I'm learning wireless penetration testing. It really is amazing. But it made me wonder, what about mobile phones? They are also means of wireless communication. So, our entire voice must be in the air surrounding us. So,

  1. What makes it difficult to intercept?
  2. By the way, is there any standard like 802.11 for Wi-Fi, for telecommunication over mobile phones?
  • 1
    You might be interested in this: venturebeat.com/2010/07/31/…
    – Peanut
    Commented Jun 14, 2012 at 1:07
  • as per your bounty, what extra information are you looking for? The questions below fully answer part 2 of your question, so I'm guessing you want something else from the first part?
    – Rory Alsop
    Commented Jun 19, 2012 at 10:30
  • 1
    There isn't much preventing you from decrypting GSM/CDMA traffic, see chao-mu's answer. You need SRTP with ZRTP authentication for secured voice/video communications. Jitsi provides this for computers. Android has ZRTP via CSipSimple. See guardianproject.info/tag/zrtp and code.google.com/p/csipsimple and androidzoom.com/android_applications/zrtp ZRTP isn't likely outside Android and real computers, i.e. no ZRTP for iOS. Commented Jun 21, 2012 at 14:01
  • Oops, it appears the zrtp.org plugin works on several other platforms, probably not as user friendly, but still. Commented Jun 21, 2012 at 14:08
  • 2
    I say this without authority: I recommend removing the additional questions you added and turning them into additional separate question posts. I like that they are more specific than the originals, but they are now beyond this thread in its current state. Paraphrasing, "what makes interception difficult" and "what telecommunication protocols exist" while interesting are what all the work hereto performed have been devoted to, whether they missed the mark or not.
    – chao-mu
    Commented Jun 21, 2012 at 18:13

6 Answers 6


For telecommunications, check out GSM, CDMA, TDMA, and EDGE. The two competing protocols in the United States are GSM and CDMA. The resources linked below are lacking when it comes to CDMA, but using site:defcon.org and site:blackhat.com in your Google searches will turn up some presentations.

For interception of GSM, I refer you to a white paper Intercepting GSM traffic from the BlackHat conference:

Abstract: This talk is about GSM security. We will explain the security, technology and protocols of a GSM network. We will further present a solution to build a GSM scanner for 900 USD. The second part of the talk reveals a practical solution to crack the GSM encryption A5/1.

The corresponding video of the presentation:

Also a talk on cellular privacy and the Android platform:

and a whitepaper on the Lawful Interception for 3G and 4G Networks (though see first comment on this answer):

This document will first provide a brief description of the various evolutions of public mobile networks that have been commercially deployed, followed by a discussion on the evolution toward the newer “long term evolution” technologies. We then discuss possible configurations for lawful interception of the evolving mobile networks, followed by descriptions of approaches to 3G / 4G interception solutions now available from Aqsacom.

And a SANS article on GSM security:

Also note that smart phones typically just automatically connect to networks with SSIDs it remembers. Sniff the airwaves for beacons that it is sending out and set up an evil access point with a matching SSID. Launch a remote attack across the network or man in the middle the device and launch a client-side attack appropriate to the device.

  • 3
    The main thing to note about Lawful Interception is that the voice data isn't encrypted as soon as it gets to the base station; so the govt only have to record it (with the co-operation of the telco); it is however encrypted between the phone and the base-station.
    – Savara
    Commented Jun 14, 2012 at 14:37
  • @Savara The "encryption" is pretty weak, unfortunately.
    – forest
    Commented Sep 4, 2019 at 6:46

Like any other secured communication, it could be possible to decode the GSM/CDMA wireless traffic; question is how tough it is and how much infrastructure cost is required to decode them. Coming to a simple answer though much details and analysis have already been posted here, it is difficult to intercept them because:

  1. There exist a secure element in the Mobile Equipment called as the SIM. The device is a smart card which consist of a secret key. The secret key is initialized into the SIM card in the process of personalization by the telco. The shared secret is known only to the telco and the SIM itself.
  2. In the initial handshake protocol in which the Mobile device registers into the telco network, there exists a challenge response protocol in which the identity of the SIM is established to the telco. After this process in conjunction with the Mobile Equipment a session key is derived and the entire communication is encrypted using some variants of the A5 algorithm.

This is how the communication is secured and how it cannot be intercepted. The ecosystem is designed in such a way that the handshake happens at some regular interval and so the session key keeps changing.

Even if one attacker had to create a tempered Mobile equipment, it is impossible to extract the secret key from the smart card.

With the advent of high capability crypto smart cards and higher bandwidths , the security model is changed to mutual authentication, in which case the network authenticates the card and the card also authenticates the network (telco) using combination of symmetric and asymmetric encryption and signing processes.

