GreedyBTS - Hacking Adventures in GSM

Explore the vulnerabilities of GSM networks in this 59-minute conference talk from the 44CON Information Security Conference. Delve into the reasons why GSM networks remain susceptible to attacks and learn about tools that can compromise phone calls, text messages, and web browsing habits. Discover the GSM architecture, including mobile stations, SIM cards, and network switching subsystems. Examine known weaknesses, radio and cellular technologies, and over-the-air encryption. Gain insights into various GSM analysis tools such as Nokia NetMonitor, GSM Analyzer, and Air Probe. Learn about attack techniques including downgrade and jamming, electromagnetic shielding, and GPRS exploitation. Get hands-on experience with the GreedyBTS tool, exploring its implementation, console operations, and Android phone association. Witness live demonstrations of call recordings and potential security risks, emphasizing the importance of protecting sensitive data transmitted via mobile phones.

Introduction
Overview of GSM
GSM Architecture
Mobile Station
SIM Card
Known Weaknesses
What is a BTS
Radio and Cellular
Physical Layer
Frequency Division Multiple Access
Network Switching Subsystem
Logical Channels
Broadcast Channel
Common Control Channel
Dedicated Control Channel
Overtheair Encryption
General Packet Radio Service
Nokia NetMonitor
GSM Analyst Analyzer
GSM Spectrum Analyzer
GSM Tap
Air Probe
Power Run Process
MD Capture Detection
IMEI
MG attached
Attack
Osmocon BB
Random Access and Paging
Downgrade and Jamming
Electromagnetic shielding
Spectrum analyzer
Implementation
Console
Help Screen
GPRS
Download GreedyBTS
Serial Console
Android Phone
Android Association
Provisioning
Restarting
Call Recordings