A5/2: Ciphertext Only Attack A5/2 could be attacked with cipher-text only, using the Error Correction Code, in order to retrieve the session key.

For the purpose of simplicity suppose that the error correction code copy the plaintext 4 time.
e.g., for $=1010101$ we will encrypt the following bits: $1010101 \space 1010101  \space 1010101 \space 1010101 \space 1010101$.

Here's an example of a message and a corresponding cipher:

$'= 1010101 \space 1010101 \space 1010101 \space 1010101 \space 1010101$
$= 0110100 \space 1000001 \space 1101111 \space 0000101 \space 1010111$

Bold bits are from the same bit in plaintext.

How can I find the session key this way?

I guess I need to make some linear functions, such as:

$p_0 \oplus k_0 = 0$,

$p_0 \oplus k_8 = 1$,

etc...

But I can't really find the key this way.
The idea in [1] (disregarding reception errors) is to first remove the impact of the message. This is done by computing the syndrome

$\qquad\qquad\mathbf{H} \mathbf{v} = \mathbf{H} (\mathbf{m} \oplus \mathbf{k}) = \mathbf{H}\mathbf{k}$.

In the case of a ${1}/{5}$ repetition code, this could correspond to adding even number of (bold) codeword symbols together (since it is a repetition code they should be equal, right?), forming linear equations containing only keystream bits. Then, by exhaustively trying all $2^{16}$ starting states, it is possible to mount an attack (for each starting state) consisting of Guassian elimination, solving for the session key.

I found a reference implemenation at [2], which you might want to check out.

[1] http://www.cs.technion.ac.il/users/wwwb/cgi-bin/tr-get.cgi/2006/CS/CS-2006-07.pdf

[2] http://www.npag.fr/project-a52hacktool