My question is about the encryption between me and my mobile operator. My mobile operator uses A5/1. I use Samsung. Sometimes I see the symbol G on my phone which means GPRS. I don't know whether it means that it uses a secure connection or not (for voice calls).
Note: I know that government can go to the mobile operator and ask them to record my mobile calls but the question is about unauthorized spying.
Yes if an attacker can create a fake basestation then they can effectively emulate the phone network and intercept calls which are made via that basestation. This is obviously a relatively local attack (e.g. you need to be close enough to the fake basestation for it to be the strongest signal available)
Some time ago the costs of doing this were pretty high, which precludes low-end attackers from doing it, however more recently there has been some research on using femtocells like the Vodafone suresignal to provide cheap interception of voice calls (more information on one project here
There is indeed a man-in-the-middle attack but, for A5/1, it is unnecessary.
The classic attack against such a weak cipher is passive eavesdropping. This has a much lower probability of detection and is highly effective. The traffic can be recovered using a rainbow table to recover the A5/1 cipher's internal state. It's not the same as recovering the encryption key but it has exactly the same effect - the voice traffic can be decrypted.
Two separate sets of rainbow tables are widely available. The Berlin Set is the oldest and best-known, works with the deka software, and covers only around 20% of the keyspace (so for 4/5 of voice calls the cipher state cannot be recovered). The Infocon set is newer and I've not tried it yet but you can find it here.
Yes, but you have to be within 10 feet of the caller and you need to have an antenna and a bluetooth interpreter.
