Project

General

Profile

Actions

Sniffing » History » Revision 4

« Previous | Revision 4/8 (diff) | Next »
Anonymous, 02/19/2016 10:49 PM


'''The ''burst_ind'' branch ONLY WORKS WITH FTDI OR [wiki:Hardware/CP210xTutorial CP210x] BASED SERIAL CONVERTERS.'''

The OsmocomBB git repository contains a branch called `sylvain/burst_ind`. Using this branch, you can dump the burst sequences from the network by running `layer1.bin` and `ccch_scan`. However, this is only useful if you know what you are doing or if you are sniffing on your own network. See [http://lists.osmocom.org/pipermail/baseband-devel/2010-December/000912.html Sylvains explanations] about his sniffing attack. Also have a look at his and Karsten Nohl's presentation that they held at 27c3 ([http://mirror.fem-net.de/CCC/27C3/mp4-h264-HQ/27c3-4208-en-wideband_gsm_sniffing.mp4 MP4 video]).

In case you want to decrypt your own phone calls without knowing the Kc (which is stored e.g. on the SIM and can be read from there), you need to have Kraken and a guesser (as Sylvain explains in the mail above) that guesses the key stream that you need as input for Kraken. See [http://lists.lists.reflextor.com/pipermail/a51/2010-July/000804.html Sylvain's hints] for known plaintext vulnerabilities in the GSM framework.

'''The ''burst_ind'' branch ONLY WORKS WITH FTDI OR [wiki:Hardware/CP210xTutorial CP210x] BASED SERIAL CONVERTERS.'''

Files (0)

Updated by about 8 years ago · 4 revisions

Add picture from clipboard (Maximum size: 48.8 MB)