Slashdot Mirror
Open Source GSM Cracking Software Released
angry tapir writes "The GSM technology used by the majority of the world's mobile phones will get some scrutiny at next week's Black Hat security conference. An open source effort to develop GSM-cracking software has released software that cracks the A5/1 encryption algorithm used by some GSM networks. Called Kraken, this software uses new, very efficient, encryption cracking tables that allow it to break A5/1 encryption much faster than before."
Will this allow me to finally clone my multiple V2 sim cards on a single super card so I won't have to carry multiple GSM cards when I travel abroad?
Release the Kraken!
Get with the times, guys. This isn't "GSM cracking" this is "GSM lawful intercept"... At least that is what the folks who already do it routinely call the practice...
They are TRYING to show that the ability to crack GSM must already exist because it has been so easy for them to do. If a Government or powerful organization wanted to listen to a GSM call, they could be doing it today.
http://soylentnews.org/~tibman
Not could but can. It's a pretty well known fact that in most western countries there are schemes in place to allow intelligence agencies direct internal access to cell phone provider networks.
they are doing it, so what's the fuzz?
Burning some karma here.
Ironic that this is hot on the heels of Slashdot's pro-net neutrality story. If the government took over the internet, it would make sure to "regulate" any websites posting this kind of cracking information. Want to pirate it on Bittorrent? Sorry, the government would "regulate" Bittorrent too thanks to political donations from lobby groups like the RIAA/MPAA. In fact, the government would require all your activities to be logged by ISPs for investigative purposes.
Net neutrality--proving that there are always people naive enough to hand great things over to the government where they are ruined forever.
Does this lead to more wiretapping, or free cellular service?
TFA also points out that eavesdropping as 'easy' as making a fake tower, getting phones to connect to it, commanding them to drop encryption, and having enough disk space to save the conversations. Not very expensive, and not very difficult.
So this would work well if you brought a fake tower with you to an event, like a convention or even a press conference, and just gather conversations at will. Setting up a tower near the White House would not be impossible, unless they already understand this and have an onsite tower they can secure. The Secret Service is no doubt already working with this, if not already in place. If VZW or Sprint is their most common carrier, well, those are different standards so this is not the problem.
All said and done, it is not impractical to be able to eavesdrop on GSM phones, though it is nontrivial. Data intercept I don't know a lot about.
deleting the extra space after periods so i can stay relevant, yeah.
"It's a pretty well known fact that in most western countries there are schemes in place to allow intelligence agencies direct internal access to cell phone provider networks."
All the more reason to port Zimmerman's Zfone to the iPhone and Android and any other smart phone you can think of.
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
"used by the majority of the world's mobile phones"
I don't know much about mobile phone tech, but this sounds strange. This is 2010, I don't know anyone still using a GSM-phone, most of us switched to 3G 6-7 years ago. If it's true, surely GSM users are in the minority in the developed world?
What I don't understand is why they don't use something along the lines of a Diffie-Hellman key exchange when a call is being set up. In the case of wireless communication, all data gets broadcast in all directions, so setting up an MitM attack wouldn't work, or at least be instantly recognized as such, unless one could somehow intercept 100% of the signal before it reaches its destination, which I'd think isn't generally going to be feasible.
File under 'M' for 'Manic ranting'
"Can you hear me now?"
"Yup"
"yes"
"uh-huh"
"me too!"
"absolutely!"
Part of the issue... you have to remember how old the GSM standards are. The processing chips didn't have nearly as much oomph as they do today. Most more modern encryption schemes would not have been feasible to even put in a chip that would a) physically fit in a cell phone b) be low enough power to have any meaningful cell phone usage c) have costs low enough to be considered cheap enough to put into cell phones.
N/T
Indeed. This is no tin-foil hat conspiracy theory - there are NO technical obstacles in place for law enforcement or intelligence agencies to tap into the cell-phone network. I used to work at one of the major providers of hardware for cell-phone networks. My mentor at the time, who worked on this gear all over the world, explained how service providers work with law-enforcement to allow them complete access. I wouldn't know about the paperwork required (warrants and such) but if a three-letter agency shows up at the doorstep of a service provider - telling them they need to listen in on a call - they'll get exactly what they want.
"Lawful" interception.
It would be nice to know exactly which GSM carriers use A5/1 encryption, and to what extent it is used. Is it a de facto standard, or a fallback algorithm?
Could this be used to both eavesdrop on calls as well as snatch arbitrary data transfer as in wi-fi wireless sniffing? I see a lot more dastardly uses of the data than random calls from schmoopy to schmoopy. I always felt like banking on the phone for example was more secure than on an arbitrary computer.
