Slashdot Mirror
Hacker Builds $1,500 Cell Phone Tapping Device
We previously discussed security researcher Chris Paget's plans to demonstrate practical cell phone interception at DefCon. Paget completed his talk yesterday, and reader suraj.sun points out coverage from Wired. Quoting:
"A security researcher created a $1,500 cell phone base station kit (including a laptop and two RF antennas) that tricks cell phones into routing their outbound calls through his device, allowing someone to intercept even encrypted calls in the clear. Most of the price is for the laptop he used to operate the system. The device tricks the phones into disabling encryption and records call details and content before they are routed on their proper way through voice-over-IP. The low-cost, home-brewed device ... mimics more expensive devices already used by intelligence and law enforcement agencies — called IMSI catchers — that can capture phone ID data and content. The devices essentially spoof a legitimate GSM tower and entice cell phones to send them data by emitting a signal that's stronger than legitimate towers in the area. Encrypted calls are not protected from interception because the rogue tower can simply turn it off. Although the GSM specifications say that a phone should pop up a warning when it connects to a station that does not have encryption, SIM cards disable that setting so that alerts are not displayed. Even though the GSM spec requires it, this is a deliberate choice of the cell phone makers, Paget said."
If the GSM spec does specify the warning should be there, does that mean the manufacturers are violating their GSM license when they disable that warning? Or could they be sued for false marketing because the phone you bought does not follow the GSM spec despite being called a GSM phone?
In short: Could they be (successfully) sued for it?
The Tao of math: The numbers you can count are not the real numbers.
The government will mandate better encryption and stronger standards so they maintain their monopoly on being able to intercept phone calls.
So wait, law enforcement use a method to interception that would be compromised if that warning was displayed, and phone manufacturers fail to enable such a warning? Call my a conspiracy nut but perhaps they were asked not to include such a warning for exactly that reason. It wouldn't be the first time the government has asked private industry to make it easier to snoop.
So which manufacturers/service providers leave the encryption warning intact?
The device works only on 2G GSM. While Chris Paget did not demonstrate it, he noted that he could also set up the device to block 3G signals and thus force all calls through 2G.
Well, there's spam egg sausage and spam, that's not got much spam in it.
I am not sure I understand the above text. If it is the SIM card disabling the setting, why is this then labeled a deliberate choice by the cell phone makers?
Also I have seen at least on numerous Nokia mobile phones that an icon in the display notify you at least in some instances when encryption is disabled. (This happen quite frequently in e.g. China).
I find it quite astonishing that it is that easy to intercept GSM calls. And that phonemakers disable this warning is even more astonishing!
So what are the currently available options for true end-to-end encryption between cell phones anyway?
on iphone and android?
The root cause of this weakness is that whereas the 2G network can authenticate the handset (both the SIM and the ME), the handset cannot authenticate the network. It's assumed the 2G network is trustworthy, which in this case, it isn't. There's a stack load of problems with 2G (GSM) security including unilateral authentication, which leads to network impersonation; weak encryption (short keys and broken algorithms); lack of end-to-end or virtually end-to-end encryption; weak confidentiality; no data integrity algorithms; lack of visibility to the user that encryption is on, etc. A lot of these are fixed in 3G. See http://www.3gpp.org/ftp/tsg_sa/WG3_Security/_Specs/33120-300.pdf and http://www.arib.or.jp/IMT-2000/ARIB-spec/ARIB/21133-310.PDF. In this second PDF, section A.4 Hijacking of services describes this attack.
this is a deliberate choice on the cell phone makers, Paget said.
After having been told to do so by the carriers who were told to do so by the intelligence collecting agencies of various governments via their respective communications ministries no doubt.
I still cannot find the droids I am looking for...
It'd be funny if Verizon used this as an advertising slam against the iPhone and ATT (though of course they won't). I wonder if something like this could be done against CDMA?
We apologize for the inconvenience.
He actually gave a talk about this on Hak5. It seemed it could be accomplished using an USRP and OpenBootTS
I can't even explain how common this thing is, and how many geeks are playing with it.
He didn't actually *build* the hardware, he purchased it - some smart people actually build these things, and hobbyists play with it.
Why this guy felt like he had to take a credit for it is beyond me.
These guys may be able to intercept cell calls, but I can't even send an SMS message with Wammu on my Ubuntu machine.
The built-in Sony Ercicsson F3507g modem works for Mobile Broadband through Network Manager, but Wammu cannot use it to send an SMS.
And it doesn't work with my external phone either. On the rare occasions when Wammu can find the phone, it says it sent the SMS, but in fact it didn't.
So I sure admire these guys who can intercept calls with a laptop, while I need an XP virtual machine so that I can reliably send SMSes using "MyPhoneExplorer"...
...but if I had a GSM phone (I have no cellphone at all, actually) I'd be a lot more interested in using this to set up my own cell and route my calls over the Net.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Fact is, the GSM security notification was circumvented so the government(s) could snoop in on your conversations. Re-enabling security notifications would render many operational spy-jobs and much equipment (at the lowest levels) useless. For this reason alone, I'm pretty sure that there will be no outrage and no media circus. Instead the issue will be quietly ignored and (some) folks who run this kit will be sent to Guantanamo. All at the expense of our real security... think twice about sending CC details over a cell phone.
Make sure everyone's vote counts: Verified Voting
http://www.phonecrypt.com/
I killed da wabbit -Elmer Fudd
If a company is working on my dollar, then they'll do as I expect. Phone systems on the Cell Service were always open and non-encrypted no different than a WiFi HUB that cascaded it's WAN to another WiFi Hub encapsulated somewhere else using a MicroWave'd link. They are the same frequencies used by Amateur Radio HAM operators where they too could call someone up. The fee only went to the service of a Cell Service between it's bridges to other networks who had subscribing clients. Then they got greedy to the local internation operators (HAM's) and forced the encryption of the entire network but use proprietary means of selling Cell Phones that would be much more useful if the people could remove encryption to use as 2-way like they used too. The truth is a Cell Phone is nothing more than a tranceiver with a PDA computer that was crippled by the carrier's agenda. So many of these devices are thrown away and wasted and littered into the environment just because of someone's jealousy to do as a HAM radio operator (individual) but without the liability because they are a for-profit company with a regulated corporation.
Can you imagine if everyone had open use of their Cell Phone, and every one was it's own peer'd access point in a Bittorrent-style of repeated redundant network of shared routes? Who needs Cell Phone Towers when properly-written software on those PDA's could geographicall navigate communications just by pressence alone?
There are lawsuits in the U.S. District Court for Northern District of Illinois right now. A law firm is accused of using IMSI catcher to grab someone's cell phone calls during an EEOC investigation.
The cases go to trial later this year. FBI has been informed.