Demo: TETRA decryption oracle vulnerability (CVE-2022-24401)

 

104 views Jul 24, 2023

Midnight Blue, a specialist security consulting firm, announced today the discovery of 5 zero-day vulnerabilities collectively known as "TETRA:BURST", 2 of which critical, that affect the Terrestrial Trunked Radio (TETRA) standard used globally by law enforcement such as the C2000 network in the Netherlands, Airwave in the U.K., BOSNET in Germany, and RAKEL and Nødnett in Sweden and Norway. Other use-cases include military communications and critical infrastructure in the power, oil & gas, water, and transport sectors and beyond. In this video, we demonstrate the decryption oracle attack (CVE-2022-24401), which affects all TETRA configurations. The demonstration is performed on our lab setup using an instrumented base station as an attack platform.

Transcript

Follow along using the transcript.