Download the
Tom's Guide App from the AppsStore
News and trends on internet
/ mobile / "sound & picture" / IT
Yes No

$1,500 System Can Intercept Your Cellphone Calls

- By - Source : Tom's Guide US

You can be tapped easier than you think.

You see it in movies all the time when the characters pass sensitive information through a cell phone conversation. If you've watched any of the TV series 24, you'll know what sort of dramatic effect cell phones have.

Security researcher Chris Paget demonstrated a home made cell phone tower antenna that can spoof itself as a legitimate AT&T or T-Mobile (or any other GSM network) tower to intercept all outgoing calls.

The system is composed of two RF directional antennas that emits only 25 milliwatts, a laptop and open source software. The entire setup cost $1,500, with a significant portion of that being from the laptop.

The cell tower spoofing system is able to capture and record all outgoing cell phone conversations by intercepting the audio and then routing it through a VoIP system. Currently, the system is unable to intercept data, even if it's transmitted over EDGE.

Calls that are inbound to those connect to the spoofed cell phone tower will be routed straight to voicemail.

While one would be quick to criticize the GSM specification for the weakness, GSM phones and towers actually have encryption features. Phones are supposed to have the capability to tell the user when the phone call is no longer encrypted, but cell phone makers have chosen to disable the warning – perhaps to avoid dealing with customers concerned about the warning messages they are getting on their phones.

Paget demonstrated his technology by capturing about 30 phones on AT&T in the nearby vicinity. Anyone trying to make a call received a message first telling them that their calls were being recorded to a USB stick (which was destroyed after the demonstration).

As for those on 3G, Paget said that he could jam 3G signals and force phones to fall back to 2G mode so that they'd be susceptible to his interceptor.

Read more on Wired.

Share:
35
Comments
X

Comments

bv90andy 08/06/2010 1:16 PM
Hide
-16+

Interesting, so now we have to keep an eye for strange antennas that appear out of nowhere on our neighbours roof

joytech22 08/06/2010 1:21 PM
Hide
-6+

Zomg! i want to make one!!! Then i could see who my brother is always talking to.. he always mentions something stupid that i can never seem to hear.

rohitbaran 08/06/2010 1:35 PM
Hide
--2+

Interesting and dangerous if used for the wrong reasons.

nevertell 08/06/2010 1:48 PM
Hide
-20+

Don't worry, the cia already has these.

babybeluga 08/06/2010 1:52 PM
Hide
-15+

$10 goes to whomever can tell me what that baby is reading. It looks like something evil.

yzfr1guy 08/06/2010 2:00 PM
Hide
-7+

I've been able to hear cell phone conversations on a $300 radio receiver for years... whoopiee doo daa. Our government records every phone conversation, watch what your saying, my friend didn't and had the local fbi come to our freaking house years ago... ugh.

anamaniac 08/06/2010 2:06 PM
Hide
-9+

yzfr1guy :
I've been able to hear cell phone conversations on a $300 radio receiver for years... whoopiee doo daa. Our government records every phone conversation, watch what your saying, my friend didn't and had the local fbi come to our freaking house years ago... ugh.


Maybe having a lisp that most people find difficult to understand is a good thing after all. ^_^

Like many others I assume, my first thought was, 'I want'. Though I'm more interested in a jammer...

damasvara 08/06/2010 2:06 PM
Hide
-1+

that would cost me another $1000 to built these kinda rig... a spy rig... lol

Camikazi 08/06/2010 3:02 PM
Hide
-3+

Nice the setup can't intercept 3G so he jams 3G and forces phone to 2G so he can intercept, I like it :)

Marco925 08/06/2010 3:05 PM
Hide
--3+

Perfect for parents!

mrmotion 08/06/2010 3:16 PM
Hide
-10+

nevertell :
Don't worry, the cia already has these.



I'm guessing the CIA has stuff that makes this look like childs play.

tokenz 08/06/2010 3:24 PM
Hide
--3+

Glad I am CDMA and not GSM. Not to mention if I wanted total privacy I would run a Blackberry. Double encryption. Try to break that on your laptop.

tokenz 08/06/2010 3:25 PM
Hide
-2+

nevertell :
Don't worry, the cia already has these.



No the CIA and NSA. Have back doors built into every phone system. So all they have to do is make a phone call to ATT to get a transcript. No need to hook anything up.

Pei-chen 08/06/2010 4:09 PM
Hide
-2+

The National Geospatial-Intelligence Agency, NGA, also intercept calls except they do it from orbit.

superblahman123 08/06/2010 4:40 PM
Hide
-3+

babybeluga :
$10 goes to whomever can tell me what that baby is reading. It looks like something evil.



So considering the fact that baby's can't read, does that make this a potential trick bet? ;-)

TwoDigital 08/06/2010 4:47 PM
Hide
--2+

tokenz :
Glad I am CDMA and not GSM.

+1 tokenz. GSM has always been far more vulnerable, but it's cheaper to implement, was already the standard protocol in Europe, and had better capacity than the analog AMPS system it was competing with at the time. CDMA (Verizon, Sprint) is exponentially more secure. GSM is a fancy upgrade to TDMA from the old AT&T Wireless days.

cyprod 08/06/2010 4:49 PM
Hide
-0+

I'd like to know how he jams the 3G signal. It's a spread spectrum air interface that operates well below the noise level.

I work in cellular, albeit the software side, and have been trying to figure out how to do this asking the RF guys. (guy I go to lunch with can't detatch himself from his blackberry). They either can't figure out a cost affective solution or are keeping their mouths shut. Seriously, beyond a box over the antenna, we can only think of something that would fill a small moving truck and cost a minimum of 50 grand.

gwolfman 08/06/2010 5:07 PM
Hide
-3+

Another reason to stay away from the iPhone & AT&T. :)

Anonymous 08/06/2010 5:18 PM
Hide
-0+

@cyprod

3G coverage is marginal at the best of times, it doesn't take much for those silly smartphones to fall back to 2G (happens more often then not) so really he doesn't need to completely jam the signals just cause enough static for the phone to decide it's more trouble then it's worth, having 3 people in a single cell connect and max out the connection would probably do it.....

jsc 08/06/2010 5:29 PM
Hide
-2+

Baby isn't reading anything. His brain is being fried by icrowave radiation.

jsc 08/06/2010 5:29 PM
Hide
-2+

Whoops, "microwave".

cadder 08/06/2010 5:47 PM
Hide
-8+

My cellphone conversations are so boring I don't care who listens in to them.

lukeeu 08/06/2010 6:32 PM
Hide
-1+

rohitbaran :
Interesting and dangerous if used for the wrong reasons.

Can't see any right reasons.

Camikazi 08/06/2010 6:39 PM
Hide
-0+

superblahman123 :
So considering the fact that baby's can't read, does that make this a potential trick bet? ;-)


Haven't you seen the infomercials? Your Baby Can Read!

lukeeu 08/06/2010 6:42 PM
Hide
-3+

cadder :
My cellphone conversations are so boring I don't care who listens in to them.

That's because you didn't had half a century of old school totalitarian communism in USA. A few more P.A.T.R.I.O.T. acts and private security companies creating databases of genital photos and maybe you'll understand. First signs will be targeted penis enlargement ads at airports.

COLGeek 08/06/2010 6:47 PM
Hide
-2+

babybeluga :
$10 goes to whomever can tell me what that baby is reading. It looks like something evil.


It would appear that our young cell phone user is reading a product brochure from a car company.

Go ahead and send my $10 to the NSA. While the CIA may have some of these, the NSA's are sure to be better.

Honestly, does this ability, given how cellular systems work and the need for interoperability and backwards compatibility, come as surprise to anyone? This is essentially basic RF jamming. Not rocket science.

For those (including the folks in the Arabian Peninsula) who think the encryption used by Blackberries makes it too hard to eavesdrop, you aren't using the right tools. Anything that accesses public cell networks can be decrypted.

JPHD 08/06/2010 7:14 PM
Hide
-0+

I pick up loads of 2.4 ghz phone calls by accident when I turn my Sennheiser wireless headphone on. Every time I turn the thing on without a signal from my pc I get all sorts of crazy talk. Same logic should apply to any form of wireless communication. If you want confidentiality use a land line. Not saying it cant be tapped, just that it's harder.

K-zon 08/06/2010 8:04 PM
Hide
-0+

Theres been cheaper means for yrs, your cordless phone. Guess prices are going to going up on those.

ahnilated 08/06/2010 8:05 PM
Hide
-0+

>I pick up loads of 2.4 ghz phone calls by accident when I turn my >Sennheiser wireless headphone on. Every time I turn the thing on without a >signal from my pc I get all sorts of crazy talk. Same logic should apply to >any form of wireless communication. If you want confidentiality use a land >line. Not saying it cant be tapped, just that it's harder.

Oh I beg to differ! Land lines have been recorded for about 50 yrs.

igot1forya 08/06/2010 8:13 PM
Hide
-0+

I'm running a cell booster on my roof now because cell service in my area is so poor. I assume you could easily modify one of these kits to record whatever you wanted. I got my kit at www.jdteck.com if anyone wants to get one.

nforce4max 08/06/2010 8:15 PM
Hide
-1+

nevertell :
Don't worry, the cia already has these.



In reality they don't even need to intercept the signal but instead they are in bed with the major service providers such as AT&T or Comcast and can eavesdrop from the major hubs that make up the internet as well the phone networks.