Project

General

Profile

Mobile Network Assessment Tools » History » Version 10

Karsten, 12/23/2013 04:08 PM

1 1 Linus
h2. Overview
2
3
This is a collection of tools for the assessment of mobile network security.
4
It includes:
5 3 Linus
6
* *[[SIMtester]]*
7 8 Karsten
Finds configuration bugs in SIM cards
8 1 Linus
9 8 Karsten
* *[[GSMmap-apk]]*
10
Android application that collects 2G and 3G network traces from Samsung Galaxy phones
11
12 3 Linus
* *[[xgoldscanner]]*
13 8 Karsten
Linux application that collects 2G and 3G network traces from Samsung Galaxy phones
14 2 Linus
15 10 Karsten
* *[[CatcherCatcher]]*
16 8 Karsten
Collect evidence of 2G fake base station activity (requires Osmocom phone)
17 1 Linus
18
19 8 Karsten
The tools are included in the *GSMmap-live* system, which auto-submits data for analysis at "GSMmap.org":https://GSMmap.org
20 1 Linus
21
*****
22 2 Linus
23
h2. SIMtester
24
25 8 Karsten
Assess SIM card security in two dimensions:
26 2 Linus
27 8 Karsten
* *Cryptanalytic attack surface.* Collect cryptographic signatures and encryptions of known plaintexts
28 1 Linus
29 9 Karsten
* *Application attack surface.* Generate a list of all application identifiers (TAR) and find "unprotected" (NSL=0) applications
30 2 Linus
31
h3. Requirements:
32
33 8 Karsten
* Java (TODO: Which Java edition/version?)
34 2 Linus
* PC/SC reader –or–
35
* Osmocom phone
36
37 1 Linus
h3. Download
38
39 3 Linus
Pre-compiled .jar TODO
40
Source Code TODO
41 2 Linus
Live System TODO
42
43
h3. Instructions
44
45
# Download
46 1 Linus
# unpack
47 3 Linus
# run: TODO call
48
* TODO command line parameters
49
50 1 Linus
h3. Mailing list
51 3 Linus
52 9 Karsten
A public mailing list for announcements and discussion can be found "here":https://lists.srlabs.de/cgi-bin/mailman/listinfo/simsec
53 2 Linus
54
*****
55
56 1 Linus
h2. xgoldscanner
57 2 Linus
58 3 Linus
Actively collect 2G and 3G traces using Samsung Android phones.
59 2 Linus
Log files can be analyzed with Tobias Engel's "xgoldmon":https://github.com/2b-as/xgoldmon tool, which heavily inspired the development of xgoldscanner.
60
61
h3. Requirements:
62
63
* Samsung Galaxy S2 / S3  phone
64
* Micro-USB cable
65
* Linux Computer
66 1 Linus
67 2 Linus
h3. Download:
68 1 Linus
69
* Source Code (bash)
70
* Live System
71 6 Linus
72
h3. Disclaimer
73 7 Karsten
74 6 Linus
The active tests include an active part. First, your phone will place outgoing calls
75
to a dedicated number. This number will always be busy and never answer in order
76
to rule out voice charges as best as we can.
77
78
Secondly, your phone will send SMS short messages via an invalid SMS-C to
79
an invalid number.
80
81
During our tests we have not found a European network that charges for these
82
transactions. However, we can not rule out that you may be charged in specific
83
settings.
84
85
To control for involuntary charges, we strongly advise the use of a dedicated
86
pre-paid SIM card for these tests.
87 1 Linus
88
h3. Instructions
89 2 Linus
90 4 Linus
# Download
91
# unpack
92
# run:  <pre>sudo ./xgoldscanner.sh -n [telephone number, e.g. +491234567]</pre>
93
Optional parameters:
94
*  -g  conduct GPRS test
95
*  -d  display debug messages
96
*  -o  offline mode [skip log upload for manual submission]
97
*  -3  conduct 3G tests only [skip 2G tests]
98 2 Linus
*  -y  assume "yes" to questions and confirmation dialogues [for automated testing]
99
*  -i  <n> repeat each test <n> times (default is 5)
100
101 3 Linus
h3. Advanced usage
102 2 Linus
103 3 Linus
Use Tobias Engel's "xgoldmon":https://github.com/2b-as/xgoldmon tool to analyze log files.
104
105
h3. Mailing list
106
107 5 Ben
A public mailing list for announcements and discussion can be found TODO  "here":http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51 .
108 3 Linus
Please file bugs and support requests through the "issue tracker TODO ":http://opensource.srlabs.de/projects/a51-decrypt/issues/new as they may be of little relevance to the majority of the mailing list subscribers.
109 2 Linus
110
