On Sat, 2010-07-31 at 15:09 +0300, sakin wrote: > Just a few questions for plaintext: > > Assume that, the attacker has enough time to find Kc in the initial attempt. > > 1) The attacker sends a known SMS content to the target phone like "big > discount for you", which will be the plaintext. Also sender phone number and > SMS-C center are candidates for plaintext. Can we find Kc from this > plaintext? The attacker has hours for resolve. > 2) When the attacker resolves Kc of this known SMS, the hacker decode > "Cipher Complete Message" which contains IMEISV.
Some SMS messages like voice mail status notification can have a "discard" bit set. These are interesting in such a scenario, since the target will be totally unaware of these messages. http://mobiletidings.com/2009/07/08/voicemail-waiting-indication-sms/ Moreover, SMSCs aren't always set up to filter such messages with a spurious origin. Sending a few such messages yields a lot of known plaintext and can possibly also be used to reveal the TMSI of a target. The only unknown plaintext will be the SMSC timestamp, which can be guessed. However since there already is a constant stream of SI5/SI6 etc there shouldn't be a need for going down this route.... Frank _______________________________________________ A51 mailing list [email protected] http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
