GSM cracking is all about knowledge, not money

Since the cracking of GSM encryption back in December 2009 by encryption expert Karsten Nohl, the cost of setting up an operation that includes sniffing out the calls made by a specific target and decrypting them has decreased time and time again.

It used to be that this possibility was open only to law enforcement agencies or criminals that could afford to spend some $50,000 on a powerful network-sniffing device. But almost half a year ago, ethical hacker Chris Paget demonstrated at DEFCON his ability to intercept phone calls made by members of the audience through GSM networks by bypassing the cryptoscheme and using a home-made, low-cost IMSI catcher combining free open-source software and a $1,500 piece of hardware.

And yesterday, Karsten Nohl and project programmer Sylvain Munaut demonstrated at the Chaos Computer Club Congress that the price for executing such an attack has dropped some more.

They proved that all it takes is a laptop, some open source software and four sub-$15 telephones acting as network “sniffers”, and you can have a completely working set up to go searching for your victim and spy on his calls.

According to Wired, when Nohl cracked GSM encryption, network operators poh-pohed this revelation by saying that it would be difficult to find a specific phone and to detect the correct encrypted radio signal out of the many in the air at that moment and in that place. In short, they claimed that the danger of anyone misusing his discovery was minimal.

Now, a year later, Nohl and his colleague came back with this cheap and working set up that showed them they were wrong. Using subscriber location data that GSM networks swap in order to accurately forward phone calls and SMSs, they demonstrated that is possible to pinpoint an approximate location of the victim’s phone.

After that, the attacker must simply drive through the area while sending “broken” SMSs from their phone with special data-retaining firmware to the targeted phone, sniff out the traffic to and from bay stations in the area and use the information to find out the exact location of the phone.

The information provided by this simple maneuver also allows the attacker to learn the random network ID number that belongs to the target phone. And the way the operator networks exchange system information with their phones also allows him to, in the end, discover the key that encrypts the session (call).

Unfortunately for the target, this same key is ofter reused by the operators for several consecutive calls, so the attacker can listen in on them, too.

Fortunately for us all, there are a number of things that network operators can do to prevent such attacks, and these changes are relatively easy to implement, says Nohl. The only thing needed is the good will of the operators, and the sniffed out information could not be available anymore, nor would the encryption keys be recycled. Let’s hope they are listening and are amenable to change.