Practical Cellphone Spying
Chris Paget explores practical cellphone spying at DEF CON 18, examining hardware-security and practical defenses.
Summary
Architecture and Background
Chris Paget - Practical Cellphone Spying It's widely accepted that the cryptoscheme in GSM can be broken, but did you know that if you're within radio range of your target you can intercept all of their cellphone calls by bypassing the cryptoscheme entirely?
Vulnerability Analysis
This talk discusses the practical aspects of operating an "IMSI catcher", a fake GSM base station designed to trick the target handset into sending you its voice traffic.
Exploitation and Demonstrations
Band jamming, rolling LACs, Neighbour advertisements and a wide range of radio trickery will be covered, as well as all the RF gear you'll need to start listening in on your neighbours.
Remediation and Defensive Strategies
Chris Paget has over a decade of experience as an information security consultant and technical trainer for a wide range of financial, online, and software companies. Chris' work is increasingly hardware-focused, recently covering technologies such as GSM and RFID at venues such as Defcon and Shmoocon. With a wide range of experience encompassing software, networks, radio, cryptography and electronics, Chris enjoys looking at complex systems in unusual ways to find creative attacks and solutions. For copies of the slides and additional materials please see the DEF CON 18 Archive here:
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Main Stage·47 min
Michael Ossmann
Michael Ossmann explores the nsa playset: rf retroreflectors at DEF CON 22, examining hardware-security and practical defenses.
Main Stage·47 min
Pierce · Loki
Pierce and Loki explores nsa playset: gsm sniffing at DEF CON 22, examining hardware-security and practical defenses.