Listening to mobile phones using software.

[Объединенное Детективное Бюро]

Listening to mobile phones using software. Vulnerability in the mobile communications system allows you to set the numbers and names of subscribers and monitor their movements, according to American researchers. Caller ID allows any interested person to get information about a person’s name and his mobile number, as well as to track his location. This was stated by American computer security experts Nick DePetrillo (Nick DePetrillo) and Don Bailey (Don Bailey). In their report at the Source Conference on April 21 in Boston, researchers said that they used the Caller ID base to identify the name and number of the subscriber. Depetrillo and Bailey were able to relate the number with the name of the subscriber using Asterisk software and VoIP-telephony protocol. To establish the location of the subscriber, the researchers used the SS7 protocol, which is usually used for the same purpose by mobile operators, reports The Register. Depetrillo and Bailey indicated that they did not violate any law during their research. According to Depetrillo, both individual subscribers and large corporations can become victims of an attack in this scenario. Bailey said that the threat should be reported to all users of mobile networks. [url = http: //ruformator.ru/] https://ruformator.ru/ [/ url]

 

[Матушкин Андрей Николаевич]

Thank!

 

[spy-phone]

Listening to mobile phones using software. “Mobile phones are spying on you,” are not a revelation. We all know that our movements both in real life and on the Web, not to mention calls and SMS, are recorded by operators. That is, when we move from point “A” to point “B”, the base station changes, and all this information is stored by mobile operators. So, "the researchers who gained access to the anonymous database of the mobile operator claim that they were able to predict user behavior with 93 percent accuracy, predicting when and where the person will go in the near future." And this means that not only operators can use this information in order to optimize the load on their base stations and redistribute traffic if necessary, but also attackers. What can I say, the fact of its “transparency” is even unpleasant for any person, even with respect to persons or companies that collect and use information about you legally, if we are talking about intruders, then innocuous hostility can turn into paranoid.

 

[Детективное агентство ИКС-Инфо.]

Interview with Carsten Nole, Mobile Communications Security Researcher

German analyst and information security specialist Carsten Null, who works for Security Research Labs in Berlin, has been actively involved in mobile security issues recently. So, he had already opened the GSM standard protection, and this week he and his colleagues presented the results of a new study demonstrating the relative simplicity of compromising GPRS. Andb Greenberg, a Forbes journalist, talked with Mr. Zero about current issues in the defense of mobile radio communications.

Andy Greenberg: So, this week you demonstrated the possibility of hacking GPRS, intercepting transmitted data and successfully decrypting it. Tell us more about this.

Karsten Zero: The main news is proof of the fundamental possibility of hacking GPRS. Frankly, many experts had previously suggested that there were flaws in its protection - due to the fact that essentially this is one of those systems that are developed by large telecommunication companies and government departments in an atmosphere of secrecy. They are supposed to protect their clients and citizens, but in reality they usually do not do very well. In this case, we have before us the product of the activities of the SAGE expert group, which designed and created cryptographic protection systems for DECT and GSM standards, for police walkie-talkies, etc. All of them were developed by her, all were studied, and all were hacked. News about GPRS appeared only now, not because it is better protected, but simply because it was investigated chronologically last.

The SAGE group was created by the state telecommunication monopolies of Germany, France and the United Kingdom, which united and planned the future of mobile communication systems. As far as I understand, they were engaged in the design of protection under the direct supervision of the government departments of these countries, and the results of these studies and developments were never made publicly available. They were created in an environment of secrecy for exploitation in secrecy mode. However, hopes for an eternal secret did not materialize: analysts have long been dealing with issues of breaking into these standards.

In your opinion, why almost all the cryptographic protection systems they created were vulnerable to hacking?

Anecdotal case: some of the data available to us indicates that they did not seem to intend to create a flawless cipher that provided reliable protection. So, two encryption standards were developed for GSM; the first, A5-1, is for countries of Western Europe (that is, for the citizens of those countries that created GSM), and the second, A5-2, is “for export”, for all other states. And this second standard was deliberately weakened by them. The difference is one modest "cryptographic fact", a function that makes one option more secure and the other more vulnerable. It is called "irregular clocking." It was invented at about the same time that the A5-1 was created, and it was deliberately excluded from A5-2.

