By Robert McMillan
November 11, 2009
IDG News Service
Researchers at the University of Pennsylvania say they've discovered a
way to circumvent the networking technology used by law enforcement to
tap phone lines in the U.S.
The flaws they've found "represent a serious threat to the accuracy and
completeness of wiretap records used for both criminal investigation and
as evidence in trial," the researchers say in their paper, set to be
presented Thursday at a computer security conference in Chicago.
Following up on earlier work on evading analog wiretap devices called
loop extenders, the Penn researchers took a deep look at the newer
technical standards used to enable wiretapping on telecommunication
switches. They found that while these newer devices probably don't
suffer from many of the bugs they'd found in the loop extender world,
they do introduce new flaws. In fact, wiretaps could probably be
rendered useless if the connection between the switches and law
enforcement are overwhelmed with useless data, something known as a
denial of service (DOS) attack.
Four years ago, the University of Pennsylvania team made headlines after
hacking an analog loop extender device they'd bought on eBay. This time,
the team wanted to look at newer devices, but they couldn't get a hold
of a switch. So instead they took a close look at the telecommunication
industry standard -- ANSI Standard J-STD-025 -- that defines how
switches should transmit wiretapped information to authorities. This
standard was developed in the 1990s to spell out how telecommunications
companies could comply with the 1994 Communications Assistance for Law
Enforcement Act (CALEA).
Did a friend send you this? From now on, be the
first to find out! Subscribe to InfoSec News