Critical Zero-Day Flaws Found in Global Emergency Services Communications Protocol

July 24, 2023

The Terrestrial Trunked Radio (TETRA), a radio voice and data standard primarily utilized by emergency services such as the police, fire brigade, military, and certain industrial environments, has been found to have several critical vulnerabilities. Researchers from Midnight Blue Labs discovered five vulnerabilities in TETRA, two of which, CVE-2022-24402 and CVE-2022-24401, are rated as critical. These vulnerabilities, collectively referred to as 'TETRA:BURST', could allow adversaries to decrypt messages in real-time or delay, inject messages, deanonymize users, or conduct session key pinning attacks.

The potential implications of these vulnerabilities are significant, with the potential for adversaries to eavesdrop on police and military communications, track their movements, or manipulate critical infrastructure network communications carried over TETRA. Demonstrations of the vulnerabilities showed that attackers could capture encrypted messages by targeting a specific radio. 'The only thing is you're getting is the key stream, which you can use to decrypt, arbitrary frames, or arbitrary messages that go over the network,' said Wouter Bokslag, founding partner of Midnight Blue.

Another demonstration revealed a 'backdoor' in the TETRA Encryption Algorithm (TEA1) that could affect networks depending on TEA1 for confidentiality and integrity. The TEA1 algorithm uses an 80-bit key that an attacker could brute-force to undetectedly listen in on communications. Bokslag explained that the cipher's weakening would allow an attacker to exhaustively search through the 32 bits and decrypt all traffic with inexpensive hardware.

The researchers' goal was to open TETRA for public review, perform a risk analysis, resolve issues, and promote the use of open cryptography. TETRA, first published in 1995 by the European Telecommunications Standards Institute (ETSI), is a widely used professional mobile radio standard, particularly for law enforcement. Despite most of TETRA standard being open, its security relies on a set of secret, proprietary cryptographic algorithms.

The researchers also found a reference to TETRA in the 2013 Edward Snowden leaks, particularly in the interception of TETRA communications. Some of the issues, including CVE-2022-24401, could be resolved through firmware updates. However, CVE-2022-24402 is not fixable through firmware updates as it is part of the standard. 'For TEA1, you could apply end-to-end encryption as a solution, but it's going to be very costly and very labor intensive to roll out,' Bokslag said.

Users in over 100 countries and most industrial sectors, including law enforcement, military, and intelligence services, will be impacted by these vulnerabilities. The researchers have been in contact with manufacturers and network operators to assist in resolving these issues. Manufacturers have developed patches for the vulnerabilities in response to the research, and Midnight Blue recommends migrating from TEA1 to another TEA cipher for now.

Latest News

• Critical Vulnerability in MikroTik Routers Exposes Up to 900K Devices to Potential Takeover
• VMware Patches Information Disclosure Bug in Tanzu Application Service for VMs
• Norwegian Government IT Systems Breached Using Ivanti Zero-Day Vulnerability
• Apple Issues Security Updates to Address Zero-Day Vulnerabilities
• Critical Zero-Day Vulnerabilities in Atera Windows Installers Expose Users to Privilege Escalation Attacks