Defcon Hacker Eavesdrops on GSM based phone conversations for $1,500

[Arun 795]

PC Mag

08.01.2010

With but $1,500 worth of equipment and some ingenuity, security researcher Chris Paget can create his own cell phone tower.

Here's the catch, however: The tower itself isn't real. It's a fake recreation of a GSM base station that allows Paget to overpower the actual signals from real-life base stations. The end result? Cell phones connect to PagetNet—or whatever name he's assigned his creation—thinking that they're accessing an actual cell phone tower.

When that happens, Paget can listen in to the conversations and/or record them at his leisure. His device—an International Mobile Identity Subscriber catcher—bounces the call to an actual cell phone tower and the user is none the wiser, save for the fact that all inbound calls now go directly to said user's voicemail as the carrier considers the actual phone off-network.

Paget showed off his device at this year's Defcon convention in Las Vegas after making quite a few consultations as to the actual legality of his talk and demonstration. The trick only works against AT&T and T-Mobile customers in the United States, as Verizon and Sprint both use CDMA technology to power their networks—as mentioned, Paget's spoof only works across GSM-based networks.

The gear included an antenna and radio equipment and broadcast a GSM signal that imitated a legitimate telecom service tower, prompting handsets to automatically connect.

As well, the exploit doesn't work for those running on 3G connections. However, Paget noted in his talk that it's easy to overpower a 3G network with a noise generator—which he also happened to have on-hand, but didn't use—to force phones to revert to 2G connections. Once that happens, they're prime targets for Paget's exploit, should he overpower the legitimate signals emanating from local cell towers.

"GSM is broken," Paget said. "It is up to telecom providers when to shift from 2G GSM to 3G networks. GSM is widely deployed with millions of handsets in use."

"There's a good chance you won't even know about it when it happens," said Paget during his presentation, a snippet of which can be found below.

"As far as your cell phones are concerned, I'm now indistinguishable from AT&T."

[Genius 817]

^^^ Thats SomThin

I always feel Reverse Engineering is more powerful, you need 150 MB anti virus for 50 kb virus, even the technology in RE is always innovative.

[ami1 237]

If you want to create such a micro Tower, all you have to do is:

1. Buy a USRP Card & connect to a PC / Laptop

2. Download & boot the OpenBootTS CD on the PC / Laptop

3. Profit ??

(off course without a big antenna, your coverage will be limited to a few rooms)

Edited August 2, 2010 by ami1

[Harshal 11]

Can the hacker die of radiation, seeing that now he is walking with a cell tower rather than a cell phone?

[abhi.r 95]

read in a newpaper some times before that equipments to hack GSM, CDMA, even Blackberry e-mails is available in singapore's Shimling tower for just 200,000USD (appx).

This equipment can cover a small area only and can listen and record any calls going and coming in that area.

Good for corporate spies imo or political spies or tahelka.com people

but Govt banned imports of such equipments few days ago.

I wonder if Blackberry say their USP is their encryption and are not willing it to share with govt. agencies.. how come this equipment can record the mails coming and going thru blackberry devices?

[ami1 237]

The radiation per sqm is actually less than most cell phones (as per the original article linked in slashdot.org).

Anyway, there are huge cell tower atop every other building these days. And this radiation is just radio waves not a nuclear radiation that one can die.

Maybe too much exposure could have some long term effects but even that is not proven yet.