LAS VEGAS (AP) – A computer security researcher has built a device for just $1,500 that can intercept some kinds of cell phone calls and record everything that’s said.
The attack Chris Paget showed Saturday illustrates weaknesses in GSM, one of the world’s most widely used cellular communications technologies.
His attack was benign; he showed how he could intercept a few dozen calls made by fellow hackers in the audience for his talk at the DefCon conference here. But it illustrates that criminals could do the same thing for malicious purposes, and that consumers have few options for protecting themselves.
Paget said he hopes his research helps spur adoption of newer communications standards that are more secure.
“GSM is broken – it’s just plain broken,” he said.
GSM is considered 2G, or “second generation,” cellular technology. Phones that run on the newer 3G and 4G standards aren’t vulnerable to his attack.
If you’re using an iPhone or other smart phone and the screen shows that your call is going over a 3G network, for example, you are protected. BlackBerry phones apply encryption to calls that foil the attack, Paget pointed out. But if you’re using a type of phone that doesn’t specify which type of network it uses, those phones are often vulnerable, Paget said.
Paget’s device tricks nearby cell phones into believing it is a legitimate cell phone tower and routing their calls through it. Paget uses Internet-based calling technology to complete the calls and log everything that’s said.
A caveat is that recipients see numbers on their Caller IDs that are different than the cell numbers of the people calling them. Paget claims it would be easy to upgrade the software to also include the callers’ real numbers.
The device he built is called an “IMSI catcher,” which refers to the unique International Mobile Subscriber Identity numbers that phones use to identify themselves to cellular networks.
Commercial versions of such devices have existed for decades and have mainly been used by law enforcement. Paget’s work shows how cheaply hobbyists can make the devices using equipment found on the Internet.
“That’s a significant change for research – it’s a major breakthrough for everyone,” said Don Bailey, a GSM expert with iSec Partners who wasn’t involved in Paget’s research.
Another security expert, Nicholas DePetrillo, said such devices haven’t been built as cheaply in the past because the hardware makers have closely controlled who they sell to. Only recently has the necessary equipment become available cheaply online.
In the U.S., AT&T Inc. and T-Mobile USA are two cellular operators whose networks include GSM.
There are more than 3 billion GSM users and the technology is used in nearly three quarters of the world’s cell phone markets, according to the GSM Association, an industry trade group.
In a statement, the group emphasized the hurdles to launching an attack like Paget’s, such as the fact an attacker’s base station would need to be physically close to the target and that only outgoing calls can be intercepted. Incoming calls are not vulnerable.
“The overall advice for GSM calls and fixed-line calls is the same: neither has ever offered a guarantee of secure communications,” the group said. “The great majority of users will make calls with no reason to fear that anyone might be listening. However, users with especially high security requirements should consider adding extra, end-to-end security features over the top of both their fixed line calls and their mobile calls.”
A representatives for AT&T had no comment. T-Mobile didn’t immediately respond to e-mails Saturday from The Associated Press.
Paget had been debating dropping the demonstration from his talk, after federal authorities told him it might violate wiretapping laws. He went ahead with it after conferring with lawyers. He said he didn’t believe he had broken any laws.
“It’s really interesting to watch a phone number turn into a person’s life,” security researcher Nick DePetrillo told the Los Angeles Times in a report published yesterday. According to Petrillo and fellow expert Don Bailey, the mere digits of your cell phone number can betray your name, your travel itinerary, and your work and home address; it can also allow others to listen in on your voice messages and personal phone calls.
Using “widely available information and existing techniques,” DePetrillo and Bailey reportedly were able to construct detailed files on a cellphone user. Find out how after the break.
As “white hat hackers,” meaning the good guys that hack you to expose security gaps and then figure ways to patch them, DePetrillo and Bailey have learned that by using special software to spoof a call from the target number, tricking the cell phone company into thinking the call is coming from the target’s cell phone: The Caller ID system then identifies the victim’s name for you. As the LA Times points out, a hacker could create their own phonebook of numbers and corresponding identities.
From there, the hacker can then query the cellphone network to discover the location of the phone. Websites such as InstaMapper are openly accessible and free to use. With this, one can hypothetically track and generate a general schedule of your movements.
Moreover, there is always the possibility of malicious applications, which appear to do one thing but in reality can collect private information. For example, security expert Tyler Shields created an application called “TXSBBSPY,” which when installed on a Blackberry, could read text messages, listen to voice mail, and even turn on the phone’s mic at will.
Today, smartphones including the iPhone, Blackberry, and Android devices comprise about 21% of the cell phone market, and often contain sensitive information like other phone numbers, e-mails, and banking information. Nielsen Co. estimates the smartphone to become the new standard by 2011. However, as the smartphone is a recent development, Shields says that we are only living in the “late ’90s” when it comes to mobile security.
The obvious solutions, of course, are to 1) keep your cell phone number private; 2) shield your number with services like Google Voice; 3) use common sense – don’t access suspicious software and links.
With traditional identity theft channels now closing, fraudsters are increasingly targeting unprotected voice conversations to obtain confidential insider information, passwords and PIN codes without detection. Voice correspondence is almost always uncharted territory for business security armour under the false assumption that phone hacking is a highly sophisticated and expensive means of attack.
The days of phone fraud involving thousands of pounds of equipment and an extensive army of technology experts are long gone. Only in December it was revealed that a computer engineer had broken the algorithm used to encrypt the majority of the world’s digital mobile phone calls online, and published his method…
Gold Lock is proud to announce that Douglas Haskins, Channel Manager-North America, is scheduled to be interviewed by Federal News Radio AM1500 in Washington, DC, Monday 12/14/09 at 8:30am (eastern time). Federal News Radio contacted Gold Lock to schedule the radio interview to discuss the Gold Lock Hacker Challenge: a $250,00o prize to anyone who can hack a 10 minute encrypted conversation.
Would be hackers are free to use any tools or technology at their disposal. This contest is open to anyone, anywhere, unless your participation is specifically prohibited by law.
Hackers have until 12:00 AM (GMT/UTC + 02:00 hours) on February 1st 2010 to provide us with the transcript. Read the contest rules for complete details and restrictions. Be sure to complete the entry form on that page before you start trying to grab the gold.
Single Channel Beeper BusterTM System
If the bad guys in your jurisdiction use pagers to conduct their business, you need The Beeper BusterTM. With The Beeper BusterTM, you can sit in the privacy of your own office and monitor every message sent to any pager. You do not need the cooperation of the paging system operator, nor will the user of the pager know you are monitoring all his messages. The Beeper BusterTM can capture all messages sent to a target pager, capture all messages containing a particular “search string” (such as the phone number of a suspect location, pay phone), or any combination of the above. Special techniques are used to determine the unique address (the “capcode”) of the pager, meaning you do not need access to the target pager to capture its messages. It’s very simple. And, the The Beeper BusterTM is affordable. Unlike rival units, The Beeper BusterTMactually operates faster than the paging system. This means no missed pages, for any format at any speed. Persons using other less capable pager intercept systems are well aware of the problems of missed pages. The high speed and perfect accuracy of The Beeper BusterTM is due to our extensive use of custom designed high speed hardware. If you need to use captured messages as evidence in court, the specially designed features of The Beeper BusterTMguarantee the integrity of the data.