9

Is it possible to sniff or record and process GSM 3G signals (from some reciever) given that there is no other signals interrupting etc (the most comfortable conditions)

Update (with some supporting material ) http://events.ccc.de/congress/2010/Fahrplan/events/4208.en.html

Iszi
  • 26,997
  • 18
  • 98
  • 163
Nick Ginanto
  • 593
  • 3
  • 5
  • 16

2 Answers2

16

Sniffing and recording the signal is certainly doable, since that's what both cell phones and base stations do all day long.

Now the tricky point is that communications are encrypted, and decrypting the data from the outside can prove tricky. "3G" is a wide term, but (normally) 3G communications use the block cipher KASUMI. The best known cryptanalytic attack on KASUMI is a related-key attack which is something quite important for academics (especially since the attack can be demonstrated with two hours of computation on a PC), but by essence not applicable to the way KASUMI is used in 3G computation (it might be applicable if someone wanted to use KASUMI as a building block in a hash function, but that's really another subject).

So we can say that right now (early 2012), there is no known way to effectively break KASUMI encryption, provided that the block cipher is used properly.

The GSM protocols are complex beasts and it is possible that some weaknesses lurk in there, which might allow for security breaches without having to fight KASUMI upfront. I am not aware of any serious weakness of that nature (but absence of proof is not proof of absence). Also, be aware that all this crypto is only between the phone and the base station. The base station will then communicate the data to the provider network using whatever crypto, or lack thereof, that it wishes. If I wanted to tap on GSM 3G signals, I would do a bit of roof climbing and plug myself directly on the base station.

Thomas Pornin
  • 320,799
  • 57
  • 780
  • 949
  • 4
    If you really want to, you can jam 3G transponder frequencies, forcing all phones in the area to fall back to 2G mode. – ewanm89 Jan 06 '12 at 22:52
  • 1
    There's an active attack that can recover the KASUMI (A5/3) key. It is a version rollback attack: the attacker tricks the victim into using A5/2 (which is totally broken). The attacker breaks A5/2 and recovers the key. This is the same key used for A5/3, so in this way, the attacker can learn the key and decrypt traffic. See [Instant Ciphertext-Only Cryptanalysis of GSM Encrypted Communication](http://www.cs.technion.ac.il/users/wwwb/cgi-bin/tr-info.cgi?2006/CS/CS-2006-07), Elad Barkan, Eli Biham, Nathan Keller. I cannot confirm whether this remains feasible in modern 3G networks. – D.W. Aug 26 '12 at 05:20
2

Yes, but you need a transmitter too, basically, you build a base station and MITM the connection by getting phones to connect through it (usually by lying and saying you are some major network), you then have to actually handle call routing and stuff as the base stations do.

ewanm89
  • 2,043
  • 12
  • 15