10

The following papers explain that it is possible to suppress the encryption (or downgrade) in GSM using faked messages:

The main problem seems, that the messages, which are used to determine which encryption protocols are supported, are not integrity protected so an attacker can modify them.

I am just wondering how you would realize that? Do I have to drop the message which comes from the base station (is that even possible?) or can I impersonate the user and send a message to the base station that indicates that I am only supporting A5/1 ? How would you guys realize that? Using osmocomBB or are there other ways?

Improve this question

1 Answer 1

Reset to default
2

This concept is used in the IMSI catchers you have heard about law enforcement using.

They spoof cellphone towers and cause all the phones in their range to register with them.

They also downgrade the encryption so they can retrieve text and voice in addition to the metadata.

The best example that talked about the details was shown at DEFCON.

Hacker Spoofs Cell Phone Tower to Intercept Callsenter image description here

Here is a Google search that talks to this issue:

https://www.google.com/search?q=defcon+fake+cell+site+gsm+downgrade

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .