Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Given that 2G is proven to be insecure (broken) at DefCon, is it possible for a Corporate IT department to work with the Telco and ban 2G connections for their devices?

Some cell phones are unable to disable 2G connections or exclusively use 3G, and so I'm trying to shore up this issue with the Telco if possible.

share|improve this question
    
As a general rule, telcos have no way to do this. They don't have that kind of control over their partner's networks. However, you may be able to instruct your own phones not to make 2G connections. Some 3G phones have a "3G only" option. –  David Schwartz Mar 4 '12 at 0:37
    
@DavidSchwartz If they don't have direct control over partners, is information (verified or not) passed along that describes the connection type? –  makerofthings7 Mar 4 '12 at 1:27
    
Information is passed along for billing purposes. I'm not sure at what level it is aggregated as it is sent between partners. It may be at too high a level to contain information about individual connections. (Consider a phone moving from site to site.) –  David Schwartz Mar 4 '12 at 2:19
1  
Even if this were possible you don't actually want this to happen. Phones have backwards support for a reason. There are regions that do not have 3G and thus our phones have to support 2G. There are also phones that don't support 3G currently in use. Why are you worried about this? –  Ramhound Mar 6 '12 at 18:47

2 Answers 2

Asking the telco to do this would not solve your problem. The biggest issue with 2G is that the base stations are relatively cheap (approx. £600; this is from someone who gave a talk at Over The Air) and, loaded with OpenBTS, can allow an attacker to set up a nefarious 2G base station wherever they want. Unless you can lock the phone down to only use 3G, or to only use certain base stations, you have a problem.

Here is a rather good video from Chaos Computer Club Congress which explains a lot of the details of how mobile phone networks work (I've been to other talks where they've demonstrated 2G highjacking with an OpenBTS base station). It can get very technical (and there are a grotesque number of acronyms) but may help with anything mobile.

http://www.youtube.com/watch?v=759Ftfe2TUM

share|improve this answer
    
Forcing the phones to 3g/4g would be the best prevention, however time is the enemy. I'm sure in the next couple of years a 3g base station will be much more affordable. Fast forward again and the next gen tech will eventually be the same. –  Brad Mar 30 '12 at 18:25
    
This is true. I went to a talk by the gentleman who developed the encryption for the GSM standard (A5/1). His remit was to make an encryption standard that didn't require powerful chips (mobile phone companies wanted cost/power to be low) and would last 20-25 years. It lasted that long before it was finally cracked. –  webtoe Apr 2 '12 at 10:49

The only real solution IMO would to be replace the devices with encrypted ones that encrypt ALL communications.

check out: http://www.dpl-surveillance-equipment.com/100602.html

http://www.endoacustica.com/scramblers_en.htm

http://www.global-teck.com/english/telecomproducts This site has info on blackberry and windows mobile encryption software for voice, text, and data. This may be the way to go.

The only drawbacks are expense and both parties in conversation will need to be compatable with each other.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.