GSM override
*GSM 900* Crossover
Varib *GM* assignments for receiving and processing signals
to the GSM-900 standard, 1800 yak for the presence of the day and for the presence of the crypto-protector
(Algorithms A5.1 and A5.2).
"GM" allows:
- control direct voice channel (voice channel)
bazi)
- to control the reverse chi voice channel (viprominyuvannya
tubes)
- scan all channels in search of active channels
- scan channels vibrating and set the hour of rescanning
- organize a thorough audition
- organize a wiretapping for TMSI, IMSI, IMEI,
ABN number, Ki.
- automatically record rommovie to a hard drive
- control rozmovu without a record
- conduct a search for an active subscriber (for open channels)
- fix the number that is dialed by the style subscriber
- fix the phone number on the telephone on the stylish device (if
AVN enabled)
- display all registrations in the channel
Virib avenge two primary channels - direct and return.
For the presence of a crypto-protector *GM* can be practiced in two modes:
- Poshuk active mobile subscriber.
For the obviousness of the crypto-protection only in the mode
- control of the station channel (direct and return);
When controlling the channel of the key station *GM*, the next
parameters for skin care:
- IMSI or TMSI (depending on the robotic control mode -
my measure, qi signals are transmitted by the base station);
- IMEI

Availability of a mobile subscriber, so how is it possible to fix the
tubes);
- the number to be dialed (when calling from the mobile phone
of the subscriber and for his energy availability
viprominyuvannya tube);
- AON number (when it is transmitted by the base station).
The mode of the active subscriber is monitored whether it is
z'ednannya. In this mode, *GM* constantly looks over the entire range
when an active subscriber is detected, switch to the control mode (especially
if the subscriber is talking at the moment, the device switches on the transmitter
only for an hour of love). If necessary (as if Rozmov did not
click) the operator can override the control mode and "GM" again switch
the scan mode does not yet know another active subscriber. Mode
Ask the active subscriber to dotsilno vikoristovuvat suprovodі. AT
This operating mode *GM* does not assign a subscriber ID!
When controlling the channel of the base station, two options are possible
robots:
- in open mode
- in the mode of choice for signs
In the open regimen for control, the first rozmov’s
control cells, as well as all registrations are displayed. Yakshcho tsey
rozmov not tsіkava, then the control can be pinned to the pressure of the button
Break.
In the selection mode, there are no more controls from tasks
TMSI, IMSI, IMEI, ABN number or number to dial. Selection list
includes up to 200 identifiers. At the time of control of the closed channel
crypto mode selection is required for Ki, which is allowed
uniquely identify the subscriber without specifying TMSI, IMSI or IMEI.
With this add-on list includes up to 40 subscribers.
*GM* endings in the appearance of a monoblock with a size of 450x250x50 mm. management
robot *GM* zdіysnyuєtsya vіd zvnіshnyї PEOM (may be connected
laptop) via the serial RS-232 port.
The delivery set includes attachments for software security,
which allows you to read the Ki parameter from the SIM card, read in
between 10 years.
Zhivlennya GM zdіysnyuєtsya vіd merezhі zminny struma 220V. so i
constant voltage 12, for example, in the side railing of a car.
At the request, it is possible to prepare channels in the range of 1800 MHz and 450 MHz.

Abbreviation and meaning
TMSI - time clock identifier (number) of a handy subscriber
IMSI - international identification number of a handy subscriber
IMEI - International Identification Number
rickety
stations
Ki – subscriber's individual authentication key
1. The complex of assignments to the receiver of signals in the TTT system.
2. The complex has two channels for receiving and processing - one for the upper and one for the lower range.
3. The complex is securely adjusted to any of the 124 possible control channels.

4. For an hour of work, the complex can have two modes:
- without selection;
- With choice.
The selection table can accommodate up to 40 identifiers.
The identifier is composed of IMSI and IMEI (you can specify more than IMSI or more than IMEI).
The complex is charged for IMSI, IMEI and TMSI. Відбір ТМSI after inclusion in the complex
be safe only after omitting the command from setting IMEI or IMSI.
Respect! IMEI – identification number of the handset (assigned by the dialer). IMSI -
international identification number of the subscriber (records from the SIM card). There is no direct
validity to the subscriber's number. The table of validity is set by the operator (company that sees
tubes).
5. The appointment of the exit number is taken care of.
6. Take care of the handover mode.
7. It is not possible to process the data correctly up to A5 algorithms.
8. The complex is managed by the Windows program behind the last port.
9. Registration can be done both on a tape recorder and a sound blaster.
10. Upon notification of life, the complex switches to the active subscriber's search mode. When yoga is revealed
the complex is converted to receive mode. Transferred subscriber drop. In this mode, keruvannya
computer is not needed. In this mode, identifiers are not assigned.
After the launch of the program that controls, the complex switches to the control mode for the specified channel
management (provided for the following points 3 ... 5).

BRIEF DESCRIPTION OF THE SYSTEM.
The broadest version of the system began in 1993 after the creation of MTS and
otrimannya allowed on a different band 890 - 915 MHz and 935 - 960 MHz without 10 MHz,
recognition to robotic radar.
For tribute given to a friend at a given hour, Russia has 180 to 220 thousand
koristuvachiv. The system for economical showings is to milk the road with those її koristuvachs, like
as a rule, there is a prosharok of suspіlstva, which goes up to the so-called middle class (as a minimum).
This fact, having created a change of mind and the need to expand the means of control over information,
circulating in the system.
This standard is wide-width in areas with a large population.
At this time, the system was fired and rebuilt in operation in refurbished places:
- MOSCOW;
- SAINT PETERSBURG;
- SAMARA;
- TOGLIATTI;
- ROSTIV on DON;
- KALUGA;
- SEVERODVINSK;
- MURMANSK;
- SMOLENSK;
- TULA;
- PSKIV;
- RYAZAN;
- VOLODYMIR;
- ARKHANGELSK;
- PETROZAVODSK.
- KYIV
- DNIPROPETROVSK
- DONETSK
- ODESSA
Also, the introduction of the system in other places, for example, Yaroslavl, will end.
Standard has automatic roaming secured to approximately 58 countries around the world.