GSM has become the standard not only for Western Europe, but also for a significant part of the rest of the world. I don’t know if it was supposed that it would last 20 years, but in the end it turned out to be the most successful communication standard - despite the fact that the process of its creation was surrounded by secrecy, and the efforts of the developers, among other things, were focused on making a good and a reliable cryptographic algorithm did not fall into the hands of the Russians.

How does irregular clocking work?

Imagine the many possible keys for a cryptographic function in the form of an inverted triangle that can be filled from bottom to top; the height of the figure is determined by the length of the key. Depending on what function you use, the triangle fills up to a certain "mark"; if the function is optimal, then it will be complete. Moreover, before encrypting the packet, the function passes the polynomial used in cryptography through a series of iterations, with each of which its length increases in a random order. If irregular clocking is not used, then the length of the polynomials does not change, their maximum number decreases, and our imaginary triangle will never be filled to the end.

Simply put, in encryption everything can be considered as a system of equations. Each output bit is defined as a function of the input bits. When using irregular clocking, these equations become very long. If the encryption system is good, you can’t even write these equations: there’s not enough time. However, in A5-2, where there is no element of random selection, this is very simple. We wrote down the equations and solved the system, although theoretically we should not have had the opportunity to do either one, much less the other.

But you and the A5-1 hacked last year, right?

So. Both standards are vulnerable to hacking. Just opening the A5-2 is a trivial task. So here; What does all this have to do with GPRS? We know that the SAGE group made one standard reliable and the second weak; and now, many years later, in 1997, she created GPRS. You will undoubtedly think that its participants provided the new standard with the same irregular clocking that they had already built into the A5-1. Think - and make a mistake.

Well, let's say there was a cold war then, and they had reasons to develop poor crypto protection. But at the time of the creation of GPRS, the conflict was long over - and nevertheless, they removed the function that, as they well knew, was required to ensure the security of the standard. Of course, if they had said this during the development process, people would immediately have noticed the vulnerability. It is very difficult for me to believe that the creators of the standard themselves did not suspect this flaw - especially since the last time they applied the same irregular clocking technology to create a more reliable cryptographic defense.

But why design a system so that it is vulnerable?

I have no idea.

Maybe there is some plausible technical explanation?

I see no reason to exclude this feature. At least, mobile devices do not exactly impose any restrictions on its implementation.

Do not you think that this was done specifically to facilitate the extraction of information?

I would not like to build any fabrications on this score. Of course, you can come to this conclusion, the probability of this exists; but no one can say for sure whether this is so - except for the developers themselves.

Why did it take so long before the public knew about all this?

The encryption function was - and remains, since we did not publish it - a secret. I believe this circumstance prevented many people from trying to conduct an appropriate analysis. However, the flaws of the A5 were reported back in 1994 - the results of relevant studies were sent to expert Ross Anderson in Cambridge and subsequently published on the Internet. This letter has not yet been featured in GPRS history.

You said that intercepting and decrypting data transmitted via GPRS is quite simple. What is meant by this? How long does it take to crack?

This task is most commonplace in those countries where GPRS traffic is not encrypted at all. It should be noted that there are surprisingly many of them. With regard to GSM, the picture is different: mainly dictatorial regimes refuse encryption, where the state consistently opposes any attempts by the population to use cryptographic protection. But if it comes to GPRS, then in Europe there are countries where encryption is not used - it is easier for them to track information and spy. In such states - in Italy, for example - it is very easy to open GPRS. I won’t name other countries, but people interested can easily determine how encryption works in their countries without special efforts.

And if encryption is used in the country, how much time does it take to overcome protection?

A typical computer with a quad-core processor takes about eleven minutes to hack. A relatively small, acceptable time, although perhaps not so small as to constitute a large-scale threat - especially since we do not disclose all the details that could completely compromise the defense. Our task is only to warn people about the vulnerability of mobile communication standards.

