Tag Info

Hot answers tagged

52

A few scams I've seen making the rounds: Use it to dial a premium rate number owned by the group. In the UK, 09xx numbers can cost up to £1.50 per minute, and most 09xx providers charge around 33%, so a five minute call syphons £5 into the group's hands. If you're a good social engineer, you might only have a 10 minute gap between calls as you wander ...


39

GSM includes some protection through cryptography. The mobile phone and the provider (i.e. the base station which is part of the provider's network) authenticate each other relatively to a shared secret, which is known to the provider and stored in the user's SIM card. Some algorithms known under the code names "A3" and "A8" are involved in the ...


34

What are the technical aspects to tracing a phone call; is it more difficult for mobile phone? In the old days, signaling was inline, hence the 2600hz hack. Calls were setup as one switch talked to another, then another, and so on until a circuit was established end-to-end. In the modern age, everything is out-of-band over SS7 and every switch is lined ...


27

Who's to say that the phone is really off? If someone controls the firmware of the device then the off functionality could be replaced with state in which the phone appears to be "off" but is in fact maintaining a line of communication to a remote user. However firmware cannot stop you from introducing a hardware switch to disconnect the microphone. A ...


22

For telecommunications, checkout GSM, CDMA, TDMA, and EDGE. The two competing protocols in the United States are GSM and CDMA. The resources linked below are lacking when it comes to CDMA, but using site:defcon.org and site:blackhat.com in your Google searches will turn up some presentations. For interception of GSM, I refer you to a white paper on ...


22

A SIM identifies you with your network operator; it is necessary to be able to receive calls and to bill you for calls you make. Without a SIM, a phone is mostly useless as a phone, but it can still make emergency calls (in most countries). Without a SIM, your cell phone will not normally transmit data to local base stations, but if you make an emergency ...


20

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in ...


18

They could use it to send the detonation signal to that nuclear weapon they've secreted in a warehouse in Manhattan. That's pretty much the worst-case scenario.


16

They could dial their own number to get yours (assuming your number isn't private.) I think I just invented a new, somewhat forceful and creepy, pick-up move.


16

Mostly, two-factor authentication reduces the need for strong passwords in the same way as safety belts in cars reduce the need for efficient brakes. When you drive your car, your probability to be killed during a given journey is the probability of your having an accident, multiplied by the probability of your being killed when an accident occurs. Good ...


15

There are many VoIP services that provide ID-spoofing functionality Jumblo: Create an account and add some credit to it (10 Euros minimum excluding VAT), then install their Android app, login, the go to Settings and choose "Add Caller ID" then add the number. (Requires SMS verification) * Skype: You can create an online number (15 Euros minimum) then add ...


12

Yes, this is accurate. If your version of the Android OS has known privilege escalation vulnerabilities, there is nothing stopping a rogue application from exploiting a privilege escalation vulnerability and thus escaping the sandbox (i.e., gaining unrestricted access to your phone). This absence of security upgrades is a shortcoming of the Android ...


12

The SIM card must be plugged into a device for it to be functional in any way. It does not contain a power supply or an antenna. As such, it'd be impossible to track a SIM card on its own. However, once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s).


11

Well, many people consider Location data to be sensitive, as you'd imagine. The classic example is someone being stalked - they don't want their location out on the Internet anywhere. I suppose what's special about location is that it usually happens automatically and so it's easy to accidentally leak information. For example, I'm unlikely to accidentally ...


11

The whole idea about a second factor/step for authentication is to provide two independent layers of security. Vulnerabilities in one layer should not affect the security of the other. Second factor authentication was designed and used properly in the past but lately it has been weakened by companies who care more about profit than security. SMS messages ...


10

So I'm probably looking for some kind of a challenge-response mechanism here I'd guess so. Print up a few pages of text in the following format: # Challenge Response # Challenge Response 1 monkey character 2 sinew orange 3 bottle helmet 4 glass glove You'll both have the same list. Whenever you authenticate it doesn't matter ...