The above context was more with respect to GSM technology. In CDMA, it uses some technique called frequency hopping spread spectrum using which a data pipe takes more bandwidth and space than actually it would have had required; thus scattering the data as dust particle (just explanation). So for an interceptor it becomes tough to regenerate the actual data from some reference data from the scattered data.

As far as your other question regarding 802.11 standards for mobile devices, AFAIK the standards are same for any device which want to use 802.11 weather it is a mobile or a simple laptop device. The security requirement is imposed by the 802.11 routers.

What exactly is SIM (Subscriber Identity Module) Card?

SIM (Subscriber Identity Module) is a specialized smart card in a form factor which can be inserted into a mobile device. Smart Card is not a secret password but a slave computer device (simple explanation). Unlike thumb drives which we use for storing data; SIM card doesn't allow an external entity to directly access the memory in the chip. SIM card acts as a computer in a sense the other computer (reader or mobile equipment) is needed to have a protocol for communication. There are standards like ISO-7816-4 which provides commands interface using which an external reader can communicate with the smart card.

How does SIM Card play role in Establishing connection between Phone & Network Operator?

Now I will try to explain the basic steps again how the security is established in the entire life cycle of SIM and secure mobile communication:

  1. When the telco initializes the SIM card, it inserts a secret key into the SIM card using ISO-7816 command set. The security of the key file is such that it cannot be read. The SIM card will only allow operation like encipher or signing using the file. When the manufacturer of the SIM card ships the smart card to the telco, it initialized it with a initialization key which it secretly shares with the telco. The SIM shall allow loading of the key file by telco only if the telco could prove that it have the initialization key or the pin. In this way telco have full control over the SIM. In the process of initialization of SIM by telco, telco maps a serial number in its system and the same number is printed on the back side of the SIM (for example). This number is used by telco at latter stage to map and activate a SIM card. Technically the printed serial number enables the telco to fetch the secret key for activating the SIM and informing the same to its validation systems.

  2. When the SIM is inserted on to the Mobile Equipment, the mobile equipment scans for available networks present in air in the 900/1800/1900 channel. It talks to the desired network to let it register to the network. The mobile sends the unique SIM ID to the network. The network sends a challenge to the mobile device. Using ISO-7816 command specification, the mobile equipment constructs the required command for authentication request which also consist of the challenge received by the equipment from the network. The SIM card using the secret key encrypts the challenge and sends it as a response to the ISO 7816 command to the equipment. The response is passed to the network by the mobile equipment. The network validates the response as it also possesses the secret key in its system mapped with the unique SIM identifier. Based on the validation the network either grants registration or denies registration to the mobile equipment in the network. The further process of generation of session key is slightly complex and is beyond the scope of this context. The SIM is not required any more by the equipment. In regular intervals the network shall ask the equipment to re-do challenge response in which case SIM shall again be used. For this reason if you have a mobile device in which SIM can be removed without removing battery you mobile shall continue to operate for a finite period of time.

How does Manual & Automatic Registration of Network Work?

Now coming to the issue of manual and automatic registration. When the telco initializes the SIM it writes one more read only file in the SIM which contains the network ID. This helps the mobile to detect the preference in which it should select the network provider from the list of available network providers to which it should make the first attempt to register.

In case the file is not available, the mobile will make an attempt in a sequential manner with the list of network providers. The mobile also maintains a history record of the SIM ID and network to which it registered, which helps it to fasten the process when the equipment is restarted for judging the network to which the request for registration to sent first.

How WiFI Security differs from GSM Security?

Now coming to the WIFI and 802.11 communications using the mobile device. Here SIM is not part of any communication or authentication. In-fact you can connect to the WIFI without the SIM present in the device. The security guidelines for WIFI are provided in WIFI specifications. Based on the security rules configured in the router, the clients have to authenticate and have the channel of communication secured and encrypted or non secured. Mobile device just contains the client hardware and software to use a WIFI network in addition to the GSM radio.

Further Reading:

