Slashdot Mirror
Cell Phone Interception At Def Con
ChrisPaget writes "I'm planning a pretty significant demonstration of GSM insecurity at Defcon next week, where I'll intercept and record cellular calls made by my attendees, live on-stage, no user-input required. As you can imagine, intercepting cellphones is a Very Big Deal in the eyes of the law; this blog post is an attempt to reassure everyone that their privacy is being taken seriously despite the nature of the demo. I'm not just making it up either — the EFF have helped significantly with the details."
Does this mean Verizon will start advertising that they are CDMA?
The teachers will crack any minute, purple monkey dishwasher.
Is jamming UMTS network also planned? (yes, lots of folks still don't have handsets with UMTS; but at Defcon...)
One that hath name thou can not otter
Isn't this the show that the "Spot the Fed" game?
RIP America
July 4, 1776 - September 11, 2001
It is illegal to intercept cellphone communications. Doesn't matter if it is a "security demonstration" what you call it is not relevant. You probably need waivers from everyone you plan on intercepting.
Get a lawyer who know that area of law, and not from the EFF. I like their ideals and all, but their track record is as idealists and they don't seem to do so good in terms of actual law, especially in the court.
Not saying don't give your talk, GSM security is serious and the phone companies need to get with it and fix that shit. However make sure you aren't breaking the law.
Just press lightly against the bottom left!
In this age, where more and more people and institutions are trying to control, and intercept, the flow of information, encryption is the future. Anyone with some knowledge in the area knows that LE et al have the ability to intercept all kinds of comm, emails, phone calls, etc. Just as you should automatically assume that any email you send to anyone is compromised and therefore public knowledge, the same for phone conversations. The only way around this is to encrypt if at all possible, though the demand has to rise for things to be more pragmatic and easily accessed. It is still an interesting method, but much like the internet, phone systems were not designed with security as a main priority.
"It's ok, I'm completely secure as long as my iron is off"
I was planning on going to defcon (but everyone bailed on me and I don't know very many hard-core computer nerds - ugh!)... but I do wonder about smart cell phones there. I was hesitant to even bring my G1 there because as a computer it certainly can be hacked by some of the evil geniuses which inhabit that place. Is anyone else not going to bring the smart phone at all because of this - or am I just very paranoid?
I was planning on digging up an old crappy phone which basically just makes calls. (But given this article, it sounds like no matter what happens, I'd be screwed!)
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
Evidently, you haven't been to too many attorneys because those are the same exact responses you would get from them! Though they'd use bigger words and charge you $350 for an opinion.
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
For fear of wifi trickery, I decided to bring an iPad 3G to defcon. I was to use the 3G connection exclusively while there. Oops.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
It doesn't ask for advice (apparently he got some from the EFF) he is just making advertisement for his talk on /.
Which is totally on-topic if this is really what the summary says it is about.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
The article suggests he's doing a MITM style attack, is he spoofing a cell tower?!
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
Is there anyway to setup a faraday cage with a cell phone inside it with some passive antenna repeater? That way you could isolate the testing to a small group of phones. Just an idea.
So, for the NSA to listen in on all cell conversations with Echelon is ok under the Patriot Act, but its not ok for the average citizen....? Gotta love Amerika!
Somehow, I doubt that anyone will ever be able to implement encryption that is actually secure while being used by large segments of the population that really don't care that much. The only people who use high-quality encryption for pretty much any kind of communications are paranoid/curious geeks and people who have (or think they have) very good reasons for keeping their communications secret, e.g. some criminals, spies, the military, etc, and I don't expect that to change anytime soon. The best we're likely to get is a system where the messages are encrypted over the air with a key that the carrier or some other central authority has, which will readily give the Government whatever it asks for, and probably won't be too hard to hack for anyone really motivated anyways. AFAIK, that's pretty much what we have now.
I don't reply to ACs
What's the point of mooning the Man (unless that IS the point) when you could publish the information offshore without attribution?
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Pffft! Such interception is easily defeated with complex analog encryption strategies such as Arp Language.
they have been listening to you all for a while
From the blog post...
"It is unlikely that any 911 service can be provided, however a best effort will be made to connect any emergency calls to a suitable local destination."
Well let's hope your best effort doesn't result in someone's death. That generally doesn't bode well for tech demos.
I have nothing compelling to say
Wow, violence. Yeah, that will solve everything. Did you actually read any part of the articles linked?
First off, the area will be marked, secondly it's announced and thirdly you should expect stuff like this to happen at a hacker conference. If you can't handle that, stay away. This is demonstrated to provide proof of a flaw so it can be addressed.
I can remember the last Access All Areas in London where people wandered in off the street and started checking their email on the computers we had installed there. I mean, how dumb can you get?
Insert
Tough words from a tough guy. On the other hand, if you enter a talk with a big fat tagline of "we will now intercept your calls", it might make sense to either avoid that or live with it.
That's not as much fun as armchair-bullying from your mom's basement, though ;)
You can set your phone to GSM only.. (which lots of people do as it increases battery life and generally gives a better call quality) .. Or just put a few phones doing data connections on UMTS at the time of the demo.. It will take up most of the connection (used to be max of 7 per cell).. then everyone else will be diverted to GSM
...hence not with "no user-input", requiring deviation from defaults.
Few data connections? It's primarily a telephony network, with QoS geared heavily towards that goal.
One that hath name thou can not otter
I would hope you had bail money in your pocket for the battery charge, and a good lawyer when they sued you for medical damages. Plus whatever the anger management classes the judge would order you to take after you paid your fine (or served your jail time).
As Isaac Asimov's Salvor Hardin said in the Foundation, "Violence is the last refuge of the incompetent."
Free Martian Whores!
Actually, I am not a violent person but my strong comments were meant to illustrate my disdain at no-hopers searching for a bit of fame by using Slashdot as an advertising platform for some boring little talk they're doing at a computer show somewhere.
People like me, who just get on and do their security work without bragging to the rest of the world about it, are the ones with skills - anyone can stand in front of a bunch of salivating muppets and perform magic tricks.
Gentoo Linux - another day, another USE flag.
Foon you kill me man.. shout me, been a long time! :D