Emergency Services At Risk From Soft Radio Hacking

“Even five or six years ago, it would have cost several thousand pounds for the kit to do this type of thing,”  Jones said. “Now you can purchase a fake mobile base station for approximately £800 and most of the software is off-the-shelf.”

“Like all things to do with hacking, it is becoming cheaper and easier,” said Jones. “Mobile phone hacking is so new that many people would not be aware it has happened to them,” he added. “Of course, that has now changed in the last few months [with the News of the World allegations].

Over the air

“Computer hackers have a good and well-understood capability to manipulate communications travelling ‘over-the-wire’ as there are many tools for capturing and manipulating wired communications, network sniffers being the most obvious,” Jones said. “The SDR now means these same people can apply that capability and their knowledge to attack over-the-air communications to compromise radio systems and radio standards.

“Given our ever-growing dependency on wireless networks, it’s extremely likely that criminal gangs, hacktivists and others will all show a growing interest in this technology,” Jones warned. “And we’re not just talking about the hacking of individual mobile phones here, but the possible compromise of critical infrastructure. Our transport networks commonly use wireless communications and may be vulnerable to attack. Wireless hacks will no longer be isolated incidents but well-orchestrated campaigns and SDR is likely to become the hacker’s weapon of choice.”

“If one were to consider the implications of a co-ordinated attack against a critical communications system over, say, London, even if the attack were restricted simply to signal jamming, the potential is there to cause massive disruption,” Jones said.

There has long been concern about security risks of critical infrastructure, especially those using SCADA systems. These concerns also apply to mobile phones. Last October, for example, it was revealed that the London Metropolitan Police Service (MPS) had acquired surveillance technology that can that can masquerade as a mobile phone cell tower, allowing the police to intercept mobile calls.

It is also known that GSM phone calls are vulnerable to hacking. In December, 2010, security researchers showed how they could eavesdrop on any calls and text messages made on a GSM network. Prior to that they had cracked and published the encryption code, but the Global System for Mobile Communications Association (GSMA) downplayed any concerns over the security of mobile phone calls.

But in January, 2010, the researchers also cracked the 768-bit RSA encryption used for protecting sensitive data in transit. In August, 2010, fresh concerns were raised after security specialists uncovered a flaw that could turn the mobile phone into a listening device that could effectively turn the device into a bug and allow them to listen in on any conversation.