Hackers crack open mobile network ("Any GSM call is fair game,")

BBC ^ | December 31, 2010 | Unknown

[decimon]

Mobile calls and texts made on any GSM network can be eavesdropped upon using four cheap phones and open source software, say security researchers.

Karsten Nohl and Sylvain Munaut demonstrated their eavesdropping toolkit at the Chaos Computer Club Congress (CCC) in Berlin.

The work builds on earlier research that has found holes in many parts of the most widely used mobile technology.

The pair spent a year putting together the parts of the eavesdropping toolkit.

"Now there's a path from your telephone number to me finding you and listening to your calls," Mr Nohl told BBC News. "The whole way."

He said many of the pieces in the eavesdropping toolkit already existed thanks to work by other security researchers but there was one part the pair had to create themselves.

"The one piece that completed the chain was the ability to record data off the air," he said.

[KoRn]

/mark

[ShadowAce]

[LonePalm]

Old Crow Ping

Please let me know if you want on or off the Old Crow ping list.

Depending on who is using it, it is either a great way to work against terrorists or 'Big Brother' on steroids.

Garde la Foi, mes amis! Nous nous sommes les sauveurs de la République! Maintenant et Toujours!
(Keep the Faith, my friends! We are the saviors of the Republic! Now and Forever!)
LonePalm, le Républicain du verre cassé (The Broken Glass Republican)

[RC one]

You probably shouldn’t be saying anything to revealing on a cell phone anyways. I know for a fact that you can listen in on cordless telephone calls with a police scanner too fyi.

[JRandomFreeper]

Former Eagle Keeper ('80-83). Didn't know any Old Crows were here.

Jam me onto the list.

/johnny

[decimon]

You probably shouldn’t be saying anything to revealing on a cell phone anyways.

Or on an elevator or lots of places. But people do.

[Texas Fossil]

Duhhhh!

It was programmed to do this by design, it was simply not intended that other than the cellular companies could do this.

[muir_redwoods]

Hackers should be declared international terrorists and be subject to the death penalty. Sentence should be carried out via a public flogging with barbed wire, naked, while being hosed down with high pressure hot vinegar.

They are human viruses.

[E. Pluribus Unum]

How convenient!

[NailInACoffin]

Stories like these always kind of creep me out. Some days I feel paranoid, other days not paranoid enough.

[JoeFromSidney]

I never was an Old Crow myself, but in '72 - '73 I was EW staff officer at the Avionics Lab, Wright Field. I was responsible for managing the Lab's whole EW program. As an old electronicker, I didn't feel that much out of place. I listened to the guys who knew the score.

Probably no point in putting me on the ping list, since I've not been involved in EW for nearly 40 years.

[DaisyCutter]

Before you go off the deep end, you might want to understand the subject at hand. While the researchers in question demonstrated the capability, they do not intend to make the "toolkit" public.

Individuals and groups poking and prying at technology that is widely available is one of the most useful and productive ways bugs and holes in the technology is discovered. A large number of the bugs that major software vendors patch with each patch cycle are discovered by unaffiliated researchers that report the vulnerabilites so that they may be fixed in later versions.

Or would you prefer we make it illegal to carry out such research so that the bugs and holes are found by less responsible individuals that don't report them so they may be fixed, but rather exploit the holes to use against you instead?

[muir_redwoods]

Extending your logic I perform a valuable service when I poke at the security at the local bank and do the world a favor when I see if it's possible to poison the supply of medications or the water supply.

No thanks. Punish hackers publicly, severely (very severely) and do so reliably.

[antiRepublicrat]

Let’s make tinkering with cars illegal too.

[antiRepublicrat]

We used the cheap Motorola telephones because a description of their firmware leaked to the internet," he said.

So GSM was in part relying on security through obscurity. That is always a failure in the end.

The encryption system that scrambles this data can be defeated using a huge list of encryption keys, called a rainbow table

If they're using rainbow tables, this is likely the cheaper GSM encryption. BTW, it's France's fault. Seriously. They didn't want strong encryption in the hands of the people, so they had the GSM encryption system dumbed-down.

Mr Nohl said that before now commercial equipment that could spy on calls cost upwards of £35,000.

So this is about proving it can be done on the cheap. That it can be done at all was proven long ago.

[muir_redwoods]

Tinkering with other peoples’ cars w/o their permission is illegal. If you want to write a program or an app and hack it, feel free. If you want to tinker with my car you can go to jail. If you want to tinker with the pollution control devices on your own car you will also be in trouble in many states and, lastly, if you want to advise others on how to circumvent the pollution controls on their cars you might well be in trouble as well.

[antiRepublicrat]

Tinkering with other peoples’ cars w/o their permission is illegal.

These people have not been accused of illegally intercepting phone calls or tinkering with cell phones belonging to others.

If you want to tinker with the pollution control devices on your own car you will also be in trouble in many states and, lastly, if you want to advise others on how to circumvent the pollution controls on their cars you might well be in trouble as well.

The same tools used for a tune-up are the tools used to mess with emissions controls. Should we make the tools illegal? As for the know-how, I am of the opinion that neither knowledge, nor the spread of it, should be illegal.

[muir_redwoods]

You opinion regarding what the law should be is noted

[antiRepublicrat]

You opinion regarding what the law should be is noted

For one, I know that Jefferson would have found the idea of criminalizing the common sharing of discovered knowledge abhorrent.