SITCH Inexpensive, coordinated GSM anomaly detection About Me - - PowerPoint PPT Presentation

▶
sitch
SMART_READER_LITE
LIVE PREVIEW

SITCH Inexpensive, coordinated GSM anomaly detection About Me - - PowerPoint PPT Presentation

Nov 27, 2023 515 likes •1.11k views

SITCH Inexpensive, coordinated GSM anomaly detection About Me 2000: Technology career started (I can get paid for this??) 2003: Started building with Linux Came to infosec through systems and network engineering, integration

slide-1
SLIDE 1

SITCH

Inexpensive, coordinated GSM anomaly detection

slide-2
SLIDE 2

About Me

  • 2000: Technology career started (I can get paid for

this??)

  • 2003: Started building with Linux
  • Came to infosec through systems and network

engineering, integration

  • Security tools and integration (SIEM, HIDS, etc…)
  • Current: R&D
slide-3
SLIDE 3

About You

  • Background in systems and network engineering
  • Interested in GSM threat detection
  • Tinfoil hat not required… but not unwelcome!
slide-4
SLIDE 4

–Ashmastaflash

“Thoughts and opinions expressed are my

  • wn. If you take anything away from this talk

and act on it, I’m not responsible if you go to jail, become a pariah, or your dog stops liking

  • you. Know the laws you’re subject to and
  • perate accordingly.”
slide-5
SLIDE 5

What We’re Covering Today

  • Why Care?
  • Current Threat and Detection Landscape
  • Project Goals
  • SITCH: MkI
  • SITCH: MkII
  • Service Architecture
  • Future Plans
  • Prior Art
  • Q&A
slide-6
SLIDE 6

Why Care?

  • Invasions of privacy are bad, even when

they’re unnoticed.

  • Industrial espionage costs money and jobs.
slide-7
SLIDE 7

WTF Is Under All That??

slide-8
SLIDE 8

Is Anybody Home?

slide-9
SLIDE 9

Terminology

  • Software Defined Radio (SDR): Using software to perform signal

processing in concert with an adjustable-frequency RF receiver

  • ARFCN: Absolute Radio Frequency Channel Number
  • BTS: Base Transceiver Station
  • CGI: Cell Global ID (MCC + MNC + LAC + CI)
  • MCC: Mobile Country Code
  • MNC: Mobile Network Code
  • LAC: Location Area Code
  • CI: Cell ID
  • IMSI: International Mobile Subscriber Identity
slide-10
SLIDE 10

GSM Addressing

slide-11
SLIDE 11

Threat and Detection Landscape

  • Malicious Devices
  • Indicators of Attack
  • Existing Detection Methods
slide-12
SLIDE 12

Hacked Femtocell

Trusted part of provider’s network Your phone doesn’t know it’s evil

slide-13
SLIDE 13

Evil BTS

Handset will automatically associate, unable to assert trustworthiness

slide-14
SLIDE 14

Indicators of Attack

  • ARFCN over threshold
  • ARFCN outside forecast
  • Unrecognized CGI
  • Gratuitous BTS re-association
  • BTS detected outside of range
slide-15
SLIDE 15

Detection Methods

  • Commercial Options:
  • Pwnie Express
  • Bastille Networks
  • Open Source:
  • Fake BTS
  • AIMSICD
  • Femto Catcher
slide-16
SLIDE 16

Project Goals

  • Inexpensive (what can I get for $100?)
  • Small footprint, low power requirements

preferred

  • Functional Targets: Indicators of Attack (IOA)

Coverage

  • Centrally managed software and

configuration

slide-17
SLIDE 17
slide-18
SLIDE 18

Raspberry Pi 2

slide-19
SLIDE 19

Raspberry Pi 2 logarithmic antenna

slide-20
SLIDE 20

Raspberry Pi 2 logarithmic antenna Odroids

slide-21
SLIDE 21

Raspberry Pi 2 logarithmic antenna Odroids C1+ XU4

slide-22
SLIDE 22

Raspberry Pi 2 logarithmic antenna Odroids C1+ XU4 galaxy of

slide-23
SLIDE 23

Raspberry Pi 2 logarithmic antenna Odroids C1+ XU4 galaxy of RED

slide-24
SLIDE 24

Raspberry Pi 2 logarithmic antenna Odroids C1+ XU4 galaxy of RED BLUE

slide-25
SLIDE 25

Raspberry Pi 2 logarithmic antenna Odroids C1+ XU4 galaxy of RED BLUE GREEN

slide-26
SLIDE 26

Raspberry Pi 2 logarithmic antenna Odroids C1+ XU4 galaxy of RED BLUE GREEN ORANGE

