Campbell Murray - GSM: We Can Hear Everyone Now
Demonstrates practical GSM interception using commodity SDR hardware and open-source software to decrypt 2G voice calls.
Summary
Practical GSM Voice Interception
Campbell Murray (Global Head of Security Services, BlackBerry) presents a practical demonstration of GSM (2G) voice call interception using commodity software-defined radio hardware and open-source software tools.
GSM Security Model Failures
GSM provides one-way authentication (network authenticates subscriber; subscriber cannot authenticate network) and uses the A5/1 stream cipher, which was broken cryptanalytically in 2009 with rainbow table attacks. GSM networks also transmit calls in cleartext when the network operator sets the encryption indicator to none.
Full Interception Setup
Using a $35 RTL-SDR dongle, Osmocom software, and publicly available A5/1 rainbow tables, Murray demonstrates decrypting and recording live 2G voice calls within range of a passive SDR antenna — no IMSI catcher required for unencrypted calls.
LTE Fallback Vulnerabilities
The talk covers LTE networks' forced fallback to 2G (SRVCC) as an attack vector: a malicious cell tower can force a target's LTE phone to downgrade to vulnerable 2G for interception.
Related talks
Main Stage·40 min
Cooper Quintin · Yomna Nasser
Shows how modifying an inexpensive consumer 4G LTE mobile hotspot allows researchers to capture raw network packets and detect IMSI catcher surveillance.
Main Stage·46 min
Cooper Quintin
EFF researcher Cooper Quintin introduces Crocodile Hunter, an open-source tool using low-cost SDRs to detect 4G LTE IMSI catchers (Hailstorm) in real time.
Main Stage·30 min
Cooper Quintin
Cooper Quintin answers questions on Crocodile Hunter, 4G IMSI catcher detection mechanics, and cellular surveillance tracking.