Wiretapping and SMS Interception: Theory and Practice

Discussions about wiretapping never seem to end. Indeed, Big Brother is always watching. But aside from government surveillance, there are also malicious actors who want to listen to your calls and read your SMS messages. What tools do they have? What is fact and what is fiction? Let’s break down the modern methods and capabilities based on real facts.

Methods of Traffic Interception

1. Passive MethodThis involves eavesdropping on a mobile phone by intercepting and decoding GSM traffic. Devices for this purpose are freely available online, though prices start at around $50,000. Essentially, such a device is a laptop connected to an antenna. It scans cellular channels nearby and allows you to connect to one of them to intercept information. However, all intercepted data is encrypted. To decrypt it, you need “rainbow tables” and the Kraken tool.

   This interception method is complex, even for experienced specialists, because a single mobile operator uses at least 4-5 ARFCNs (Absolute Radio Frequency Channel Numbers), so you need to connect to each channel and search for information. You can’t find a specific phone number this way, as numbers are stored in the operator’s database. Calls and SMS are addressed using the IMSI (the SIM card’s internal identifier).

   To find a subscriber’s IMSI, you need to perform an HLR (Home Location Register) request to the subscriber’s number: HLR test sms.

2. Active MethodThis method involves actively interfering with the existing GSM network. The main tool is a fake base station, which acts as a bridge between subscribers and the legitimate operator’s base station.

   You can use professional (starting at $120,000), semi-professional (from $5,000), or hobbyist (from $420) equipment. The differences are:

   • Brand (professional gear is aimed at law enforcement and intelligence agencies)
   • Additional features (thermal protection, battery, “wake-on-t” mode, etc.)
   • Number of radio modules—most important, as only professional equipment can work with multiple operators and frequencies simultaneously.

   Encryption, Rainbow Tables, Kraken, and Myths

   Many users confuse active and passive interception methods and believe in the myth of using rainbow tables in active interception. Let’s clarify encryption types:

   • A5/0 — plain text, no encryption
   • A5/1 — stream cipher enabled
   • A5/2 — a weakened version of A5/1
   • A5/3 (Kasumi) — introduced with 3G networks
   • A5/4 — Kasumi modification for LTE networks

   In active interception, the attacker controls the encryption. All A5 cipher models use a key stored both by the operator and on the subscriber’s SIM card. The fake base station tricks the phone into lowering encryption to A5/2, which can be decrypted in real time. At this moment, the attacker extracts the subscriber’s secret key and then restores the connection to the previous encryption level. With the key, the attacker can decrypt all traffic online—no Kraken or rainbow tables needed.

3. Interactive MethodThis method provides full access to SMS, calls, and geolocation of any subscriber anywhere in the world. It exploits vulnerabilities in the SS7 protocol. Access is typically via IP, port, login, and password, but only those with prior experience can use it effectively.
   

   Where to Buy?

   Many look for access on the dark web or “hacker” sites, but most offers are scams. Official or semi-official access can sometimes be obtained from telecom operators or companies specializing in GSM interception, often for government agencies.

   How Much Does It Cost?

   Forget sensationalist articles claiming you can wiretap any phone for $500. In reality, prices range from $10,000 to $30,000 per month, depending on geographic coverage and web interface features.

4. IMSI CatcherIMSI catchers are often confused with fake base stations, but they deserve their own category. An IMSI catcher (e.g., based on RTL-SDR) passively detects all subscribers nearby by their IMSI/TMSI/network name. It’s nearly impossible to detect. While not very useful on its own, it’s invaluable when used with a fake base station, especially for protecting the attacker during interception.
   

   Example 1:

   An attacker waits for a target (e.g., near their home) to intercept calls using a BladeRF. Instead of running the fake base station constantly (which is risky), the attacker first uses an IMSI catcher. When the target appears, the IMSI catcher automatically activates the fake base station, minimizing detection risk.

   Example 2:

   Questions like “Can BladeRF reach 1 km?” are common. The answer: you can, but you’ll get caught. When a fake base station broadcasts a beacon, legitimate operators are alerted to unauthorized activity. To avoid this, you should measure the distance to the nearest real base station and adjust your fake station’s power accordingly—again, using RTL-SDR as an IMSI catcher.

Equipment

1. Motorola cXXXBased on old Motorola phones with the Calypso chipset (e.g., C115/C117/C123/C121/C118/C140/C139/C155/V171), modified by the Osmocom project. Very cheap (about $20), but unstable and with a small range. Good for learning, but for passive interception, you’ll need to solder tiny filters—buy a ready-made kit if possible.

   Capabilities: IMSI catcher, active and passive interception, creating your own cellular network.

   Where to buy: Radio markets, eBay, Taobao.

   Software: Osmocom, TyphonOS

2. HackRFA legendary SDR from Great Scott Gadgets. Somewhat outdated, but still works. Good for beginners. Main drawback: weak signal.

   Capabilities: IMSI catcher, active and passive interception, creating your own cellular network.

   Where to buy: AliExpress (many replicas available).

   Software: OpenBTS 2G/3G

3. BladeRFNext-generation SDR device with flexible settings, high power, and full duplex. Recommended for full base station emulation.

   Capabilities: IMSI catcher, active and passive interception, creating your own cellular network.

   Where to buy: Online stores.

   Software: OpenBTS 2G/3G

4. RTL-SDRA cheap TV tuner that doubles as an SDR. Essential for anyone building a base station. Mainly used to measure distance to real base stations and adjust fake station power. Also great as an IMSI catcher.

   Capabilities: IMSI catcher, passive interception.

   Where to buy: AliExpress.

   Software: IMSI-Catcher

Ready-to-Use Operating System Builds

• GNU-Radio: Pre-built with many SDR components. Supports RTL-SDR/BladeRF/HackRF.
  • GNU-Radio LiveCD 14
  • GNU-Radio LiveCD 16
• RTL-SDR/HackRF: Pre-installed software for IMSI catching and HackRF use.
• BladeRF Pentoo: Build for BladeRF.
• Osmocom, TyphonOS

Terminology

Below is a glossary of common terms and abbreviations used in GSM and mobile network interception:

• • 2G: Second generation GSM standard
  • 3G: Third generation GSM standard
  • ARFCN: Absolute Radio Frequency Channel Number
  • IMSI: International Mobile Subscriber Identity
  • IMEI: International Mobile Equipment Identity
  • SS7: Signaling System No. 7
  • HLR: Home Location Register
  • BTS: Base Transceiver Station
  • SDR: Software Defined Radio
  • GSM: Global System for Mobile Communications
  • SIM: Subscriber Identity Module
  • SMS: Short Message Service
  • OpenBTS: Open-source software for GSM base stations

Author: Marat_1162