Introduction to Femtocells

....... introduction to femtocells

Kvin Redon

Technische Universitt Berlin, Security in [email protected]

OsmoDevCon 2012, Berlin, 24th March 2012

Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)UMTS architecture

SecT / TU-Berlin 2 / 20

Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)femtocells: ooading technology

technical name in 3G: Home Node B (HNB)technical name in 4G: Home evolved Node B (HeNB)trac ooad from public operator infrastructureimprove 3G coverage, particularly indoorcheap hardware compared to expensive 3Gequipmentthe user provides prower, Internet connection,maintenance, and still pays for the communicationdierent architecture (TS 25.467) more securityrequired (TS 33.302, TR 33.820)


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)small cells


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)Home Node B Subsystem (HNS)


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)SFR femtocell

39 femtocell oers over 24 countriestarget sold by SFR (2nd biggest operator in France)cost: mobile phone subscriptionhardware: ARM9 + FPGA for signal processingOS: embedded Linux kernel + proprietary servicesbuilt by external vendors (in our case Ubiquisys),congured by operator


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)Command and Control

HNB is not only an Node B, but also includes a miniRNC (TS 22.220)cell conguration is done by the HMS (TS 32.581)HNBHMS communicatio is tr-069 (aka ACS),using SOAP/XML/HTTPcells asks HMS, but HMS can also pushmost data provided one time, check at everyregistration, with rare updatesprovisioning data: SeGW address, HNB-GWaddress, MNC, MCC, ARFCN, GSC, ...


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)3G IMSI-Catcher

Howto build a 3G IMSI-Catcher:cell conguration is kindly provided as a feature offemtocellssome comfort provided ) hidden web interface

we can catch any phone user of any operator intousing our boxroaming subscribers are allowed by SFR

) the femtocell is turned into a full 3G IMSI-Catcher


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)mutual authentication

classical approach in GSM: IMSI-Catcherfake operator BTS (MCC/MNC)acts as MitM between operator and victimphone usually can't detectused to track and intercept communication

UMTS standard requires mutual authenticationmutual authentication is done with the homeoperator, not with the actual cellthe femtocell forwards the authentication tokensmutual authentication is performed even with arogue device


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)HNBHNB-GW communication

Iuh protocols:Iup: Iub over IPIMS/SIPGeneric Access Network (GAN)

GAN:UMA specied by operators in 2004standardized by 4GPP in 2005 into GAN (TS44.318,TS 43.318)designed for MSMNO communication over IP(WiFi)borrowed for femtocells, but needs to be adapted


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)Generic Access Network (GAN)

device is communicating with operator via GANprotocol (UMA)

TCP/IP mapped radio signalingencapsulates radio Layer3 messages (MM/CC) inGAN protocolone TCP connection per subscriberradio signaling maps to GAN messages are sentover this connection

GAN usage is transparent for the phone


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)but what about over-the-air encryption?

only the phone , femtocell OTA trac is encrypted) encryption/decryption happens on the box

femtocell acts as a combination of RNC andNode-B: receives cipher key and integrity key fromthe operator for OTA encryption

reversing tells us: message is SECURITY MODECOMMAND (unspecied RANAP derivate), whichincludes the keys


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)SECURITY MODE COMMAND

derived from RANAP, but spec unknown


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)plain text

OTA encryption optionaltrac decoded in the HNBthe only the SeGW access it used forauthentication/encryption when connectionall trac in plain textsame in HeNB (with stronger trusted corerequirement)


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)GAN proxy/client

proxies all GAN connections/messagesrecongure femtocell to connect to our proxyinstead of real GANCproxy diers between GAN message typesattack client controls GAN proxy over extendedGAN protocol


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)MitM

interception (SMS in GAN, voice over RTP)modication (because of the point to point design)injection (need the phone for authentication)


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)return of the IMSI detach

IMSI detach DoS discovered by Sylvaint Munaut in2010 1) results in discontinued delivery of MT services(call, sms,...)) network assumes subscriber went oinedetach message is unauthenticatedhowever, this is limited to a geographical area(served by a specic VLR)user can not receive calls

1http://security.osmocom.org/trac/ticket/2SecT / TU-Berlin 17 / 20

Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)imsi detach in femtocell ecosystem

proximity constraint not existent in femtocellnetworkdevices reside in various geographical areasbut all subscribers meet in one back-end system )and they are all handled by one femtocell VLR (atleast for SFR)

we can send IMSI detach payloads via L3 msg inGAN) we can detach any femtocell subscriber, noproximity needed!


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)the end

thank you for your attention

questions?


Home Node B (HNB) Home Node B Subsystem (HMS) HNB Gateway (HNB-GW)contact us

Nico Golde @iamnionKvin Redon Ravi Borgaonkar @raviborgaonkaror just [email protected]


Home Node B (HNB)Home Node B Subsystem (HMS)HNB Gateway (HNB-GW)

Introduction to Femtocells

Documents

Transcript of Introduction to Femtocells