10

For the most part[1] they are encrypted, but not sufficiently enough to be considered as safe, tap resistant encryption. GSM uses 64-bit A5/1 encryption that is weak, to say the least. $15 phone, 3 minutes all that’s needed to eavesdrop on GSM call article from ArsTechnica covers it pretty well IMO, if you care to read more about it. However, it also ...


10

You're trying to take away communications capabilities from a tool designed to communicate. It's probably not the best choice of devices. You can start by setting the phone into "airplane mode", which is intended to shut off the radios. Because of the way RF works, that means it shuts off both transmitting and receiving. It should keep you safe, but of ...


10

If you have a phone with a removable main battery, you can try this: Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode. Make a note of the current time shown on the phone and on your PC by writing it down on paper. Shut down the phone, remove the main battery and ...


9

In addition to Jeff's and Rory's answers, there are some less conventional ways of tracking someone. Not by tracing his phone, but analyzing his call behavior. I worked on a datamining project were this was tested(it was based on MIT's Reality Mining). We would train the system with patterns gathered from statistics which you could get from a cellphone ...


9

A secure phone line is conceptually possible; this is not really different from, e.g., a secure communication between a Web browser and a HTTPS server (there are technical subtleties about lost packets and whether they should be tolerated, but that is not the issue here). However, the movie-secure phone is not secure, and that's a structural problem. The ...


9

The kind of attack you are talking is popularly coined as "Juice Jacking". Are there any "known bad" or "known safe" smartphones with regard to USB security? In my knowledge, NO. How does a corporation protect from these risks? By making policies (actually spreading awareness) about the threat as many people yet aren't aware about it. And ...


9

Yes, it is possible and almost trivial to make your phone call appear to come from a different number. Since many calls originate from within internal networks (e.g. PBX systems), the phone companies have a mechanism allowing the caller to indicate which phone number the call originates from. Traditionally there has been no restriction on which outgoing ...


9

A Korean researcher demonstrated this on Samsung Smart TVs at Black Hat this year. (Slide deck here.) He mentions that the malware was originally designed for cell phones, and that TV sets were even easier to attack because battery life did not give them away. His basic premise is that if he owns your device, he owns the power indicators, too. Remote ...


8

GSM Network is encrypted. But that doesn't make it bullet-proof of course. It can be compromised. However, the attacks Rook (and later in much more detail Thomas Pornin) described are very localized and requires significant effort to accomplish. They are not impossible, but very difficult. It requires breaking the GSM network in proximity of the mobile phone ...


8

Cell towers are for the GSM/3G/4G network, which tend to require user authentication -- with the SIM card. No SIM card, no 3G, hence cell towers are irrelevant. If you "surf the Web" and yet do not have a SIM card, then you are using WiFi (and you use your phone as if it was a laptop computer). WiFi signal can be tracked and pinpointed.


8

When the call is coming from an external PBX, then the Caller ID you receive is what the caller's service provider sends to your service provider. This could by anything the caller's service provider wants. Many service providers choose to respect that and send the real Caller ID to your service provider (and eventually, to you). Many SIP / VOIP service ...


8

Caller ID is always insecure, VOIP Caller ID is no more insecure than any other. If you want to know for sure who the caller is, you have to do a trace rather than trust the included information. Caller ID is kind of like politely asking someone for their name, they don't have to tell you the truth.


7

you're right, wireless communications are all around us. We can detect them, but they are encrypted. 3G security seems to be based around the concepts of secure authentication and encrypted communication. Here's an interesting article on the subject. 3G Security Architecture There are five different sets of features that are part of the ...


7

Like any other secured communication, it could be possible to decode the GSM/CDMA wireless traffic; question is how tough it is and how much infrastructure cost is required to decode them. Coming to a simple answer though much details and analysis have already been posted here, it is difficult to intercept them because: There exist a secure element in the ...



Only top voted, non community-wiki answers of a minimum length are eligible