There is a digital method of data transfer before the system is over, the number is large
one-hour service of subscribers, difficulties in making twins (cloning SIM-cards), reliability
the work of the subscriber, the possibility of designating the replacement of devices with the choice of legal SIM-cards and
and etc.
The establishment of a higher factor determined the dotality of the establishment of control methods.
BASIC ALGORITHMS OF THE COMPLEX FUNCTION.
Algorithms for processing radio traffic secure the most recent and current access to
information that circulates in the merezhі, and also allow to increase the capacity of the complex with the appearance
new standards without changing the main software by way of adding additional
modules Before them, for example, one can see the planned appearance of a vocoder with a raised quality of the movie,
transmission of data and facsimile transmissions. At previous operation the complex can be supplemented
regimes for specific tasks of the coristuvacha
The complex vikoristovuetsya in stationary and mobile options.
ROBOT MODES.
(basic delivery kit)
The scanning mode allows you to change the visible frequencies of the base stations at the stop point, as well as
the main parameters of the measure In the process of robots, it is ensured that the analysis of a specific frequency is
the mode of robotic channel control is analyzed. Tsey mode allows you to ensure optimal
configuration of the receiving tract. The selected configuration can be promptly secured or saved.
Manual Scanning Mode #1 automatic appointment channels
visible frequencies from the indication of the presence of activity. Allows the operator to select the active
new slots. For the presence of the subscriber in the zone of radio visibility, it is safe to receive duplex.
Manual Scan Mode #2 ensures automatic re-scanning of visible frequencies
a spike on the active frequency slots and molding up to a few duplexes in the end mode
machine. When an active channel is enabled, autoscanning continues. It is possible to continue
scanning for operator commands. This mode allows automatic recording of negotiations
for the availability or visibility of the operator as many channels as possible. Vikoristovuetsya mainly with
low traffic activity, for example, due to the operator's daily hours at night or with a small number
visible frequencies. Be sure to receive a duplex for the visibility of the rest in the radio visibility zone.
Work mode for hour numbers is allowed on selected control channels (no more than six)
secure automatically adjusted on timchas numbers of subscribers from statistics, and when choosing
subscriber, which is of interest for the removal of bills, or when re-registering in the next hour of work in
mobile option, add yoga to the database and permanently with uninterrupted control.
Imovirnist of constant control to fall in the number of crossover frequencies (at 10-12
to become 80%), as well as the speed of movement (up to 80 km/year for the standard signal, which is victorious).
Additional delivery kit.
Energy Saving Mode No. 1
assigning active frequencies and seeing the result to the operator, following the command of the rest
setting the channel to accept with one-hour duplex reception. The number of channels to receive - up to chotiriox
duplex.
Energy efficiency mode No. 2 ensures the safety of the energy available
subscribers in the range of robots and portable devices. Allows secure autoscanning for a range of
assignment of active frequencies and automatic adjustment to active slots with fixation of conversations. behind
After the end of the session, autocontrol is trivaє.
With the extended option, a module is supplied that allows you to designate and identify, when
presence in the zone of radio visibility of a portable device, the number of a fixed or mobile subscriber when
weekly call directly to the base station, as well as when passing IMEI numbers robiti identification
subscriber.
Regions in Russia, where MTS subscribers can use call services:
(data for the 6th quarter)
1. MTS
Moscow, Moscow region, Tver, Tver region, Siktivkar, Ukhta, Kostroma, Komi Republic.
2. Russian Telephone Company (RTK) - connection to the MTS switch

Volodymyr, Volodimir region, Kaluga, Kaluzka region, Pskov, Ryazan, Ryazan region, Smolensk,
Smolensk region, Tula, Tulsk region
3. Recomm
Eagle, Lipetsk.
4. Tambov electric connection
Tambov, Michurinsk.
5. National roaming
Location, operator Service area
1. St. Petersburg
Pivnichno-Zahidny GSM
(250 02)
Arkhangelsk,
Vologda,
Leningrad region,
Murmansk,
Novgorod the Great,
Petrozavodsk,
Sevrodvinsk,
Cherepovets
2. Samara
SMARTS
(250 07)
Astrakhan,
Tolyatti,
Ufa
3. Rostov-on-Don
Dontelecom
(250 10)
Azov,
Taganrog
4. Krasnodar
Kuban GSM
(250 13)
Adler, Anapa,
Gelendzhik,
hot key,
Dagomis, Yeysk,
Lazarevska, Matsesta,
Chervona Polyana,
Dinska, Novorossiysk,
Tuapse, Sochi,
Timashevsk, Temryuk,
Krymsk, Khosta
5. Yekaterinburg
Uraltel
(250 39)
6. Nizhny Novgorod
NS, S
(250 03)
(!!!
international access)
7. Stavropol
BecomingTeleSot
(250 44)
Yesentuki,
Nevinomysk,
Kislovodsk,
P'yatigorsk,
Mineral water
8. Novosibirsk
CCC 900
(250 05)
9. Omsk
Mobile communication systems
(250 05)
10. Surgut
Yermak RMS
(250 17)
Langepas,
Nizhnyovartovsk,
Megion,
Khanty-Mansiysk,
Naftyugansk
11. Khabarovsk
Far away stylists
system-900
10
(250 12)
12. Kaliningrad
EXTEL
(250 28)
International roaming
Krajina Operatori
1. Austria 1. MobilKom
2. max mobile. Telecom Service
3. CONNECT
2. Australia 4. Telstra
3. Azerbaijan (SND) 5. Azercell
4. Andorra 6. STA
5. Bahrain 7. Batelco
6. Belgium 8. Belgacom Mobile
9 Mobistar S.A.
7. Elephant's Brush Coast 10. SIM
8. Bulgaria 11. MobilTel AD
9. UK 12. Vodafone Ltd.
13. Cellnet
14. Orange GSM-1800
10. Ugorshchina 15. Westel 900 GSM Mobile
16. Pannon GSM
11. Nіmechchina 17. DeTeMobile (D-1)
18. Mannesmann Mobilfunk (D-2)
12. Greece 19. Panafon S.A.
20. STET Hellas
13. Georgia (SND) 21. Geocell
22 Magticom Ltd
14. Hong Kong 23. Hong Kong Telecom CSL
24. Hutchison Telephone Comp.
25.SmarTone Mobile Communications
15. Gibraltar 26. Gibtel
16. Denmark 27. Sonofon
28 TeleDanmark Mobil A/S
17. o. Jersey 29. Jersey Telecoms
18. Italy 30. TIM
31. Omnitel Pronto Italia S.p.A.
19. Iceland 32. Lands siminn
33.TAL
20. Spain 34. Airtel Movil, S.A.
35. Telefonica Moviles
21. Indonesia 36. Satelindo
37. PT Excelcomindo Pratama
38. Telkomsel
22. Ireland 39. Eircell
40. Esat Digifone
23. Cyprus 41. CYTA
24. China 42. China Telecom
25. Latvia 43. LMT
44. Baltcom GSM
26. Lithuania 45. Bite GSM
46. ​​Omnitel
27. Lebanon 47. LibanCell
48. FTML S.A.L.
28. Luxembourg 49. P&T Luxembourg
50. Tango
29. o. Main 51. Manx Telecom Ltd.
30. Macau 52. CTM
31. Macedonia 53. GSM MobiMak
11
32. Mauritius 54. Cellplus
33. Malaysia 55. Celcom
34. Malta 56. Telecell Limited
57 Vodafone Malta
35. Moldova 58. Voxtel
36. Norway 59. Telenor Mobil AS
60. NetCom GSM as
37. New Zealand 61. BellSouth New Zealand
38. Netherlands 62. Libertel B.V.
63. KPN Telecom
64. Telfort
39. UAE 65. Etisalat
40. Portugal 66. Telecel
67.TMN
41. Poland 68. Polska Telefonia Cyfrowa (ERA)
69. Polkomtel S.A.
70. Centertel GSM-1800
42. Romania 71. MobilFon SA
72. Mobil Rom
43. USA 73. Omnipoint
44. Singapore 74. SingTel Mobile (GSM 900/1800)
75.Mobile One
45. Slovakia 76. Globtel
77. EuroTel Bratislava
46. ​​Slovenia 78. Mobile
47. Thailand 79. Advanced info service (AIS)
48. Taiwan 80. Chunghwa Telecom LDM
81.GSM PCC
82. FarEasTone
83Mobitai Communications Corp.
49. Turechchina 84. Telsim
85. Turkcell
50. Uzbekistan 86. Coscom
51. Ukraine 87. UMC
88. Kyivstar
89.URS
52. Finland 90. Oy Radiolinja Ab
91. Sonera
53. France 92. SFR
93 France Telecom
54. Croatia 94. HPT
55. Czech Republic 95. EuroTel Praha
96.RadioMobil
56. Sweden 97. Europolitan AB
98 Comviq GSM AB
99 Telia Mobile AB
57. Switzerland 100. Swiss Telecom PTT
58. Sri Lanka 101. MTN
59. Estonia 102. EMT
103. Radiolinja Eesti
104. AS Ritabell
60. Yugoslavia 105. Mobtel * Srbija * BK-PTT
106. ProMonte (Montenegro)
61. Pivdenna Africa 107. MTN
108. Vodacom (Pty) Ltd

