|
Vulnerability GSM (Cell phone security) Affected GSM System Description Ross Anderson posted following about GSM security. For those who don't know, GSM is the dominant cellular telephone standard in Europe, and it is also used by some companies in the United States. He and his team found a way to hack it. You need to know the IMSI (international mobile subscriber identification). How does our attack work? Well, when a GSM phone is turned on, its identity (the IMSI) is relayed to the authentication centre of the company that issued it, and this centre sends back to the base station a set of five `triples'. Each triple consists of a random challenge, a response that the handset must return to authenticate itself, and a content key for encrypting subsequent traffic between the mobile and the base station. The base station then relays the random challenge to the handset. The SIMcard which personalises the handset holds a secret issued by the authentication centre, and it computes both the response and the content key from the random challenge using this secret. The vulnerability they planned to exploit is that, although there is provision in the standard for encrypting the traffic between the base station and the authentication centre, in practice operators leave the transmissions in clear. This is supposedly `for simplicity' (but see below). To break GSM, they transmitted the target IMSI from a handset and intercept the five triples as they come back on the microwave link to the base station. Now you can give the correct response to the authentication challenge, and encrypt the traffic with the correct key. You can do this online with a smartcard emulator hooked up through a PC to a microwave protocol analyser; in a less sophisticated implementation, you could load the handset offline with the responses and content keys corresponding to challenges 2 through 5 which will be used on the next four occasions that you call. The necessary microwave test set costs about $20,000 to buy, but could be home built: it's more than an undergraduate project but much less than a PhD, and any 23cm radio ham should be able to put one together. Testing team would have borrowed this, and reckoned on at most 3 person months for SIM-handset protocol implementation, system integration, debugging and operational testing. Given such an apparatus, you can charge calls to essentially any GSM phone whose IMSI you know. IMSIs can be harvested by eavesdropping, both passive and active; `IMSI-catchers' are commercially available. Credit goes to Ross Anderson, Cambridge University Computer Laboratory and acknowledgement to their research students Stefan Hild, Abida Khattak, Markus Kuhn and Frank Stajano contributed in various ways to researching and planning this attack. An academic paper on the subject will appear in due course. Solution The fix for this attack is to turn on traffic encryption between the GSM base stations. But that will not be politically acceptable, since the spooks listen to GSM traffic by monitoring the microwave links between base stations: these links contain not only clear keys but also clear telephony traffic. Such monitoring was reported in the UK press last year, and now the necessary equipment is advertised openly on the net. See for example: http://www.gcomtech.com/