Embed Size (px)
Citation preview
FOSLTEIMSICATCHERDOMI
WARNING!ThistalkwillbeaboutclassicIMSIcatchers– do
notexpectMITMcalls,dataetc.
GSMIMSIcatcher- recap• CreateafakeBTSwith• highreselectionvalue(C1,C2)• randomlocationareacode
• PhoneswillconnectandinitiateLocationUpdate• ReplywithIdentityRequest(requestIMSI)• AftergettingtheIMSIsendLUReject– cause13oranyotherdependingonyourintention
Whycouldwedothis?Nomutualauthentication,thenetworkisalwaystrusted
Rejectmessagesneedtobeunencrypted
(Sh*tty ornullcryptoalsoleadtoMITMetc.)
LTEArchitecture
EUTRANArchitecturebyCrati underCCBY-SA3.0
INTERNETPSTNPLMN
ChangesinLTE•Mutualauthentication
• Integrityprotection
• Bettercrypto
Procedureimprovements•MostproceduresrequireASsecurityenabled(integrityprotection)• UEsdropnon-protectedmessagesoncetheyhaveestablishedsecuritycontext
•Shouldbefine,right?
Tinylittleprotocolproblem…
TrackingAreaUpdateReject• UEsendsaTrackingAreaUpdateRequest• RogueeNodeB rejectsitwithcause9
3GPPTS24.301-5.5.3.2.5
CatchingtheIMSI• Nomorekey/securitycontextinUE
• UEwillinitiateattach
• ItisallowedtoaskforitsIMSIinanIDENTITYREQUEST
• AftergettingitwesendanATTACHREJECTwithcause#12(TrackingAreanotallowed)
HWandSW• USRPandlaptop•ManyopensourceLTEprojects(thisisAWESOMEbtw):•openLTE•OpenAirInterface• srsLTE andsrsUE• OwnimplementationofMME/corenetwork(pendingrequesttoopensourceit)
RogueeNodeB• Needtosomehow‘lure’UEs• InGSMyoujustneededaneighborcell’sfrequency+highreselectionvalue• InLTEalistoffrequenciesarebroadcastedwiththeirpriorities–>youneedtodecodethelist,andselectthefrequencywiththehighestpriority
ThesePeoplearegreat!*APPLAUSE*• Ravishankar Borgaonkar andAltaf ShaikfordiscoveringtheTAURejectvuln (andmanyotherproblems)inLTE• BenoitMichau forthelibrarymycorenetworkisbasedon• PhilippeLanglois andElvisPfützenreuter forpysctp
•MymentorsduringmyinternshipatQualcomm:KevinRedonandNicoGolde
Q&A
Thankyou!Key-ID:E2712651
Fingerprint:811C3FC3CFCB16E4BAEBF5FB7440DF59E2712651
![IMSI Catchers and Mobile Security...to prevent them from accessing the GSM network. Figure 2: Simplified GSM network architecture [9] 2.4.2 Authentication and Encryption When a Mobile](https://img.pdfslide.us/doc/110x75/5e7adc86e1f8f8227f24a8b6/imsi-catchers-and-mobile-security-to-prevent-them-from-accessing-the-gsm-network.jpg)
![Perspectives of Physical Layer Security (Physec) for the ... · hacking systems (such as advanced IMSI catchers for example [2]) that operate at the radio interface of wireless networks,](https://img.pdfslide.us/doc/110x75/5ecff013e6412007d6038dde/perspectives-of-physical-layer-security-physec-for-the-hacking-systems-such.jpg)
