Hacker builds cellphone tapping device


LAS VEGAS: A computer security researcher has built a device for just US$1,500 (RM4,800) that can intercept some kinds of cellphone calls and record everything that’s said.

The attack Chris Paget showed illustrates weaknesses in GSM (Global System for Mobile Communications), one of the world’s most widely used cellular communications technologies.

His attack was benign; he showed how he could intercept a few dozen calls made by fellow hackers in the audience for his talk at the DefCon conference here on Saturday.

But it illustrates that criminals could do the same thing for malicious purposes, and that consumers have few options for protecting themselves.

Paget said he hopes his research helps spur adoption of newer communications standards that are more secure.

“GSM is broken — it’s just plain broken,” he said.

GSM is considered 2G (second generation) cellular technology. Phones that run on the newer 3G and 4G standards aren’t vulnerable to his attack.

If you’re using an iPhone or other smartphone and the screen shows that your call is going over a 3G network, for example, you are protected. BlackBerry phones apply encryption to calls that foil the attack, Paget pointed out.

But if you’re using a type of phone that doesn’t specify which type of network it uses, those phones are often vulnerable, Paget said.

Paget’s device tricks nearby cellphones into believing it is a legitimate cellphone tower and routing their calls through it. Paget uses Internet-based calling technology to complete the calls and log everything that’s said.

A caveat is that recipients see numbers on their Caller IDs that are different than the cell numbers of the people calling them. Paget claims it would be easy to upgrade the software to also include the callers’ real numbers.

IMSI

The device he built is called an “IMSI catcher,” which refers to the unique International Mobile Subscriber Identity numbers that phones use to identify themselves to cellular networks.

Commercial versions of such devices have existed for decades and have mainly been used by law enforcement. Paget’s work shows how cheaply hobbyists can make the devices using equipment found on the Internet.

“That’s a significant change for research — it’s a major breakthrough for everyone,” said Don Bailey, a GSM expert with iSec Partners who wasn’t involved in Paget’s research.

Another security expert, Nicholas DePetrillo, said such devices haven’t been built as cheaply in the past because the hardware makers have closely controlled who they sell to. Only recently has the necessary equipment become available cheaply online.

There are more than three billion GSM users and the technology is used in nearly three quarters of the world’s cellphone markets, according to the GSM Association, an industry trade group.

In a statement, the group emphasised the hurdles to launching an attack like Paget’s, such as the fact an attacker’s base station would need to be physically close to the target and that only outgoing calls can be intercepted. Incoming calls are not vulnerable.

“The overall advice for GSM calls and fixed-line calls is the same: Neither has ever offered a guarantee of secure communications,” the group said. “The great majority of users will make calls with no reason to fear that anyone might be listening.

“However, users with especially high security requirements should consider adding extra, end-to-end security features over the top of both their fixed line calls and their mobile calls.”

Paget had been debating dropping the demonstration from his talk, after federal authorities told him it might violate wiretapping laws. He went ahead with it after conferring with lawyers. He said he didn’t believe he had broken any laws. — AP

Article type: metered
User Type: anonymous web
User Status:
Campaign ID: 1
Cxense type: free
User access status: 3
Join our Telegram channel to get our Evening Alerts and breaking news highlights
   

Next In Tech News

Facebook to launch portable version of Portal video chat device
Former F1 driver Rosberg, Agnelli's Exor invest in adopt-a-tree site Treedom
EU plans to legislate for common phone charger despite Apple grumbles
AT&T plans multi-year effort to burnish its brand image
Facebook spent over $13 billion on safety, security since 2016
Biden sanctions cryptocurrency exchange over ransomware attacks
Banks say draft capital rules make cryptoassets too costly to trade
Google to buy more office space in NYC as big tech swoops down on real estate
Brazil's Gol hails deal to bring flying taxis to Sao Paulo
Activision says working with regulators to address workplace complaints

Stories You'll Enjoy


Vouchers