WirelessMoves

Today, most Wi-Fi hotspots at home use the standard WPA/WPA2 authentication and encryption mechanism that uses a shared password between the Wi-Fi hotspot and clients. The downside of this approach is that all users have to share the same password which enables an attacker who is in range of the network and in possession of the password to decode encrypted packets if he has observed the initial EAPOL authentication and ciphering dialog of another client. Another downside is that the password needs to be stored in all access points of a Wi-Fi network. All these things are clearly not acceptable in company environments or during public events that want to offer air interface security. For such environments, the Wi-Fi alliance has specified the WPA-Professional authentication approach that can use various authentication methods with certificates and individual passwords for each user. Let's have a closer look at one option of which I was recently able to take a Wireshark trace:

To address the need of companies for a centralized user management, WPA/WPA2-Professional manages certificates and passwords from a central authentication server, often referred to as a RADIUS server. In practice it's not straight forward to discuss such setups because they are mostly used by companies and hence can't be discussed in public. Fortunately I've now found one network that uses WPA2-Professional with a certificate and passwords that can be discussed in public: The Wi-Fi network that was used during 32C3.

As they've described on their Wiki, a server side certificate was used to authenticate the network towards the user via TTLS. To authenticate clients, a username/password of choice could be used in the network. As the conference network administrators were not interested to authenticate users, any username and password combination was accepted. In practice users could remain anonymous this way while at the same time an individual secret was used to generate cipher keys, i.e. packets can't be deciphered by an attacker even if the authentication packets were captured.

The screenshot of the Wireshark trace on the left (here's the pcap in case you want to have a more detailed look) shows how the TTLS/Certificate authentication works in practice. After associating with the network, the Wi-Fi access point asks for a username, which can be anonymous and then tells the user that it wants to proceed with a TTLS-EAP authentication procedure. The client device then answers with a 'Client Hello' packet that contains all cipher suites it supports. The network then selects a cipher suite and sends it's signed certificate to authenticate itself which contains it's public key.

In company environments, the certificate used in Wi-Fi networks is usually signed by a private certificate authority. To enable the device to validate the signed certificate that was sent, the public key of the certificate authority that has signed the delivered certificate has to be stored in the device before it connects to the network for the first time.

In case of the 32C3 network a public certification authority was used to sign the certificate delivered to the device. As anyone can get a signature for a certificate from a public certification authority if he is the owner of the domain specified in the certificate an additional client side configuration is required to ensure that only signed certificates with the correct domain name of the Wi-Fi network are accepted. Unfortunately, Ubuntu's graphical network configuration tool doesn't have a field to configure this extra information as shown in the second screenshot.

Fortunately it's possible to modify Ubuntu's configuration file for the network after it has been created in '/etc/NetworkManager/system-connections' by adding the 'altsubject' line in the 802.1x section with the domain name used by the Wi-Fi network's certificate.

[802-1x]
eap=ttls;
identity=x
ca-cert=/etc/ssl/certs/StartCom_Certification_Authority.pem
altsubject-matches=DNS:radius.c3noc.net;
phase2-auth=pap
password-flags=1

Putting in a wrong value in this line makes the connection establishment fail so I could verify that the overall authentication process is secure.

Once the client device has accepted the server certificate (packet 14 in the trace) an encrypted handshake message is exchanged that is client specific. For this dialog, the client uses the public key that was part of the certificate to encrypt the message. Decoding the packets on the network side is only possible with the private key. As the private key is never sent over the air an attacker can't use a copy of the certificate for a rogue access point.

Afterward the standard 4 step EAPOL Wi-Fi messaging is used to activate link level wireless encryption, based on an individual secret exchanged during the TTLS process. Packet 22 shows the first encrypted packet exchanged between the access point and the client device, a DHCP message to get an IP address. As the trace was done on the client device the decoded version of the packet is shown. Once the IP address has been received the connection is fully established and user data packets can be exchanged.

I travel a lot in Europe and I call lots of people in different countries not only when I'm in my home country but also while traveling. In other words, without a good tariff for international calling and data use, it's no fun. A new mobile EU-Flat tariff introduced by my mobile network operator last year has, for the first time, enabled me to use my monthly mobile data volume anywhere in the EU and to call back home without per minute fees for a modest additional monthly fee of 5 euros. This has helped a lot and apart from one exception I didn't have to use local SIM cards anymore.

