Hacker Spoofs Cell Phone Tower to Intercept Calls
LAS VEGAS — A security researcher created a cell phone base station that tricks cell phones into routing their outbound calls through his device, allowing someone to intercept even encrypted calls in the clear.
The device tricks the phones into disabling encryption and records call details and content before they’re routed on their proper way through voice-over-IP.
The low-cost, home-brewed device, developed by researcher Chris Paget, mimics more expensive devices already used by intelligence and law enforcement agencies – called IMSI catchers – that can capture phone ID data and content. The devices essentially spoof a legitimate GSM tower and entice cell phones to send them data by emitting a signal that’s stronger than legitimate towers in the area.
“If you have the ability to deliver a reasonably strong signal, then those around are owned,” Paget said.
Paget’s system costs only about $1,500, as opposed to several hundreds of thousands for professional products. Most of the price is for the laptop he used to operate the system.
Doing this kind of interception “used to be a million dollars, now you can do it with a thousand times less cost,” Paget said during a press conference after his attack. “If it’s $1,500, it’s just beyond the range that people can start buying them for themselves and listening in on their neighbors.”
Paget’s device captures only 2G GSM calls, making AT&T and T-Mobile calls, which use GSM, vulnerable to interception. Paget’s aim was to highlight vulnerabilities in the GSM standard that allows a rogue station to capture calls. GSM is a second-generation technology that is not as secure as 3G technology.
Encrypted calls are not protected from interception because the rogue tower can simply turn it off. Although the GSM specifications say that a phone should pop up a warning when it connects to a station that does not have encryption, SIM cards disable that setting so that alerts are not displayed.
“Even though the GSM spec requires it, this is a deliberate choice on the cell phone makers,” Paget said.
The system captures only outbound calls. Inbound calls would go directly to voicemail during the period that someone’s phone is connected to Paget’s tower.
The device could be used by corporate spies, criminals, or private investigators to intercept private calls of targets.
“Any information that goes across a cell phone you can now intercept,” he said, except data. Professional grade IMSI catchers do capture data transfers, but Paget’s system doesn’t currently do this.
His setup included two RF directional antennas about three feet long to amplify his signal in the large conference room, a laptop and open source software. The system emitted only 25 milliwatts, “a hundred times less than your average cell phone,” he said.
Paget received a call from FCC officials on Friday who raised a list of possible regulations his demonstration might violate. To get around legal concerns, he broadcast on a GSM spectrum for HAM radios, 900Mhz, which is the same frequency used by GSM phones and towers in Europe, thus avoiding possible violations of U.S. regulations.
Just turning on the antennas caused two dozen phones in the room to connect to Paget’s tower. He then set it to spoof an AT&T tower to capture calls from customers of that carrier.
“As far as your cell phones are concerned, I am now indistinguishable from AT&T,” he said. “Every AT&T cell phone in the room will gradually start handing over to my network.”
During the demonstration, only about 30 phones were actually connecting to his tower. Paget says it can take time for phones to find the signal and hand off to the tower, but there are methods for speeding up that process.
To address privacy concerns, he set up the system to deliver a recorded message to anyone who tried to make a call from the room while connected to his tower. The message disclosed that their calls were being recorded. All of the data Paget recorded was saved to a USB stick, which he destroyed after the talk.
Customers of carriers that use GSM could try to protect their calls from being intercepted in this manner by switching their phones to 3G mode if it’s an option.
But Paget said he could also capture phones using 3G by sending out jamming noise to block 3G. Phones would then switch to 2G and hook up with his rogue tower. Paget had his jammer and an amplifier on stage but declined to turn them on saying they would “probably knock out all Las Vegas cell phone systems.”
Photo: Dave Bullock
Phone Eavesdropping in Vogue Again
With traditional identity theft channels now closing, fraudsters are increasingly targeting unprotected voice conversations to obtain confidential insider information, passwords and PIN codes without detection. Voice correspondence is almost always uncharted territory for business security armour under the false assumption that phone hacking is a highly sophisticated and expensive means of attack.
The days of phone fraud involving thousands of pounds of equipment and an extensive army of technology experts are long gone. Only in December it was revealed that a computer engineer had broken the algorithm used to encrypt the majority of the world’s digital mobile phone calls online, and published his method…
…
Silvio Berlusconi wiretap victory in confidence vote
…
Wiretapping is a widespread practice in Italy. Just this week it emerged that both Pope Benedict XVI and Hillary Clinton, the US secretary of state, had been inadvertently taped by Italian investigators.
They were recorded during telephone conversations with the head of Italy’s civil protection agency, Guido Bertolaso, who was being wire-tapped as part of an investigation into allegations of corruption over the awarding of contracts for the building of a venue for last year’s G8 conference.
