Gsm Phone Call Security Hacked

[james.wilson]

Engadget have a story about Chris Paget (rfid hacker) where he has fooled the gsm protection system and can listen into calls etc. This seems to be 2G only, but as the majority of dualpath signalling devices use this do we see this as conerning?

http://www.engadget.com/2010/07/31/hacker-intercepts-phone-calls-with-homebuilt-1-500-imsi-catcher/

[norman]

no

[arfur mo]

denial of service by swamping?

Arfur

[Guest Oxo]

Concerning?

Yes as its intercepting the outbound call so to speak.

[hpotter]

might be listening in, but dont seem to be preventing the calls, or aint i reading it right?

[james.wilson]

as i read it, it fools the gsm device into thinking its a valid base station. I suppose you could then do what you want with that call. Pass it through to where its supposed to go... or somewhere else.

Worse than a jammer as the system will beleive the signal has been passed. Any device IMHO thta uses gsm as its primary path is a concern. Id assume this wouldnt affect gprs.

3g has other issues as femtocells could be used in the same way. But id assume there is more security on this as its a newer std.

[hpotter]

eg G2 redcare:

dont stu want ack from bt esp after period (eg 10 secs in alarm) or esp reports comms fail within 60 mins if polling failure?

G3/4 obviously faster

[james.wilson]

Everything wants some sort of acknowledgments. But a SOHU. is a low security ack. Don't know what secure uses but I'd assume that would be relatively trivial to find out.

[hpotter]

do you think we're relying on the integrity of gsm network rather than encryption of messages within? well both i guess?

[james.wilson]

Is agree ie both. If the gsm network becomes public integrity will be as important as it is on up signalling.