Cheap GSM Eavesdropping a Reality 75
Techmeology writes "GSM eavesdropping has been demonstrated at the Chaos Computer Club Congress in Berlin using a €10 Motorola phone and open source GSM firmware. Karsten Nohl and Sylvain Munaut replaced the firmware on the phone, enabling them to process all the data it received. They used already available rainbow tables to decrypt data being sent to and from other mobile phones. They have no plans to release the hack publicly, however they expect others to successfully attempt the hack. Mr. Nohl said the objective was to raise awareness of GSM's insecurity."
Until phones have real crypto (Score:4, Insightful)
Until phones use proper PK crypto with a proper certificate authority, key revocation, etc. under the user's control, you can safely assume your phone calls are trivially snooped over the air. That's just a great big "duh". Not at all surprising that it can be done cheaply. What's surprising is that it took so long.
Re:I don't care... (Score:4, Insightful)
Re:I don't care... (Score:4, Insightful)
"The government will typically need a warrant ..."
Boy you're so wrong. They just need a National Security Letter.
http://www.wired.com/threatlevel/tag/national-security-letter/ [wired.com]
Re:I don't care... (Score:5, Insightful)
Actually, they just need to promise to deliver one in a week...
Third bullet from the bottom. [wikipedia.org]
In this day and age of fear, a kid with an undetonated firecracker, a chip on his shoulder and a lighter could easily be labeled a 'terrorist threat'. Which any lawyer worth his/her salt, or golfs with the judge, could qualify as an 'emergency'. Getting around to sending the letter ex post facto? I'm sure it will be a top priority for the listeners already listening.
Re:I don't care... (Score:2, Insightful)
Remember the retroactive telecom immunity bill passed in 2008? Before that, the rules where that if, say AT&T, reasonably tried to obey the law (it didn't matter whether they actually did or not, they just had to try, and act in good faith) then they would be free of liability. This wasn't good enough so we needed FISA amended.
Meeting requirements is too onerous? No, even trying to meet requirements is too onerous. Wanting to meet the requirements is too onerous. Having a vague intent to possibly try to be legal if it happens to be convenient, is too onerous. Asking them to not go out of their way to harm the public, is an insult to them.
And we still vote for the people who changed that law. That's how low we've sunk. That's how important privacy is, and how much we believe in the spirit of the 4th amendment.