IMSI Catchers and Mobile Security

More documents

Recommendations

Info

It appears that gaining access to first-hand nearby cell tower information as observed by the cell phone may require special access to the baseband chip in the SIM. Future steps could involve obtaining this baseband access to gain first-hand cell tower information, and using other heuristics to detect when a phone may be pinged by or connected to a fake cell tower, emulating the reported functionality of other IMSI catcher detectors. 4.6 Upgrading of 2G Networks and Phone Capabilities Attacks on GSM encryption have been shown as early as 1987, then re-iterated in 1994. Most recently, Karsten Nohl and Chris Paget demonstrated in 2010 that cracking GSM encryption can be done “at home”, using commercial software-defined radios (SDR) and Rainbow Tables [99]. The security researchers are part of an ongoing effort that calls for the overhauling of the highly-vulnerable 2G network and phone capabilities. If cellular networks and cell phones no longer support the GSM standard, then current IMSI catcher technology will be rendered obsolete. As of 2014, GSM continues to be the dominant standard for cellular networks worldwide. In the United States, some major carriers like Verizon and AT&T are starting to phase out their 2G networks (see Table 1 below). However, others like Sprint are instead taking advantage of the opportunity to grab some of the migrating customers to their 2G networks. In addition, even if network providers phase out the GSM standard, cell phones that still have baseband chips with 2G GSM functionality may still be susceptible to IMSI catcher attacks. In other countries, some major carriers have also begun shutting down their GSM networks, for example, Telstra (Australia) plans to do this by the end of 2016 [100]. Table 1: 5 Largest U.S. Wireless Service Providers Carrier Verizon Wireless 131.9 AT&T 120.6 Subscribers [101] (in millions) 2G Network Plans to shut down 2G (and 3G) network by approximately 2021 [101]. Plans to shut down 2G GSM network by approximately Jan 2017 [102]. Sprint 55.5 T-Mobile 55.0 Upgrading GSM networks to LTE and HSPA+ since 2012; plans to leave some 2G bandwidth in place [103] US Cellular 4.8 At the December 2014 Chaos Computer security conference, Karsten Nohl pointed out vulnerabilities in the 3G network that exploit the SS7 telephony signaling protocols [18]. SS7 enables the setting up and management of calls in a separate network rather than the same network that the call is made from, allowing for services like call forwarding and wireless roaming [104]. 28
Nohl explained that in 3G networks, although IMSI catching is still technically possible in the sense that catchers can force mobile phones to broadcast their IMSI numbers, direct man-in-themiddle attacks that allow IMSI catchers to eavesdrop and mimic mobile communications are not possible because IMSI catchers are unable to authenticate their identity (as base stations) to the mobile phone [18]. However, by exploiting global SS7 networks, IMSI catchers can obtain authentication proof from the mobile operator and falsely authenticate their identity to the mobile phone. Figure 13: Man-in-the-middle attack on 3G networks exploiting SS7 vulnerability In 2014, the News Tribune in Tacoma, Washington, unearthed a March purchase order from the Drug Enforcement Administration (DEA) for a “StingRay II to Hailstorm Upgrade” [105]. Hailstorm reportedly gives StingRay devices the capability to intercept 4G LTE phones even after 2G networks have been phased out, which imply that overhauling the GSM standard may not render all IMSI catchers obsolete. Martone Radio Technology also seems to advertise products with the capability to intercept 4G LTE phones [106], although this may merely be an ability to jam 4G signals and force the phone into a 2G connection before carrying out a man-inthe-middle attack. Apart from these two exceptions, no other 4G IMSI catchers are currently known to exist. 4.7 Wireless Network Providers Since IMSI catchers must simultaneously connect to the target mobile phone and the original cell tower, it is possible for network operators to detect IMSI catcher activity [99]. In the words of security researcher Karsten Nohl, “The network operator, in any given country, knows where IMSI catchers are operating.” 9 9 Note that this assertion stands in contrast to Strobel’s assertion in [9] that IMSI catchers can tap mobile phones in such a way that “even the network operator cannot notice anything”. 29
Page 1: By Joseph Ooi IMSI Catchers and Mob
Page 4 and 5: 1 INTRODUCTION IMSI catchers are ra
Page 6 and 7: Figure 1: GSM World Coverage Map [5
Page 8 and 9: Equipment Identity Register (EIR):
Page 10 and 11: 2.4.3 GSM vulnerabilities At a glan
Page 12 and 13: 3 IMSI CATCHERS 3.1 Introduction At
Page 14 and 15: Figure 4: Man-in-the-middle attack
Page 16 and 17: Digital Receiver Technology, Inc. (
Page 18 and 19: emulators more than 300 times over
Page 20 and 21: 4 COUNTERMEASURES 4.1 Detection Ind
Page 22 and 23: 4.1.6 Absence of Encryption As desc
Page 24 and 25: the near future. For calls, a new k
Page 26 and 27: Blackphone+. With these subsequent
Page 28 and 29: New cell towers suddenly appearing
Page 32 and 33: However, network operators have thu
Page 34 and 35: 6 APPENDIX 6.1 List of Federal Agen
Page 36 and 37: 6.3 Data Collection App source code
Page 38 and 39: Reset count of cell JSONObjects sig
Page 40 and 41: WORKS CITED [1] AT&T Tech Channel,
Page 42 and 43: [30] "A5/1 Decryption," [Online]. A
Page 44 and 45: manufacturer-asked?redirect=blog/na
Page 46 and 47: [82] A. Greenberg, "There’s Now a

IMSI Catchers and Mobile Security

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?