Її you can remember!
Rob visnovki.

It goes without saying that homeowners need to know that public Wi-Fi hotspots are not safe. If you don’t care about ordinary coristuvachas, they’re completely dirty with them - even if you can’t, but if it’s boring and you really want to, then you can! І without any VPN - if you want the VPN function, now you can use it in complex antivirus products. A healthy alternative to Wi-Fi has always been respected by a more mobile connection, moreover, it becomes cheaper with skin rock, and the speed of yoga is more and more. Ale chi is so safe, how can we get it? In this article, we have chosen the main sources of food and sustenance, assigned to the hoarding of mobile data, and signified, chi varto yogo be afraid of the splendid, distant view of the hidden secrets of koristuvachev.

What is an IMSI-perekhoplyuvach?

Tse such an attachment (expansion from the valise or navigate only from the phone), which is a victorious design feature of mobile phones - to overcome the strength of the style tower, whose signal is the strongest (to maximize the signal strength and minimize the energy supply). In addition, in the GSM (2G) measure, only a mobile phone is guilty of going through the authentication procedure (it’s not necessary in style), and it’s easy to enter it into Oman, in addition, you can turn on the new data encryption. On the other side, universal system mobile call UMTS (3G) will require two-way authentication; however, it is possible to get around using the GSM network mode, which is more common. 2G measures, like before, are widely expanded - operators use GSM as a backup measure in quiet places, when UMTS is not available. Detailed technical details of IMSI-referencing are available from the SBA Research Center. Another opis, which has become a daily document of modern cybercriminals, is the article “Your secret slope is no longer secret”, published in the fall of 2014 in the Harvard Journal of Law & Technology.

When did the first IMSI-transitioners appear?

The first IMSI-transitioners appeared in 1993 and were great, important and expensive. "Long live the microcircuits - with fourteen little ones ... and two with handles." Virobniks of such perekhoplyuvachiv can be perekhuvati on the fingers, and the temple vartyst bordered around coristuvachiv - exclusively state regulations. However, at the same time, stinks become cheaper and less bulky. For example, Chris Page prompted an IMSI-cheaper for less than 1500 dollars and introducing yoga at the DEF CON conference in 2010. The first version is composed of a programmed radio and a cost-free software with a valid exit code: GNU Radio, OpenBTS, Asterisk. All the information necessary for the retailer should be available to public access. And in the middle of 2016, the hacker Evilsocket propagated his version of a portable IMSI-cheaper for less than 600 dollars.

How do IMSI-transferrs monopolize access to a mobile phone?

• To deceive your mobile phone, fooling you into thinking that there is only one available.
• Get in such a rank that without the mediation of an IMSI-perfect you cannot make a call.
• Read the report about monopolization in the publication of the SBA Research Center: IMSI-Catch Me If You Can: IMSI-Catcher-Catchers.

Assortment of transitions that are for sale, call for help. And what about handicrafts?

