Slashdot Mirror
Cell Phone Interception At Def Con
ChrisPaget writes "I'm planning a pretty significant demonstration of GSM insecurity at Defcon next week, where I'll intercept and record cellular calls made by my attendees, live on-stage, no user-input required. As you can imagine, intercepting cellphones is a Very Big Deal in the eyes of the law; this blog post is an attempt to reassure everyone that their privacy is being taken seriously despite the nature of the demo. I'm not just making it up either — the EFF have helped significantly with the details."
"Uh-oh... Slashdot incoming..."
Does this mean Verizon will start advertising that they are CDMA?
The teachers will crack any minute, purple monkey dishwasher.
"I'm planning a pretty significant demonstration of vault insecurity at Bankcon next week, where I'll break-in and take financial deposits made by bank customers, live at-bank, no teller-input required. As you can imagine, cracking safes is a Very Big Deal in the eyes of the law; this blog post is an attempt to reassure everyone that their money is being taken safely despite the nature of the demo. I'm not just making it up either -- the EFF have helped significantly with the details."
Is jamming UMTS network also planned? (yes, lots of folks still don't have handsets with UMTS; but at Defcon...)
One that hath name thou can not otter
Isn't this the show that the "Spot the Fed" game?
RIP America
July 4, 1776 - September 11, 2001
Want to have your call intercepted and overheard? There's an app for that!
It is illegal to intercept cellphone communications. Doesn't matter if it is a "security demonstration" what you call it is not relevant. You probably need waivers from everyone you plan on intercepting.
Get a lawyer who know that area of law, and not from the EFF. I like their ideals and all, but their track record is as idealists and they don't seem to do so good in terms of actual law, especially in the court.
Not saying don't give your talk, GSM security is serious and the phone companies need to get with it and fix that shit. However make sure you aren't breaking the law.
Just press lightly against the bottom left!
In this age, where more and more people and institutions are trying to control, and intercept, the flow of information, encryption is the future. Anyone with some knowledge in the area knows that LE et al have the ability to intercept all kinds of comm, emails, phone calls, etc. Just as you should automatically assume that any email you send to anyone is compromised and therefore public knowledge, the same for phone conversations. The only way around this is to encrypt if at all possible, though the demand has to rise for things to be more pragmatic and easily accessed. It is still an interesting method, but much like the internet, phone systems were not designed with security as a main priority.
"It's ok, I'm completely secure as long as my iron is off"
Isn't it illegal already to simply own an IMSI catcher or a GSM/UMTS jamming device in the US?
Because here in unfree Switzerland, it is.
I was planning on going to defcon (but everyone bailed on me and I don't know very many hard-core computer nerds - ugh!)... but I do wonder about smart cell phones there. I was hesitant to even bring my G1 there because as a computer it certainly can be hacked by some of the evil geniuses which inhabit that place. Is anyone else not going to bring the smart phone at all because of this - or am I just very paranoid?
I was planning on digging up an old crappy phone which basically just makes calls. (But given this article, it sounds like no matter what happens, I'd be screwed!)
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
It is not going to be a demonstration of the recently discovered cryptographic vulnerability. Instead it's going to be a demonstration of an "IMSI catcher", a device which pretends to be the network and can therefore simply avoid offering encryption to the handset.
No one asked for legal advice.
Evidently, you haven't been to too many attorneys because those are the same exact responses you would get from them! Though they'd use bigger words and charge you $350 for an opinion.
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
For fear of wifi trickery, I decided to bring an iPad 3G to defcon. I was to use the 3G connection exclusively while there. Oops.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
It doesn't ask for advice (apparently he got some from the EFF) he is just making advertisement for his talk on /.
Which is totally on-topic if this is really what the summary says it is about.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
The article suggests he's doing a MITM style attack, is he spoofing a cell tower?!
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
Is there anyway to setup a faraday cage with a cell phone inside it with some passive antenna repeater? That way you could isolate the testing to a small group of phones. Just an idea.
While i sort of admire your supposed dedication to the openness and security of common technology..
I'm pretty sure you'll be spending some of the near future in jail.
Worth it?
Personally i kinda frown on spending money to lock you up for such a stupid stunt that you know will get you in trouble... Or should know...
It would be cheaper all around if some LEO were just to shoot you...
Because i pretty much dont care about the security of my cellphone calls.
{shrug}
So, for the NSA to listen in on all cell conversations with Echelon is ok under the Patriot Act, but its not ok for the average citizen....? Gotta love Amerika!
Somehow, I doubt that anyone will ever be able to implement encryption that is actually secure while being used by large segments of the population that really don't care that much. The only people who use high-quality encryption for pretty much any kind of communications are paranoid/curious geeks and people who have (or think they have) very good reasons for keeping their communications secret, e.g. some criminals, spies, the military, etc, and I don't expect that to change anytime soon. The best we're likely to get is a system where the messages are encrypted over the air with a key that the carrier or some other central authority has, which will readily give the Government whatever it asks for, and probably won't be too hard to hack for anyone really motivated anyways. AFAIK, that's pretty much what we have now.
I don't reply to ACs
What's the point of mooning the Man (unless that IS the point) when you could publish the information offshore without attribution?
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Pffft! Such interception is easily defeated with complex analog encryption strategies such as Arp Language.
Chris Paget is great on stage just like any other magician. Once you pull him away from the smoke and mirrors, trying to get him to actually produce results is the same as getting a magician to really float without hidden wires.
Last year's magic act was with how insecure RFID proxy cards are. To quote Chris Paget himself:
"We're determined to see this project through; we think that ProxPick is a valuable tool and we're determined to give you all some great hardware to hack on. ProxPick represents an evolutionary leap in terms of the functionality and control that it gives to RFID hackers..."
The result of Chris Paget's seeing the project through is that http://proxpick.com/ simply returns ""
It is sad that the EFF's time is being burned up on this latest magic act. Watch as something strangely goes wrong with the demo and Chris Paget is once again left to claim: "electronics sometimes seems like 10 parts engineering and 1 part voodoo - it seems the right incantations have not yet been said..."
Why DefCon keeps falling for this type of snake oil is anyone's guess.
they have been listening to you all for a while
From the blog post...
"It is unlikely that any 911 service can be provided, however a best effort will be made to connect any emergency calls to a suitable local destination."
Well let's hope your best effort doesn't result in someone's death. That generally doesn't bode well for tech demos.
I have nothing compelling to say
...because if I was, and you decided to eavesdrop & record one of *MY* calls, the only "interception" would be between my fist & your face.
Gentoo Linux - another day, another USE flag.
Wow, violence. Yeah, that will solve everything. Did you actually read any part of the articles linked?
First off, the area will be marked, secondly it's announced and thirdly you should expect stuff like this to happen at a hacker conference. If you can't handle that, stay away. This is demonstrated to provide proof of a flaw so it can be addressed.
I can remember the last Access All Areas in London where people wandered in off the street and started checking their email on the computers we had installed there. I mean, how dumb can you get?
Insert
You can set your phone to GSM only.. (which lots of people do as it increases battery life and generally gives a better call quality) .. Or just put a few phones doing data connections on UMTS at the time of the demo.. It will take up most of the connection (used to be max of 7 per cell).. then everyone else will be diverted to GSM
...hence not with "no user-input", requiring deviation from defaults.
Few data connections? It's primarily a telephony network, with QoS geared heavily towards that goal.
One that hath name thou can not otter
The result of Chris Paget's seeing the project through is that http://proxpick.com/ simply returns ""
How about you try to get the site's address right before making an idiot of yourself: http://www.proxpick.com/
Foon you kill me man.. shout me, been a long time! :D