One thing that the offer didn't include, however, was making calls from my home country or while traveling in the EU to fixed and mobile phones of other EU countries. At prices of well over a euro a minute this had remained prohibitively expensive. But things have moved on since then and my fixed and mobile network operator of choice has made me a bundle offer to extend my current EU-flat to also include voice calls from anywhere in the EU to anywhere in the EU to both fixed and mobile devices. Yes, that's what I've been waiting for for some many years. The 'everything inclusive anywhere EU-Flat' now costs an extra 10 euros on top of my normal fixed line and mobile contracts instead of the 5 euros I paid before but with my usage pattern that's a deal I was more than willing to take.

No longer waiting to make some calls only until I'm back home or in the office or by using complicated dial-in numbers, no nightmares about costs spiraling out of control because that conference call only offers an international dial-in number, it's definitely my tariff add-on of the year!

P.S.: No, this is not an advertisement for a particular fixed and mobile network operator which is why I haven't named the company in the first place. This blog entry is about documenting a very positive change in the telecommunication market and to encourage other network operators to follow.

Like ever year at the end of the Congress one of the last sessions is the Infrastructure Review. Here, the people who built the congress data network, the DECT network, the GSM network and the Seidenstraße talk about the technology they used this year. It always interesting to hear how much data, calls and packets have been shuffled through the networks and how that compares to last year, how many people used the network, how many wireless devices were used, which networking equipment was used and so on and so on. For anyone interested in networks this talk is a must see and fun to watch not only because of the interesting numbers but also because the presentation contains a lot of hacker fun and sarcasm. This year was certainly no exception. The cut video of the session is not yet on the congress streaming server but the raw-uncut version can be found here in the meantime.

One important message I also want to repeat here: So far, the GSM network of the Congress used the 1800 MHz DECT/GSM guard band. This won't be possible in 2016 anymore as that part of the spectrum has been auctioned in 2015 so one of the network operators in Germany has to be kind enough to loan the Congress GSM network organizers a couple of ARFCNs for the week. So if you are working in spectrum planning at a network operator and think you can spare a couple of channels for a week at the Congress location please think about it and get in touch with the organizers. If you don't know how to do that, let me know, I'll be glad to help!

One feature some proponents are pushing for future 5G networks are ultra short reaction times for ultra critical communication, for example between cars. What I failed to understand so far in this discussion was why for car to car communication a fixed network infrastructure and a backhaul network was necessary!? After all, car to car communication mainly makes sense for cars that are in close proximity to exchange information about potential dangers such as emergency braking, breakdowns and their current status such speed, direction etc., etc. It seems that my skepticism was not unfounded because unknown to me and perhaps also to the 1 ms 5G proponents, decentralized solutions not requiring a network infrastructure already exist.

While Europe and the US seem to be on different paths (once again) on higher layers of the protocol stack, both approaches are based on the IEEE 802.11p extension of the Wi-Fi standard. In this "Wi-Fi" flavor, there are no central access points, no fixed equipment and no backhaul of any kind. On top of this physical layer, event and context information is exchanged. An interesting challenge is how to ensure that messages are sent from "real" vehicles and not from rouge devices that want to disrupt traffic, e.g. by sending messages about emergency breaking etc. while at the same time ensuring privacy, i.e. to send messages anonymously to prevent tracking.

The concept that car companies have come up with is a public key infrastructure and cars equipped with a master certificate by car manufacturer. Based on the master certificate, temporary certificates are signed by a certificate authority which are then included in 802.11p messages sent by cars. Vehicles receiving messages can then validate the message by checking the temporary certificate which does not contain the car's identity and which are changed frequently. Rouge devices that do not have a master certificate can't get temporary certificates, at least in theory, and therefore can't include proper temporary certificates in their messages. That makes me wonder of course how hard it might be in the future to get a valid certificate by extracting it from an on-board computer of a vehicle. SIM cards of mobile devices have provided pretty good security over the past decades so there is at least some hope that the master certificates can be stored safely.

For more details, here's the talk on this topic from 32C3.