• Today (in 2017 roci) are demanding technical specialists to prepare IMSI-reversible devices, using high-tech boxed components available for sale, and a hard-wired radio antenna, and can be used for no more than 600 dollars (div. version of the IMSI-reversible hacker Evilsocket). There are few stable IMSI transitions. Ale є th experimental, cheap, yakі pratsyuyut unstable. For example, in 2013, at the Black Hat conference, a version of an unstable IMSI jumper was presented, the total variance of hardware components was 250 dollars. Today, a similar implementation would be even cheaper.
• Yakshcho vrahuvati, shochasna zahіdna vysokotechnologichna vіyskova tekhnіka can vіdkritu architecture of hardware security that open code software security (these are the annual updates of the language of the mind, to secure the sum of the software and hardware systems that are being developed for the needs of the military), - from the retailers, from the prepared IMSI-perehoplyuvachiv, and all the tricks for this. You can read about the current trend of Russian hi-tech in the Leading Edge magazine (divine article “SoS-Integration Transitions”, published in the lute issue of the magazine for 2013). It doesn’t seem like it’s about those that recently the US Department of Defense announced its willingness to pay 25 million dollars to a contractor to build an effective system for radio identification (div. quarterly issue of the monthly Military Aerospace magazine, 2017). One of the main vimog that hangs up to the system's tsієї is due to buti vіdkritimi її arkhіtekura and komponenti, z yakh won't be added. In such a rank, the name of architecture is the current state of mind of the totality of software and hardware systems that are being developed for military needs.
• To that, it is not necessary for IMSI-transitioners to instill great technical qualifications of the mother - it is only necessary to take the combination of the already essential solutions and place them in one box.
• In addition, today's microphone, which is cheap at an unbearable pace, allows you to fit your handicraft viroba not only into one box, but also put (!) into one chip (div. description of the SoC concept) and put more - put inside. bezdrotov merezha(Div. description of the NoC concept is up to you yourself), as it is replaced by a traditional data bus. What can we say about IMSI-transitional devices, if you can find technical details about the hardware and software components of the super-modern American F-35 winemaker today.

How can I become a victim of “vipadic overreach”?

As much as possible. Imituyuchi steward's house, IMSI-overhearing the entire local traffic- where s-pomіzh іnshoy spend and rozmov innocent passers-by (read "the secret of the elder sister of the Great Brother"). I love the argument of “advocacy for the lack of torment of private life”, as if they act against the victoriousness of IMSI-perfectionists by law enforcement agencies, as if they were victorious as a high-tech possession to expel evil spirits.

How can an IMSI-transitioner check my movement?

• Most of the IMSI-transitioners, which are vicorated by the local law enforcement agencies, are vicorated for tracing.
• Knowing the IMSI of the cell phone, the operator can program the IMSI switcher to call the cell phone, if it is within reach.
• After connecting the operator to the process of mapping radio frequencies, in order to determine the goals directly.

Can you hear my twinkies?

• It should be deposited in vicory IMSI-perekhoplyuvach. Changes to the basic functionality simply fix: "such a place has such and such a mobile phone."
• To listen to the IMSI calls, you will need an additional set of functions, like pickers, for an additional fee.
• 2G calls are easy to hear. IMSI-transferrs are available for them for over ten years.
• The variability of the IMSI-transferrable deposit depends on the number of channels, the operating range, the type of encryption, the speed of the encoding/decoding of the signal, and the fact that the radio interfaces may be cool.

Promotion available only to members

Option 1. Come to the “site” to read all the materials on the site

Membership with a jointly assigned term grants you access to all materials of the Hacker, to increase the special accumulative discount and allow you to accumulate a professional Xakep Score rating!

Recently, I have been using the HackRF capability to analyze GSM traffic, a synchronizing signal will be attached to some floating, but in any case, the result will be access to other system alarms. Further, I admit that you have linux installations with gnuradio, and also you are a happy master of hackrf. However, you can cite a live cd, information about which one is in the "Software Security" forum. This is a viable option, if hackrf works right out of the box.

On the back, you need to select the frequency of your GSM station. For whom I'm typing gprx, scho inclusions to stock live cd. Following the analysis of frequencies in the region of 900 MHz, you should look at the point:

You can play regular channels on 952 MHz and 944.2 MHz. Nadal and frequency will be the right points.

Now, for the help of the offensive teams, it is my fault to install Airprobe.

git clone git://git.gnumonks.org/airprobe.git

git clone git://git.gnumonks.org/airprobe.git

cd airprobe/gsmdecode
./bootstrap
./configure
make

cd airprobe/gsm receiver
./bootstrap
./configure
make

Installation completed. Now we can receive the GSM signal. Run wireshark for help command

In the capacity of the primal outbuilding, select “lo”, and as a filter, select gsmtap, as shown in the step-by-step little one:

Now turn back to the terminal and enter

cd airprobe/gsm-receiver/src/python
./gsm_receive_rtl.py -s 2e6

You will see the merging window, and you will need to turn off the automatic selection, as well as move the slider to the maximum. Next, enter the GSM frequency, otrimany earlier, in the quality of the middle frequency.

You can also select the peak and average values ​​in the trace options section, as shown below:

You can tell that only the signal of the correct sequence (blue graph) will go beyond the peak value (green graph), thereby showing yourself that this is a regular channel. Now you need to decode. At the vіknі it's pressing on the middle of the th frequency strobka. You can pardon, but it's okay. I began to take the data in this way:

Now you can remember that gsm data is coming from wireshark. As I guessed on the cob of the stat, the synchronizing signal is floating, so in order to tune the given frequency, you need to continue to press on the circuit. Tim is not smaller, the program is doing good. It didn’t sound like it was funny, but, wrapping your hack rf around a towel (otherwise, it’s similar), you increase the thermal stability of the synchronizing signal and change the rozkid. By itself, this method, sing-song, will not give you a bad idea, but I think, at least, it shows the great potential of HackRF.

Perehoplennya radio and style call

To change Rozmov's radiotelephone, the mother does not need special equipment. Dosit nobility, in the frequency range of pracyuє pristrіy, and connect to the frequency of the hoppy.

For the crossover of roses on a stilt tie, it is necessary to use folding equipment. As has already been said mobile companies zealously encrypt their signals, it is not so easy to cross over and recognize them. Complexes of transition and control of the tie-rod of the brand AMPS or NMT-450i are being prepared in the lands of Western Europe in the open spaces Russian Federation.

The robotic complexes are used to detect incoming and outgoing signals, which are confirmed at the hour of calling, calling subscriber numbers, linking them to the mobile phone number, alerting the monitored subscriber to the telephone call hour.

The number of subscribers who can be heard at once, lie down due to the tightness of the building and the installed software.

In the middle, a complex of overreaching and a pillar of a stylistic connection building control over 14 subscribers or sim telephone calls. Deyakі prilady dodatkovo possessing tape recorders and dictaphones for one-hour recording of roses. Information is transmitted to hard drive attached EOM or zberigaєtsya on the memory card of the annex itself. The complex will help control the "life" of the subscriber, zdiisnyuyuchi postiyny monitoring yogo calls and podomlen.

