Solutions to the GSM Security Weaknesses †

Mohsen Toorani ‡ A. Beheshti

Abstract systems. This paper is organized as follows. Section 2

briefly introduces the security attributes of the GSM.
Recently, the mobile industry has experienced an Section 3 challenges the GSM security. The security of
extreme increment in number of its users. The GSM GSM transport channels is briefly described in section
network with the greatest worldwide number of users 4. Section 5 provides some practical solutions to
succumbs to several security vulnerabilities. Although improve the security of GSM, and section 6 gives the
some of its security problems are addressed in its conclusions.
upper generations, there are still many operators
using 2G systems. This paper briefly presents the most
important security flaws of the GSM network and its
transport channels. It also provides some practical
solutions to improve the security of currently available
2G systems.

1. Introduction
The Mobile communications has experienced a great
acceptance among the human societies. It has
influenced and revolutionized different aspects of the
human life. With a mobile handset, anyone can be
accessed anywhere. At the beginning of 2007, the
worldwide number of mobile users reached to 2.83
billion people where 2.28 billion users out of them (i.e.
80.5%) were using the Global Service for Mobile Figure 1. GSM Architecture
communications (GSM) [1]. The GSM system and its
building blocks are depicted in Figure 1. The GSM has
experienced gradual improvements that leaded to
2. Security Architecture of the GSM
several versions such as GSM1800, HSCSD (High The security architecture of GSM was originally
Speed Circuit Switched Data), EDGE (Enhanced Data intended to provide security services such as
rates for GSM Evolution), and GPRS (General Packet anonymity, authentication, and confidentiality of user
Radio Service). The GSM improvements are continued data and signaling information [5]. The security goals
to 3G systems such as UMTS. It is believed that the of GSM are as follows:
GSM has many inherent security flaws and some of its  Authentication of mobile users for the network,
security flaws are addressed in the upper generations
 Confidentiality of user data and signaling
such as UMTS. However, many operators especially in
information,
the developing countries are still using the traditional
 Anonymity of subscriber's identity,
GSM network that succumbs to several security flaws.
 Using SIM (Subscriber Identity Module) as a
Although the GSM security is considered in some
security module.
literatures [2-4], they did not present a complete
security evaluation or even propose solutions. This
The Mobile Station (MS) consists of the Mobile
paper provides a brief and complete review of the
Equipment (ME), and the SIM card. The SIM is a
GSM security flaws, and some applicable solutions to
cryptographic smart card with the GSM specific
improve the security of currently available GSM
applications loaded onto it. As a smart card, it has

†
Copyright © 2008 IEEE. Reprinted from the Proceedings of the 2nd International Conference on Next Generation Mobile Applications,
Services, and Technologies (NGMAST'08), pp.576-581, University of Glamorgan, Cardiff, UK, Sep. 2008 [DOI 10.1109/NGMAST.2008.88].
This material is posted here with permission of the IEEE. Internal or personal use of this material is permitted. However, permission to
reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution must be
obtained from the IEEE by writing to [email protected].
‡
Corresponding Author, ResearcherID: A-9528-2009.
some inherent security functions specified to smart algorithms is controlled by the GSM Memorandum of
cards [6]. Its operating system and chip hardware have Understanding (MoU). A5/3 is a block cipher based on
several security attributes. SIM includes all the the Kasumi algorithm that is defined by the 3GPP at
necessary information to access the subscriber's 2002 and can be supported on dual-mode phones that
account. IMSI and Ki are stored on every SIM. IMSI is are capable of working on both 2G and 3G systems.
the International Mobile Subscriber Identity with at The GSM authentication, session key generation, and
most 15 digits uniquely devoted to every mobile encryption processes are depicted in Figure 2.
subscriber in the world. Ki (Individual subscriber
authentication Key) is a random 128-bits number that
is the root cryptographic key used for generating
session keys, and authenticating the mobile users to the
network. Ki is strictly protected and is stored on the
subscriber's SIM, and AuC. The SIM is itself protected
by an optional Personal Identification Number (PIN).
