0

I heard that there are inherent flaws in the GSM protocol that make it possible for someone to impersonate a network operator and do all sorts of nasty things remotely, even if your phone is off.

Is this true? Is it also true of today's Android phones?

3

It depends on your carrier's technology. According to Wikipedia all the encryption used in GSM (A5/1, A5/2 and A5/3) have been cracked (albeit some are more difficult to decrypt than others). A5/2, the least secure of these, is no longer in any GSM-related standards (and newer phones shouldn't implement it). A5/3 has not been decrypted in 3G, but people have cracked it.

GPRS and EDGE (GSM's data protocols) - the "G" or "E" above your network signal status icon - may also be vulnerable. It depends on your carrier's encryption level. Some carriers don't encrypt GPRS data at all. Others will use the GEA/1 or GEA/2 - which both have a publicly available tool called "gprsdecode" available to crack them. GEA/3 is "relatively hard to break", but the recommendation is to upgrade to GEA/4, which uses 128-bit encryption. UMTS (aka 3G) is more secure, meaning that your data is safely encrypted.

To be certain that you're actually using your carriers network, your carrier needs to have implemented USIM, and your phone needs to support it - which is guaranteed if your carrier supports UMTS and your phone supports 3G. However, to get these additional security features you need to use UMTS - which means your phone can't be on "prefer 2G networks" mode, and your phone can't connect to 2G networks.

Now, as for "doing nasty things while your phone is off" - I really don't think this is possible, but perhaps you can clarify what these "nasty things" are? And also perhaps where you've read about this.

TL;DR depends on your carrier and if you use 2G networks or 3G networks.

  • By "nasty things" I mean using the phone's microphone to listen to its surroundings (without being in a call). It's a rumor I heard recently, but from people I can't discount easily. – Eyal Jul 20 '14 at 11:33
  • 1
    I can't say for sure (but it seems very unlikely to me that there would be microphone listening), but if you use a custom ROM/AOSP ROM such as CyanogenMod in which the code is open there's no way android itself could be doing any spying (low-level phone firmware is another matter, and it's pretty hard to know if it's doing anything because it's all closed-source.) – keepcalm Jul 22 '14 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.