Re: German home banking (fromn RISKS)

[Andrew Loewenstern <andrew_loewenstern@il.us.swissbank.com>]

>  Don't high speed modems transmit and receive on the same frequencies,
>  using echo cancelation to decode the receive signals?  Does that
>  make it impossible to eavesdrop on high-speed (i.e. V32bis) modems?

No, and a lot of crackers and phone phreaks found out the hard way.  You can  
buy protocol analysers off-the-shelf that will give a dump of the entire  
communication by just passively listening in (or possibly playing back a  
recording).  I have seen units that could decode all of the popular Blue Book  
protocols for consumer equipment such as faxes and high-speed modems as well  
as ISDN, T1, DS3, ATM, etc...  Most are programmable and some are full-blown  
computers running stripped down versions of Unix and can also be controlled  
over the network from RealComputers.  With multiple analysers and a little  
custom software you could easily perform MITM attacks.  The hardest part is  
getting in the middle.

Modulation, comm-protocols, and compression techniques are not a replacement  
for honest to goodness crypto.


andrew