Sniffing » History » Version 8
fixeria, 01/21/2019 04:26 AM
| 1 | 8 | fixeria | h1. Sniffing notes |
|---|---|---|---|
| 2 | 2 | laforge | |
| 3 | 8 | fixeria | The [[OsmocomBB]] git repository contains a branch called @sylvain/burst_ind@. Using this branch, you can dump the burst sequences from the network by running @layer1.bin@ and @ccch_scan@. However, this is only useful if you know what you are doing or if you are sniffing on your own network. See "Sylvains explanations":http://lists.osmocom.org/pipermail/baseband-devel/2010-December/001076.html about his sniffing attack. Also have a look at his and Karsten Nohl's presentation that they held at 27c3 (https://media.ccc.de/v/27c3-4208-en-wideband_gsm_sniffing). |
| 4 | 6 | msuraev | |
| 5 | 8 | fixeria | In case you want to decrypt your own phone calls without knowing the Kc (which is stored e.g. on the SIM and can be read from there), you need to have Kraken and a guesser (as Sylvain explains in the mail above) that guesses the key stream that you need as input for Kraken. See "Sylvain's hints":https://web.archive.org/web/20141227202731/https://lists.srlabs.de/pipermail/a51/2010-July/000804.html for known plaintext vulnerabilities in the GSM framework. |
| 6 | 6 | msuraev | |
| 7 | 8 | fixeria | *The _burst_ind_ branch ONLY WORKS WITH FTDI (FT232) OR [[HardwareCP210xTutorial|CP210x]] BASED SERIAL CONVERTERS* |
