2

IMHO there was a Blackhat video about it, but cannot find it:

Is it an existing problem that a mobile phone number could be faked? I mean when using internet banking:

The attacker gained the password for the internet banking, but an SMS token is needed to log-in.

Q: Can someone create a "fake mobile number" - for my phone numer - and get the SMS from me?

UPDATE: I'm not asking how to do it, I just want to know that it could be done or not.

4

First of all, what do we need to clone a GSM SIM card? We need to extract the private key, Ki, from the SIM card and then use it to fake/forge a new one with the same number and subscriber ID.

Here's why it's difficult to satisfyingly answer your question: GSM uses a cryptographic suite called COMP128. The biggest problem with COMP128 is that it's a collection of proprietary algorithms; they all are kept a secret. In other words, we cannot really know for sure if they have known vulnerabilities or not as it's difficult to study them. But here's something we know for sure: Because they're kept a secret, it's more likely for them to have vulnerabilities.

The first generation of COMP128 is called COMP128-1, and we know for a fact that it's completely broken. With the technology of 1998 COMP128-1 took little more than 8 hours. Fortunately, pretty much after 2000-2001, many GSM providers started switching from the first generation to the second generation; COMP128-2, which is far better than the old one.

Although a lot better, COMP128-2 inherits some of the old generation's problems, namely a vulnerability that significantly shrinks the key search space making it a bit easier to extract. The 3rd generation of the algorithm is called COMP128-3, which supposed to be highly secure. But, of course, we cannot know for sure how secure it is or which service providers use it.

Bottom line is: Currently, it's safe to say that all GSM providers use at least COMP128-2. There are currently no known feasible attacks to extract the COMP128-2 key and clone the SIM card.

  • 3
    Cloning a SIM card would not create a fake GSM number, though -- it would just hijack an existing one, the one to which the original SIM card is linked to. – Tom Leek Aug 26 '13 at 13:20
  • @TomLeek Which is what the OP is asking for. – Adi Aug 26 '13 at 15:49
4

There are other (easier to exploit) interception points where a third party could pick up a SMS message.

The easiest is probably through a smartphone app; many apps ask for (and get) access to contact lists, SMSes, call logs etc. All it takes is that one game, chat app, social media client installed on your smartphone has a vulnerability that can be misused...

Another option is if your mobile phone operator has an insecure password policy and allow access to traffic logs through the web. One scary example that I came across recently is a large (15M++ subscribers) telco whose web password policy is 4 digits. Nothing more, nothing less, and that gives access to parts of a subscriber number's traffic logs. (Not 100% sure if that includes SMSes, but is plausible).

The same company also gave me a new SIM for my own number in one of their retail outlets without verifying my identity.Telling them that I needed a new microsim for my number was enough...

Finally, employees at your mobile operator of course also have access to traffic logs and can be socially engineered.

6

Yes.Its being done. And unfortunatelly it's a pretty scary answer: All you need it's the phone number . It's the SS7 protocol has been exploited since 2014 and remains vulnerable to this date. https://thehackernews.com/2017/05/ss7-vulnerability-bank-hacking.html

Basically SS7 (Signaling System 7) it's a 70's protocol which lets telcos operate globally. It's used to signal on which cell tower a mobile station (with a given phone number) it's connected.

So , if you are in Hawai and someone from the US calls you, his telco would use SS7 to ask where your number is (even on which specific Cell ID). Then, when it gets all the routing data needed to communicate with Hawai's network, with the basestation you are connected with, it proceds to connect and diverges your traffic there.

But , as it was designed on the 70s, it wasn't done with security in mind. Unfortunately , SS7 doesn't require authentication in any stage of it's communications. Instead, its a trust-based system, telcos relies on each others. In other words, if you access the SS7 network, then you are a trusted source.

So , all your adversary needs is an access to the SS7 network, a Global Title (similar to a IP) with roaming license, which can be bought from a legit source such as a telco (or from a not so legit one from the deepweb).

Then the attacker sends fake SS7 messages to the network, registering your mobile station to it's own controlled basestation. Once he did this, he MiTM you, logging all your traffic and re-sending it afterwards.

Best part of this ? We can do nothing to protect ourselves. The SS7 protocol won't be modified soon , 'cause all the economic impact it would have on the operating networks. It would require that all telcos upgrades at the same time, so communications aren't interrupted.

EDIT : forgot to mention. This could be exploited from any part of the world. No need to be close to the target.

  • Asking because I don't know: while doing this can potentially route the traffic to your basestation, would you actually be able to read the messages? (I.e. one might hope they'd be encrypted so only the correct SIM could decode them). (But I can easily believe this is not the case). – TripeHound May 10 '18 at 15:30
  • This answer is more-correct than the answers by @Adi and KristoferA because it's how adversaries actually pull it off, regularly. gabdev's answer is my favorite because it models reality with regards to the actual risks and threats involved – atdre May 10 '18 at 21:44
  • Thanks @atdre . Still, even though SS7 remains vulnerable, I've no proofs nor I've tested whether or not telcos are doing some active security approaches. For example , physical reliability tests. That is, if my mobile station is registered in USA at 6:00 pm then it doesn't make sense that a telco from China wanted to register it at 6:01 pm. – gabdev May 18 '18 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.