This kind of technology is probably quite a few years away.
Via PC World:How does the GSM snooping work?
Chris Paget was able to patch together an IMSI (International Mobile Identity Subscriber) catcher device for about $1500. The IMSI catcher can be configured to impersonate a tower from a specific carrier. To GSM-based cell phones in the immediate area--the spoofed cell tower appears to be the strongest signal, so the devices connect to it, enabling the fake tower to intercept outbound calls from the cell phone.
What happens to the calls?
Calls are intercepted, but can be routed to the intended recipient so the attacker can listen in on, and/or record the conversation. To the real carrier, the cell phone appears to no longer be connected to the network, so inbound calls go directly to voicemail. Paget did clarify, though, that it's possible for an attacker to impersonate the intercepted device to the wireless network, enabling inbound calls to be intercepted as well.
But, aren't my calls encrypted?
Generally speaking, yes. However, the hacked IMSI catcher can simply turn the encryption off. According to Paget, the GSM standard specifies that users should be warned when encryption is disabled, but that is not the case for most cell phones. Paget explained "Even though the GSM spec requires it, this is a deliberate choice on the cell phone makers."
What wireless provider networks are affected?
Good news for Sprint and Verizon customers--those networks use CDMA technology rather than GSM, so cell phones on the Sprint or Verizon networks would not connect to a spoofed GSM tower. However, AT&T and T-Mobile--as well as most major carriers outside of the United States--rely on GSM.
Does 3G protect me from this hack?
This IMSI catcher hack will not work on 3G, but Paget explained that the 3G network could be knocked offline with a noise generator and an amplifier--equipment that Paget acquired for less than $1000. With the 3G network out of the way, most cell phones will revert to 2G to find a viable signal to connect to.
A researcher released software at the Black Hat conference on Thursday designed to let people test whether their calls on mobile phones can be eavesdropped on.
The public availability of the software - dubbed Airprobe -- means that anyone with the right hardware can snoop on other peoples' calls unless the target telecom provider has deployed a patch that was standardized about two years ago by the GSMA, the trade association representing GSM (Global System for Mobile Communications) providers, including AT&T and T-Mobile in the U.S.
Most telecom providers have not patched their systems, said cryptography expert Karsten Nohl.
"This talk will be a reminder to this industry to please implement these security measures because now customers can test whether they've patched the system or not," he told CNET in an interview shortly before his presentation. "Now you can listen in on a strangers' phone calls with very little effort."
An earlier incarnation of Airprobe was incomplete so Nohl and others worked to make it usable, he said.
Airprobe offers the ability to record and decode GSM calls. When combined with a set of cryptographic tools called Kraken, which were released last week, "even encrypted calls and text messages can be decoded," he said.
To test phones for interception capability you need: the Airprobe software and a computer; a programmable radio for the computer, which costs about $1,000; access to cryptographic rainbow tables that provide the codes for cracking GSM crypto (another Nohl project); and the Kraken tool for cracking the A5/1 crypto used in GSM, Nohl said.
More information about the tool and the privacy issues is on the Security Research Labs Web site.
The “X” denotes both “connection” and “infinite possibility,” and the “i” both “individual user” and “innovation.” The logo, which resembles the infinity symbol, aligns the letters in a single stream to embody the bonds that organically link people, goods and information, and lead to new innovation.
DOCOMO’s Xi LTE service will offer downlinks of up to 75 Mbps, approximately 10 times faster than the company’s current FOMA™ 3G service. Initially, Xi will be available in the Tokyo, Nagoya and Osaka areas, but coverage eventually will be expanded to other major cities and then additional areas of the nation. Xi users will be seamlessly handed over to the FOMA network whenever they leave a Xi service area.
Xi handsets, billing plans and other details will be announced later.
Meanwhile the world got its fourth commercial LTE network this week, and its first outside the Nordic region - in the unlikely telecoms hotspot of Uzbekistan.
The Uzbek launch came from Russian giant MTS, and shows how some emerging global telecoms players plan to leapfrog rivals by deploying LTE or WiMAX in markets where 3G is under-developed, and then harness that experience for their mainstream territories. MTS follows TeliaSonera's three LTE commercial switch-ons (in Sweden and Norway plus a soft launch in Finland).
MTS calls its new network "the first fully operational 4G network in the CIS and Central Asia" and is it initially available in the central zone of capital Tashkent, boasting theoretical peak speeds of up to 100Mbps using dongles. The network runs in the 2.5-2.7GHz band and the equipment comes from Huawei.
Regarding the technological scope, SOCRATES primarily concentrates on wireless access networks, as the wireless segment generally forms the bottleneck in end-to-end communications, both in terms of operational complexity and network costs. As a consequence, the largest gains from self-organisation can be anticipated here. We select the 3GPP LTE (3rd Generation Partnership Project, Long Term Evolution) radio interface as the central radio technology in our studies. The reason for this choice is that 3GPP LTE is the natural, highly promising and widely supported evolution of the world’s most popular cellular networking technologies (GSM/EDGE, UMTS/HSPA).
The SOCRATES project is supported by the European Union under the 7th Framework Program, and will run from January 1, 2008 until December 31, 2010.
Qualcomm apparently is in talks to sell off its struggling MediaFLO digital mobile TV business, executives said in a conference call on Wednesday.
The announcement came during the conference call accompanying Qualcomm's third-quarter earnings. Qualcomm reported net income of $767 million, up 4 percent from a year ago, on revenue of $2.71 billion, which decreased 2 percent over the same period a year ago.
During the call, Qualcomm chief executive Paul Jacobs announced the new direction for its MediaFLO business, a subsidiary of Qualcomm. MediaFLO brands its digital mobile television service as FLO TV. Qualcomm had saddled the business with a three-year, nonrefundable prepaid service agreement, which apparently hasn't helped MediaFLO's prospects.
"With respect to our FLO TV business, we're engaged in discussions with a number of partners regarding the future direction of the business," Jacobs said, according to a transcript by Seeking Alpha. "We are considering a number of alternatives and we will update you as appropriate."
One option might be to shutter MediaFLO itself and sell on the licenses and tower assets - 700MHz is seen as beachfront spectrum in the US, and both Verizon and AT&T will build their initial LTE networks there. Jacobs made clear, in an interview with GigaOM, that he would rather keep MediaFLO as a content system. He said: "We want to see FLO continue so it's not like we'd want to sell the spectrum, but there are certainly people who would buy it for the spectrum. The spectrum is extremely valuable."
Qualcomm always intended to sell MediaFLO eventually - its usual route when it invests in spectrum and builds networks. The same pattern will be seen in India, where it will work with local partners to create a TD-LTE system in the 2.3GHz spectrum it recently acquired and then will sell the business on once established. However, it would have hoped to make more return on its investment in FLO before exiting. "We put FLO TV operations into our strategic investments for financial reporting because we always intended to get out of the operator business. …. It's not operating the way we want it to - it's not necessarily our core business, so we're looking at our options," Jacobs said in the same interview.
