Project

General

Profile

CatcherCatcher » History » Version 7

Linus, 12/23/2013 05:55 PM

1 1 Linus
h1. CatcherCatcher
2 1 Linus
3 1 Linus
The CatcherCatcher tool detects mobile network irregularities hinting at fake base station activity.
4 1 Linus
5 1 Linus
h3. Requirements
6 1 Linus
7 1 Linus
* Osmocom phone
8 1 Linus
* Osmocom cable
9 1 Linus
* Linux computer
10 1 Linus
11 1 Linus
h3. Download:
12 1 Linus
13 7 Linus
* We recoomend using our "Live System":https://opensource.srlabs.de/projects/mobile-network-assessment-tools/wiki/GSMmap-live
14 7 Linus
* Source Code is available in the OSMOCOM repository. See [[Tutorial]] for manual installation instructions.
15 3 Linus
<pre>git clone git://git.osmocom.org/osmocom-bb.git
16 2 Linus
git checkout luca/catcher</pre>
17 7 Linus
18 1 Linus
19 4 Linus
20 1 Linus
h3. Instructions
21 1 Linus
22 4 Linus
# Download "GSM Map Live System":https://opensource.srlabs.de/projects/mobile-network-assessment-tools/wiki/GSMmap-live
23 4 Linus
# "Install Image to Stick":https://opensource.srlabs.de/projects/mobile-network-assessment-tools/wiki/GSMmap-live#Instructions
24 4 Linus
# run: From the main menu, choose "Run a test -> FakeBTS"
25 1 Linus
26 1 Linus
h3. Mailing list
27 1 Linus
28 1 Linus
A public mailing list discussion is "here":https://lists.srlabs.de/cgi-bin/mailman/listinfo/catchercatcher
29 1 Linus
30 4 Linus
h2. Background & Development information
31 1 Linus
32 4 Linus
h3. OsmocomBB software
33 1 Linus
34 1 Linus
Currently, the IMSI Catcher detector is available only for the OsmocomBB platform.
35 1 Linus
If you'd like to test it, you can find all the needed information in our [[Tutorial]]
36 1 Linus
Please upload improvements as patches to this site or post to the "mailing list":http://lists.srlabs.de/cgi-bin/mailman/listinfo/catchercatcher until a Git is set up.
37 1 Linus
38 4 Linus
h3. Implementation on other platforms
39 1 Linus
40 1 Linus
While Osmocom provides access to most detailed GSM data, other platforms could, too, provide useful information for detecting IMSI catcher attacks.
41 1 Linus
42 1 Linus
Folks with insights into phone programming APIs, please help fill out this list:
43 1 Linus
44 1 Linus
|                           |\4.*Available on*                      |
45 1 Linus
| *Evidence*                | Blackberry  | [[Android]] | iOS | Symbian |
46 1 Linus
| Cipher indication         | |[1] *#32489# // OEM_SM_TYPE_SUB_CIPHERING_PROTECTION_ENTER | | |
47 1 Linus
| LAC                       | |[1a] getLac() | | |
48 1 Linus
| Cell ID                   | |[1a] getCid() | | |
49 1 Linus
| Retransmission counters   | | | | |
50 1 Linus
| TMSI                      | | | | |
51 1 Linus
| Send power                | |[1] LISTEN_SIGNAL_STRENGTHS ? | | |
52 1 Linus
| Silent call               | |[1]| | |
53 1 Linus
| Silent SMS                | |[1]|[2]| |
54 1 Linus
| Remote install            | |[1c] // INSTALL_ASSET| | |
55 1 Linus
| Network Roaming           | |[1b] getRoaming()| | |
56 1 Linus
|                 | | | | |
57 1 Linus
58 1 Linus
[1] TODO: Reference / API call needed
59 1 Linus
[1a]: android.telephony.gsm.GsmCellLocation
60 1 Linus
[1b]: android.telephony.ServiceState
61 1 Linus
[1c]: GTalkService
62 1 Linus
63 1 Linus
[2] TODO: Reference / API call needed
64 1 Linus
65 1 Linus
Preliminary information for developing an Android based Catcher can be found on the [[Android]] page. 
66 1 Linus
67 5 Linus
h3. IMSI catcher detection
68 1 Linus
69 1 Linus
70 1 Linus
For IMSI catchers to achieve their goals they will need to show behavior different from normal base stations. We distinguish between yellow, red, and black flags. Yellow flag are an indication that you might have been caught; red flags are a very strong indication; and black flags tell you: "You are being tracked down; throw away your phone and run."
71 1 Linus
72 1 Linus
| #   | *Flag* | *Evidence* | *Implementable in Osmocom* |
73 1 Linus
| Setup: |
74 1 Linus
| S1  | R | No encryption after using encryption with the same operator before | done |
75 1 Linus
| S2  | Y | Cipher mode complete message is sent more than twice               | wip  |
76 1 Linus
| S3  | R | … more than four times                                             | wip  |
77 1 Linus
| S4  | Y | IMEI not requested in Cipher Mode Complete message                 | done |
78 1 Linus
| S5  | Y | Cell is not advertising any neighbor cells                         | todo |
79 1 Linus
| S6  | Y | Cell reselection offset > 80db                                     | todo |
80 1 Linus
| Location updating (for information gathering, MITM): |
81 1 Linus
| L1  | Y | The LAC of a base station changes                                  | done |
82 1 Linus
| L2  | R | The LAC changes more than once                                     | done |
83 1 Linus
| L3  | Y | The LAC differs from all neighboring cells                         | wip  |
84 1 Linus
| L4  | Y | The network queries the phones IMEI during location update         | done |
85 1 Linus
| L5  | Y | The registration timer is set to a value < 10 minutes              | wip  |
86 1 Linus
| L6  | Y | The "IMSI attach procedure" flag is set                            | wip  |
87 1 Linus
| (when locating a victim): |
88 1 Linus
| L7  | Y | Receive a silent text message                                      | done |
89 1 Linus
| L8  | R | You are paged, but do not enter any transaction                    | done |
90 1 Linus
| L9  | R | Being assigned a traffic channel but not entering call control state/receiving a text message for 2 seconds | wip |
91 1 Linus
| L10 | B | ... 10 seconds                                                     | wip  |
92 1 Linus
| L11 | Y | You do not receive a call setup message while already being on a traffic channel for 2 seconds | done |
93 1 Linus
| L12 | R | ... 10 seconds                                                     | done |
94 1 Linus
| L13 | Y | Your phone sends at the highest possible power                     | wip  |