The Patching Friars' AlmanacA calendar of CVE saints

Patron of July 24

TETRA:BURSTHoly card for tetra-burst, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 TETRA:BURST ARCANUM AUDITUR
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint TETRA:BURST, Who Listened to the Emergency Radios

Patron of TETRA radios, emergency services, and algorithms kept secret far too long.

Life

In 2023 researchers at Midnight Blue revealed TETRA:BURST, a set of flaws in the TETRA radio standard used by police, emergency services and critical infrastructure. One (CVE-2022-24401) allowed decrypting the communications, another held a backdoor in the cipher itself. The algorithms had stayed secret for decades, and that very secrecy had hidden the flaws rather than protected them.

Prayer

O Saint TETRA:BURST, who listens to the radios of those who come to our aid, teach us that security is born of scrutiny, not of secrecy. Amen.

How to celebrate

Celebrated by applying the radio makers' updates, adding end-to-end encryption where needed, and preferring public, reviewed algorithms.

A secret cipher, a hidden flaw.

Technical record

Disclosed on
July 24 2023
CVE
CVE-2022-24401CVE-2022-24402CVE-2022-24404CVE-2022-24403CVE-2022-24400
CVSS
8.8
Product
ETSI · TETRA Standard

Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active adversary can manipulate the view of these counters in a mobile station, provoking keystream re-use. By sending crafted messages to the MS and analyzing MS responses, keystream for arbitrary frames can be recovered.

Sources: midnightblue.nl

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.