  1. SIM Card Security - A Seminar Work by Sheng He - Explains the structure & Working of SIM Card.
  2. Security Architecture of Wireless Cellular Network Technologies: 2G Mobile Telephony Cellular Network (GSM)
  3. GSM Security - Brief (4-page) overview of Security in GSM
  • Thank you! That's new information. Could you kindly point me to a resource to study more about what you've said in 1st & 2nd point?
    – claws
    Commented Jun 21, 2012 at 15:31
  • Btw, is SIM is something like a secret password for connecting access point in WiFi? I just noticed in my mobile that there is an option of Network Selection Mode (defaultly set to Automatic). When I changed it to Manual, it has shown me list of Mobile Network Operators (like Airtel, Vodofone IN, Tata GSM, Tata Docomo, Cellone, Idea etc). This looks similar to Windows showing list of wifi networks (access points). Now with Wifi, we can connect to some networks only with password. So, I can only connect to Airtel Network because I've password (SIM) provided by Airtel. Am I right?
    – claws
    Commented Jun 21, 2012 at 15:39
  • Where did you learn all this from?
    – claws
    Commented Jun 21, 2012 at 16:34
  • Hi @claws. Please find the clarifications in my post. I will post some basic PDF links latter using which you can understand the mobile wireless security. The standards are available in ETSI which will be slightly complex to understand initially. The explanation I have given in the post is put in simple way more to understand the basics, the actual and current security is needed to be understood from the current specifications. The post shall give you a fair idea of how the mobile works using the SIM. Its better if you read the basics of smart card;which will help you more to known the system Commented Jun 22, 2012 at 5:32
  • 2
    www6.conestogac.on.ca/~mkabir/TCOM1010_ConEd_Cellular/… wireless.arcada.fi/MOBWI/material/CN_1_6.html emsec.rub.de/media/crypto/attachments/files/2011/04/… These are basics. I will share more latter. Keep reading as they are interesting: Commented Jun 26, 2012 at 9:41

you're right, wireless communications are all around us. We can detect them, but they are encrypted.

3G security seems to be based around the concepts of secure authentication and encrypted communication.

Here's an interesting article on the subject.

3G Security Architecture There are five different sets of features that are part of the architecture: Network Access Security: This feature enables users to securely access services provided by the 3G network. This feature is responsible for providing identity confidentiality, authentication of users, confidentiality, integrity and mobile equipment authentication. User Identity confidentiality is obtained by using a temporary identity called the International Mobile User Identity. Authentication is achieved using a challenge response method using a secret key. Confidentiality is obtained by means of a secret Cipher Key (CK) which is exchanged as part of the Authentication and Key Agreement Process (AKA). Integrity is provided using an integrity algorithm and an integrity key (IK). Equipment identification is achieved using the International Mobile Equipment Identifier (IMEI).

  • 1
    Its encrypted. No problem. But how can I intercept and get that encrypted content?
    – claws
    Commented Jun 13, 2012 at 20:09
  • If you can break the encryption then no problem- it being wireless you can simply pull it from the air. However the encryption is a challenge, so another attack is to become a cell transmission tower and run a MITM attack.
    – Rory Alsop
    Commented Jun 14, 2012 at 11:44
  • 1
    Have a look into en.wikipedia.org/wiki/A5/3 and the other A5 algorithms for GSM's encryption algorithms.
    – Savara
    Commented Jun 14, 2012 at 14:36

If you have 50min, check this video Defcon 18 - Practical Cellphone Spying - Chris Paget how easy is to intercept 2G networks.


GSM has an encryption which other form of standards has not, but it doesn't mean interception is not feasible.

There are plenty of references to this, most of them requires the use of special hardware:


The European Telecommunications Standards Institute (ETSI) is the governing body for network providers/carriers in terms of standards which includes fixed, mobile, radio, converged, broadcast and internet technologies inside telecommunications. You're looking for some sort of IEEE/RFC for telecom networks right? Here's the link:



The difficulties involved in passively intercepting mobile telephone signals can be summed up as follows:

  1. Capturing the signals
  2. Analyzing the traffic
  3. Decrypting the traffic

Capturing the signals on the downlink (base station to mobile) is relatively straightforward. You have to be in range of the transmitter and have a suitable receiver. GSM is a popular target because the channels are just 200kHz wide and, for non-hopping calls, easily intercepted even with RTL-SDRs. For hopping traffic and CDMA you'll need to capture around 8MHz of bandwidth (and for LTE 20MHz) which means a proper SDR like the BladeRF or USRPs.

Capturing the uplink is much more problematic. You'll need to be in radio range of the target and, if you want both directions captured, usually means another SDR because the downlink is in a different part of the radio spectrum.

Analysing the signal is getting better. In the last year there have been new radio projects which will let you process the radio signals and produce packets you can process in code, view in WireShark etc.. These include the gr-gsm, gr-cdma, gr-lte and openlte projects and they are all under active development so your mileage will vary in how much you might achieve.

Decrypting the signals is a pain. The A5/1 cipher is weak and falls to a rainbow table attack but the tables available right now (the "Berlin Set") is incomplete and covers only 20% of the key space. That means 80% of traffic is probably going to remain safe. The tables are also very large (1.7TB) which makes downloading them painfully slow.

Kristin Paget did some seminal work on active interception. You can do the same quite easily by setting up an OpenBTS base station but running a base station legally is not straightforward and you'll need to do a lot of legwork to ensure you stay legal. The penalties for illegally broadcasting can be very significant and anything that potentially can affect users ability to place emergency telephone calls is likely to be taken very seriously.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .