Karsten Nohl (born 11 August 1981)[1] is a German cryptography expert[2] and hacker. His areas of research include Global System for Mobile Communications (GSM) security, radio-frequency identification (RFID) security, and privacy protection.[3]
Nohl grew up in the Rhineland area of Germany and studied electrical engineering at the Heidelberg University of applied sciences from 2001 to 2004.[1][3] From 2005 to 2008, he earned his PhD at the University of Virginia on Implementable Privacy for RFID Systems.[3] Since 2010 Nohl has served as the Managing Director and Chief Scientist of the Berlin-based consultancy and think tank, Security Research Labs.[3][4][5] Karsten has also served as interim CISO for the Indian corporation Jio from 2014 to 2017, as well as, for the Malaysian corporation Axiata in 2017.[4]
Together with Henryk Plötz and CCC Berlin's, Starbug, Nohl gave a presentation in December 2007 on how the encryption algorithm used in Mifare Classic RFID smart cards was cracked. The Mifare Classic Card has been used in many micropayment applications, such as the Oyster card, CharlieCard, or the OV Chipkaart for payment.[6][7][8]
Together with Henryk Plötz, Nohl gave a presentation in December 2009 documenting the flawed security of Legic Prime RFID security. The talk demonstrated how the system employed multiple layers of strange and obscure techniques in lieu of standard encryption and cryptographic protocols. This allowed cards to be read, emulated, and even for arbitrary master tokens to be created.[9]
At SIGINT-2013, Nohl gave a presentation on the insecurity of electronic car immobilizers used to prevent vehicle theft, documenting vulnerabilities in the three most widely used systems: DST40 (Texas Instruments), Hitag 2 (NXP Semiconductors) and Megamos (EM Micro).[10]
Nohl was part of the project group deDECTed.org[11] [11], which in 2008 at 25C3 pointed out serious deficiencies in the DECT protocol.[12]
In April 2010, Nohl, together with Erik Tews and Ralf-Philipp Weinmann, published details on the cryptographic analysis of DECT proprietary and secret encryption algorithm used (DECT standard cipher), which is based on reverse engineering of DECT hardware and descriptions from a patent specification.[13]
In the summer of 2009 Nohl introduced the A5/1 Security Project.[14] The project demonstrated an attack on the GSM encryption standard A5/1 using Rainbow Tables. With the help of volunteers, the key tables were calculated in a few months and published on the 26C3 in December 2009.[15]
The GSM Association described Nohl's plans as illegal and denied that wiretapping was actually possible. He replied that his research was purely academic.[16]
As early as 2008, the hacker group THC had begun with the pre-calculation of key tables for A5 / 1, but probably never published the tables because of legal problems.[14]
At the 27C3 in December 2010, Nohl, together with Sylvain Munaut, demonstrated how mobile calls can be cut and decrypted with the help of converted cheap mobile phones and the open-source software OsmocomBB.[17] The pair showed that the GSM encryption can be cracked "in about 20 seconds" and that calls can be recorded and played back.[18][19]
At Chaos Communication Camp 2011, Nohl and Luca Melette gave a presentation showing how GPRS networks do not securely encrypt their mobile traffic.[20] The pair stated that they had recorded data transmissions in the networks of several German mobile providers, including Deutsche Telekom, O2 Germany, Vodafone and E-Plus.[2] Several mobile service providers used either no or only insufficient encryption. With a modified mobile phone, mobile traffic could be read from within a radius of five kilometers.[2]
At both Black Hat 2013 and OHM 2013, Nohl demonstrated that many SIM cards use the outdated and insecure DES encryption, undermining the privacy and security of mobile phone users.[21][22][23] Through "Over The Air (OTA)" communication, such as SMS messages, it is possible to provide a SIM card with updates, applications, or new encryption keys. Such messages are digitally signed with DES, 3DES or AES.[22][23] Nohl generated a Rainbow Table for 56-bit DES within a year based a on specially signed error message with known plain text.[22][23] The resulting attack scenario: an attacker sends the victim a signed text message.[22][23] With the help of the Rainbow Table it is then possible to crack the DES key of a SIM card in minutes and crack the internal key. (Known Plaintext Attack).