All Cops Are Broadcasting: Breaking TETRA After Decades in the Shadows
summary
Researchers reverse engineer TETRA crypto from a Motorola MTM5400 (TI OMAP L138), chain a format‑string + MPU misconfig + AES timing set of zero days to extract secret primitives, and publish implementations on GitHub. They find TA/TE primitives based on a 16‑round HURDLE block cipher, show TA1 compresses 80→32 bits — brute forcible in ≈1 minute on commodity hardware (13 hours on a 1990s PC), recover 24‑bit identities by meet‑in‑the‑middle in minutes, and build a practical keystream‑recovery decryption oracle able to decrypt live traffic; fixes require firmware fleet updates or protocol changes.
AI-written summary · about
chapters (11)
- 0:00Introduction to Tetra
- 1:00Scope and methodology
- 5:32Reverse engineering process
- 8:13Taa1 and authentication
- 11:33Identity and traffic encryption
- 14:55Ta1 cracking and demo
- 17:57Disclosure and response
- 19:33Keystream recovery attack
- 25:10Proof of concept demo
- 27:16Mitigations and intelligence
- 30:56Conclusion and Q&A
related talks
01h 02mHacking the Wireless World with Software Defined Radio - 2.0
31mCommSec D1 - Steganography Ante Portas
28mDVB-T Hacking
08mHacking 4G and how to get arrested in 10 minutes
53mHacking the Wireless World with Software Defined Radio - 2.0
01h 01mRapid Radio Reversing
52mD2T1 - Establishing Covert Channels By Abusing GSM AT Commands
51mBluetooth Hacking: Tools And Techniques