In the goTenna Pro App there is a vulnerability that makes it possible
to inject any custom message with any GID and Callsign using a software
defined radio in existing goTenna mesh networks. This vulnerability can
be exploited if the device is being used in an unencrypted environment
or if the cryptography has already been compromised. It is advised to
share encryption keys via QR scanning for higher security operations and
update your app to the current release for enhanced encryption
protocols.
goTenna recommends that users mitigate these vulnerabilities by performing the following updates:
* Android Pro: v2.0.3 or greater
* iOS Pro: v2.0.3 or greater
Configurations
Workarounds
goTenna recommends that users follow these mitigations:
General Mitigations for All Users/Clients
* Use Discreet Callsigns and Key Names: Choose callsigns and key names
that do not disclose sensitive information, such as your location, team
size, or team name. Avoid using any identifiers that could
inadvertently reveal your location or the composition of your team.
* Secure End-User Devices: Implement strong security measures on all
end-user devices, including the use of encryption and ensuring regular
software updates.
* Follow Key Rotation Best Practices: Regularly rotate encryption keys
according to industry best practices to maintain ongoing security.
Pro-Specific Mitigations
* Share Encryption Keys via QR Code: Utilize QR codes, similar to ATAK, for the secure exchange of encryption keys.
* Secure Broadcasting: When broadcasting, ensure you are in a secured
area and transmit the key at a reduced power of 0.5 Watts to limit
exposure.
* Leverage Layered Encryption: Implement layered encryption keys to
securely manage communications, whether interacting with individuals or
teams.
If you have any questions please contact prosupport@gotenna.com.
goTenna recommends users follow their secure operating best practices https://support.gotennapro.com/s/article/Secure-Operating
Exploits
Credits
finder
Erwin Karincic, Clayton Smith, and Dale Wooden reported this these vulnerabilities to CISA.