Each user is requested to enter the PIN unless this
feature is deactivated by the user. After a number of
invalid attempts that is usually 3 times, the SIM locks
Figure 2. GSM Authentication, Session key
out the PIN, and the PUK (PIN UnlocK) is then
generation, and Ciphering
requested. If the PUK is also incorrectly entered for a
number of times that is usually 10 times, the SIM
refuses local accesses to its privileged information and The anonymity in the GSM is provided by replacing
authentication functions, and makes itself useless. the use of IMSI with a 32-bit Temporarily Mobile
Authentication and confidentiality of user data are Subscriber Identity (TMSI). TMSI is typically handled
in deposit of the secrecy of IMSI and Ki. With by the VLR, is valid in a particular Location Area
disclosure of such numbers, anyone can impersonate a (LA), and will be updated at least in every location
legitimate user. A3 and A8 algorithms are also update procedure. It is also stored on the subscriber's
implemented on every SIM. This means that each SIM and prevents an eavesdropper to track a particular
operator can determine and change such algorithms subscriber.
independent of other operators and hardware
manufacturers. Therefore, the authentication will work 3. Challenges to the GSM Security
when a user is roaming on other countries or operators
since the local network will query the HLR of the The openness of wireless communications makes the
home network for the results and does not need to communicating parties more vulnerable to the security
know the A3/A8 algorithm of the home network. A3 is threats. Although GSM tried to harden the interception
mainly used for authenticating users to the network by using several techniques such as frequency
while A8 is used for generating the session key of hopping, the real-time interception of the exchanged
encryption Kc. The network sends a random challenge information is completely practical [7]. Currently,
to the user so that SIM produces Kc and SRES. After there are commercial equipments capable of
user authentication, the network can order the phone to simultaneously intercepting several collocated
start the encryption by using the generated session key subscribers [8]. While GSM was intended to be a
Kc. secure wireless system and considered the user
The cryptographic algorithms are implemented on authentication and over-the-air encryption, it is
the hardware of mobile phones. The network can completely vulnerable to several attacks, each of them
choose from up to 7 different encryption algorithms (or aiming a part of network. Hereunder, the most
the mode of no ciphering) but it should choose an important security flaws of the GSM are briefly listed.
algorithm that is implemented on the phones. A class- Several practical scenarios can also be deployed to
mark message has been earlier specified the phone's misuse such vulnerabilities that are neglected for the
capabilities to the network. Three algorithms are case of brevity.
generally available: A5/1, A5/2, and A5/3. A5/1 and 1) Unilateral authentication and vulnerability to the
A5/2 are two stream ciphers originally defined by the man-in-the-middle attack: This is the network that
GSM standards. A5/1 is stronger but it is subject to authenticates users. The user does not authenticate
export control and can be used by those countries that network so the attacker can use a false BTS with the
are members of CEPT. A5/2 is deliberately weakened same mobile network code as the subscriber's
to be deployed by the other countries. The use of such
legitimate network to impersonate himself and perform target user without any physical access to the SIM.
a man-in-the-middle attack. The attacker can then This can be accomplished by sending several
perform several scenarios to modify or fabricate the challenges over the air to the SIM and analyzing the
exchanged data. At the designing phase of the GSM responses. However, this approach may take several
protocols, this kind of attack seemed impractical due to hours. The attacker can also extract IMSI using an
costly required equipments. Currently, this kind of approach that will be explained later. After finding Ki
attack is completely applicable due to the decreased and IMSI of the target subscriber, the attacker can
costs. clone the SIM and make and receive calls and other
2) Flaws in implementation of A3/A8 algorithms: services such as SMS in the name of the victim
Although the GSM architecture allows operator to subscriber. However, the attacker will encounter with a
choose any algorithm for A3 and A8, many operators slight problem. The GSM network allows only one
used COMP128 (or COMP128-1) that was secretly SIM to access to the network at any given time so if
developed by the GSM association. The structure of the attacker and the victim subscriber try to access
COMP128 was finally discovered by reverse from different locations, the network will realize
engineering and some revealed documentations, and existence of duplicated cards and disables the affected
many security flaws were subsequently discovered. In account.
