Spoofing USSD messages

Question

I'm looking into USSD messages for a project I'm currently working upon and hoping someone can shed some light into spoofing.

Firstly, I know it should be possible if you have the relevant information (correct IMSIs and global titles etc.) and access to a telco environment. But how easy is it for a malicious user to send out a spoofed USSD string? What sort of equipment will be required?

Answer 1

I've never done this myself but it was done by Chris Paget at Defcon in 2010 successfully for an equipment cost of about $1500. You can find more information on what he did at the following links:

http://www.wired.com/threatlevel/2010/07/intercepting-cell-phone-calls/

http://www.darkreading.com/security/news/226500010/researcher-intercepts-gsm-cell-phones-during-defcon-demo.html

http://www.theregister.co.uk/2010/08/02/gsm_cracking/