12.000 people have bought tickets for the 32C3 and while they consumer a lot of data from the Internet it's easily dwarfed by the amount of data that is flowing from the congress to the outside world. How much of that are the live and recorded video streams is hard to tell but I guess it might be a fair amount. The screenshot on the left shows the state of affairs at 6 pm on day 2 of the congress:

• Outgoing traffic keeps growing and now approaches 20 Gbit/s.
• Incoming traffic is at 5.6 Gbit/s, 3 Gbit/s flowing to 7800 wireless devices over 146 Wi-Fi access points.

Amazing numbers and the 5 GHz Wifi is working just great for me! Only once did I have to fall back to the LTE network coverage so far which was during the intro session and key note in the huge conference hall during day 1 which can hold 3000 people. There are at least 8 Wifi access points in there which handle the load just fine at other times.

It's day 2 of the 32C3 in Hamburg and I'm really happy that I was able to attend in person this year. My previous tip to use a 5 GHz Wifi capable Android phone as a WiFi USB dongle for my notebook has paid out as the 2.4 GHz range is hopelessly overloaded in most places as promised. With 12.000 people attending and more streams going on in parallel than one could ever hope to follow it's total information overload so my pre-planning of what to attend paid out. In the meantime the video streams from day one are online and I can personally recommend the following ones I attended:

Towards (reasonably) trustworthy x86 laptops: Ever felt save by running Linux on your notebook? No? Well, then you probably have Coreboot as a Bios replacment and fell much better. Yes? No, have a look at the video of this session to get an idea of how Intel ME and the little microprocessors and flash in many other components of your notebook make it very hard to have trust in your hardware.

Running your own 3G/3.5G network: GSM and Osmocom are old friends and LaF0rge is working hard to bring 3G femtocells into the mix. He's almost there and if you ever wondered if you were just a bit dumb or whether ASN.1 is just a bit hard to understand, the talk will give you an answer as well. The stream's not yet online at the time of writing this but I'm sure you'll find it here by the time you read this.

How the (not so) Great Firewall discovers hidden circumvention servers: Very interesting presentation on research is presented here on how the Chinese Internet firewall actively reaches out to find out if a web server is really a web server or a hidden TOR gateway.

The Ultimate Amiga 500 Talk: For computer historians who had an Amiga of their own this 60 minute talk is a great refresher on the Amiga 500 hardware and programming. Those were the days 🙂

Lots and lots of other stuff was presented on day one is now online which will keep me busy once I'm back home as it's impossible to follow it all in real time. So head over and enjoy.

It’s become almost a tradition for me in December each year to have a look back at what happened in the previous 12 months in the telecoms industry and in my private technology endeavors that have left long lasting impression or have marked the start of something new.  And so here we go again, in the 10th year of this blog’s existence. Yes, it has already been a decade, time passes quickly!

First lets have a look at the telecoms sector. Early in 2015, 3GPP announced that they have embarked on their voyage to 5G and have published a time table that shows what they intend to do right into the 2020s. Everybody is talking about it but nobody seems to know what it really is. NGNM has published a whitpaper containing use cases and 3GPP now looks how specifications can be enhanced and newly created to fulfill those visions. I had quite a number of posts on various aspects of 5G, such as thinking about what 5G is in the first place, debunking the 1 ms 5G myth and two looks at the use of super high frequencies beyond 5 GHz, stating that such frequency bands are only usable for transmitting data over very short distances and an opposite statement made in a very interesting IEEE paper.

On the other end of the spectrum, GSM networks are starting to be switched-off and many announcing a switch-off in the years to come. 3G also has limited lifetime left with some network operators thinking about a 2020 switch-off date. Personally, I can’t wait for GSM to be switched-off.

In recent years we have seen quite a number of network operators merging in different parts of Europe, thus reducing competition which made me wonder if Free in France will keep the title as last launched 4th network operator in Europe forever. There are certainly no signs they are going to lose that tile anytime soon.

Speaking of evolution I had a look back of how mobiles looked like a couple of years ago to show what has changed in mobile computing in the last 5 years and how that compares to the (few) changes in the desktop computer industry. Quite a contrast. And speaking of change, we are now officially past peak telephony in many countries in Europe including Germany when fixed line and mobile phone minutes are combined.

Over the clouds we haven’t peaked anywhere yet when it comes to connectivity. I had a number of positive ‘over the cloud’ connectivity experiences this year but with LTE ground to air it is likely to be topped in the future.

