- Malaysia Airlines pilots sometimes left cockpit door unlocked: U.S. businessman
- PHILLIPS: The benefits of defying ‘common wisdom’
- Judge strikes down Arkansas abortion law — nation’s toughest — as unconstitutional
- Court: Tenn. must recognize 3 same-sex marriages
- Russia claims to have downed U.S. drone over Crimea region; Pentagon denies
- John Daly shoots 90 at PGA Tour event: ‘I’m falling apart’
- Police: Man arrested in West Virginia may be linked to Alexandria killings
- Smile: Equipping cops with body-mounted cameras gains steam in Calif., N.Y.
- Obama to sign bill cutting taxpayer money for party conventions
- Half of Americans worried about second Cold War: poll
Hacker builds $1,500 cell-phone tapping device
LAS VEGAS (AP) - A computer security researcher has built a device for just $1,500 that can intercept some kinds of cell phone calls and record everything that’s said.
The attack Chris Paget showed Saturday illustrates weaknesses in GSM, one of the world’s most widely used cellular communications technologies.
His attack was benign; he showed how he could intercept a few dozen calls made by fellow hackers in the audience for his talk at the DefCon conference here. But it illustrates that criminals could do the same thing for malicious purposes, and that consumers have few options for protecting themselves.
Paget said he hopes his research helps spur adoption of newer communications standards that are more secure.
“GSM is broken _ it’s just plain broken,” he said.
GSM is considered 2G, or “second generation,” cellular technology. Phones that run on the newer 3G and 4G standards aren’t vulnerable to his attack.
If you’re using an iPhone or other smart phone and the screen shows that your call is going over a 3G network, for example, you are protected. BlackBerry phones apply encryption to calls that foil the attack, Paget pointed out. But if you’re using a type of phone that doesn’t specify which type of network it uses, those phones are often vulnerable, Paget said.
Paget’s device tricks nearby cell phones into believing it is a legitimate cell phone tower and routing their calls through it. Paget uses Internet-based calling technology to complete the calls and log everything that’s said.
A caveat is that recipients see numbers on their Caller IDs that are different than the cell numbers of the people calling them. Paget claims it would be easy to upgrade the software to also include the callers’ real numbers.
The device he built is called an “IMSI catcher,” which refers to the unique International Mobile Subscriber Identity numbers that phones use to identify themselves to cellular networks.
Commercial versions of such devices have existed for decades and have mainly been used by law enforcement. Paget’s work shows how cheaply hobbyists can make the devices using equipment found on the Internet.
“That’s a significant change for research _ it’s a major breakthrough for everyone,” said Don Bailey, a GSM expert with iSec Partners who wasn’t involved in Paget’s research.
Another security expert, Nicholas DePetrillo, said such devices haven’t been built as cheaply in the past because the hardware makers have closely controlled who they sell to. Only recently has the necessary equipment become available cheaply online.
In the U.S., AT&T Inc. and T-Mobile USA are two cellular operators whose networks include GSM.
There are more than 3 billion GSM users and the technology is used in nearly three quarters of the world’s cell phone markets, according to the GSM Association, an industry trade group.
TWT Video Picks
By David A. Clarke Jr.
Blame Washington's intelligence failure, not lack of police
- CURL: We completely overhauled American health care to insure 4.2 million people?
- California gun store owner refuses to hand over customer list
- Firefighters discover church's Bible in Harlem rubble following gas explosion
- Bill Maher: God a 'psychotic mass murderer' who 'drowns babies'
- Crimea votes in favor of secession, U.S. rejects
- McCain: 'Russia is a gas station masquerading as a country'
- College group's diversity event canceled after excluding white people
- Trust me: Obama promises new overtime rules will be 'easier for everyone'
- U.S. pilot scares off Iranians with 'Top Gun'-worthy stunt: 'You really ought to go home'
- EXCLUSIVE: FBI blocked in corruption probe involving Sens. Reid, Lee
Chaos as Manhattan building explodes
Pope Francis meets his 'mini-me'
Celebrity deaths in 2014