CELLULAR SECURITY THREAD

Ask questions about: 0. Architecture cellular networks (GSM/EvDo/CDMA/WCDMA/TD-SCDMA/LTE) 1. Cellular netmonitor and (celldriving or wardriving) 2. Radio direction finding in cellular networks 3. Cellular exploits and vulnerabilities (Calls, SMS, Mobile data) 4. Cellular protection from radiohaxx devices 5. How to running own enodeb and etc. 6. Hardware questions (only cellular bands) Questions about 802.11 (WiFi) protocol will be in another thread.

How easy is it to mess with cellular networks? I know that for WiFi, you can sniff Packers easily, but is the same case for cellular? Im also curious how authentication works in cellular networks. I assume something like PKI does not work the same?

>>20544 If you sniff 802.11, for example, in Wireshark, then all packets will be without encryption, just like GSM. GPRS/EDGE mobile traffic is also sniffered without problems, if we connect it from our interface in BTS. New mobile network standards will no longer be able to be verified due to need for auth and calc key, as in WIFI standards 802.11b/g/n, 802.11a/n/ac, 802.11ad, 802.11be For authentication in cellular networks, a mobile operator needs a node name AUC. While manufacturing SIM cards, an authentication key called Ki (16 bytes) is embedded in SIM. The same key is configured on AUC, for IMSI. During GSM authentication, AUC generates vectors using Ki, RAND, and Authentication algorithm. Send Authentication-Info (SAI) is the GSM level map protocol procedure. Each GSM MAP message uses SS7 as a transport protocol. RAND - need to generate yourself Requirements for RAND: - length 16 bytes - write it as a sequence of 32 hex chars - RAND should be different from Ki UE - simplified its target subscriber For 2G authentication, AUC keeps the Ki from UE, authentication algorithm (have A3, A8 functions) and generates random number (RAND). 3GPP /GSM provides a specification for the authentication algorithm. AUC for GSM 2G, sim cards send the triplet to MSC (or SGSN). Each triplet has RAND, Kc, and SRES. A3(Ki, RAND) -> SRES, A8(Ki, RAND) = Kc Upon receiving the triplet, MSC sends the RAND to the UE, UE uses pre-configured Ki and sends SRES to the MSC. If SRES same and from AuC, authentication is successful. MSC sends Kc to the mobile device for encryption. In 3G (USIM), the procedure is more complex than 2G, to make communication more secure. USIM profile on AUC has, Ki, Random Number (RAND), the Sequence Number (SQN), and algorithm( have functions, f1, f2, f3, f4, f5). In USIM there are five authentication vectors, which is called quintuple. Each quintuple has RAND, XRES, CK, IK, and AUTN. MSC can download multiple quintuples from AuC for future use. Re-synchronization in USIM, MSC may have older vectors (e.g when a subscriber moves to the previous MSC), this may fail in the matching of the sequence number in the UE when a vector needs to use. To synchronize the sequence number, the authentication request has the AUTS parameter. AUTS has SQN and MAC. New SQN is updated in AUC and a new set of vectors is transmitted to the MSC. 4G or LTE, the authentication process is similar to the 3G. Vectors are XRES, CK, IK, AUTH, and KASME. Here KASME is a new vector. Kasme calculation also has PLMN id as input. This makes vectors specific to the visiting PLMN only.

>>20545 Thank you anon! A lot to unpack, but definitely helpful

>>20545 >If you sniff 802.11, for example, in Wireshark, then all packets will be without encryption What is WPA?

Can anybody recommend high-quality Faraday bags or similar products? I have been looking to get a new privacy-centered phone for use in emergencies which I would keep isolated the majority of the time.

>>20581 A faraday cage you make yourself will be better than a scam faraday cage you buy online. The majority of them don't work even the "good" ones. A faraday cage is dead simple to make.

>>20557 WPA is link layer, 802.11 is physical layer (how bits get turned into radio signals) 802.11 is to WPA as physical wires are to Ethernet.

>>20581 GoDark makes very good bags, though they're (somewhat) pricey. You can snag a discount since they're doing holiday deals right now. Unfortunately, it looks like they're temporarily not accepting cryptocurrency, which is a shame since they actually accept XMR.

>>20583 >If you sniff 802.11, for example, in Wireshark, then all packets will be without encryption >802.11 is to WPA as physical wires are to Ethernet Sniffing lower down in the stack doesn't magically undo the higher layer encryption.

>>20544 At layer 1 you’ll see radio in like the 10-100mhz range iirc. At layer 2 it’s just encrypted serial comms. Not at all like packets or frames etc. think more like a walky talky than packet-switching. you can see the radio traffic with a software defined radio, like what channel is broadcasting, I believe also airplane traffic (again it’s from memory so idr completely) but you don’t see anything beyond that. I believe you have to mitm like a femtocell to see layer2+ (which is illegal ofc). 4G is quite secure besides the subscribers selling/lawjacking your data. Again iirc, but you can look up 802.16 for more info on that

>>20595 >iirc You know you are just making this up.

procedures and protocols for tethering an android phone to a linux laptop *securely*. Wireless and usb tethering. There is nothing out there. Run a firewall on the phone or pc or both? How to pipe wireshark data from the phone back to the pc while tethering at the same time? Is using tor and torrenting (outside tor) from the same tethered connection a security risk? There isn't anything about this out there.

6 months of using replicant then suddenly they blocked the device from the network. Other local networks too. I wasn't even thinking about doing any dumb soykaf, just used the phone for calls + sms and fuarrrked around with the settings + fdroid when I was bored on the bus. I hate phones. Get me started on getting this device back on a network. With replicant again of course. I wanna see if they kick it again to be honest.

>>20581 Mission Darkness makes great Faraday bags and pouches. https://mosequipment.com/

>>20637 Is this taboo or something lains? give me a few search words to start with.

>>20662 https://en.wikipedia.org/wiki/3G#Phase_out

>>20540 From a professional experience, it's becoming really important to start understanding the risks of Cellular networks. A lot of IOT solutions that are being brought are just coming with 5G connections built in with the tag line "USE IT ANYWHERE". While I agree that it comes with a number of benefits, it worries me that most people don't understand it and just think SIM Card goes in, device secure. >>20545 This is one of my main problems when trying to understand cellular networks, it uses so much pre-assumed knowledge that there is an hour or two pre-research just to understand what the fuarrrk this all means. I aint being asked to be spoon fed, but that's a ton of pre-assumed knowledge.

>>20594 they were talking about unencrypted 802.11 lainon...

>>20668 You need to understand rather first the network structure, for example LTE, which network nodes it has, what they are responsible for, where subscriber registration takes place, broadcasting on L3 MIB and SIB1-SIB11 messages, etc. No one will explain in detail, because there is a lot of information on the Wired.

is there a way to get a location of where (or who) a phone number was issued or used? a scammer tried to spear phish my father disguising as myself. i thought about making a simple html5 page with gps request and send to the number (not very foolproof obviously), but first i want to know if there is some way to do so in the actual protocol itself. i only managed to get the carrier and the country.