Hacker Snoops on GSM Cell Phones in Demo

Despite concerns that federal authorities might fine or arrest him, hacker Chris Paget went ahead with a live demonstration of mobile phone interception at the Defcon hacking conference Saturday.

Using several thousand dollars worth of equipment, Paget was able to intercept mobile-phone data on the GSM (Global System for Mobile Communications) networks used by AT&T and T-Mobile. He did this using a home-made system he calls an IMSI (International Mobile Subscriber Identity) catcher.

Within minutes of activating his IMSI catcher in test mode, Paget had 30 phones connected to the system. Then, with a few keystrokes, he quickly configured the device to spoof an AT&T cell tower.

“As far as your cell phones are concerned I am now indistinguishable from AT&T,” he said. He predicted that every AT&T device in the room would connect to his tower, within the next half hour.

Cell phone interception is illegal in the U.S. And while the U.S. Federal Communications Commission had raised questions about his talk, Paget believes that his demonstration was legal because his device was operating in the 900MHz band used by Ham radio devices. Coincidentally, that 900MHz band is used by GSM devices in Europe “As far as your cell pones are concerned I am a European radio transmitter.”

Not all GSM devices will connect to Paget’s IMSI catcher, however. Quad band phones will connect, but U.S. phones that do not support this 900MHz band will not, he said.

By the end of the demo, Paget actually had fewer phones connected to the network — just 17 — something he was at a loss to explain. He said that it was possible that he had mistyped the AT&T network ID and that phones were rejecting his system because of the typo.

Android and iPhone systems would connect, however, he said. “In my experience it’s generally the iPhones that connect most easily,” he said. “It’s actually been the bane of my existence trying to keep the damned iPhones away.”

People connected to Paget’s system would get a warning message, but they could dial out as normal, but anyone trying to call them would go straight to voicemail.

Paget didn’t record or play back any calls, but he could have. His IMSI catcher can get around cell phone encryption by simply telling the connecting phones to drop encryption. “If I decide not to enable encryption I just disable it,” he said. “It’s that simple.”

Earlier this week, it wasn’t clear that Paget’s talk would go ahead. The U.S. Federal Communications Commission (FCC) got in touch with Paget Friday morning to express concern and inform him of relevant federal regulations, he said.

The agency raised concerns that Paget’s device might transmit over licensed frequencies and that he might unlawfully intercept mobile-phone calls.

On Friday, FCC spokesman Eric Bash said the agency doesn’t comment on the legality of specific matters until it fully investigates and takes enforcement action.

(Nancy Gohring in Seattle contributed to this report.)

Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert’s e-mail address is robert_mcmillan@idg.com