Phone Hacking Protection
While the activities of some of the UK Press have focused attention on the security weaknesses of mobile phones, the reality is that most of the phone hacking reported to date has been confined to voice mail hacking. If a hacker successfully attacks your voice mail, all of the messages in your mailbox are compromised.
While this is a significant problem, a much more serious issue is the threat of call interception and monitoring. When one or the many techniques for GSM call interception was demonstrated to Chris Bryant, a British MP active in the debate on phone hacking, he made the following statement in Parliament:
Chris Bryant (Rhondda) (Lab): Yesterday afternoon we heard that the man who is in charge of counter-terrorism in the Metropolitan police is 99% certain that his phone was hacked. An hour later, I was shown a piece of kit that costs about £1,500 and is readily available on the internet. It effectively sets up an illegal mobile phone mast through which it is possible to listen to any conversation held by anyone on a mobile phone within three miles.
Solutions
Phone Hacking Protection
Hacking techniques
There are a number of available techniques for monitoring GSM calls, details of most are available on the Internet. These include:
Setting up a fake base station. This was the tehnique demonstrated to Chris Bryant. A video showing a demonstration of this technique was produced at a security conference.
Attacking weaknesses in the GSM standard University of Virginia researcher, Karsten Nohl has published details of a technique to monitor GSM signals and then decrypt those signals. He later demonstrated this technique to a BBC journalist.
Exploiting Femtocell Vulnerabilities A technique for turing a commercially available Femtocell into call monitor has been published. While Vodafone, who supply this femto cell claim to have fixed the problem, the authors of the report claim that the fix does not address the core issue.
Building a mobile interceptor A report in Forbes magazine shows how by combining a number publically available technologies, a DIY digital spy drone can be built.
Solving the problem
Cell phones and other mobile devices are essential busines tools, but mobile networks cannot guarentee the privacy and integrity of calls. The only way to address the problem is to ensure that sensitive calls are encrypted.
VoIP technology provides a simple way to achieve this. All that is needed is a suitable VoIP app on your phone, and a UM Labs SIP Security Controller in your office. You can then make encrypted calls over the mobile data channel, and gain the addiitonal benefit of reducing call and roaming charges. For more details download our white paper on combatting phone hacking.