Why do you think you manage to break these standards again and again?

Not just me. Computer technology and many enthusiasts - cryptanalysts, radio specialists ... are actively involved in the work ... I rather act as a spokesperson.

What can you say about the competing standard CDMA, which is used by some operators - for example, Verizon and Sprint?

We have never studied CDMA. This standard is Qualcomm’s own development, which is mainly used in the United States, and as far as we know, there are not many researchers and crackers interested in mobile cryptography among the inhabitants of the United States - so far it has not been seriously considered.

I can only say that CDMA has gone through more stages of evolution than GSM. GSM has been unchanged for decades, while CDMA has undergone structural changes. Twenty years ago it was a different network - and GSM to this day is still the same, not counting a few add-ons.

So, users have learned that almost every GSM cryptographic security standard is unsafe. What should they do now?

Keep this in mind and try not to transmit sensitive data through mobile networks.

Or upgrade to CDMA?

I will not advertise CDMA. It is not yet known how safe it is; his defense may be even weaker.

Perhaps it is worth adding other levels of cryptographic protection besides the one provided by the operator?

There is such software for mobile phones, but it is not very convenient. You can’t just take and encrypt traffic - both participants in the conversation must have the same cryptosystem. Some large organizations like Amnesty International can afford (and their employees) phones with additional encryption protection, but the cost of such devices can reach several thousand dollars. You can also mention Chaos Computer Club: here they use Cryptophone, a device that not only provides cryptography, but also shows a list of all internal applications - so that the user can make sure that there is no spy or Trojan horse in the operating system.

And what can you say about encryption programs for Android like those released by Whisper Systems?

Inexpensive alternative. This is a purely software solution, but for the needs of most users, its capabilities will be sufficient. Such applications provide the very same additional level of encryption, and you as an individual user do not need more.

https://www.iriney.ru/links/sites/rahman ... raina.html

 

[Евгений СБ]

Don't talk too much on the air.

 

[Детективное агентство ИКС-Инфо.]

Don't talk too much on the air.

: D

 

[@InfoPoisk]

And I'm Th, I'm not Th. : D: D: D

 

[Орлан]

Listening to mobile phones using software.

Listening to mobile using software. What are the solutions?

Listening to mobile using programs All existing software can be divided into two categories. The first one is programs that require installation on a listening mobile device. The second is remote software that allows you to control using a remote phone or computer.

From the point of view of efficiency and capabilities, it is most preferable to wiretap a cell phone using the programs installed on it. A prerequisite is the availability and configuration of GPRS, as well as services such as conference calls and call waiting. Using a hidden program, you can control the location of the subscriber, record conversations on a computer, listen to conversations and surroundings, intercept SMS and print calls, as well as send SMS with a number change.

To get all of these features, you must provide at least five-minute access to the phone you want to listen to. During this time, you need to install a hidden program, which will provide you with all the necessary functions. At the same time, the owner of the monitored device will not be able to determine and accurately establish that wiretapping of the mobile phone takes place here.

At first glance, remote spyware that does not require access to a monitored device is more attractive. However, in this case, the question arises as to whether they can change its basic functions to ensure efficient operation without installation on a basic device !?

The fact is that without installation on the target device, access is possible only via the GSM channel. But at the same time, GSM can change any phone settings, especially those important such as mute and vibration, conference settings, etc. Therefore, in the absence of the ability to affect the conference call, the effectiveness of remote listening is extremely low and in most cases is reduced to zero.

The same applies to software that must be installed on a computer that is not connected to the target phone. GPRS technology does not provide the ability to connect to the phone via the Internet, and even more so to the settings of its software core, if there is no spyware installed on the device being listened to.

Therefore, we can safely say that those software developers who say that it is possible to wiretap mobile phones only when installing hidden software do not deceive their customers.

 

[Игорь Эдуардович]

Re: Listening to mobile using software. Which exist

Thank you Dmitry !!! For interesting information.

 

[НСК-СБ]

Re: Listening to mobile using software. Which exist

Thank you very much, Dmitry! Interesting!