12, 2020 @01:26PM (#24134427)
Voicemail goes to a different place and may not even get you routed to the user’s cell.
[ Parent | on HN ]
Re:Ea­ves­drop­ping En­cryp­ted LTE Calls With Re­VoL­TE by microcolonel on Wednesday August 12, 2020 @03:09PM (#24135600)
It's something so stupid I have to imagine it is deliberate.
[ Parent | on HN ]
Re:Ea­ves­drop­ping En­cryp­ted LTE Calls With Re­VoL­TE by tinus_hn on Friday August 14, 2020 @09:19AM (#24157535)
The argument typically is that good encryption causes the call setup time to be too long and costs battery life, but this indeed is an exceptionally dumb flaw.

Unless you know what you’re doing it’s hard to test for though, and if you know what you’re doing you wouldn’t make this kind of mistake.

[ Parent | on HN ]
Re:Ea­ves­drop­ping En­cryp­ted LTE Calls With Re­VoL­TE by 1231asra on Saturday August 15, 2020 @12:58PM (#24170314)
Somewhat true, but standards could assist developers with adequate test vectors, explanations and reminders why X or Y is important.
[ Parent | on HN ]