{"id":3026,"date":"2011-01-06T10:59:34","date_gmt":"2011-01-06T10:59:34","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3026"},"modified":"2015-09-09T19:37:20","modified_gmt":"2015-09-09T11:37:20","slug":"researchers-hack-mobile-calls-on-gsm-network","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2011\/01\/researchers-hack-mobile-calls-on-gsm-network\/","title":{"rendered":"Researchers Hack Mobile Calls On GSM Network"},"content":{"rendered":"

Gotta love a bit of hardware hacking in the new year, this Karsten Nohl<\/a> guy has been busy lately – he recently exposed Car Immobilisers Using Weak Encryption Schemes<\/a> and more relevant to this article we’ve written about him and GSM Hacking Coming To The Masses Script Kiddy Style<\/a> before.<\/p>\n

This kind of GSM snooping has been possible for a long time, but it’s always been prohibitively expensive. Now researchers using simple techniques and inexpensive equipment have managed to find a way to do it by running custom firmware on cheap Motorola handsets.<\/p>\n

Researchers have demonstrated an alarmingly simple technique for eavesdropping on individual GSM mobile calls without the need to use expensive, specialised equipment.<\/p>\n

During a session at the Chaos Computer Club Congress (CCC) in Berlin, Karsten Nohl and Sylvain Munaut used cheap Motorola handsets running a replacement firmware based on open source code to intercept data coming from a network base station.<\/p>\n

Armed with this, they were able to locate the unique ID for any phone using this base, breaking the encryption keys with a rainbow table lookup.<\/p>\n

Although far from trivial as hacks go, the new break does lower the bar considerably compared to previous hacks shown by the same reasearchers. In 2009, Nohl published a method for cracking open GSM’s A5\/1 encryption design using a lookup table in near real time.<\/p>\n

What was missing, however, was a way of identifying the call stream for an individual phone in order to apply the lookup to a real call within the clutter of data moving back and forth between a particular base station and the many phones using it. That is what Nohl appears to have worked out in his latest demo. <\/p><\/blockquote>\n

It’s by no means a simple or straight forwards attack but it just shows with the knowledge of the crypto algorithms used by GSM base-stations it’s possible to intercept conversations from specific handsets.<\/p>\n

There hasn’t been a whole lot of stories about GSM hacking<\/a> so it’s good to see something in this area as most of the World owns at least 1 GSM device and not a whole of people are looking at the security the networks are relying on.<\/p>\n