——-000 Frequency capability Band number 0
——1—- SM capability present
-000—— Spare
0———- Extension
Cell Identifier
00000101 IE Name Cell identifier
00000101 IE Length 5
00000001 Cell ID discriminator LAC/CI used to ident cell
******** LAC 4611
******** CI 3000
PRIority
00000110 IE Name Priority
00000001 IE Length 1
———-0 Preemption allowed ind not allowed
———0- Queueing allowed ind not allowed
—0011— Priority level 3
00——— Spare
Circuit Identity Code
00000001 IE Name Circuit identity code
00000000 PCM Multiplex a-h 0
—-11110 Timeslot in use 30
101——- PCM Multiplex i-k 5
Downlink DTX flag
00011001 IE Name Downlink DTX flag
———-1 DTX in downlink direction disabled
0000000- Spare
Cell Identifier
00000101 IE Name Cell identifier
00000101 IE Length 5
00000001 Cell ID discriminator LAC/CI used to ident cell
******** LAC 4868
******** CI 3200
The beauty of a digital mobile phone, as opposed to the analogue mobile phones still used by some people in Australia, is that a conversation is reasonably secure from eavesdroppers. If I call you on my digital mobile, our conversation will be encrypted with the A5 encryption algorithm between the mobile phone and the exchange. The carrier has copies of the Kis and, in some countries, the government can access these copies. They are, however, closely guarded secrets.
SKiMo had access to the database of the encrypted Kis and access to some of the unencrypted Kis themselves. At the time, he never went to the trouble of gathering enough information about the A3 and A8 algorithms to decrypt the full database, though it would have been easy to do so. However, he has now obtained that information.
To SKiMo, access to the keys generated for each of thousands of German mobile phone conversations was simply a curiosity—and a trophy. He didn't have the expensive equipment required to eavesdrop. To an intelligence agency, however, access could be very valuable, particularly if some of those phones belonged to people such as politicians. Even more valuable would be ongoing access to the OMC, or better still, the MSC. SkiMo said he would not provide this to any intelligence agency.
While inside DeTeMobil, SKiMo also learned how to interpret some of the mapping and signal-strength data. The result? If one of the company's customers has his mobile turned on, SKiMo says he can pinpoint the customer's geographic location to within one kilometre. The customer doesn't even have to be talking on the mobile. All he has to do is have the phone turned on, waiting to receive calls.
SKiMo tracked one customer for an afternoon, as the man travelled across Germany, then called the customer up. It turned out they spoke the same European language.
`Why are you driving from Hamburg to Bremen with your phone on stand-by mode?' SKiMo asked.
The customer freaked out. How did this stranger at the end of the phone know where he had been travelling?
SKiMo said he was from Greenpeace. `Don't drive around so much. It creates pollution,' he told the bewildered mobile customer. Then he told the customer about the importance of conserving energy and how prolonged used of mobile phones affected certain parts of one's brain.
Originally, SKiMo broke into the mobile phone carriers' network because he wanted `to go completely cellular'—a transition which he hoped would make him both mobile and much harder to trace. Being able to eavesdrop on other people's calls— including those of the police—was going to be a bonus.
However, as he pursued this project, he discovered that the code from a mobile phone manufacturer which he needed to study was `a multi-lingual project'. `I don't know whether you have ever seen a multi-lingual project,' SKiMo says, `where nobody defines a common language that all programmers must use for their comments and function names? They look horrible. They are no fun to read.' Part of this one was in Finnish.
SKiMo says he has hacked a number of major vendors and, in several cases, has had access to their products' source codes.
Has he had the access to install backdoors in primary source code for major vendors? Yes. Has he done it? He says no. On other hand, I asked him who he would tell if he did do it. `No-one,' he said, `because there is more risk if two people know than if one does.'
SKiMo is mostly a loner these days. He shares a limited amount of information about hacking exploits with two people, but the conversations are usually carefully worded or vague. He substitutes a different vendor's names for the real one, or he discusses technical computer security issues in an in-depth but theoretical manner, so he doesn't have to name any particular system.
He doesn't talk about anything to do with hacking on the telephone. Mostly, when he manages to capture a particularly juicy prize, he keeps news of his latest conquest to himself.
It wasn't always that way. `When I started hacking and phreaking, I had the need to learn very much and to establish contacts which I could ask for certain things—such as technical advice,' SKiMo said. `Now I find it much easier to get that info myself than asking anyone for it. I look at the source code, then experiment and discover new bugs myself.'
Asked if the ever-increasing complexity of computer technology hasn't forced hackers to work in groups of specialists instead of going solo, he said in some cases yes, but in most cases, no. `That is only true for people who don't want to learn everything.'
SKiMo can't see himself giving up hacking any time in the near future.
Who is on the other side these days?
