Copy of letter sent to Motorola, per their request.
To: Motorola Solutions Inc. - MOTOTRBO Product Group
From: Mars; com501 (Names redacted from document)
Date: Dec. 10, 2014
Subject: MOTOTRBO product security concerns (MOL case: 24159837)
Recently, it was reported MOTOTRBO subscriber products operating on a system configured to utilize Restricted Access to System (RAS) functionality are not operating as expected, when queried in “talkaround” mode by outside radios not provisioned with the active RAS key.
It was determined by our group as well as Motorola, RAS is performing as-designed and the fault is not centered on an error in RAS design; it was erroneously assumed RAS functionality applied to subscriber radios.
The subscriber security concerns are unresolved. It is our collective opinion a significant security threat still exists by means of how subscriber equipment handles off-network voice and data queries from unauthorized/malicious entities.
Several scenarios were discussed during a telephone conversation with [redacted] from the TRBO Product Support Group. Examples of malicious actions are:
- A malicious entity can inhibit (disable) radios which are used in a critical operating environment, such as underground mining operations;
- A malicious entity can send “spoofed” text messages to workers handling cash, causing them to make deliveries at incorrect locations;
- A malicious entity can initiate a Private Call to a specific worker, causing them to relocate at an inopportune time;
- A malicious entity can send telemetry commands to a base radio programmed to control external circuits such as an overhead door and outside parties can gain unauthorized entry.
With information from third-party DMR air-interface decoders and data contained on hobbyist websites, subscribers’ radios can be disrupted and manipulated.
Customers (with RAS-enabled systems) are under the impression their infrastructure is secure and cannot be interrupted. Of particular concern is the malicious activation of Remote Monitor, which ties up the entire system. The simplex attack causes the target radio to activate the repeater, where unbeknownst to the subscriber, their mic is hot. The unauthorized third-party can monitor audio with third-party DMR applications or hardware. During the operation, system access is denied to all users.
Motorola can enhance the security of the MOTOTRBO product line by expanding upon the functionality of the RAS featureset. A recommendation is to require the presence of a valid RAS key before a subscriber radio actions any received transmissions. This can be a simple enhancement within CPS, where on a per-channel basis, reception of both types of communications (open/RAS or RAS-only) are selectable in a RAS-enabled channel. (Firmware changes are also required.)
Any enhancement(s) to the RAS functionality are most appreciated and indicative of Motorola’s awareness of product and customer security needs.
