TETRA Tour de Force: Jailbreaking Digital Radios & Base Stations for Fun
Midnight Blue reverse engineers the secret TETRA radio standard, uncovering proprietary cipher flaws and a backdoored encryption algorithm in critical infrastructure.
Summary
The Secrecy of Terrestrial Trunked Radio (TETRA)
TETRA is the global digital radio standard utilized by police, military agencies, and critical infrastructure SCADA telecontrol for oil pipelines and electrical grids.
Reverse Engineering the TI OMAP-L138 TEE and DSP
Midnight Blue details jailbreaking the Motorola MTM5x00 radio by chaining zero-day vulnerabilities, hardware side-channel attacks, and custom decompilers across trusted execution environments.
Uncovering Flaws in TEA Ciphers and Backdoors
Extracting the proprietary TEA1 through TEA4 cipher suites for the first time revealed critical vulnerabilities, including an intentionally backdoored stream cipher with reduced entropy.
Instrumenting Motorola Base Stations and Mitigations
Demonstrating live packet decryption and traffic injection using an instrumented Motorola MBTS base station provides operators with crucial firmware mitigation guidance.
Related talks
Briefings·41 min
Carlo Meijer · Wouter Bokslag · Jos Wetzels
Presents the first public security analysis of TETRA end-to-end encryption (E2EE) used for the most sensitive communications - such as those by intelligence agencies and special forces.
RF Village·47 min
Manuel Rabid
Analyzes the VHF Weather Radio SAME protocol and seismic alert systems (SASMEX), demonstrating how unauthenticated broadcast signals risk false alarms.
Creator Stage·28 min
Katarina Amrichova
Examines the impending quantum computing threat to healthcare infrastructure and outlines Siemens Healthineers' strategies for migrating to post-quantum cryptography.