addition to the fact that COMP128 makes revealing Ki 5) Flaws in cryptographic algorithms: Both A5/1
possible especially when specific challenges are and A5/2 algorithms were developed in secret. The
introduced, it deliberately sets ten rightmost bits of Kc output of A5/1 is the XOR of three LFSRs. An
equal to zero that makes the deployed cryptographic efficient attack to A5/1 that can be used for a real-time
algorithms 1024 times weaker and more vulnerable, cryptanalysis on a PC includes two kinds of attacks
due to the decreased keyspace. Some GSM network [10]: The former that requires the first two minutes of
operators tried another new algorithm for the A3/A8, eavesdropped encrypted conversation is capable of
called COMP128-2. COMP128-2 was also secretly extracting the ciphering key in about one second, while
designed and inherited the problem of decreased the latter just needs two seconds of encrypted
keyspace. Despite of such important problem, no other conversation to extract the ciphering key in several
problems are reported so far. However, we can minutes. A5/2 is the deliberately weakened variant of
prospect for new discovered vulnerabilities in the A5/1. An efficient attack to A5/2 requires less than one
future as it is secretly designed. An improved version second of encrypted conversation to extract the
of COMP128-2, called COM128-3, is also proposed ciphering key in less than one second on a PC [11].
that generates 64 bits of session key and resolves the
6) Short range of protection: The encryption is only
problem of decreased keyspace.
accomplished over the airway path between MS and
3) SIM card cloning: Another important challenge is BTS. There is not any protection over other parts of
to derive the root key Ki from the subscriber's SIM. In network and the information is clearly sent over the
April 1998, the Smartcard Developer Association fixed parts. This is a major exposure for the GSM,
(SDA) and the ISAAC research group could find an especially when the communication between BTS and
important vulnerability in the COMP128 algorithm BSC is performed over the wireless links that have
that helped them to extract Ki in eight hours by potential vulnerabilities for interception. In some
sending many challenges to the SIM. Subsequently, countries, the encryption facility of the air interface is
some other schemes were proposed that were based on not activated at all. There are also security problems on
the chosen challenges and were capable of extracting the GSM backbone. The deployed Signaling System
Ki in fewer times. Ultimately, a side-channel attack, no.7 (SS7) has also several security vulnerabilities.
called partitioning attack, was proposed by the IBM The messages in the current SS7 system is so that they
researchers that makes attacker capable of extracting can be modifies or even fabricated into the global SS7
Ki if he could access the subscriber's SIM just for one system in an uncontrolled manner [12]. SS7
minute [9]. The attacker can then clone the SIM and incorporates very limited authentication procedures
use it for his fraudulent purposes. The COMP128 since it was originally designed for the closed
algorithm needs large lookup tables that would leak telecommunication communities. The interconnection
some important information via the side channels when with Internet can also have its potential vulnerabilities.
it is implemented on a small SIM. Additional vulnerabilities will be arisen when SS7
4) Over-the-air cracking: It is feasible to misuse the systems are interconnected using the Internet. Remote
vulnerability of COMP128 for extracting the Ki of the management of the GSM backbone elements that can
be conducted by connecting them to the IP networks
can also introduce additional vulnerabilities. If the The GSM network has some transport channels: Short
HLR and AuC are physically separated, it can be a Message Service (SMS), Unstructured Supplementary
new point of vulnerability since the authentication Service Data (USSD), Wireless Application Protocol
triplets may be obtained from AuC by masquerading as (WAP), and the voice channel. There are also some
another system entity, e.g. a HLR. Unauthorized newer services such as Enhanced Messaging Service
accesses to HLR, AuC, and MSC will also cause (EMS) and Multimedia Messaging Service (MMS) that
several problems. have been added in the GSM upgrades. The security
7) Lack of user visibility: The ciphering is controlled flaws described in the previous section are commonly
by the BTS. The user is not alerted when the ciphering applicable to all the services and transport channels
mode is deactivated. A false BTS can also deactivate since they aim all the exchanged data and signaling
the ciphering mode and force MS to send data in an information. However, in addition to such common
unencrypted manner. flaws, some of GSM transport channels have some
extra problems and vulnerabilities. The SMS
8) Leaking the user anonymity: Whenever a messaging has some extra security vulnerabilities due
subscriber enters a location area for the first time or to its store-and-forward attribute, and the problem of
when the mapping table between the subscriber's fake SMS that can be conducted via the Internet. When
TMSI and IMSI is lost, the network requests the a user is roaming, the SMS content passes through
subscriber to clearly declare the IMSI. This can be different networks and perhaps the Internet that
misused to fail the user's anonymity and can be exposes it to various vulnerabilities and attacks.