'MitM' attacks are trivial, at least to folks who have read the first couple of chapters of "An Introduction to GSM". ....
1. Buy a USRP from ettus ($600, if I remember what I paid)
2. Load up "OpenBTS" and '*'
3.
4. Profit!
Yes, it's that easy.
The gov't doesn't have to crack the encryption, they're given a back door by the telcos. This is not only happening today, it has been happening for many years.
Google CALEA for one of the more recent incarnations.
Learning HOW to think is more important than learning WHAT to think.
I know I will probably be called troll or something, but here it goes anyway...
I worked as a consultant for the defense ministry of certain latin american country (which routinely uses its military for police purposes). While being there I befriended some people who had access to complex eavesdropping systems. They showed me how they had the ability to almost instantly intercept any mobile phone call. They even did it with one of my phone calls for amusement. There were 4 cell phone operators in the country, 2 of them using GSM, 1 of them CDMA and the other used iDEN. They could listen to any call on any operator except the one using CDMA. In the iDEN operator they could listen to both calls and PTT radio.
However, I'm not sure they were breaking encryption even if they told me they were, it might just be that the operators handed them some keys or that encryption was turned off by default in all but the CDMA company and no one notices or cares.
I have heard about this sort of thing enough to believe it. But i think the GSM cracking thing is important because it means foreign government agents or other powerful organizations could listen to GSM calls without anyone knowing.. not even the phone companies.
If a foreign embassy had this capability and was safe within its doors, wouldn't that be a scary thing?
http://soylentnews.org/~tibman
ISPs are providing a service. They have EVERY RIGHT IN THE WORLD to regulate what's passing through their networks, because it's their network.
...Really? Then why if I own, say, a restaurant do I need to let minorities eat in my restaurant? I mean, its mine, right? Why should I let the government tell me that I have to serve Blacks and Asians?
HA! I just wasted some of your bandwidth with a frivolous sig!
Government--the most corrupt organization in the world-
Really? Really? Citation, please.
HA! I just wasted some of your bandwidth with a frivolous sig!
What's new, compared to other past announcements that "GSM has been broken" is that, 3 days ago, the A5/1 Project just wrote the piece of code to perform lookups in the "Berlin rainbow table set". The table set is 2TB and has been computed some time ago and can be obtained from various origins (the project member who wrote the lookup code --Frank Stevenson-- offered the arrangement of swapping preloaded disks for cash at the Schiphol airport). See my blog for some more info about these recent developments.
MitM's are not remotely trivial for wireless communication, where you'd basically have to intercept an airborne signal and somehow keep the original signal from reaching the destination so that your own attempt to send it to the destination is not detected as anomalous.
File under 'M' for 'Manic ranting'
.... Can anyone hear me now?.... Good!
"Meanwhile, another Black Hat presenter, Chris Paget plans to demonstrate a completely different way to intercept GSM calls. He's setting up a fake cellular tower that masquerades as a legitimate GSM network.
According to Paget, using open-source tools and a US$1,500 USRP radio, he can assemble his fake tower, called an IMSI (International Mobile Subscriber Identity) catcher. In a controlled experiment, he's going to set one up at Black Hat and invite audience members to connect their mobile phones. Once a phone has connected, Paget's tower tells it to drop encryption, giving him a way of listening in on calls."
Yes, the only question is how to get it to forward calls. A perverse thought is someone plugging a Magic Jack into it, but you probably need something more sophisticated. Like Skype, or Asterick and some SIP minutes. Maybe not even that.
Read Chris's blogs. She's clever. ps - I assume she's a she, she carries a handbag and wears heels, but I'm somewhat limited in my outlook, acording to Chris. I can only tell her how I see it from my frame of reference.
deleting the extra space after periods so i can stay relevant, yeah.
They don't need to. Diffie-Hellman is for key exchange, but the mobile company already has a copy of the key stored on your SIM card, so they don't need to do any key exchange.
The problem is that they used weak encryption, not that they used symmetric encryption.
Okay, so they'd know what phone the transmission was coming from... the content of the communication could still be encrypted by software on the end user's phone.
File under 'M' for 'Manic ranting'
Erm, it is. They just cracked the encryption algorithm.
You can't crack a Diffie Hellman key exchange except for a single session, because every session has a different set of keys and you have to start from scratch.
File under 'M' for 'Manic ranting'
I never said you could. You seem confused. There is no need for key exchange in thhis case. They just needed to use a better encryption method, e.g. AES.