*****
111 1 Linus
112 10 Karsten
h2. CatcherCatcher
113 2 Linus
114
Display mobile network irregularities hinting at fake base station activity.
115
116
h3. Requirements:
117
118
* Osmocom phone
119 1 Linus
* Osmocom serial cable
120
* Linux Computer
121
122
h3. Download:
123
124 2 Linus
* Source Code
125
* Live System
126
127
h3. Instructions
128
129
# Download
130
# unpack
131
# run: TODO call
132
* TODO command line parameters
133 3 Linus
134
h3. Mailing list
135
136 5 Ben
A public mailing list for announcements and discussion can be found TODO  "here":http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51 .
137 3 Linus
Please file bugs and support requests through the "issue tracker TODO ":http://opensource.srlabs.de/projects/a51-decrypt/issues/new as they may be of little relevance to the majority of the mailing list subscribers.
138 1 Linus
139
*****
140 2 Linus
141
h2. GSMmap-apk
142
143
Actively collect 2G and 3G traces using Samsung Android phones.
144 1 Linus
145
h3. Requirements:
146
147
* Samsung Galaxy S2 / S3 phone
148
149 2 Linus
h3. Download:
150
151 1 Linus
* Pre-compiled .apk
152
* Source Code
153 6 Linus
154
h3. Disclaimer
155
156
Our 3G tests include an active part. First, your phone will place outgoing calls
157
to a dedicated number. This number will always be busy and never answer in order
158
to rule out voice charges as best as we can.
159
160
Secondly, your phone will send SMS short messages via an invalid SMS-C to
161
an invalid number.
162
163
During our tests we have not found a European network that charges for these
164
transactions. However, we can not rule out that you may be charged in specific
165
settings.
166
167
To control for involuntary charges, we strongly advise the use of a dedicated
168
pre-paid SIM card for these tests.
169 2 Linus
170
h3. Instructions
171
172
# Install application from App Store
173
# Run
174 3 Linus
175
h3. Mailing list
176
177 5 Ben
A public mailing list for announcements and discussion can be found TODO  "here":http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51 .
178 3 Linus
Please file bugs and support requests through the "issue tracker TODO ":http://opensource.srlabs.de/projects/a51-decrypt/issues/new as they may be of little relevance to the majority of the mailing list subscribers.
179 2 Linus
180
*****
181 1 Linus
182 2 Linus
h2. GSMmap-live
183 3 Linus
184
This live linux system is equipped with all the assessment tools listed above. It furthermore includes
185 2 Linus
It facilitates their use and automatically uploads logs to GSMmap.org.
186 1 Linus
187
h3. Requirements:
188
189
* 64bit-compatible Computer
190
* For each test: Requirements listed above
191 2 Linus
192
h3. Download:
193
194 1 Linus
* Live system image
195 6 Linus
* Source Code
196
197
h3. Disclaimer
198
199
Our 3G tests include an active part. First, your phone will place outgoing calls
200
to a dedicated number. This number will always be busy and never answer in order
201
to rule out voice charges as best as we can.
202
203
Secondly, your phone will send SMS short messages via an invalid SMS-C to
204
an invalid number.
205
206
During our tests we have not found a European network that charges for these
207
transactions. However, we can not rule out that you may be charged in specific
208
settings.
209
210
To control for involuntary charges, we strongly advise the use of a dedicated
211 2 Linus
pre-paid SIM card for these tests.
212
213
h3. Instructions
214
215
# Download
216
# Unpack: <pre>tar xvzf gsmmap-live.img.tar.gz</pre>
217
# Write to stick <pre>dd if=gsmmap-live.img of=/dev/[USB-stick] [bs=1M]</pre>
218 3 Linus
# Boot from stick
219
220
h3. Mailing list
221
222 5 Ben
A public mailing list for announcements and discussion can be found TODO  "here":http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51 .
223 1 Linus
Please file bugs and support requests through the "issue tracker TODO ":http://opensource.srlabs.de/projects/a51-decrypt/issues/new as they may be of little relevance to the majority of the mailing list subscribers.