The price for similar complexes to lay down depends on the pressure and the number of subscribers monitored at the same time. The penny equivalent is close to 10-50 thousand dollars. Varto vrakhovuvaty the fact that shoupit and strangle the GSM calls is richly folded. Britannia and Nimechchini are working on the creations of complexes, which are overblown, and at the present moment, their cost is about 500 thousand dollars.

Transmission of acoustic information over power lines

Data transferring or bridging bookmarks will be installed in electrical appliances that live in a stationary grid of 220 volts. Other mezhzhnі bookmarks vbudovuyutsya in the same socket. Attachment is made up of a microphone, subduing and low-frequency transmission. Frequency range - 10-350 kHz.

There is no sense to install high-frequency transmissions, the fragments of them are easier to reveal. Reception of signals and yogo transmission is carried out by one electric phase.

Like the phases are blown up, like a good component, the capacitor is broken. Attachment to the receiver of acoustic information is prepared for the appointment. Prote, with yoga tasks, a block of intercom intercoms miraculously fits in.

Stinks are sold at any radio-technical store. The transmission of information will be carried out in electrical appliances and live with energy for their help. Show merezhevі bookmarks smoothly, oskіlki when scanning radio ether be-like an electronic machine svoryuvatime reshkodi.

The Russian Federation has developed and exploited a complex of conversion and decryption to a pager, which can be used for sale in all countries of the CIS.

The complex is made up of miniature EOM, on which it is installed on a daily basis software security, receiving and converting signals from the pager. As a primary accessory, the AR3000 radio scanner or radio station is installed.

Complex :

• text;
• sound;
• digital reminder.

Yaki, in his hand, in the administration of the radio stations of the paging link.

The unlocked notifications are stored on a hard disk in an archive file, and the hour and date of the notification is indicated in the file name. On the EOM hard disk, you can filter the notifications of one subscriber, filter all the notifications given interval an hour or more to work with other files. The parameters of the search and filtering are changed.

The intercessor of the director of development Kerimov Rostislav.

Cloning SIM cards

One of the biggest problems is SIM card cloning. On the Internet, you can often hear rumors about easy way card cloning, as well as anonymous utilities, for example, SIM Card Seizure. How to call cloning, indicate the possibility of cost-free calling for someone else's account and the possibility of listening to the roses of the cloned SIM-card. The first variant of the victorious clone will have problems with the removal of input signals, and the output axis can work freely. The main helpers are people who, at the subway, tell passers-by to cheaply telephone to the end of the world. When listening to a subscriber, then looking at which power is assigned to an offensive split.

At the front section, the process of verifying the authenticity of the SIM card was described (Fig. 120). Basic in this process are IMSI parameters and

KI. In order for a clone to be able to pass authentication in AUC, it is up to you to know these parameters. Recognizing IMSI is easy, you can either have entries on the card or add to it. Yogo can be easily read from SIM-cards for an additional add-on smart card reader. And the axis z K I is more complicated.

As you already know, K I is stored in two places - in the SIM card memory and in the AUC memory. K I be-if it is transmitted from the eye to the eye during authentication, then. yogo can not be changed for the first hour of authentication. Malicious people have 4 options for removing KI. The first option is a price insider for a company-operator. This option is shorter, because You can take away the information at once for the number of cards. Nedolіki tsgogo variant polagayut that, scho zavayuchi on the significance of K I, access to їх znachenie suvoro obrazhenijі і in case of mass turn Іnsider іn the case of svydko bude charges. In addition, often the AUC is daily functional for reading KI from the same mirroring without any problems. Another variant of the foundations for the redemption of KI once after the removal of the batch of SIM-cards from the picker. The problems here are the same as in the previous option: the number of people who can need access, counted as singles.

The third option: revise K I from the memory of the SIM card. For some reason, it is necessary to take physical access to the card (check the victim's phone under the drive, know the PIN code). An important little fellow: the SIM-card does not have an interface, for which you can directly upgrade or change K I.

І, nareshti, remaining option: calculate K I . The evildoer is to blame for the mother of the announcement about the A3 algorithm, which is a victorious operator. And here you can try to calculate K I , to check the results of converting RAND to SRES. For which form the RAND manually, call the encryption algorithm and send it to the RAND. This process is automated by such programs as SimScan and WoronScan.

The very first clones of SIM-cards were taken away in this rank. Tse became available through a round of information about the A3 algorithm, COMP128 titles in the measure. In the algorithm, variability was revealed, which allowed picking up KI for a reasonable number of samples. After the manifestation of inconsistency, the greater number of operators replaced it with the stijkishim. At the moment there are three versions of COMP128. Other that third version at the moment is considered incomprehensible. And wanting to know about the presence of programs that declare the possibility of evil versions of these, it will always show up for re-verification that it is meta - zmusit koristuvach zavantazhit "Trojan".

Since the evildoer doesn't know about the implementation of A3, you can try brute force. Here one more mistake is to be blamed: the number of samples for the selection of KI is fenced. At

SIM-cards є in the wake of the lichnik of the number of calls A3, and if the first threshold (65535) is exceeded, the card is blocked and ceases to be allowed to request registration (if other functions work, for example, phone book). For the best minds of exploitation, if A3 is called during skin registration of a SIM card in a cell (with a phone number), such an exchange does not matter to the subscriber. And the axis for the K I trim may be needed Great number sample

As if the evildoer was far away to pick up the brothers K I, I take away the ability to call for someone else's account. But here there are a few factors that are bordering. First, because pennies on the rahunka to start faster, lower, ring out, ymovirno, that the owner of the SIM card can remember. At the detailed rozdrukіvtsі vіdrazu zavіvі dzvіnki appear. Get and "unlimited" tariffs, because. they also have є obezhennya, zokrema for dzvinkіv for the cordon. That's why the evil-doers pragmat yaknaishvidshe vimoviti the entire available balance and dare the clone. In another way, if the cards are registered in the merger, then the input calls come to the card, as the rest was authorized, otherwise the remaining output call was sent. Evidently, a legitimate coristuvach can remember that you should stop needing a ring. Malicious people with the method of secrecy vzagali are forbidden to pick up the phone. Otherwise, the correspondents of the koristuvach would immediately reveal shakhraiism. Thirdly, the operator can count SIM-cards, which are registered in a number of geographically separated places for a short period of time. For suspicion of a cloned card, the operator will block the card, and the subscriber will see a new one.

Summarizing, we can say that you can clone SIM-cards, but it’s important to do it. Since the operator has modernized the implementation of A3 in its own time, and its supporters are loyal and incorruptible, then subscribers are not afraid of the appearance of clones of their SIM-cards. On the other hand, the relevance of such shakhraystvo is declining, because. drinking on cheap calls for cordon is compensated by the possibility of calls from Skype, as well as by propositions from legal operators.

Roses overflowing at the GSM Merazhі

Let's move on to looking at the evil GSM. Articles about inconsistency in A5 / 1 appeared about 15 years ago, but there was no public demonstration of the evil A5 / 1 in the minds of the real world. Moreover, as can be seen from the description of the robotic measure, it is necessary to understand that the evil encryption algorithm itself needs to solve a number of daily engineering problems, as if they were omitted from a glance (including those at public demonstrations).

Most of the articles on the evil GSM are based on the article by Eli Barkan in 2006 and the contribution of Karsten Noh.

In the article Barkan with co-authors showing that because in GSM, pardon correction goes to encryption (but it needs to be changed), it is possible to change the scope of the search for the selection of K C and the implementation of the known-ciphertext attack (with passive eavesdropping on the air) for a good hour for the help of the calculation of data in advance.

The authors of the article themselves seem to think that if they receive without reshkod for an evil drawer 2 minutes, 50 terabytes of reimbursable data is required. At the same article (at the distribution about A5 / 2) it is indicated that the signal from the air is always in line with the recodes, so that the key can be combined. For A5 / 2, a change has been made to the algorithm, which is a kind of building insurance reshuffle, but with the help of a greater obligation to re-insurance of data, and, obviously, an hour of damage to a greater debt. For A5/1, the possibility of prompting similar to the algorithm is indicated, but no vin is indicated. You can admit that in this case it is also necessary to increase the amount of reinsurance of the data of the widows.

The process of selecting the key A5/1 is to be deposited at the hour, then. The better you go to the hearing, the greater the opportunity to pick up K C . In this manner, the statement in Article 2 hvilin - tse razkovy, and not guarantees, the hour for the selection of K C .

Carsten Nohl is developing the most popular project for the evil GSM company. Yogo firm, as it deals with the problems of computer security, was elected until the end of 2009 in open access round tables of session keys to the A5/1 algorithm, which is used to encrypt traffic in GSM networks.

His demarche against A5/1 Karsten Knoll explains the need to turn the respect of the vastness to the real problem and the need for operators to make calls to switch to perfect technologies. For example, the UMTS technology transmits the 128-bit algorithm A5 / 3, the stability of such a thing, which is not possible with any available methods today.

Behind Karsten's rozrahunki, the full table of A5/1 keys in the packaged look takes 128 petabytes and is distributed on the anonymous computers at the Merezha. For її rozrahunku need about 80 computers and 2-3 months of work. Іstoday izmenshennya hour calculate the amount of robit of current CUDA records graphic cards and programming Xilinx Virtex arrays. Zokrema, bagato galasu made yoga vistup at 26С3 (Chaos Communication Congress) in thorax 2009. You can briefly formulate the essence of the speech as follows: it will not be difficult to realize the appearance of budget systems for online decoding A5/1.

Let's move on to engineering problems. How do you take the data from the Ether? To cross the roses, you need a full scanner, which is responsible for picking up, how to move around, at certain frequencies, which operators stink, which telephones with which TMSI present moment active. scanner base stations.

On the Internet, it is possible to get such a scanner without a decoder for 40-50 thousand rubles. dollars Tse cannot be called a budget annex.

In such a manner, for the creation of an attachment, which, after awkward manipulations, to start listening to a telephone call, it is necessary:

a) realize the part that works with the ether. Zocrema, let me tell you which TMSI shows the phone that you are joking about, or for the help of active attacks, send telephones and “reveal” your real IMSI and MSISDN;

b) implement an algorithm for selecting K c for A5 / 1, which works well on real data (with reshuffles / pardons, reruns just fine);

d) combine all the points at the end of the final solution.

Karsten and other contributors overrule point "c". AT

Zokrema, Yogo Colleagues to chime in OpenBTS, airdump and Wireshark for a meeting IMSI(IMSI catcher). The report about attachments and other interchanges is written below in the “Attack of the Man in the Middle in GSM” section. For the time being, it can be said that this attachment emulates the base station and that it will be between the MS and the right base station.

Additional information confirms that the SIM card can easily be shown to the phone, that it works in the A5 / 0 encryption mode (that is, without encryption in the ignition) and that there are more SIM cards in circulation. It's really possible. GSM 02.07 says (Normative Annex B.1.26) that the SIM card should set a special OFM bit in the Administrative field, which, if equal loneliness, bred to the fence an indication of the encryption of the z'ednannya (at the sight of a barn lock). GSM 11.11 Restore the following access rights to this field: read is not available at all, but write permissions are described as "ADM". The specific set of rights that regulate the entry in this field is determined by the operator at the stage of SIM-card matching. In such a rank, additional information suggests that most of the cards are issued with an inserted bit and telephones do not show an indication of the availability of encryption. It is true that it is easier for the IMSI catcher robot because

The spy on the phone can not detect the daytime encryption and suspect it.

Cicava detail. Recent authors have come across the fact that phone firmware is tested for compliance with GSM specifications and is not tested for handling abnormal situations, which is why in case of incorrect operation of the base station (for example, OpenBTS “substitute”, as it was hacked for overriding), phones often freeze.

The greatest resonance was made by the statement that for $1500 you can get USRP, OpenBTS, Asterisk and airprobe for a ready-made kit for listening to roses. This information was widely disseminated on the Internet, only the authors of novelties and similar articles forgot to guess, that they themselves did not give additional details, and the demonstration did not come up.

In early 2010 rock Carsten and Munaut (Sylvain Munaut) again spoke at the conference 27C3 with an additional note about the roses overturning in GSM meshes. How many times have the stench presented a greater scenario, but in a new one, the impersonal "hothouse" minds.

For the purpose of revealing the distribution of stench, use Internet services, which allow you to enter “send routing info” into the SS7 measure. SSV - tse merezha / stack of protocols telephone operators(GSM and "terrestrial") one by one and for the combination of GSM components one by one.

They gave the authors a request for the implementation of a mobile phone call in Nimechchyna. There, as a result, the RAND request is well correlated with the region code (area code / zip code). Therefore, it is possible to name it there exactly to the place, or to name parts of the place, so that the subscriber is known in Germany. Ale robiti operator is not goiter.

Narazі doslidniki know the place. After all the stink, take a sniffer, go to a known place and start building all the LAC. Arriving at the territory, how to enter the LAC, they send the victims SMS and listen for paging on the victim's phone (it is on an unencrypted channel, for all basic voices). Like a tweet, they will take away information about TMSI, which is a kind of vision for the subscriber. Yakshcho nі - їgo overvіryat offensive LAC.

Next, indicate that because IMSI is not transmitted during paging (and the last ones don’t know), but only TMSI is transmitted (what a stink and want to know), then an “attack by hour” (timing attack) is carried out. They send a bunch of SMS with pauses between them, and wonder, for some TMSIs, paging is carried out, repeating the dot procedure, the list of “suspected” TMSIs does not have more than one dock (or one).

So that the victim did not commemorate such a “promotion”, such an SMS is enforced, which will not be evidence to the subscriber. Either special creations of flash sms, or wrong (beating) SMS, which phone to process and see, and nothing is shown.

Z'yasuvavshi LAC, stink pochinayut vodvіduvati vіdvіduvati vіdvіduvati vіdvіduvatі vіdvіduvati vіdvіduvatі vіdvіduvatі vіdvіduvati vіdvіduvati tsіgo LAC, nadsilati SMS-ki ki podguki paging. If it is true, then the victim is in this cell, and you can start to break the session key (K C) and hear it.

Before cym it is necessary to write down the ether. Here the doslidniki pronounce on their feet:

1) based on the FPGA-board installation, which can record all channels at once, either uplink (communication channel from the subscriber (phone or modem) to the base station of the telephone operator), or downlink (communication channel from the base station to the subscriber) GSM frequencies (890-915 and 935-960 MHz are available). How bulo is appointed, the cost is the same possession of 4050 yew. dollars, the availability of such a possession for a simple doslednik of security is doubtful;

2) it is possible to take a smaller amount of pressure and a more cheaper possession and hearing of a part of the frequencies on the skin from them. This option costs approximately 3.5 thousand. euro according to decisions based on USRP2;

3) you can break the session key, and then decode the traffic “on the fly” and follow the change of frequency (frequency hopping) for the help of some phones, which have alternative firmware OsmocomBB. Telephone roles: The 1st telephone is selected for paging and voice control, the 2nd telephone is seen by the subscriber for mobile calls. With this skin, the phone is guilty of writing reception and transmission. Tse is an extremely important point. Up to this point, OsmocomBB has been little practiced and stretched to rock (from 26С3 to 27С3) OsmocomBB was upgraded to the adventitious to the standard, tobto. until the end of 2010, there was no practical workable solution.

The evil of the session key. Perebuvayut in one cell with the victim, stink send їth SMS, write down the victim's connection with the base one, and hack the key, chiseling it, at the first hour of the session setup (session setup) there will be an exchange of anonymous packets in or out of the box. For the sake of evil vikoristovuyutsya district tables. At the time of the 26C3 table, the tables were not so good and evil, shying away not for the bad days and not for the dozens of bad days (the authors guess the year). So until 27C3, there was no solution to call Karsten (the main worker in my gallery), as it allowed the KC to be broken in a pleasant hour (by pulling which, better for everything, there will be no change of the session key (rekeying)).

Let's wait for the elders to complain about it, that changing the key is rarely shy after a skin call, or SMS that session key, which stench was recognized, does not change for a long time. Now, knowing the key, they can decode traffic encryption to the victim in real time, and work to change the frequency (frequency hopping) at the same time with the victim. In order to bury the air in any given moment, it is really enough to have enough telephones to ask again, so it is not necessary to write all the frequencies and all the timeslots. The successors demonstrated this technology in robots. True, the “victim” was sitting on the floor and was served by one cell.

Pіdvodyachi intermediate pidbag you can firmly confirm the power of the possibility of overwriting and decryption on the basis of GSM roses. When you need to remember this take:

1) The technology is not described any more in the eyes, available to any kind of kiddies (zokrema. script kiddies). The goal is not to build a constructor, but to prepare for the details of the designer, as I need to refine it to the appendage for the quotation. Doslidniki more than once respect that the stench does not have clear plans for making public access to the specifics of the implementation. This means that on the basis of these dorobkiv, the workers of the Close Descent do not prepare a mass annex for 100 dollars, as everyone can hear.

2) OsmocomBB supports only one family of chips (even the widest).

3) The method of determining the distribution of requests to HLR and enumeration of LAC is more theoretical, lower practical. In practice, the evildoer either knows where the victim is physically, otherwise he cannot eat in the same place as the victim. Like an evildoer, you cannot listen to that very cell, in which the victim is trying, there is no way.

On the surface of the demonstration, in fact, in the middle of the LA adventages, there are thousands of paging alerts. Moreover, paging does not work at the time of editing, but in the first hours of the day in batches (behind paging groups with their own lines, the number of which is an excess in the IMSI subdivision on the number of channels, as in the skin cell, you can use your own), which will re-implement .

4) Admissible, LA knowledge. Now you need to "name" the subscriber's name. Transmitting to the phone may be tight 1-2 wati. Obviously, scan yoga from a few dozens of meters and tasks (we won’t forgive). Exit phenomenon: LA curves, for example, the whole area (local). For example, they have 50 hundreds, and some of them have a radius of up to 30 km. We try to slander and decipher on an omnidirectional antenna viprominuvannya. For the implementation of this task, such an option needs a lot of possession. As it turns out, there are reasons, if the victim is found to be in direct line of sight, then. in a way that seems to be more realistic, richly efficient and simpler than directing the microphone. The next thing to note is that in the demonstration the last ones outsmart their telephones with a 2-meter winder.

5) Relocation of the victim between the stylists calls out problems, tk. you also need to move out of her at once.

6) Telephones, which are featured in the demonstration, require hardware modifications, it is necessary to remove the filter from the antennas in them, otherwise the "foreign" uplink telephones do not "play". The filter on the telephone is needed in order to “hear” not all frequencies, but only “your own”.

7) If the key is changed regularly (rekeying) or the TMSI is changed (expected from the previous ones not being recovered), the method does not work in the fire, or it’s even worse (the hour of decryption may appear more than the hour of decryption).

8) Don't listen to the whole thing, you need to know the phone number.

Defendant against traffic overflow

1) Change of constant byte to change for paging of empty GSM-adjustment of change values.

2) Change K C after skin tag.

3) Minimize TMSI more often.

