Practical Cellphone Spying

Presented at DEF CON 18 (2010), July 31, 2010, 1 p.m. (50 minutes).

It's widely accepted that the cryptoscheme in GSM can be broken, but did you know that if you're within radio range of your target you can intercept all of their cellphone calls by bypassing the cryptoscheme entirely? This talk discusses the practical aspects of operating an "IMSI catcher", a fake GSM base station designed to trick the target handset into sending you its voice traffic. Band jamming, rolling LACs, Neighbour advertisements and a wide range of radio trickery will be covered, as well as all the RF gear you'll need to start listening in on your neighbours.

Presenters:

• Kristin Paget - Ethical Hacker   as Chris Paget
  Chris Paget has over a decade of experience as an information security consultant and technical trainer for a wide range of financial, online, and software companies. Chris' work is increasingly hardware-focused, recently covering technologies such as GSM and RFID at venues such as Defcon and Shmoocon. With a wide range of experience encompassing software, networks, radio, cryptography and electronics, Chris enjoys looking at complex systems in unusual ways to find creative attacks and solutions.

Links:

• https://defcon.org/html/defcon-18/dc-18-speakers.html#Paget
• https://infocon.org/cons/DEF CON/DEF CON 18/DEF CON 18 video and slides/DEF CON 18 - Chris Paget - Practical Cellphone Spying - Video and Slides.mp4 (Video and Slides)
• https://www.youtube.com/watch?v=fQSu9cBaojc

Similar Presentations:

• DEF CON 24 (2016) / Forcing a Targeted LTE Cellphone into an Unsafe Network
• DEF CON 22 (2014) / NSA Playset : GSM Sniffing
• Black Hat USA 2010 / Base Jumping: Attacking GSM Base Station Systems and Mobile Phone Base Bands