Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI...

27
Discovering and Triangulating Rogue Cell Towers Eric Escobar, PE Security Engineer

Transcript of Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI...

Page 1: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

DiscoveringandTriangulatingRogueCellTowers

EricEscobar,PESecurityEngineer

Page 2: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Whatisaroguecelltower?• Adevicecreatedbygovernmentsorhackersthathastheability

totrickyourphoneintothinkingit’sarealcellphonetower.

• AlsoknownasIMSIcatchers,interceptors,cell-sitesimulators,Stingrays,andprobablyafewmore.

• Roguecelltowershavetheabilitytocollectinformation aboutyouindirectlythroughmetadata (calllength,dialednumbers)

• Insomeconditionscancollectcontentofmessages, calls,anddata.

Page 3: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Howarecellsimulatorsusedtoday?AtHome(IntheUnitedStates):• IMSI-catchersareusedbyUSlawenforcementagenciestohelp

locate,track,andcollectdataonsuspects.

• ACLUhasidentified66agenciesand24statesthatownstingrays.• UsedtomonitordemonstrationsintheUS

• UsedinChicagopoliticalprotests

• It’spossibletomakeanIMSI-catcherathome• DEFCON18:PracticalCellphoneSpying - ChrisPaget

Page 4: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Howarecellsimulatorsusedtoday?Abroad:• ReporteduseinIreland,UK,China,Germany,Norway,

SouthAfrica

• Chinesespammerswerecaughtsendingspamandphishingmessages.

• Usedbygovernmentsandcorporationsalike.

Page 5: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

What’stheIMSIin“IMSI-catcher”?• IMSIstandsforInternationalMobileSubscriberIdentity.• Isusedasameansofidentifyingadeviceonthecellnetwork.

• Typically15digitslong

• Containsgeneralinformationaboutyoudevice(Country&Carrier)• MobileCountryCode– MCC

• MobileNetworkCode– MNC• MobileSubscription IdentificationNumber– MSIN

Page 6: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

What’sanIMSI?

IMSI=Uniqueidentifiertoyourdevice

Page 7: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

SampleIMSI:

310 26 0123456789MCC MNC MSIN

USA AT&T UniqueIdentifier

Page 8: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Why you should care?• Yourphonewillconnectautomaticallytocellsitesimulators.• Thievescanstealyourpersonalinformation.

• Hacker’scantrackwhereyougo,whoyou’retalkingto,andgraballsortsofotherdataaboutyou.

• Yourdigitallifecanbesniffedoutoftheairbyanyonewithsometechnicalchops,andalaptop.

• Yourcompanycouldbeleaking tradesecrets.

• Yourprivacyisatrisk.

Page 9: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Whybuildadetector?• TherearesomegreatappsforAndroidphonesandthathavethe

abilitytodetectcelltoweranomalies.

• Youneedspecificphonemodels&rootforthistowork

• Iwantedadevicethatmetthefollowingconditions:• Cheap~$50/device

• Iwantedtosetitandforgetit.• Iwantedtobealertedtoanyanomalies.

• Iwantedtheabilitytonetworkmultipledevicestogether.

Page 10: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Howdoyoudetectaroguecelltower?• Everycelltower(BaseTransceiverStation,BTS)beaconsout

informationabout itself

• ARFCN– Absoluteradiofrequencychannelnumber

• MCC– MobileCountryCode• MNC– MobileNetworkCode

• CellID– Unique identifier(withinalargearea)• LAC– Locationareacode

• Txp – Transmitpowermaximum

• Neighboring cells

Page 11: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Howdoyoudetectaroguecelltower?• Typicallythesevaluesremainconstant:

• ARFCN– Absoluteradiofrequencychannelnumber

• MCC– MobileCountryCode

• MNC– MobileNetworkCode• CellID– Unique identifier(withinalargearea)

• LAC– Locationareacode• Txp – Transmitpowermaximum

• Neighboring cells

• Powerlevel

Page 12: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Howdoyoudetectaroguecelltower?• Ifvaluesdeviatefromwhat’sexpecteditcanmeanthatthereis

maintenancetakingplace.

• Itcanmeanchangesarebeingmadetothenetwork.

• Itcouldalsomeanthatthereisaroguecelltowerisnearby!• Theideaistogetabaselineofyourcellularneighborhood overa

periodoftime.• Itwouldbelikekeepinganeyeonthecarsthatcomeinandout

ofyourneighborhood, afterawhileyoubegintoknowwhichdoesn’tbelong.

Page 13: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Howdoyoudetectaroguecelltower?• Examples:

• Anewtower(UnknownCellID),hightransmissionpower

• Mobilecountrycodemismatch

• Mobilenetworkcodemismatch• Frequencychange

• LocationAreaCodemismatch

Page 14: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Howdoyoulocateatower?• Combineuniquecelltowerdata,receivepower,and location.• Onedetectorcanbemovedaround withanonboardGPS

• Readingsofuniquetoweridentifiers,powerlevelandGPScoordinatesallowforasingledetectortocreateamap.

• Somemath,opensourceGISsoftware,andprettycolorscanapproximatelocationsoftowersorpossibleroguetowers

Page 15: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Howdoyoulocateatower?

Page 16: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Howdoyoulocateatower?• Multipledetectorswithknownlocationsallowfortrilaterationof

thesuspectedroguetower.

• Receivepoweranddistancearenotinverselyproportional

• Regressionformulaswererequiredtobecalculatedinordertofinetunetheresults.

• Lessaccuratebutstillprettygood

Page 17: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Howdoyoulocateatower?

Page 18: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

What’sthebuild?• RaspberryPi3,poweradapter,SDcard(runningstockRaspbian)• SIM900GSMModule

• SerialGPSmodule

• TVtunersoftwaredefined radio• Scrapwood&hotglue

Page 19: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Braceyourself…thisisquiteliterallyahack.

Page 20: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used
Page 21: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

SIM900CellModule

Scrap wood& hot glue

Raspberry Pi

GPSModule

SerialtoUSB

Softwaredefinedradio(USBTVTuner)

Page 22: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

SIM900• SIM900Engineeringmode

• Seventowerswiththehighestsignal

• Givesyouatonofinformationvia

aserialconnection• NoSIMcardisrequiredfor

engineeringmode

Page 23: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

GPSSerial• Adafruit UltimateGPSmodule

• Fixespositionquickly.

• Good indoorreception

• Worksexactlyhowyouwouldexpect

Page 24: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

RaspberryPi3• StockRaspbian OS(debian forpi)

• Pi3hasenoughpowertorunaSDR

• HasfourUSBportsforserialadapters• EasilypoweredbyaUSBbatterypack

Page 25: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

• $20Softwaredefinedradio

• Widerangeoffrequencies

• Github:Gr-Gsm• CanlistentorawGSMtraffic

• Seealltherawframes• Notnecessaryforlocatingcelltowers

• Providesdeeperinsights

TVTuner

Page 26: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Datacollection:• Everythingdumps toaSQLitedatabase forlateruse

Page 27: Discovering and Triangulating Rogue Cell Towers CON 24/DEF CON 24...What’s the IMSI in “IMSI -catcher”? • IMSI stands for International Mobile Subscriber Identity. • Is used

Questions?