Cheap GSM Eavesdropping a Reality

Techmeology writes "GSM eavesdropping has been demonstrated at the Chaos Computer Club Congress in Berlin using a €10 Motorola phone and open source GSM firmware. Karsten Nohl and Sylvain Munaut replaced the firmware on the phone, enabling them to process all the data it received. They used already available rainbow tables to decrypt data being sent to and from other mobile phones. They have no plans to release the hack publicly, however they expect others to successfully attempt the hack. Mr. Nohl said the objective was to raise awareness of GSM's insecurity."

Comments

Until phones have real crypto

[dgatwood]

Until phones use proper PK crypto with a proper certificate authority, key revocation, etc. under the user's control, you can safely assume your phone calls are trivially snooped over the air. That's just a great big "duh". Not at all surprising that it can be done cheaply. What's surprising is that it took so long.

Re:I don't care...

[TheRaven64]

Not true. The government will typically need a warrant to wiretap at the provider. At the very least, they will leave a paper trail. In contrast, they can tap into unsecured communications without any kind of warrant, and if they can do it with $10 of equipment then there is nothing that will require a paper trail.

Re:I don't care...

[nospam007]

"The government will typically need a warrant ..."

Boy you're so wrong. They just need a National Security Letter.

http://www.wired.com/threatlevel/tag/national-security-letter/

Re:I don't care...

[tunapez]

Actually, they just need to promise to deliver one in a week...
Third bullet from the bottom.
 
In this day and age of fear, a kid with an undetonated firecracker, a chip on his shoulder and a lighter could easily be labeled a 'terrorist threat'. Which any lawyer worth his/her salt, or golfs with the judge, could qualify as an 'emergency'. Getting around to sending the letter ex post facto? I'm sure it will be a top priority for the listeners already listening.