Spy Phone and privacy ! WARNING ! - The Orange Room

Absar Min

After watching it on youtube, I would like to remind you that with spy phone anybody can listen to your conversation thru your cell phone and localize your position even if the cell phone is off. The israeli used this technique to kill with great precision palestinian leaders in the past. It might be for this reason that the Hizb has its own wired communication system. Any comment on this technique: legal or not, how popular it is in Lebanon especially on this election period, ways to prevent it, jokes, etc...

IA64

Can you post some links please ? because I believe it is not as easy as you seem to make it appear ...

IA64

I hope you are not talking about this : YouTube - How to intercept a cellphone? ...

I can guarantee you that you cannot intercept GSM calls unless you have specific equipments that cost around 480,000$ and available to Law Enforcement agencies ONLY.. And it has to work with IMSI, TMSI, IMEI, and MSISDN identificators... also it has to decode LPT, RPE and EFR ( wiki that ... )

A brief explanation on how complicated it is :

when you mobile comes to the the area of an MSC, the mobile calculates the signal response with the A3 algorithm using the given challenge and the Ki (secret key shared between the SIM and the HLR of the subscriber's home network) residing in the SIM. the mbile then sends the signal rsponse to the MSC, which can confirm that the signal response really corresponds to the challenge sent by comparing the signal response from ur mobile and the signal response in the triple from the HLR. thus, ur mobile has authenticated itself to the MSC...

The mobile then generates a session key, Kc, with the A8 algorithm ( key generation algorithm) using the challenge from the MSC and the Ki from the SIM. The BTS, which is used to communicate with the MS, receives the same Kc from the MSC, which has received it in the triple from the HLR...now conversation through the BTS and mobile can be encrypted.
Each frame in conversation is encrypted with a different keystream using the A5 algorithm that is initialized with the Kc and the number of the frame to be encrypted, thus a different keystream for every frame... so you can only decrypt the call if you know the Kc code..

There are different kinds of attacks against the A5 algorithm like bruteforcing and divide-and-conquer.. I will tell you briefly that the time complexity of the attack is 2^54 bits. this requires too much tme in order to be feasible in eavesdropping on GSM calls in real time..
ONLY IF the attacker can access the operator's signaling network, he will be able to listen to everything that is transmitted, including the actual phone call and everything bcz the SS7 signaling network used in the operator's GSM network is completely insecure if the attacker gains direct access to it but only by using the equipments I stated above..

Absar Min

Thanks for the detailed explanation. But here is the link: Tapping your cell phone - WTHR | Indianapolis
You can find it too on youtube:
YouTube - Beware - Illegal software allows anyone to tap your cell phone. Note that it makes a reference to the serious NBC network.
It seems that whatever you explained could be cracked by some kind of software which would not be so expensive :http://www.phone-spy.net/?gclid=CNq0...FQObFQodqSZY9A. Or: Spy Phone mobile surveillance, spyphone, unless these web sites dont really deliver what they advertise or if this is only accessible to people with a much higher budget. I read a while ago maybe in Hamas website that they warn their militants not to keep their cell phones with them even if they are off for fear to be tracked and killed by israelis; effectively this happened to their leader...
N.B.- I did a search on Hoax sites and did not find any reference to spy phone as being another hoax circulating on the web.

IA64

Spy Phone 3.00 is covert surveillance software developed by MediaMax.
Spy Phone allows the user to call the target phone (with the installed software) which will result in the phone answering in ghost mode, i.e. answers at zero ring, without lights, call notifications and log creation. No visual or physical changes can be noticed on the target phone.
Spy Phone 3.00 supports different languages (including English)....

If you know what I mean... You should first install the software on the victime phone.. This is pretty lame huh ? It is like installing a keylogger on your computer and then ask someone to type his password so you could call yourself hacker .. so you MUST HAVE ACCESS TO HIS PHONE, how can you if dont even know where he is? The idea behind eavesdropping is to be able to monitor calls and locate a target. I do not think they will ask Mr.Nasrallah to borrow his device for few minutes and install some tools so they can target him..

nuclearcat

IA64, just good and powerful FPGA array and voila. But it's not cheap to do...

Quote:

In 2008, the group The Hackers Choice launched a project to develop a practical attack on A5/1. The attack requires the construction of a large look-up table of approximately 3 Terabytes. Constructing this table has proved too big a task for anyone to complete it until now, but the group are in the process of building this table and it expected that it will be completed within the year. As of June 2008 it is not reported complete.

Once the table is built, and together with the scanning capabilities developed as part of the sister project, the group expect to be able to record any GSM call or SMS encrypted with A5/1, and within about 3–5 minutes derive the encryption key and hence listen to the call / read the SMS in clear.

IA64

Hey nuclearcat, I read it on wikipedia but as you quoted, still, in the Q2 of 2009, this project is not yet complete and still in the development phase. However, as you know, once the security is broken, a new algorithm ( already developed ) is always on hold to replace its predecessor ( like WPA versus WEP ). I do not know how reliable and fast a new encryption can be implemented but IMO hackers are always behind < what is new >. Their objective is to prove that security can be bypassed and it is time to upgrade.

nuclearcat

IA64 in case of wireless it wasn't easy, and even now still there is a lot of WEP only devices. With case of mobiles it is even much more difficult, because GSM part is implemented in ASIC, not softprocessor, because mobiles have much more strict powersaving and price requirements, and it will be much more difficult to update all devices to new crypto.

IA64

Yeah I had doubts on how reliable upgrading the encryption is. What can I say, I hope they will not make it anytime soon

nuclearcat

Quote:

* A5/0 utilizes no encryption.
* A5/1 is the original A5 algorithm used in Europe.
* A5/2 is a weaker encryption algorithm created for export and used in the United States.
* A5/3 is a strong encryption algorithm created as part of the 3rd Generation Partnership Project (3GPP).

I am feeling it is A5/2 in Leb.
Also http://cryptome.info/a51-crack.htm