Slashdot Mirror
Fake GSM Base Station Trick Targets IPhones
mvar writes "While his Black Hat DC Conference demonstration was not flawless, a University of Luxembourg student on Wednesday did show that it's possible to trick iPhone users into joining a fake GSM network. Ralf-Philipp Weinmann showed how to cobble together a laptop using open-source software OpenBTS and other low-cost gear to create a fake GSM transmitter base station to locate iPhones in order to send their owners a message. A number of iPhone users in the room expressed surprise that they had gotten a message asking them to join the network. 'You want to get phones not just used by the teenage crowd but executives,' said Weinmann, adding that it is possible to 'have complete control of the phone.' Part of the reason these fake GSM network attacks are possible is because the code base used in smartphones such as the iPhone, which is Infineon-based, goes back to the 1990s."
Users click on "Click here to install Rogue Antivirus for free!" links, children click on flashing boxes regardless of anything, and executives make money off of the backs of much lower paid workers!!!
Shocking.
The exploit he demonstrated has since been patched by Apple.
Boredom is bliss.
I had the impression that most, if not all, phones are vulnerable to this attack due to the inherent flaws in GSM.
This is a rather old news article that has been reported multiple times.
Why is it suddenly "news" again when someone discover it works on the iPhone?
And if you're on about targeting business users, won't a compromised Blackberry be as, if not more, significant?
Ah yes, art's imitation by Life Itself.
... is always dangerous, but this goes beyond that.
Much more than a legacy leftover, this remains a chipset and baseband issue, and goes much deeper than the application set.
If the world isn't beating a path to your door you're doing something wrong.
I had the impression that most, if not all, phones are vulnerable to this attack due to the inherent flaws in GSM. This is a rather old news article that has been reported multiple times. Why is it suddenly "news" again when someone discover it works on the iPhone? And if you're on about targeting business users, won't a compromised Blackberry be as, if not more, significant?
Its only "news" because of iPhone. If you don't mention iPhone in your title or description then your article/page will have fewer readers and you presentation will have fewer attendees. Basically mentioning iPhone in your title is marketing and even presentations have to be marketed.
Cool. Can we get it as an Asterisk plugin? or a Skype proxy?
If you've joined a bogus network, your first text message will read "How are you gentlemen!!"
#DeleteChrome
The old Fake GSM Base Station trick. That's the second time this week I fell for it!
Perhaps this is why Apple is moving to Qualcomm for future iPhone chips, starting with the CDMA iPhone for Verizon and other carriers. (This has been widely reported; I first saw it on Engadget.) This will almost certainly continue with iPhone 5.
If I were Infineon (and I'm not, never have been affiliated with them), I would be hopping mad at being blamed for this kind of security flaw.
It is a GSM flaw and it is a basic architectural/protocol flaw - not a hardware OR (strictly) software vulnerability.
The problem is simple. GSM phones inherently trust GSM base stations to be authentic. A GSM phone has no way to validate the authenticity of an "alleged" base station. If the phone comes across a GSM BCH (broadcast channel) in its spectrum, and the BCH adheres to GSM protocol format, the phone accepts that the BCH is being transmitted by an authentic base station. There is nothing in the signal (messaging) that can be used to validate the base station's authenticity.
This was changed in UMTS (aka 3G). In UMTS, the protocol by which a UMTS phone attaches to a UMTS base station includes MUTUAL authentication. The base station must cryptographically prove its authenticity or the phone will not associate with it. This authentication related cryptography is performed inside the SIM card (called USIM application in UMTS) -- the phone simply serves as courier - between the base station and the USIM. The USIM tells the phone whether it finds the base station's credentials to be acceptable. Since the base station is authenticating the USIM's credentials as well, the authentication is mutual. Both the USIM - AND- the base station (actually the core network behind the base station) have to find each others' credentials acceptable, or the phone will not attach.
There is nothing Infineon or Apple or anyone else can do to "fix" this vulnerability in GSM. UMTS is the "fix".
P.S. Turning femtocells into rogue base stations is theoretically possible -- it is up to the femtocell manufacturer to build safeguards into their designs to make this impossible (I know - I've worked on just such safeguard designs in a past life...)
University of Luxembourg student
Ralph-Philip is a researcher at the university here, not a student.
This could be learned even from the Google results page. Don't even have to click links.
You wouldn't call Shigeru Miyamoto an intern at Nintendo either, now would you?
There is nothing wrong with your iPhone.
Do not attempt to adjust your network settings.
We are now controlling the transmission.
We control the 3G, 4G and the WiFi.
We can deluge you with a thousand websites or expand one single app to crystal clarity and beyond.
We can shape your vision to anything our imagination can conceive.
For the next hour we will control all that you see and hear.
You are about to experience the awe and mystery which reaches from the deepest inner mind to the outer limits.
will it allow me to send a 'We will control the horizontal, we will control the vertical. For the next hour, sit quietly and we will control all that you see and hear.' message to iPhone users?
That would be so totally fsckin' cool.
There are a lot of people discussing "flaws" in the GSM, "nice features" in UMTS and no one mentioning stupiid truth.
Problem not in the protocols, or software. Problem is that operators think that they have right to control user equipment.
And when this equipment grows from the stupid phone to full-featured computer, user privacy goes void.
Do not be afraid of rogue with laptop, be afraid of operator's insider.
What would happen if next generation of phones would get direct brain interfaces? You'll allow operators to control your brain just like now they control your calendars and bookshelves?
Whooooo there. Take a deep breath, put your tin-foil hat back on and please return to your moms basement.