wiki:Sniffing

The burst_ind branch ONLY WORKS WITH FTDI OR CP210x BASED SERIAL CONVERTERS.

The OsmocomBB git repository contains a branch called sylvain/burst_ind. Using this branch, you can dump the burst sequences from the network by running layer1.bin and ccch_scan. However, this is only useful if you know what you are doing or if you are sniffing on your own network. See Sylvains explanations about his sniffing attack. Also have a look at his and Karsten Nohl's presentation that they held at 27c3 (MP4 video).

In case you want to decrypt your own phone calls without knowing the Kc (which is stored e.g. on the SIM and can be read from there), you need to have Kraken and a guesser (as Sylvain explains in the mail above) that guesses the key stream that you need as input for Kraken. See Sylvain's hints for known plaintext vulnerabilities in the GSM framework.

The burst_ind branch ONLY WORKS WITH FTDI OR CP210x BASED SERIAL CONVERTERS.

Last modified 3 years ago Last modified on May 19, 2012, 4:09:08 PM