Privacy concerns at Defcon
July 22nd, 2010 by Chris in UncategorizedI’m planning to give a pretty spectacular demonstration of cellphone insecurity at Defcon, where I will intercept the cellular phone calls of the audience without any action required on their part. As you can imagine, intercepting cellphone calls is a Very Big Deal so I wanted to announce at least some of the plan to reassure everyone of their privacy.
First and foremost – I’m not just making this stuff up. I know when to get advice from a good lawyer, and in this case I’m taking the advice of the very best there is: the EFF. They’ve been kind enough to offer their help and I’m taking it – this is what we’ve worked out.
1. If you’re in an area where your cellphone calls might be intercepted, there will be prominent warning signs about the demo including the time and date as well as a URL for more info. This will be the only time when unknown handsets will be allowed to connect; at all other times only pre-registered handsets will be granted access. You will be clearly warned that by using your cellphone during the demo you are consenting to the interception, and that you should turn your cellphone off during that time if you do not consent. A recorded message with essentially the same info will also be played whenever a call is made from the demo network.
2. The demo itself will be performed from a machine with no hard drive, only a USB key for local storage. At the end of the demo this USB key (including all logs, recordings, and other data) will be handed over to the EFF for destruction. No logs, recordings or other data will be exported from the machine except as necessary to connect calls during operation.
3. Transmit power will be kept to a maximum of 250mW (for comparison, a handset is typically 2W) and will comply with all relevant FCC regulations to operate in the band.
4. At all times, for all connected handsets, a best-effort will be made to connect calls successfully to their destination. It is unlikely that any 911 service can be provided, however a best effort will be made to connect any emergency calls to a suitable local destination.
Also, to be clear, my demonstration should not affect handsets on Verizon or Sprint in any way. The technology I’m working with is GSM and these are not GSM networks; if your handset is not capable of GSM (it must have a SIM card) then it will not possible for your calls to be intercepted by my equipment. That said, I invite all of my attendees to bring a GSM cellphone with them and participate – the more the merrier!
Share this:
Leave a Reply
You must be logged in to post a comment.
Tuesday, July 27, 2010
GSM Cell Phone Interception and Privacy concerns at Defcon
via tombom.co.uk
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment