GSM Cloning Fraud - Still A Threat

Deterred by encryption algorithms?

Unlike analogue networks in which sensitive personal data is announced over the air and can be easily intercepted, GSM networks are protected by encryption algorithms. The algorithms serve to protect the radio signal between the mobile customer and the network, meaning that even if the signal was intercepted, it would be virtually impossible to decipher the information.

Earlier versions of the algorithms were compromised by fraudsters, who if given eight hours access to the SIM card and the correct equipment could clone a handset. The length of time taken for this process, plus the expense of the equipment required, has served as an effective deterrent and made other types of fraud more attractive. Worryingly, advances in technology mean that traditional cloning can be carried out in as little as four hours, using equipment bought on the black market for less than two hundred dollars.

The compromised algorithms have been superseded by new releases, the latest (A5/3) becoming publicly available from the GSM Association in Q3, 2002. The A5/3 algorithm will be used on GSM networks, but also for GPRS and EDGE services. It is based on an algorithm for 3rd Generation networks and paves the way for the evolution towards a secure UMTS network. Despite this advance, many operators are choosing not to upgrade the algorithms they are using, either out of ignorance or as a misguided cost saving measure. "Cloning of GSM handsets is rare, but it is getting easier and easier to carry out", says Daniel Winterbottom, author of Chorleywood Publications' new report: 'Minimising the Fraud Risk in Next Generation Networks'. "Operators who continue to use compromised algorithms will find that incidents of cloning on their network and the related losses will rise significantly".

SIM card access made easy

The job of the fraudster has been made even easier by a recent discovery. The traditional methods of cloning have been replaced by a technique that can crack a SIM card within a minutes of access to it. The power consumption of the SIM card is monitored whilst certain instructions are run through the circuit, allowing the data to be analysed and the SIM card cloned.

Although significant danger is represented by the cloning of handsets, the potential losses will increase massively as m-commerce applications become more commonplace. Users will be able to transfer money out of their bank accounts and make payments for goods and services through their handset. "Without careful planning, operators will find that their customers become the victims of huge losses and the liability for the loss will rest squarely on the telco's shoulders", says Winterbottom.

The Evolution of Fraud

Traditional types of fraud still exist and the majority of operators have shown themselves to be ineffectual in curbing them. The development of next generation networks offers huge potential for revenue generation but the amount of risk operators will expose themselves to will also increase dramatically. The more complex networks, services and processes become, the more opportunity fraudsters have to exploit loopholes and steal vitally needed revenue. The factors that will lead to more risk exposure include:

• Multiple, new and immature services
• Increased numbers of business transactions
• Open, distributed networks
• Entrance of new, non 'traditional' players
• Mergers and acquisitions
• New methods of access
• New billing systems and processes
• Huge increase in amount of data generated by users

These factors are all part and parcel of a successful next generation network, but to be successful their impact must be comprehensively analysed. In the 3G market, operators will want to quickly launch services with the aim of gaining a sizeable market share and establishing a brand. This will leave the operator with significant risks that without careful planning will result in huge losses. As networks and services evolve, so will the forms of fraud. Variations of fraud previously unseen on the telecommunications networks will emerge, associated with the production and distribution of content, high value mobile transactions, 'always on' IP connections and the emergence of mobile communities.

MEDIA CONTACT AND ENQUIRIES

Lana Silk
Marketing and PR Manager, Chorleywood Publications
Telephone: 020 7017 4652
Email: enquiries@chorleywood.com
Visit our website: www.chorleywoodpublications.com

ABOUT 'FRAUD - MINIMISING THE FRAUD RISK IN NEXT GENERATION NETWORKS'

The report gives an in depth analysis of telecoms crime and its latest developments, together with an evaluation of how it will evolve in next generation networks. It provides real solutions to mitigating the threat of fraud and analyses fraud prevention tools currently on the market.

Key areas of focus are subscription fraud, internal fraud, partnership and wholesale fraud, fixed and mobile network fraud, prepaid fraud, roaming fraud and value added services fraud.

ABOUT CHORLEYWOOD PUBLICATIONS

Chorleywood Publications is the research and publishing division of Chorleywood Consulting. Chorleywood Consulting is a management consultancy that has grown from a core expertise in customer care and billing within the global information, communications and technology (ICT) sectors. Part of Informa Group plc, a FTSE 250 company, Chorleywood' s expertise extends across the management and telecoms IT disciplines, offering strategic development through market research and analysis, consulting, systems integration and project management.

Recent and upcoming reports include:

• Global Trends and Market Forecasts in Telecoms BCC 2001
• Global Trends and Market Forecasts: Procurement Strategies for Telecoms BCC
• Customer Retention and Churn Management
• SLAs - the Key to Competitive Advantage
• Pricing Strategies for GPRS, DSL and IP Services
• GPRS and 3G Billing - plus updates
• Pricing and Billing for Content - Creating New Revenue Streams from Content
• Revenue Assurance - the Key to Profit Maximisation
• Partner Relationship Management
• BSS Yearbook 2002
• Optimising Revenues from Mobile Messaging
• The Interconnect Evolution - Increasing ROI from your Interconnect Billing System

ABOUT THE AUTHOR

Daniel Winterbottom is a research analyst at Chorleywood Publications and has three years' experience in telecoms industry research. He started his career at IBC Global Conferences, where he researched and organised telecoms conferences on IP-based VPNs, mobile messaging, mobile handset development, digital content rights, mobile ISPs and user interface development for mobile devices.

Daniel now specialises in revenue assurance and fraud and contributes to the Billing Plus newsletter, published by Baskerville. Daniel holds a Bachelor of Science degree in environmental chemistry from UMIST University and a Masters degree in instrumentation and analytical science.

http://chorleywood.com