SPECTRAL SECURITY: Waiting to Be Bugged

Packet

transmission over cellular media is about to usher in an

explosion in the use of wireless data. Of the 400 million mobile

subscribers world-wide, about 12 million (3 percent) already use

data services over wireless media. According to one estimate,

the number of mobile subscribers, as well as the percentage of

them using wireless data services, is set to provide business

worth $ 69.1 billion by 2002. It seems as though nothing can

stop voice and data over wireless from forging ahead. Brave

words, spoken too early.

Cloud on the

Horizon



There is a little cloud on the horizon though. All 2G cellular
technologies have concentrated their signals in narrow windows

in the RF spectrum. All of them use very low-powered

transmitters, and therefore, very sensitive receivers. All of

them use omni-directional antennas, and openly announce their

operating parameters. This combination makes them extremely

fragile and very susceptible to malicious interference. As with

any other system using radio frequencies, cellular systems will

work only if they are the sole users of the band allotted to

them. And any other user of the same band will cause

interference. How susceptible is wireless telephony to malicious

interference?

Smelling big bucks,

companies have blindly invested millions in wireless media,

without a thought to the security of the media itself. Consider,

for example, a pair of copper wires passing through thick

jungle. Any prankster may cut them, tap them or feed his

information into them, because they are unguarded. And just how

secure is Ether? Unlike directed media, where information

follows specified and often secured/guarded paths, information

on Ether always passes through thick jungle, so to speak. Though

it cannot be "cut", it can be tapped and false

information can be fed into it. Ether is unguided and unguarded,

especially in the case of cellular communications. Information

is floating around in space, waiting to be either plucked or

implanted.

What Is the

Technology Catch?



All 2G cellular systems convert voice into bit streams, and use
digital passband modulation techniques to translate these bit

streams to the allocated frequency bands. The receiver

intercepts these frequencies, extracts the bit streams, and

reconstructs the voice signals. At some stage of this process,

some bits are either corrupted by the channel or misinterpreted

by the receiver, thus distorting the voice signal. This

distortion is not usually catastrophic if the number of misread

bits is small. Voice quality is at an acceptable level if, on an

average, no more than one in a thousand bits has been corrupted.

This means that a Bit Error Rate (BER) of 10-3 or less is

acceptable. If, on an average, a malicious transmitter manages

to corrupt two out of every thousand bits, he would have

degraded voice quality to unacceptable levels. How Easy Is

It?




The next step is to determine how easy it is for the malicious
transmitter to do so.

Let us take the case of a

GSM base station receiver waiting for mobile handsets to

transmit. Let us presume that a malicious transmitter is a

simple white noise generator, bandpass filtered such that noise

exists only in the GSM uplink band. If power levels are

sufficiently high, the base station receiver will be saturated,

effectively shutting down communications in that cell, and

perhaps in the adjacent cells as well. The higher the

sensitivity of the receiver, the easier it is to saturate the

receiver.

Mobile receivers are

sensitive enough to receive signal powers as low as -90 dBm, and

still yield a BER below 10-3. Standard calculations show that

when average noise power reaches within 13 dB below the signal

power, more than one in a thousand bits are corrupted, thus

disrupting voice communication.

Considering the fact that

the signal power at the base station receiver is in the order of

micro watts, any communication man can tell you that impinging

noise that is 13 dB below this power is child’s play,

especially if directional antennae are used. The implications

are clear–a simple low-powered band limited white noise

generator with an antenna on any rooftop or window can wrest

control of the cellular spectrum.

The malicious transmitter

described above is of the "brute force" variety, and

rather crude. In the world of malicious transmissions, there

also exist some truly nasty ones, the types who are more

sophisticated. Cellular communications are synchronous, and

therefore predictable. The standards and protocols are easily

available and well understood, and therefore lend themselves to

selective disruption. Hardware and electronics is available off

the shelf, and very inexpensive. Any communications professional

can, with very little effort, work backwards and deduce all

information required to design a truly malicious transmitter.

What About

Packet Data?



So far we have been dealing with digitized voice. The case of
packet data is worse. Most packet switching systems use Layer 4

to impose reliability and the corruption of even a single bit

will be instantly detected by Layer 4 software. Layer 4 would

then request retransmission, and a lot of bits will fly before

malice is detected. A malicious transmitter which has

synchronized itself to the GSM frames will only need to transmit

a single short pulse periodically–just enough to corrupt one

bit per IP packet. TCP/IP reliability will do the rest.

Detecting, locating and neutralizing this kind of a transmitter

will tax the ingenuity of mankind.

Before long, some whiz

with criminal leanings is going to figure out that big companies

have big bucks riding on the narrow cellular spectrum, and may

be willing to shell out money to retain control over this

spectrum. Companies need to take a hard look at spectral

security before pumping in more money into wireless data. Though

spectral allocation is well regulated–both by international

bodies and local governments–spectral security is governmental

responsibility. Some legislation prohibiting unauthorized use of

the RF spectrum does exist, but the enforcement mechanism is

hazy. What should be

Done?



What the companies need to do is to design and deploy equipment
and techniques to help the authorities nail the culprit. First,

the operator will not know that one of his cells have been

compromised until he gets complaints from his clients, by which

time the miscreant would have  moved into another cell.

What is needed equipment that continuously monitors the

spectrum, and instantaneously detects suspicious activity in a

non-intrusive manner. Second, the operator needs to pinpoint the

source of mischief–an extremely difficult proposition in a

dense urban environment. Third, they need to do this within a

time-frame small enough to nail the culprit in the act. Fourth,

this may not always succeed, since most malicious transmitters

will probably be designed for remote operation detection and

location equipment will always have to be one generation ahead

of the malicious transmitters, and will be extremely

sophisticated and expensive.

Finally, cellular

techniques may have to be designed with spectral security in

mind. At present, only CDMA offers built-in resistance to

malicious transmissions. Remember that Spread Spectrum

Modulation was designed by the US military to operate in a

hostile spectral environment, and any system based on this

technique will inherit good LPI/LPJ (Low Probability of

Interception/Low Probability of Jamming) qualities.

IS - 95 CDMA uses Direct

Spreading, which is slightly inferior to Frequency Hopping in

LPI/LPJ qualities. Though CDMA was designed for efficient

bandwidth utilization, we may yet see it redesigned with

spectral security in mind.

On 14 January 2000, the

CBI arrested a group of individuals who had set up their own

satellite telephone system and local switching centre and were

trunking international calls at a fraction of VSNL rates.

Harbingers of the spectral mafia?