Back on earth with wires attached, I’ve been migrated from VDSL+ISDN at home to an all-IP connection with fixed line VoIP. Not that it had been my free will but I got quite a number of advantages from the move, including an upgrade from 25 to 50 Mbit/s in the downlink direction, from 5 to 10 Mbit/s in the uplink direction and HD-voice speech quality between fixed line and mobile.

Staying for a moment longer in the voice call domain, despite moving past peak telephony, I was really glad to get rid of Skype on the PC and to put it on a tablet where this proprietary piece of software will hopefully do less harm. On the other hand, I learned to like Skype while traveling to Asia as Skype over LTE is significantly cheaper than circuit switched voice for me while voice quality is significantly better. Not that I would install it on my mobile device that contains my private data but I rarely travel with only a single mobile device.

On the hardware side there have been a number of really important projects for my private development this year. The most important one, no doubt, has been the 4-Bit Nibbler CPU project about which I had many blog entries and on which I spend many weeks to put it together and finally realizing my dream understanding how computers really work by actually building a CPU from several chips.

On a more global scale, I was rocked by the announcement of the Raspberry Pi Zero, the first fully working computer that has been shipped as a magazine complement. This is a milestone in computing history not only for being small and cheap enough to fit onto the cover of a computer magazine. If you’ve lived under a stone for the past few months and haven’t heard of it, this is the story to check out!

When it comes to vintage computing, 2015 has also been an interesting year for me in that area, too. I’m a proud owner again of a Commodore C64 and an Amiga 500 and disk drives that take today’s SD cards instead of real 5.25 or 3.5 floppy disks have greatly helped me to explore my personal computing history and home computing history in general. The culmination in my vintage adventure has certainly been the 30th anniversary celebration of the Amiga in Neuss, Germany and the many people I met there with a similar passion for the home computers that had a significant impact on them when they were teenagers.

Before I get too nostalgic let’s better get back to 2015. My software discovery of the year has certainly been ‘Conversations’ an open source XMPP client app for Android that looks and feels very much like Whatsapp but offers privacy and confidentiality without compromising usability. I’m using it for about half a year now and in the meantime I’ve been able to convince quite a number of my friends that this is the way to communicate not only with me but also with their friends. Further on the software side, the Selfoss RSS reader continues to be an important tool I user several times a day to keep up to date with what is going on in the world. As it’s open source, I contributed some code for it as part of keeping myself current with PHP and database programming.

And last, but not least, I’ve read a couple of great books about computing this year, especially to better understand computing history and the history of free and open source software. ‘The Innovators‘ and ‘Fire in the Valley‘ comes to mind as well as ‘Rebel Code‘,  ‘Commodore – A Company on the Edge’,  ‘Amiga – The Future was here’ and ‘Diary of an 80s Computer Geek‘. And on the fiction side, I very much enjoyed ‘Chronos‘ and ‘The Martian‘, both excellent reads. As far as ‘The Martian’ is concerned, there’s a movie based on the book now, which I haven’t seen because in my opinion there’s no way it can be even half as good as the book has been. So if you haven’t seen it either, my advice is not to go for the DVD but to read the book.

There we go, this has been 2015 for me on the technology side. What a great year!

It almost time for the 32C3 now and I'm on my way to attend in person this year. One thing the organizers have kept pointing out over the last few years is that due to the very limited spectrum available in the 2.4 GHz band, the network experience will be rather mediocre in this band. To get much better throughput, participants are advised to use the 5 GHz band instead. That's all nice and well but my notebook, and I guess the notebooks of many others, does not support the 5 GHz band with the built-in Wi-Fi PCI card. But there's an elegant solution!

These days even medium-priced smartphones come with 2.4 + 5 GHz Wi-Fi built in. What many people don't know is that the smartphones Internet connectivity, no matter whether it is over cellular or over Wi-Fi can be shared with a PC over USB. It's called USB tethering and can be activated in the tethering menu as shown on the left.

To make sure Wi-Fi is used as the backhaul, go to flight mode and only enable Wi-Fi on the smartphone. On the PC, disable Wi-Fi connectivity. Once the smartphone is connected to the Wi-Fi network, connect it to the PC and activate USB tethering if not already done. And that's it, your smartphone is now acting as a USB Wi-Fi dongle for your PC.

Note: I'm not sure if Windows requires a driver for this to work but on Ubuntu this works out of the box. But who uses Windows at the 32C3 anyway…