accomplished by sending an IDENTITY REQUEST Another concern is arisen when an adversary gets
command from a false BTS to the MS of the target access to the phone and reads the previous unprotected
user to find the corresponding IMSI. messages. The USSD that is a session-oriented
9) Vulnerability to the DoS attack: A single attacker technology is also vulnerable to attacks since the
is capable of disabling an entire GSM cell via a Denial messages are not encrypted and secured on the GSM
of Service (DoS) attack. The attacker can send the backbone.
CHANNEL REQUEST message to the BSC for The WAP allows ME to connect to the Internet. The
several times but he/she does not complete the protocol WAP Gateway that resides between MS and Web
and requests another signaling channel. Since the server in the WAP architecture and acts as an
number of signaling channels is limited, this leads to a interpreter between the Internet protocols (HTTP,
DoS attack. It is feasible since the call setup protocol SSL/TLS, and UDP/TCP/IP) and the corresponding
performs the resource allocations without adequate WAP protocols (WSP/WTP, WTLS, and WDP),
authentication. This attack is economical since it does introduces an additional security flaw in some
not have any charge for the attacker. It can also be implementations that is referred to as the WAP gap.
used for many practical situations such as terrorist Other concerns are arisen from security problems of
attacks [13]. the Internet as a huge uncontrolled network that is in
contradiction with assumptions of the GSM security
10) Absence of integrity protection: Although the architecture in which the core network is assumed as a
GSM security architecture considers authentication and secure and controlled environment. The web servers
confidentiality, there is no provision for any integrity may also download and execute malicious applets at
protection of information [2]. Therefore, the recipient the client (ME) so the safety of applets and other
cannot verify that a certain message was not tampered downloaded programs is another concern.
with.
11) Vulnerability to replay attacks: The attacker can 5. Solutions to the GSM Security Flaws
misuse the previously exchanged messages between
the subscriber and network in order to perform the The GSM specifications have been revolutionized
replay attacks. during times. In 2002, several efforts have been done
to design new cryptographic algorithms for GSM,
12) Increased redundancy due to the coding ECSD, GPRS, and EGPRS that can be implemented on
preference: The Forward Error Correcting (FEC) is dual-mode phones. Ultimately, A5/3 for GSM and
performed prior to the ciphering so there is a ECSD/EDGE, GEA3 for GPRS, and f8 for UMTS
redundancy that increases the security vulnerabilities were proposed, all of them having a similar structure.
of deployed cryptographic algorithms. The security mechanisms of the GPRS are similar to
4. Security of Transport Channels that of the GSM. However, instead of using A5
algorithm, GPRS uses the GPRS Encryption Algorithm
(GEA) that currently has three versions: GEA1, GEA2, cryptographic algorithms cannot be so useful. Even
and GEA3. In the GPRS, the end terminal of though the ciphering algorithms are replaced with the
encryption is moved towards a deeper point in the strongest ones, the attacker can simply impersonate the
network, i.e. the SGSN. Although the encryption is real network and force MS to deactivate the ciphering
performed at the physical layer of the GSM, it is mode so it is also necessary to modify the
accomplished at the Logical Link Control (LLL) layer authentication protocols.
of the GPRS. The UMTS, in addition to its new 3) Securing the backbone traffic: Encrypting the
offered applications, has scrutinized the GSM security backbone traffic between the network components can
problems and has resolved most of them. The main prevent the attacker to eavesdrop or modify the
reason of GSM security problems was due to the fact transmitted data. Although this solution may be
that its security was provided by obscurity so the implemented without the blessings of GSM
UMTS algorithms were openly designed. consortium, the cooperation of hardware
Consequently, its algorithms are not encountered with manufacturers is still required.
