IDG News Service - Computer security researchers say that the GSM phones used by the majority of the world's mobile-phone users can be listened in on with just a few thousand dollars worth of hardware and some free open-source tools.
In a presentation given Sunday at the Chaos Communication Conference in Berlin, researcher Karsten Nohl said that he had compiled 2 terabytes worth of data -- cracking tables that can be used as a kind of reverse phone-book to determine the encryption key used to secure a GSM (Global System for Mobile communications) telephone conversation or text message.
While Nohl stopped short of releasing a GSM-cracking device -- that would be illegal in many countries, including the U.S. -- he said he divulged information that has been common knowledge in academic circles and made it "practically useable."
Intercepting mobile phone calls is illegal in many countries, including the U.S., but GSM-cracking tools are already available to law enforcement. Knoll believes that criminals are probably using them too. "We have just basically copied what you can already buy in a commercial product," he said.
The flaw lies in the 20-year-old encryption algorithm used by most carriers. It's a 64-bit cipher called A5/1 and it is simply too weak, according to Nohl. Using his tables, antennas, specialized software, and $30,000 worth of computing hardware to break the cipher, someone can crack the GSM encryption in real time and listen in on calls, he said. If the attacker was willing to wait a few minutes to record and crack the call, the total cost would be just a few thousand dollars, he said.
There are about 3.5 billion GSM phones worldwide, making up about 80 percent of the mobile market, according to data from the GSM Alliance, a communications industry association representing operators and phone-makers.
Because even discussing wiretapping tools can be illegal in the U.S., researchers have steered clear of this type of work. But after consulting lawyers with the Electronic Frontier Foundation, Nohl and his collaborators set upon a way of conclusively disclosing the flaws in the GSM system without --they believe -- breaking the law.
Last August they kicked off an open-source project to create the cracking tables -- something that would take a decent gaming computer about 10 years to compute -- and they have shown which open-source tools could be used to intercept messages, but they have stopped short of designing a device to intercept the messages. This is, however, something that a technically sophisticated hacker could figure out, Nohl said.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Architecting the Network of the Future Networks need to change, as does the way IT thinks about and manages them. In addition to reliability, IT must now add higher...
- BlackBeard Case Study In this case study, learn how a business with 95% of revenues generated online was hit by DDoS attacks over a 6-month period,...
- Four Ways DNS Can Accelerate Business Growth This e-book describes how DNS has developed over the years to support business growth as new needs have emerged, for example, advanced traffic...
- Gartner 2013 Magic Quadrant for Enterprise Backup/Recovery Software See why CommVault was positioned as the #1 leader in Gartner's 2013 Magic Quadrant for Enterprise Backup/Recovery software for the 3rd year in...
- Four Myths of High-Productivity App Dev Debunked Debunk the main myths surrounding high-productivity application development and how both platforms have overcome them.
On-Demand Webcast: 7 Reasons to Choose VoIP
Thinking about a new phone system for your business?
Be sure to watch this informative webcast. Steve Strauss, small business columnist for USA...
All Network Security White Papers |