Slashdot Mirror
GPRS Can Be Hacked Easily, Claims German Researcher
hypnosec writes "A German technology researcher on Wednesday showed global mobile makers and technology firms how General Packet Radio Service can easily be tapped, intercepted, and decrypted with an average mobile phone and a few applications. According to the New York Times, Karsten Nohl, a computer engineer and mobile security researcher, demonstrated to fellow researchers gathered to attend Chaos Communication Camp, a Berlin-based hackers event, how to intercept the voice or data messages sent between mobile devices over GPRS easily, owing to weak protection provided by mobile network carriers for data information. Nohl, in collaboration with his colleague Luca Melette, tapped the information within a radius of five kilometers using a seven-year-old inexpensive mobile phone from Motorola." Computerworld also has an informative, link-laden account. If you are attending this year's CCC (only every four years, sadly), feel free to drop a line (with the submissions form) about cool projects you encounter there.
Hundreds of millions of people will lose their livelihood as a result of this exploit!
That's why I got lost despite my GPS last time. Some people in my house tried to make me feel as if I was stupid.
That the Enigma machine code could also be broken easily. Of course nobody told them til after the war...
But are they Whole wheat, saltine, or low sodium crackers?
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
They want their outdated mobile data standard back (preferably with no shipping charges)
using a seven-year-old inexpensive mobile phone from Motorola
Yet another reason why I still use my RAZR. MUHAHAHAHA!
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
No, these are hackers. They work on the software, the hardware and the society to figure out how everything works or doesn't work. Nohl filters out all data that isn't sent or meant to be received by one of his phones. He can still demonstrate the flaw, but he supplies his own prey. You might be interested to know that the Chaos Computer Club regularly operates a GSM network at the yearly Chaos Communication Congress, and they run it on open source software. Besides, they have their own linguist "on staff".
I recently switched to Sprint which runs the much more secure CDMA net..............[NO CARRIER]
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Bill Clinton called. He said, "Gimme some more sugar, or it's back to high school for you" !!
Isn't GPRS effectively obsolete at this point? The only time I see it in use is way out in the boonies where they're clearly near the bottom of the list for tower upgrades. Often the service is broken anyway (get GPRS connection with strong signal, but no packets make it through). 10 or 15 years ago this would have been a big issue, but these days I just can't see it.
I read the internet for the articles.
GPRS is 2G GSM-based (TDMA) technology, which has been known to be insecure for years.
That's why everybody uses some form of CDMA for 3G. The GSM world may have won the GSM vs. CDMA war, but they did so by adopting a form of CDMA (W-CDMA) for UMTS/HSPA.
Now that's it's fairly inexpensive ($50) and abundant that you can get GPRS transceivers, and the wire protocol is widely known today.... it's not surprising that folks can hack into it.
I mean current technology R/C transceivers are more secure nowadays.
Is is really news that unencrypted transmissions can be listened to? Also, it is well known that the weakest encryption schemes of GSM/GPRS is broken since long ago. Serious operators has exchanged these to new schemes a long time ago. Also, none of this works in 3G or LTE.
Are there any cellular protocols that are secure? That a criminal, corporation, or government couldn't hack? GPRS and CDMA are out from what I remember recently. Anything else been hacked? What hasn't been hacked yet?
Also, are cellular communications inherently less secure than wired communications like a land line? Or are those even easier for say your phone company or government to listen in on?
Yea, you go ahead and explain that to the NYT. We'll wait here for ya.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Good hackers are called anti-hackers according to CNN.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Karsten Nohl states - “One reason operators keep giving me for switching off encryption is, operators want to be able to monitor traffic, to detect and suppress Skype, or to filter viruses, in a decentralized fashion,” Mr. Nohl said. “With encryption switched on, the operator cannot ‘look into’ the traffic anymore while in transit to the central GPRS system.”
This is rubbish. Deep Packet Inspection for the detection of layer 7 applications such as Skype being used by mobile broadband subscribers is generally done on the Gi interface, on or after the GGSN towards the ISP network. At this point in the network, there is no encryption (except for VPNs towards corporate networks for example).
DPI is not achieved by sniffing the radio interface, so Karsten Nohl's comment here is misguided and not accurate.