serious problems. Although some theoretical attacks
are proposed, they are not practically feasible with the 4) End-to-end Security: The best, easiest, and most
current technology. However, there are also some profitable solution is to deploy the end-to-end security
other problems related to the deployed protocols. or security at the application layer. Most of GSM
Regardless of security improvements in the upper security vulnerabilities (except SIM cloning and DoS
generation networks, it is necessary to provide attacks) do not aim ordinary people, and their targets
solutions to improve the security of the currently are usually restricted to special groups so it is
available 2G systems. Hereunder, some practical reasonable and economical that such groups make their
solutions are proposed for this purpose. communications secure by the end-to-end security.
Since the encryption and security establishment is
1) Using secure algorithms for A3/A8 performed at the end-entities, any change to the GSM
implementations: This can thwart the dangerous SIM hardware will not be required. In this way, even if the
card cloning attack. This solution is profitable since conversation is eavesdropped by the police or legal
the network operators can perform such improvement organizations, they cannot decrypt the transmitted data
themselves and without any need to the software and without having the true ciphering key, provided that a
hardware manufacturers or the GSM consortium. secure enough cryptographic algorithm is deployed.
However, this solution requires providing and Therefore, in order to avoid illegal activities, it should
distributing new SIM cards and modifying the be transparent to both GSM operator and service
software of the HLR. Currently, both COMP128-2 and provider. It may also be necessary to find solutions for
COMP128-3 algorithms thwart the SIM card cloning a legal interception or a key screw scheme. The end-to-
and over-the-air cracking of Ki. Since COMP128-3 end security establishment has a complete flexibility to
enhances the effective key length of the session key to the deployed algorithms so the appropriate upgrades
further 10 bits, it allows the deployed cryptographic can be easily accomplished when necessary. However,
algorithm to have its nominal security. Although it is it may be a subject to export control. Generally, the
soon to judge on the real security of COMP128-2 and end-to-end security can be provided in the cellular
COMP128-3, they have apparent advantages over the systems by following one or some of the following
traditional COMP128-1 that its SIM cloning apparatus approaches:
are available at very low prices. 1) Exploiting the processing capabilities of mobile
2) Using secure ciphering algorithms: Operators can phone using the programming languages such as
use newer and more secure algorithms such as A5/3 J2ME (Java 2 Mobile Edition): Supported by the most
provided that such improvements are allowed by the recent cellular phones and Personal Digital Assistants
GSM consortium. The deployed cryptographic (PDA) with the improved processing capabilities.
algorithms should be implemented on both BTS and 2) Exploiting the processing capabilities of the SIM
mobile phones. Any change to the cryptographic using the SIM Application Toolkit (SAT) [14]: Not
algorithms requires agreement and cooperation of supported by all SIM cards; especial SIM cards are
software and hardware manufacturers since they required; the processing resources are still limited; and
should perform the appropriate changes to their operations may be so time-consuming.
products. Since the cryptographic algorithms should be 3) Exploiting the processing capabilities of an
implemented on the cellular phones, the agreement of additional smart card, e.g. JavaCard: Not supported
mobile phone manufacturers is also required. by the usual phones; requires costly dual slot cellular
However, a lonely upgrading of the deployed phones.
4) Exploiting the processing capabilities of a portable References
PC (laptop) connected to the ME: suitable for security
[1] GSM World News - Statistics: http://www.gsmworld.
mechanisms with huge processing and memory com/news/statistics/index.shtml. Access: Jan. 23 2008.
requirements, e.g. real-time end-to-end secure voice [2] P. Chandra, “Bulletproof Wireless Security, GSM,
communications over the GSM voice channel [15]. UMTS, 802.11 and Ad hoc Security,” Elsevier, 2005.
5) Exploiting the processing capabilities of a crypto- [3] S.M. Siddique, and M. Amir, “GSM Security Issues
processor that is embedded in the ME [16]: It should and Challenges,” 7th IEEE International Conference on
be accomplished by the mobile manufacturer; cannot Software Engineering, Artificial Intelligence,
be changed or manipulated by the user; and may be a Networking and Parallel/Distributed Computing
subject to export control. (SNPD'06), pp.413-418, June 2006.
