Hacker intercepts phone calls with homebuilt $1,500 IMSI catcher, claims GSM is beyond repair

In 2009, Chris Paget showed the world the vulnerabilities of RFID by downloading the contents of US passports from the safety of his automobile. This year, he's doing the same for mobile phones. Demonstrating at DefCon 2010, the white hat hacker fooled 17 nearby GSM phones into believing his $1,500 kit (including a laptop and two RF antennas) was a legitimate cell phone base station, and proceeded to intercept and record audience calls. "As far as your cell phones are concerned, I'm now indistinguishable from AT&T," he told the crowd. The purpose of the demonstration was highlight a major flaw in the 2G GSM system, which directs phones to connect to the tower with the strongest signal regardless of origin -- in this case, Paget's phony tower.

The hacker did caveat that his system could only intercept outbound calls, and that caller ID could tip off the owner of a handset to what's what, but he says professional IMSI catchers used by law enforcement don't suffer from such flaws and amateur parity would only be a matter of time. "GSM is broken," Paget said, "The primary solution is to turn it off altogether." That's a tall order for a world still very dependent on the technology for mobile connectivity, but we suppose AT&T and T-Mobile could show the way. Then again, we imagine much of that same world is still using WEP and WPA1 to "secure" their WiFi.

[maztec Posted Aug 1st 2010 2:48PM]

OH MY GOD RUN THE HILLS ARE FALLING FROM THE MUSIC!

Yeeesh. Let me check to see if I understand this "hack":
1) Set up an antenna.
2) Put it somewhere that it will exist between caller A and caller B.
3) Intercept communications.

How by any stretch of the imagination is this not a MITM (man-in-the-middle) attack? Method: pass through communication, but use authentication keys received from both ends to decrypt it. This has existed for ages and works quite well. The problem? They're difficult to detect, surprisingly easy to set up, and difficult to prevent from working. The extra security precautions are not trivial and affect most older communication technology on the market.

My bet? You can do this with CDMA systems just as easily. The only difference is that a CDMA system won't hop to the strongest signal (is that good or bad?). And a minor upgrade could stop GSM from doing this (you complained about dropped calls before ...).

In the end, this is non-news and utterly unsurprising.

[Viper Matrix Wireless Posted Aug 1st 2010 3:53PM]

@maztec Correct. If they really wanted too it wouldnt take much to make them work much alike. I still say both suck anyhow.

[Viper Matrix Wireless Posted Aug 1st 2010 3:55PM]

I have a question. If CDMA was so superior then why do people scream the word POLICE when you talk to them about getting Cricket & thats a CDMA network. Answer: Because they used to tap into ppls cells & the ppl who were selling drugs got busted.

[JackInLA Posted Aug 1st 2010 4:30PM]

You know, if these "security experts" that keep hacking Facebook, cell phones, etc., really want to do some "good", why don't they hack the servers of the companies that distribute computer viruses and rogue antivirus software and shut them down?

Seriously, quit hacking innocent people and start hacking the crooks!

[m4j7 Posted Aug 1st 2010 4:51PM]

This is not news to anyone who has worked with GSM or studied the freely available specifications. GSM base stations do not authenticate themselves to the phone. Period.

The presented method is simple and effective, but it requires the eavesdropper to transmit. GSM encryption has been pretty much broken already. It shouldn't be much more expensive to build a system that records encrypted signals and decodes them later in reasonable amount of time.

[The Albatross Posted Aug 2nd 2010 9:28AM]

QUICK... SOMEONE TELL MCNULTY AND FREAMON! THE WIRE IS A GO!