Sneak Preview – your cellphone can be tapped
You probably have a cellphone. Your company might even provide an additional one. Your boss most certainly uses a cellphone. What do you use it for? Do you share details about your private life via phone conversations? Did you ever talk to a business partner about confidential offers? Do you rely on cellphone when it comes to important messages? If so you might be interested in hearing some news about the state of security of mobile networks. Most of them are broken, outdated or both when it comes to security. Details of the security issues have been presented at DeepSec 2009 by Karsten Nohl.
During Defcon18 in Las Vegas a security researcher successfully faked several attendees’ cell phones into connecting to his phony GSM base station during a live demonstration that had initially raised concerns at the Federal Communications Commission (FCC). Basically this means that cellphone users expecting a moderate or high grade of security from the network have a big problem. In its current state these networks do not provide sufficient protection. All companies being at risk from industrial espionage should be careful and reflect this reality in their security policies and implementations of secure messaging. If you want to know more we’d like to invite you to join the GSM security workshop at DeepSec 2010.
Recent years saw a significant increase of research in GSM attacks: The weaknesses of A5/1 encryption have been shown practical, rainbow tables were distributed widely on the internet, and open-source baseband software is being developed. This software allows for fine-grained control over all information sent to the GSM infrastructure, enabling protocol fuzzing and flooding.
Despite the availability of attack methods, the tools are often hard to use for pen-testers due to their limited documentation. The published attacks are often difficult to reimplement when assessing the vulnerability of GSM networks.
This two-day workshop will re-visit GSM’s security features and their publicly known weaknesses. It will then introduce and demonstrate the various publicly available attack tools.
After extensive hands-on sessions performing the various attacks, counter-measures will be presented, followed by a discussion of the current best practices for securing GSM networks. The target audience of this workshop are GSM network operators and IT security professionals.
Given the circumstances you might not want to give us a call and use the SSL/TLS-based registration form instead.