Since listening to a few Defcon talks on SIM cards and, more recently, the NSA Playset, I've become interested in GSM. This page gives a fairly good tutorial on getting Kraken set up, but apparently for a known-plaintext attack, I need to know the plaintext. The aforementioned tutorial isn't very helpful with this, only saying:
Note: this step [known-plaintext attack with Kraken] is not as easy as it sounds. Usually capture some calls of your own phone where you know the Kc (it can be read from the SIM or displayed by the Engineering Mode Screen of some phones) and look for known-plain-text candidates. An example are "SYSTEM INFORMATION 5/6/5ter" in the SACCH or "LAPDM U, func=UI" frames. Also keep in mind that there could be wrong bits in a burst due to distortion.
I'm more than happy to do this, as I believe in learning through experimentation (and like playing in traffic), but I'm having trouble finding Kc. I don't have the hardware to read my SIM card while it's connected to my phone (which I think I would need to do, or there wouldn't be any open sessions to have keys for). That leaves this "Engineering Mode Screen." I found several Android apps which say they open Engineering Mode, all of which open a screen entitled "Testing." This gives a great deal of information, but I don't see Kc (or anything that looks like it). Does anyone know how I can find my session key (preferably without buying anything)? Thanks!