Items 2 and 3 can be changed with a simple configuration of the element in the provider's network and do not require firmware updates, or have it.

There are various modifications of telephony on the market, for example, a crypto smart phone Cancort, which ensures the robot on the lines of communication with the GSM 900/1800 standard in two modes:

emergency mode (primary GSM mode);

Encryption mode is guaranteed against malicious encryption of information.

Cancort has the following features:

Encryption / decryption short reminders(SMS service)

Data encryption/decryption (service BS26 and GPRS).

Encryption / decryption of electronic mail.

Encryption / decryption of information of all telephone directories (SIM PB).

Encryption/decryption of MMS information.

Also, for the attack, you can use a scrambler, as they have proven themselves well in the attack of the great telephone networks. As a butt, you can point the GUARD GSM. Tsey Priya(like analogues) connect with a stylish phone using a hand-held headset and may be small. The GUARD GSM scrambler has thirty two scrambler modes.

The principle of operation of this scrambler is based on cob disruption and timcha shifting of the sound on the transmitting side with further inspiration on the receiving side. This process is two-sided. The timing permutation of the moving signal and its sequence of receptions occupy the first interval of an hour. Because of the language power of such equipment, there is little interference with the signal on the receiving side. As a rule, the ear of roaming starts at the open mode and then, on command, it switches to the scrambling mode. When conducting negotiations, the applicator simultaneously performs two functions of scrambling and descrambling. The message is encrypted by one of the subscribers, and the other scrambler, which is known to the other subscriber, decrypts the message. You will be directly connected to the gate, if you start talking to another subscriber.

Technical characteristics:

1. Diversity of the movie is not less than 95%.

2. Type of call - full duplex.

3. Shuttering to the line signal is no more than 100 ms.

4. The line protection ratio of the thymic signal.

5. Linked to the GSM 900/1800 standard.

6. Connection type up to style phone wired headset 7. Dimensions 80х45х16 mm

GSM man-in-the-middle attack

The previously reviewed attack actively defeated the IMSI-catcher attachment. At whom the division is considered the principle of work similar to the building that yoga smut.

On the Internet, you can hear impersonal proposals for the sale of special outbuildings, which can emulate base stations. In such voices it is declared that such emulators allow you to secretly eavesdrop, whether or not you speak, without informing the operator and calling without knowing the telephone number of the eavesdropped person.

Attachments with similar functionality are effectively known (for example, the RA 900 complex is being developed by Rohde & Schwarz), but the stench may be far from being so hostile:

1) you can only install a secret, which is in the cover zone of the phone, in which a SIM card is inserted from the assigned IMSI, or take the IMSI / IMEI list instead of phone numbers in the cover zone "pseudo-basic". Tse maє on uvazі, scho to the evildoer vіdomy IMSI.

2) You can listen to the day of your call from a specific phone, but the subscriber will have an encrypted signal enabled. In addition, the subscriber's number will be changed or attached. If so, the subscriber himself can reveal the fact of wiretapping (or suspect).

3) In case of uninterrupted wiretapping, calls cannot be delivered to the subscriber and, obviously, cannot be wiretapped. In order to decide subscribers in the area, the subscriber who is being eavesdropped is known as a “covered area”.

As you can see, the functionality of conveying the obviousness of singing statements about the victim.

Principles of work IMSI-catcher

IMSI-catcher is an attachment, which, from one side, behaves like a GSM base station, and from the other side, take away your SIM card or else technical background for connection from communication measures. Vikoristovuetsya out like this:

1. Attachments are located near the victim's mobile phone. The distance depends on the intensity of the real base station.

2. When robotic attachment is a great station. Obviously, she is guilty of seeing for herself the station of that operator, to which the victim lies. It is not necessary for the GSM standard, so that the base station confirms its authenticity to the phone (for example, it is easy to get through to the phone). The frequency and intensity of the signal of the broken base are selected so that the real base stations of all the vascular networks do not create the robot's transition.

3. The victim's phone should be set to select an updated base so that I can get the best available base station through a good and weak signal. The principle of choice has been described earlier. As a result, the attacker can determine the IMEI of the victim.

4. To listen to the calls during the registration hour, the database was updated to inform the phone about the need to switch to the A5 / 0 encryption mode, so that it does not start with encryption. A GSM phone cannot be moved.

5. When all the calls of the victim pass through the next station at a clear sight, they can be recorded / listened to. The pristry acts as a proxy, independently calling on the dialed number and transparently translating a voice in an offending direction.

Exchange IMSI-catcher

1. When connected to a broken station, the victim becomes inaccessible to input calls. For support of incoming calls, the extension is obliged to be serviced by the operator's service as well as other base stations. For which one you need to connect to a base station controller (BSC), you must register in your routing tables. However, if the attacker can access the operator’s network on the level, which allows you to connect and configure new base stations, then in this way you can efficiently win SORM. Yakshcho krіm sacrifices to the zone of coverage I will add to eat others mobile phones, roztashovani order from the victim, the stench will show the obviousness of the cover, but there are no entrances, no exit calls to serve anything. Tse mozhe cause pіdozri.

2. Larger current telephones may indicate encryption (like a padlock) and the victim may be wary, as if to say that the code is not encrypted.

3. For broadcasting weekend calls, I will add a video telephone line. As for which one wins, the power GSM-module with a SIM-card is used, the external calls to the updated station will be assigned to the number that specifies the number of the victim. For the purpose of accepting someone, you can win the service of “attaching the call number”, which can also alert the holders of the call and can tell about the victim. As an option, you can change the number of the updated station to the correct one, but also compose the design.

For more accurate change, it is necessary to add a SIM-card of the same operator as the victim, so that the attacker will be able to broadcast the victim's call on the service and short numbers.

4. If the victim is collapsing, you can easily get out of the cover zone, I’ll add it, I’ll bring it to the point where the process needs to be started back.

The re-arrangement of the nedolіki shows that the congestion of such an outbuilding is surrounded by short-line overflows of roses and is practically not suitable for trivial listening.

In this way, the main burden of such an attachment can be to identify the ShZSHMSh of the victim, for sure, only in the house of її miscalculation, and then we’ll already win the report about Sh5І for conducting a great listening by the SORM.

Visnovok

Perekhoplennya povіdomlenya in OBM merezhve is possible. Ale, vrakhovuyuchi mind, necessary for the implementation of perekhoplennya, we can say that the MBM of thefts is much shorter than shown in films and the Internet.