The first four approaches have an inherent [4] V. Niemi, and K. Nyberg, “UMTS Security,” John
Wiley and Sons, 2003.
advantage due to their capability of being simply
[5] C-C Lo, and Y-J Chen, “Secure Communication
manipulated by the end-entities. However, choosing Mechanisms for GSM Networks,” IEEE Transactions
the most profitable approach regards to some on Consumer Electronics, Vol.45, No.4, pp.1074-1080,
parameters such as required memory and processing Nov. 1999.
resources of the corresponding application. For [6] W. Rankl, and W. Effing, “Smart Card Handbook,” 3rd
example, if the voice is to be end-to-end encrypted ed., John Wiley and Sons, 2003.
over the data channel, it can even be implemented by a [7] F.J. Gonzalez-Castano, J. Vales-Alonso, J.M. Pousada-
software application that is installed on an advanced Carballo, F.I. de Vicente, and M.J. Fernandez-Iglesias,
cellular phone. On the other hand, for encryption over “Real-Time Interception Systems for the GSM
Protocol,” IEEE Transactions on Vehicular
the voice channel that is hard to be tracked and so
Technology, Vol.51, No.5, pp. 904-914, Sept. 2002.
attractive for the terrorist and illegal activities, the [8] http://www.alarm.de
fourth approach may be suitable [15]. The end-to-end [9] J.R. Rao, P. Rohatgi, H. Scherzer, and S. Tinguely,
security can be established by both symmetric and “Partitioning Attacks: Or How to Rapidly Clone Some
asymmetric encryption. The asymmetric encryption is GSM Cards,” IEEE Symposium on Security and
usually too slow to be used for the real-time Privacy (S&P'02), pp.31-41, 2002.
applications and may be used for the key establishment [10] A. Biryukov, A. Shamir, and D. Wagner, “Real Time
of a symmetric encryption algorithm. The public keys Cryptanalysis of A5/1 on a PC,” pp.1-18, Fast Software
are usually jointed with the certificates. The private Encryption Workshop, April 2000.
[11] E. Barkan, E. Biham, and N. Keller, “Instant
keys and the certificates can be securely stored on
Ciphertext-Only Cryptanalysis of GSM Encrypted
either SIM card, an additional smart card (for the dual- Communication,” pp.600-616, CRYPTO 2003.
slot phones), or a secure hardware on the phone. There [12] G. Lorenz, T. Moore, G. Manes, J. Hale, and S. Shenoi,
are also some proposals for the Wireless Public Key “Securing SS7 Telecommunications Networks,” IEEE
Infrastructure (WPKI). Workshop on Information Assurance and Security,
pp.273-278, June 2001.
6. Conclusions [13] V. Bocan, and V. Cretu, “Mitigating Denial of Service
Threats in GSM Networks,” 1st IEEE International
In this paper, the security of the GSM network is Conference on Availability, Reliability and Security
evaluated, and a complete and brief review of its (ARES'06), April 2006.
security problems is presented. It is proved that the [14] European Telecommunications Standards Institute.
Digital cellular Telecommunications system (Phase
GSM network has many inherent security flaws that 2+); Security mechanisms for the SIM Application
can be misused for fraudulent purposes or for Toolkit; Stage 1. GSM 02.48 version 6.0.0 Release 97.
deceiving users. Some practical solutions to improve April 1998.
the security of currently available 2G networks are also [15] N.N. Katugampala, K.T. Al-Naimi, S. Villette, and
proposed. Some solutions include the security A.M. Kondoz, “Real-time End-to-end Secure Voice
improvement of the infrastructure while the others tend Communications Over GSM Voice Channel,” 13th
to provide the end-to-end security. It is also deduced European Signal Processing Conference
that the end-to-end security or the security at the (EUSIPCO'05), Turkey, Sep. 2005.
application layer is the best and most profitable [16] A.B. Rekha, B. Umadevi, Y. Solanke, and S.R. Kolli,
“End-to-End Security for GSM Users,” IEEE
solution for the currently available 2G systems.
International Conference on Personal Wireless
Communications, pp.434-437, Jan. 2005.