Implementing an Affordable and Effective GSM IMSI Catcher with 3G Authentication

Abstract

Recently revealed information on secret agencies eavesdropping on the politicians’ phone calls all over the world, have shown how common practice it is. Although the insecurity of the mobile telecommunication system GSM has been known in the scientific community, these events made it clear to the public. Particularly, the extent and usage of such techniques demonstrates its relevance in the current society. In this paper, we will demonstrate techniques used to intercept mobile calls and analyze the feasibility of man-in-the-middle attacks in real-life scenarios. We show how to build an affordable and effective IMSI catcher which works even when mutual authentication between phone and a network is enforced. The methods to detect it and other potential countermeasures are discussed as well.

Appendix: Experimental setup details

In practice the attack consists of two phases: site survey and actual man-in-the-middle. The first phase is needed to gather information on the cells visible in particular area — this step is required to properly pick ARFCN on which attacking BTS should listen. The actual attack is then performed once target phone enters the area. Note that first phase does not have to be performed right before the attack — it is possible to gather this data separately.

1.1 Software

There are numerous open source projects implementing both network and mobile side of the GSM and, to some extent, 3G stack of protocols. This allows researchers unaffiliated with mobile industry to make independent inquiry into operation and security of mobile networks deployment.

Osmocom-BB [21] is an open source GSM stack implemented around Calypso chip used in old Motorola phones. It consists of several utilities including actual GSM phone implemented in software.

The command to start 2G phone is:

Tools like RSSI implemented on top of the Osmocom-BB stack were used to assess radio environment and monitor signal quality during the experiment. The following command will chain-load RSSI into Osmocom-compatible phone (Motorola model C123 and alike):

Xgoldmon [14] is the utility, which obtains debug stream from Intel/Infineon XGold baseband processor. It supports Samsung Galaxy S2/SIII, Note2 and Nexus phones. The read-only debug stream contains raw 3G messages including authentication request and response data. By writing IMSI of the target phone into programmable SIM card we can use xgoldmon-compatible attacking phone to issue authentication request and thus obtain authentication challenge made for the target phone as shown in Fig. 2.

OpenBTS [22] implements GSM base station with SIP backend. This makes experimental setup self-contained: no other components like BSC are required. During the experiment patched version of OpenBTS were used with additional functionality taken from Fairwaves version.

Due to version incompatibilities OpenBTS requires the explicit version of GNURadio¹³ software stack to work properly with USRPv1. It can be supplied using following commands:¹⁴

OpenBTS uses “open loop” power control, which means it does not actively control the transmission power of the cellphone. To successfully execute man-in-the-middle attack we should carefully assess radio environment and choose proper transmission power and a channel to operate on to make sure that radio interference from existing cells will not prevent our IMSI catcher from taking the role of preferred cell for cell selection.

To extract authentication information from xgoldmon the utility daemon was written. It parses the GSMTAP traffic and updates OpenBTS database with recent authentication data. This helps to automate the attack and further ease timing requirements. The authentication challenge contains SQN — sequence number, which is increased with every challenge so the current authentication challenge is invalidated as long as the phone receive authentication request with more recent sequence number.

Table 3. OpenBTS configuration options and cell (re)selection parameters

1.2 Hardware

The open source implementations of GSM protocols rely on either SDR hardware where all the signal processing details are handled in the software itself or on the chips with known or reverse-engineered specifications, which allows for fine-grained control over the data sent to the network.

UmTRX [20] is open source hardware project implementing SDR transceiver capable of GSM and LTE operations. It is a successor to quite popular USRP hardware with better clocking and multi-channel capabilities available out of the box. Both USRPv1 with ClockTamer clock source and UmTRX were used during the experiments.

Motorola C123 phone with Osmocom-BB firmware and Nokia with net-monitor feature enabled were used for the site survey during the attack.