deDECTed: DECT Cordless Telephony Authentication Broken at 25C3
On 29 December 2008 at 25C3, Erik Tews, Ralf-Philipp Weinmann and Andreas Schuler of the deDECTed.org project showed that the secret security of DECT, the standard behind most cordless phones and many baby monitors and payment terminals, could be broken with cheap hardware.
02Deep-Dive Technical Analysis
The team reverse-engineered the secret DSAA: its A11 core is built from four 64-bit SPN block ciphers ("cassable"), with A12/A21/A22 as thin wrappers, and they found practical attacks on its building blocks plus a common implementation error that could practically lead to a total break. Worse, many handsets did not authenticate the base station or insist on encryption, so a PC with a commodity DECT PC-card could impersonate a base station and intercept or reroute calls. Their RSA-CT 2009 paper published DSAA; the DSC cipher was cryptanalysed in 2010.
03Vulnerability & Exploit Flow
Rogue base-station impersonation against handsets that do not authenticate the fixed part or enforce encryption, plus weaknesses in the proprietary DSAA.
04Recommended Defense & Mitigation Protocol
Mandatory mutual authentication and encryption via DECT Forum security certification, and migration to AES-based DSAA2/DSC2.
05Security Impact & Geopolitical Consequence
Exposed tens of millions of cordless phones as trivially interceptable, prompting the DECT Forum security certification programme and later AES-based DSAA2/DSC2 algorithms.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.