1Mobile Phone CommunicationHoang VoBilly NgoWireless Network•Analog Network•Advance Mobile Phone System (AMPS)•Nordic Mobile Telephone (NMT)•Total Access Communication System (TACS).•Digital Network•GSM•3GPPP Protocol2Analog Authentication•MIN/ESN Protocol•MIN: Mobile Identify Number, 10 digits•ESN: Electronic Serial Number, 32 bits•Clear transmission•Attack•Simple police frequency scanner.•Prone to eavesdropping•CloningCellular Phone Cloning• The “cloning” of a cellular telephone occurs when theaccount number of a victim telephone user is stolen andreprogrammed into another cellular telephone.• Each cellular phone has a unique pair of identifyingnumbers: the electronic serial number (“ESN”) and themobile identification number (“MIN”).• The ESN/MIN pair can be cloned in a number of wayswithout the knowledge of the carrier or subscriber throughthe use of electronic scanning devices.3Cellular Phone Cloning Cont.• After the ESN/MIN pair is captured, the clonerreprograms or alters the microchip of any wirelessphone to create a clone of the wireless phone fromwhich the ESN/MIN pair was stolen.• The entire programming process takes ten-15minutes per phone.• After this process is completed, both• phones (the legitimate and the clone) are billed tothe original, legitimate account.Analog (cont.)• Counter Measures•Duplicate Detection•Velocity trap•RF fingerprinting•Usage profiling•Call counting•Pin code4Eavesdropping• Eavesdropping means to overhear, record,amplify or transmit any part of the privatediscourse of others without the permissionof all persons engaged in the discourse.• Use of cellular phone ESN readers or policescanners can be used for eavesdropping oncell phone conversations.GSM Authentication•Encryption algorithms:•A3 - Authentication algorithm.•A5 - Encryption and Decryption•A8 - Key generator•Currently COMP 128 algorithm is used as theA3/A8 implementation in most GSM network5MOBILERADIO INTERFACE FIXED NETWORKChallenge RResponse SRESA3KiA3KiA5 A5ENCRYPTED DATAA8KcA8KcKeySIM?GSM authentication•A3 Ki (128), Rand (128)A3SRES(32bit)•A8A8Kc(64-bit)Ki (128), Rand (128)6GSM (cont.)•Comp 128Comp 128Ki (128), Rand (128)128bit ouptputSRES 32bitand Kc 54 bitGSM(cont..)•A5A5Kc(64bit), Frame Number(22bit)114 keystream7GSM(cont.)•A5(cont.)•consist of three LSFRs of length 19, 22, and 23, which areclocked based on the middle bits of the register•Output of Three LSFRs are XOR• Attacks on A5•Brute-Force - time complexity 2^64•Divide and conquer attack- reduce the complexity to 2^45Cell Phone Tracking• Every cellular telephone is a physical locatingdevice!• This is generally true even when the user is not ina call. The phone need merely be switched on.• Location tracking is inherent in the way cellulartelephones work. The network needs to know(approximately) where you are in order to do itsjob.• There is no known way to avoid revealing yourlocation when you use a cell phone.83GPP (3rd Generation Partnership Project)• In the last few years, GSM took a lot of flak fortheir approach to crypto algorithm design, whichrelied on keeping the algorithms secret.• 3GPP has chosen a superior approach to theircrypto requirements.• They are making open to the public all of theirdrafts, standards and recommendations, and relyon their algorithms withstanding the scrutiny ofany interested
View Full Document
Unlocking...