The prime minister has insisted that police have been allowed to carry out far too many wiretaps. He has claimed that the leaking of transcripts to the media could destroy the reputation of public figures before a case had even come to trial.
…
‘Colombian govt involved in illegal wiretaps’
In a special report on Tuesday Colombian news source CM& claimed to have access to documents proving that information collected through the surveillance and wiretapping of judges, journalists and politicians conducted by security agency DAS was passed on to members of the government.
The documents were obtained by the Prosecutor General’s Office and used to justify the arrest of five former DAS officials last Friday.
Among the documents is allegedly a file labeled “President Uribe,” which was used by the DAS officials to collate “documents of interest to the Colombian president.”
A second document allegedly shows evidence of the surveillance of journalist Holman Morris by the security agency, including an apparently illegally-obtained email written by Morris.
The final piece of evidence mentioned in CM&’s report documents the opinions and intentions of Supreme Court magistrates concerning the re-election referendum of President Alvaro Uribe.
The report is allegedly also labeled with the word “President” and documents which of the court’s magistrates were against the approval of a referendum that would allow for the potential re-election of Uribe to his third term as president.
In reference to the new evidence, the president of Colombia’s Supreme Court, Jaime Arrubla, said on Mondaythat “everything seemed to indicate” that the government had been directly involved in the wire-tapping of court magistrates, which he found “horrifying.”
Arrubla accused the Colombian government of a “conspiracy of the state against the court, a criminal action” and requested a full investigation of the aides of President Uribe who have been implicated in the scandal.
Speaking to national media, Gustavo Petro, the presidential candidate for political party Polo Democratico, also recommended that an investigation be opened into allegations against President Uribe.
“There is no doubt that the political responsibility lies with President Uribe,” said Petro, adding that the inspector general must conduct investigations, “proceeding according to his duty and showing his independence.”
A statement released by the Colombian government on Monday, however, denied all allegations of involvement in the wiretapping scandal, saying, “Following stories in the press related to the investigation carried out by the Prosecutor General’s Office about alleged illegal wiretaps, the Presidency of the Republic wishes to state that not one employee of the Casa de Nariño has met with officials to instruct or order the interception (of communication) or shadowing of magistrates, politicians or any person. All officials are willing to appear before the judicial bodies to ratify that the Casa de Nariño never has given instructions in this sense.”
New evidence collected will primarily be used to investigate charges against the scandal-ridden DAS for illegal wire-tapping and surveillance activities.
COLOMBIA – Uribe Denies Ordering Wiretaps
President Alvaro Uribe declared today that he never ordered wiretaps, nor surveillance of Supreme Court judges and opposition party leaders
In an interview with a local radio station, President Alvaro Uribe swore that he never ordered surveillance or wiretaps on Supreme Court judges and opposition party leaders. The leader asked that his statements be transcribed and copies submitted to the Prosecutor’s Office, the Attorney General’s Office, the House of Representatives Accusations Commission and the Superior Council of the Judiciary so that they be added to the investigation which resulted from the scandal.
Read more: http://www.poder360.com/dailynews_detail.php?blurbid=6802#ixzz0lbSpukbX
U.S. Ends Aid to Colombian Anti-Drug Agency Accused Of Illegal Wiretapping
Washington, DC, United States (AHN) – The U.S. government cut off its assistance this week to a Colombian anti-drug law enforcement agency after allegations of illegal spying.
Officials in the administration of Colombian President Alvaro Uribe are implicated in some of the allegations.
The Colombian government already has signaled its intention to dismantle the agency, called DAS, or the Administrative Department of Security.
U.S. financial and technological assistance for Colombia’s effort against drug lords will continue, but it will be transferred to the National Police and other agencies, said U.S. Ambassador William Brownfield.
…
Read more: http://www.allheadlinenews.com/articles/7018412865#ixzz0lYNGrbxy
5 former DAS executives arrested over wiretap scandal
Agents of Colombia’s Prosecutor General’s Office on Friday arrested five former executives of intelligence agency DAS for their alleged responsibility in the illegal wiretapping of judges, journalists, human rights workers and politicians.
Fernando Tabares, Jorge Lagos, Bernardo Murillo, Luz Marina Rodriguez and German Albeiro Ospina will have to respond to charges of conspiracy and abuse of power.
The five directors of the agency’s intelligence and counter-intelligence units are suspected of having known of the existence of the DAS’ G3 unit that was specialized in the spying on individuals.
According to newspaper El Espectador, the five will be arraigned on Saturday.
The wiretap scandal led to severe criticism by those subjected to illegal spying and forced President Alvaro Uribe to dismantle the intelligence agency and create a new one. Following the scandal, the U.S. Congress demanded that no money earmarked for aid to Colombia can be spent on the DAS or its successor.