Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cell Phone Encryption Exploit Demonstrated

Posted by Soulskill on from the wiretapping-on-the-cheap dept.

Saxophonist brings us a story from Forbes about security researchers who demonstrated a new method for breaking the encryption on GSM cellular signals. The presentation was made at the recent Black Hat conference, and it's notable for the fact that the technique only requires "about half an hour with just $1,000 in computer storage and processing equipment." The researchers also claim to have found a faster method, which they intend to market for $200,000 - $500,000. Quoting: "Undetectable, 'passive' systems like the one that Muller and Hulton have created aren't new either, though previous technologies required about a million dollars worth of hardware and used a "brute force" tactic that tried 33 million times as many passwords to decrypt a cell signal. All of that means, Hulton and Muller argue, that their cheaper technique is simply drawing needed attention to a problem that mobile carriers have long ignored--one that well-financed eavesdroppers may have been exploiting for years. 'If governments or other people with millions of dollars can listen to your conversations right now, why shouldn't your next-door neighbor?' Muller says."

4 of 153 comments (clear)

  1. GNUradio is also up to GSM cracking by erlehmann · · Score: 4, Informative

    and i'll bet they won't charge anything.

    check out some movie about the GSM state of security [1] and mod me informative. ;)

    [1] http://chaosradio.ccc.de/camp2007_m4v_2015.html

  2. Re:There never was end-to-end encryption... by QuantumG · · Score: 4, Informative

    Ya know, it *is* strange. Take, for example, Pidgin (formerly GAIM). There's about two dozen plugins for it. One of the plugins is Pidgin-Encrypt which does everything that you would expect (except possibly for some sort of certificate system) and is about as secure as ssh. Does it come with Pidgin by default? No. Is it enabled by default? No. Why not? Why is encryption still considered some opt-in alternative? Considering that it takes both parties to consciously choose to install this plug-in, the grand total of people who use it is about 10.

    --
    How we know is more important than what we know.
  3. Re:For those three people ... by Anonymous Coward · · Score: 5, Informative

    Newsflash - most of the world outside the US uses GSM.

  4. Lets look at some facts.... by threeturn · · Score: 4, Informative
    This is a good hack, and impressive work by all involved, but its rather limited in its application. It only works against the GSM A5/1 encryption algorithm. While there is a huge amount of A5/1 equipment out there it's a ~30 year old algorithm that was designed to run on battery powered equipment from the late 80s.

    New GSM equipment already supports A5/3 which is still secure. I think the main impact of this hack is going to be some sensational headlines and a big push to make A5/3 universally available.