Hacker makes mobile phone snooping affordable

A hacker on Saturday brought mobile phone snooping to the modestly financed, showing how to build a call-catching system for about 1,500 dollars (US).

Chris Paget demonstrated his creation for more than a thousand people crammed into a grand room at a DefCon gathering of hackers in Las Vegas, warning them to turn off their phones if they wanted to be spared.

"I can intercept cell phone calls with 1,500 dollars worth of radio gear and a laptop," Paget said after the talk.

"You handset thinks I'm your cell phone tower and I get to control your calls. These attacks used to cost millions of dollars, now you can do it for a lot less."

The gear included an antenna and radio equipment and broadcast a GSM signal that imitated a legitimate telecom service tower, prompting handsets to automatically connect.

A hacker could then pretend to be the telecom service provider, forwarding calls to intended recipients and listening in.

"I can target specific people if I want to spy and I can command only certain types of phones to connect," Paget said. "An attacker could easily take advantage of this."

Mobile phone snoops with this gear could snag credit card or account information from calls made to shops or banks. Companies could be staked out in the hope insiders would reveal valuable information during calls.

His creation worked only on mobile phones using the GSM network and not more secure 3G, third generation, networks.

"GSM is broken," Paget said. "It is up to telecom providers when to shift from GMS to 3G networks. GMS is widely deployed with millions of handsets in use."

However, someone could use a noise generator and a power amplifier could easily jam a 3G network and prompt handsets to resort to GSM systems commonly used as backup systems, according to Paget.

He gestured to a noise generator he bought online for 450 dollars and a power amplifier purchased on the Internet for 400 dollars.

"I'm not turning this thing on," Paget said. "It would knock out pretty much every cell phone there is for most of Las Vegas."

The system only grabs outgoing calls since it has fooled handsets.

Since the phones have disconnected from real telecom service providers, they are considered gone from the networks and incoming calls are routed directly to voice mail boxes.

There is a way for hackers to use credentials from duped handsets to impersonate the phones to carriers, according to Paget.

His talk was almost scuttled by the US Federal Communications Commission, which reached out to him with concerns about the danger it might pose or statutes it might violate.

"There was so much shenanigans involved making sure I could get on stage," Paget said after the DefCon briefing. "The good news is that it is all over and I haven't been arrested."

Life and Style
ebookNow available in paperback
ebooks
ebookPart of The Independent’s new eBook series The Great Composers
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating
and  

By clicking 'Search' you
are agreeing to our
Terms of Use.

ES Rentals

    iJobs Job Widget
    iJobs Gadgets & Tech

    Ashdown Group: Senior .Net Developer - Kingston Upon Thames, Surrey

    £70000 - £80000 per annum: Ashdown Group: A long-established, technology rich ...

    Recruitment Genius: Project and Resource Manager

    Negotiable: Recruitment Genius: This fast growing experience-led technology co...

    Recruitment Genius: Sales Support / IT Sales / Graduate Sales / Trainee

    £20000 per annum: Recruitment Genius: An opportunity has now arisen for a Sale...

    Recruitment Genius: Administration Manager

    £25000 - £30000 per annum: Recruitment Genius: Due to continued growth an exce...

    Day In a Page

    Homeless Veterans campaign: Donations hit record-breaking £1m target after £300,000 gift from Lloyds Bank

    Homeless Veterans campaign

    Donations hit record-breaking £1m target after huge gift from Lloyds Bank
    Flight MH370 a year on: Lost without a trace – but the search goes on

    Lost without a trace

    But, a year on, the search continues for Flight MH370
    Germany's spymasters left red-faced after thieves break into brand new secret service HQ and steal taps

    Germany's spy HQ springs a leak

    Thieves break into new €1.5bn complex... to steal taps
    International Women's Day 2015: Celebrating the whirlwind wit of Simone de Beauvoir

    Whirlwind wit of Simone de Beauvoir

    Simone de Beauvoir's seminal feminist polemic, 'The Second Sex', has been published in short-form for International Women's Day
    Mark Zuckerberg’s hiring policy might suit him – but it wouldn’t work for me

    Mark Zuckerberg’s hiring policy might suit him – but it wouldn’t work for me

    Why would I want to employ someone I’d be happy to have as my boss, asks Simon Kelner
    Confessions of a planespotter: With three Britons under arrest in the UAE, the perils have never been more apparent

    Confessions of a planespotter

    With three Britons under arrest in the UAE, the perils have never been more apparent. Sam Masters explains the appeal
    Russia's gulag museum 'makes no mention' of Stalin's atrocities

    Russia's gulag museum

    Ministry of Culture-run site 'makes no mention' of Stalin's atrocities
    The big fresh food con: Alarming truth behind the chocolate muffin that won't decay

    The big fresh food con

    Joanna Blythman reveals the alarming truth behind the chocolate muffin that won't decay
    Virginia Ironside was my landlady: What is it like to live with an agony aunt on call 24/7?

    Virginia Ironside was my landlady

    Tim Willis reveals what it's like to live with an agony aunt on call 24/7
    Paris Fashion Week 2015: The wit and wisdom of Manish Arora's exercise in high camp

    Paris Fashion Week 2015

    The wit and wisdom of Manish Arora's exercise in high camp
    8 best workout DVDs

    8 best workout DVDs

    If your 'New Year new you' regime hasn’t lasted beyond February, why not try working out from home?
    Paul Scholes column: I don't believe Jonny Evans was spitting at Papiss Cissé. It was a reflex. But what the Newcastle striker did next was horrible

    Paul Scholes column

    I don't believe Evans was spitting at Cissé. It was a reflex. But what the Newcastle striker did next was horrible
    Miguel Layun interview: From the Azteca to Vicarage Road with a million followers

    From the Azteca to Vicarage Road with a million followers

    Miguel Layun is a star in Mexico where he was criticised for leaving to join Watford. But he says he sees the bigger picture
    Frank Warren column: Amir Khan ready to meet winner of Floyd Mayweather v Manny Pacquiao

    Khan ready to meet winner of Mayweather v Pacquiao

    The Bolton fighter is unlikely to take on Kell Brook with two superstar opponents on the horizon, says Frank Warren
    War with Isis: Iraq's government fights to win back Tikrit from militants - but then what?

    Baghdad fights to win back Tikrit from Isis – but then what?

    Patrick Cockburn reports from Kirkuk on a conflict which sectarianism has made intractable