Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text...
Transcript of Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text...
![Page 1: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/1.jpg)
Catching IMSI catchersOr how we failed to find any.
![Page 2: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/2.jpg)
IMSI’s?
● International Mobile Subscriber Identity● Unique identity on mobile phone networks● Rarely send over the network
![Page 3: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/3.jpg)
IMSI catcher?
● Also known as Stingray in the U.S● Device to eavesdrop on conversation● Possibility for tracking movement
![Page 4: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/4.jpg)
![Page 5: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/5.jpg)
IMSI catcher catcher?
● Ways to detect silent text messages● Ways to detect SS7 network attacks● Ways to detect IMSI catchers● Or: battery drain
![Page 6: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/6.jpg)
Cryptophone
![Page 7: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/7.jpg)
SnoopSnitch
![Page 8: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/8.jpg)
100 euro and a few hours
● Moto E (XT1021)● Unlock + Root● Install SnoopSnitch● Not easy for average user
![Page 9: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/9.jpg)
Driving around
● Amsterdam →● Schiphol →● Wageningen →● The Hague
![Page 10: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/10.jpg)
![Page 11: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/11.jpg)
Nothing!
● Nothing interesting.
![Page 12: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/12.jpg)
![Page 13: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/13.jpg)
Schiphol?
● Nothing
![Page 14: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/14.jpg)
SnoopSnitch results
● Not a single event.○ No SS7 event○ No IMSI-catcher○ No silent text messages○ No nuffin’
![Page 15: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/15.jpg)
Cryptophone
● Lots of event.● Lots of the same events.● No useful data.● Only detects baseband issues.
○ Not such a good meaure.○ Didn’t catch any NSA TAO 0day
![Page 16: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/16.jpg)
Vodafone
● Doesn't seem to like silent sms● SnoopSnitch not working fine enough?● Need more cross-network data!
![Page 17: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/17.jpg)
Future research
● Gather data from more providers.● Use OsmocomBB C115.● Correlate data sources.
○ Hard to pull off
![Page 18: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/18.jpg)
Conclusions
● Were not on a shit list!(yet)
● Vodafone has a pretty fine network.● KPN as well.● Maybe too early?
![Page 19: Catching IMSI catchers - TA3M.org · PDF fileIMSI catcher catcher? Ways to detect silent text messages Ways to detect SS7 network attacks Ways to detect IMSI catchers Or: battery drain](https://reader033.fdocuments.us/reader033/viewer/2022051305/5a8650c07f8b9afc5d8d0193/html5/thumbnails/19.jpg)
What’s next?
● More research!● Standard integration for Iphone/Android!● Open source basebands……..