Karsten Nohl

Karsten Nohl is a German cryptographer and security researcher known for a series of high-profile disclosures exposing weaknesses in widely deployed communications and access-control systems. Born on August 11, 1981, he studied electrical engineering at SRH University Heidelberg from 2001 to 2004, then earned a PhD in computer science from the University of Virginia (2005-2008), where his dissertation addressed "Implementable Privacy for RFID Systems."

While still a doctoral student, Nohl worked with Henryk Plötz and a researcher known as "Starbug" from the Chaos Computer Club to reverse-engineer the MIFARE Classic RFID chip, a smart card widely used for transit fare systems and building access control. They presented their cryptanalysis of the card's proprietary Crypto-1 cipher at the Chaos Communication Congress in December 2007 and published a follow-up academic paper at the USENIX Security Symposium in 2008.

Cracking GSM Encryption

In 2009, Nohl launched the A5/1 Security Project, an open, crowdsourced effort to compute rainbow tables mapping the internal states of the A5/1 stream cipher used to encrypt GSM voice and data traffic. He presented the results at the 26th Chaos Communication Congress in Berlin in December 2009. At Black Hat USA 2010 he and collaborators, including Chris Paget and Sylvain Munaut, extended this work to show practical interception and decryption of live GSM calls.

Nohl has served since 2010 as Managing Director and Chief Scientist of Security Research Labs (SRLabs), a Berlin-based security research and consulting firm he founded. In 2013, at Black Hat USA, he disclosed that many SIM cards still used the outdated DES cipher for over-the-air updates, allowing an attacker to extract a SIM's cryptographic key by sending a single malicious SMS.

BadUSB and Later Research

In 2014, together with fellow SRLabs researcher Jakob Lell, Nohl presented "BadUSB: On Accessories that Turn Evil" at Black Hat USA, demonstrating that the firmware of common USB controller chips could be reprogrammed to covertly impersonate other device types in a way conventional antivirus tools could not detect. That same period, Nohl and researcher Tobias Engel separately publicized exploitation techniques against flaws in the SS7 telecom signaling protocol, showing that attackers could intercept calls and texts and track a phone's location using only its number; the vulnerability was later demonstrated on the U.S. television program "60 Minutes" in 2016.

Nohl's research has repeatedly targeted the gap between the theoretical and practical security of systems assumed to be robust, spanning RFID access cards, mobile network encryption, SIM card firmware, USB peripherals, and telecom signaling infrastructure.

Timeline

• 1981-08-11Born in Germany.
• 2007-12Presented cracking of the MIFARE Classic RFID cipher at the Chaos Communication Congress.
• 2009-12Presented the A5/1 GSM cipher cracking project at 26C3 in Berlin.
• 2010Became Managing Director and Chief Scientist of Security Research Labs (SRLabs) in Berlin.
• 2013-07-31Disclosed a DES-key extraction attack on SIM cards via SMS at Black Hat USA.
• 2014-08Presented BadUSB, the USB firmware reprogramming attack, with Jakob Lell at Black Hat USA.
• 2016-04SS7 vulnerability exploitation demonstrated on CBS's '60 Minutes.'