[21][22] This allows an attacker to send a signed SMS, which in turn loads a Java app onto the SIM card. These apps are capable of multiple actions, including sending SMS or sharing the location of the device. An attacker could, for example, command a device to send SMS messages to foreign premium services at the cost of the device owner.[22][23] In principle, the Java Virtual Machine should make sure that every Java app can only access predefined interfaces.[23] Nohl found that the Java sandbox implementations of at least two major SIM card manufacturers, including market leader Gemalto, are insecure and it is possible for a Java app to escape the sandbox environment and thus gain access to the entire SIM card.[23] This makes it possible to duplicate SIM cards including the IMSI, authentication key (Ki) and payment information stored on the card.[23]
At the 30C3 in December 2013, Nohl introduced the Android app "GSMmap". Initially designed for use on a Galaxy S2 or S3 (including root access), the app collects information on the level a mobile network secures its traffic. The collected data can be uploaded, with the app user’s consent, to a database that evaluates the security of mobile networks worldwide, based on selected protection capability criteria. The results of this analysis are displayed on the "GSM Security Map" website, where the security level of mobile providers are visualized on an interactive world map and made available for download as "country reports".
At the 31C3 in December 2014, Nohl presented the Android app "SnoopSnitch" as a possible countermeasure against various mobile network security attacks. On various smartphones models with Qualcomm chipset and root access, mobile network traffic can be collected and analyzed locally with "SnoopSnitch,” where the app gives the user information about the encryption and authentication algorithm being used by the network, the possibility for SMS and SS7 attacks, as well as the potential presence of IMSI-catchers.
The data collected via “SnoopSnitch” can also be uploaded, with the user’s consent, to a database to support additional security analysis, which is shared on the "GSM Security Map" website.
Also at the 31C3, Nohl presented a side channel attack using Signaling System 7 (SS7) on UMTS communication and described other SS7-based attacks that can allow the reading of text messages, the determination of location coordinates, and various scenarios for fraud.
In April 2018, Nohl presented on security in the mobile Android environment.[24] Nohl and his colleagues analyzed Android firmware images from various smartphone vendors. In some cases, a so-called "patch gap" was found, where vendors had not applied all security patches that otherwise should have been present based on the monthly patch level date specified in the firmware. Nohl released an updated version of the open source “Snoopsnitch” app with new features to allow users to run tests on their Android phones to check for a "patch gap" on their device.[25]
At the 32C3, Nohl and colleagues presented an attack on the EC card protocols ZVT and Poseidon, which are a dialect of ISO 8583.[26][27] Both protocols are the most common payment protocols in German-speaking countries.
At the 33C3, Nohl and colleagues highlighted security holes in Amadeus, Sabre, and Travelport, three of the largest Global Distribution Systems (GDS) which combined, handle approximately 90% of worldwide flight reservations and a large proportion of hotel, car rental, and other travel bookings.[28]
At Black Hat 2014, Nohl and Jacob Lell presented on security risks associated with USB devices.[29][30][31][32] The USB standard is versatile and includes many different classes of devices.[31] Their research is based on the reprogramming of USB controller chips, which are widely used and found in USB sticks.[31] There is no effective protection against reprogramming, so a harmless USB device can be converted and used as a malicious device in many ways.[31]
Possible scenarios for abuse include:
Preventing such attacks is not yet possible because malware scanners have no access to the firmware version of USB devices and behavior detection is difficult.[31] USB firewalls that can block only certain device classes do not (yet) exist.[31] The usual process to remove malware - reinstalling the operating system - fails here because the USB stick that installs the operating systems may itself already be infected, as well as a built-in webcam or other USB devices.[31]
In addition, a proof of concept for Android devices was released to test the security.[31]