slide-27
SLIDE 27

Raspberry Pi 2 logarithmic antenna Odroids C1+ XU4 galaxy of RED BLUE GREEN ORANGE Intel NUC

slide-28
SLIDE 28

Raspberry Pi 2 logarithmic antenna Odroids C1+ XU4 galaxy of RED BLUE GREEN ORANGE Intel NUC Intel Edison

slide-29
SLIDE 29

Raspberry Pi 2 logarithmic antenna Odroids C1+ XU4 galaxy of RED BLUE GREEN ORANGE Intel NUC Intel Edison GSM Modem

slide-30
SLIDE 30

Raspberry Pi 2 logarithmic antenna Odroids C1+ XU4 galaxy of RED BLUE GREEN ORANGE Intel NUC Intel Edison GSM Modem RTL-SDR

slide-31
SLIDE 31

Raspberry Pi 2 logarithmic antenna Odroids C1+ XU4 galaxy of RED BLUE GREEN ORANGE Intel NUC Intel Edison GSM Modem RTL-SDR

I didn’t really *need* all

  • f this…
slide-32
SLIDE 32
slide-33
SLIDE 33

SITCH

Situational Information from Telemetry and Correlated Heuristics

slide-34
SLIDE 34

SITCH Sensor MkI

slide-35
SLIDE 35

SITCH Sensor MkI

slide-36
SLIDE 36

MkI Results

Targets MkI Coverage ARFCN over threshold YES ARFCN outside of forecast YES Unrecognized CGI NO Gratuitous BTS re-association NO BTS detected outside of range NO Price ~$100

slide-37
SLIDE 37

Releasing MkI?

No.

slide-38
SLIDE 38

What’s wrong with MkI?

slide-39
SLIDE 39

Start Demo Here!

  • Confirm device registration
  • Image download starts
slide-40
SLIDE 40

Deployment Pipeline

slide-41
SLIDE 41

Service-Side Software

Tool Purpose Logstash Inbound Information Processing Alert delivery Elasticsearch Scan document retention Carbon/Graphite Time-series database Statistical analysis of time-series data Kibana Browse scans Tessera Dashboard for Graphite Graphite Beacon Alert Generation Vault Secret management Resin Software Deployment Slack Notifications

slide-42
SLIDE 42

SITCH Service Architecture

slide-43
SLIDE 43

SITCH Intelligence Feed

  • OpenCellID Database:
  • MCC, MNC, Lat, Lon,

Range

  • Twilio:
  • MCC, MNC, CarrierName
slide-44
SLIDE 44

SITCH Sensor MkII

slide-45
SLIDE 45

SITCH Sensor MkII

slide-46
SLIDE 46

SITCH Sensor MkII

slide-47
SLIDE 47

SITCH Sensor MkII

slide-48
SLIDE 48

SITCH Sensor MkII

slide-49
SLIDE 49

SITCH Sensor MkII

slide-50
SLIDE 50

Return to Demo!

  • Slack alerts
  • Tessera graphs
  • Kibana scan search
  • Resin logs
slide-51
SLIDE 51

MkI, MkII Summary

Targets MkI Coverage MkII Coverage ARFCN over threshold YES YES ARFCN outside of forecast YES YES Unrecognized CGI NO YES Gratuitous BTS re- association NO YES BTS detected outside of range NO YES Price ~$100 ~$150

slide-52
SLIDE 52

Going Forward

  • Automatic device detection
  • Device and service heartbeats
  • Gnuradio = pure SDR:
  • GR-GSM
  • ADS-B
  • FPV drone
  • Dedicated radios:
  • Ubertooth One
  • YARD Stick One
slide-53
SLIDE 53

Prior Art

  • DIY Cellular IDS (Davidoff, Fretheim, Harrison, & Price,

Defcon 21)

  • Traffic Interception and Remote Mobile Phone Cloning with

a Compromised Femtocell (DePerry, Ritter, & Rahimi, Defcon 21)

  • Introduction to SDR and the Wireless Village (DaKahuna &

Satanklawz, Defcon 23)

  • http://fakebts.com - Fake BTS Project (Cabrera, 2014)
  • How to Build Your Own Rogue GSM BTS for Fun and Profit

(Simone Margaritelli)

  • Gnuradio (many)
  • Gr-gsm (Krysik, et al.)
  • Kalibrate (thre.at)
slide-54
SLIDE 54

THANKS!

  • John Menerick
  • Gillis Jones
  • Christian Wright
  • Dave Doolin
  • Silent Contributors…
slide-55
SLIDE 55

Q&A

slide-56
SLIDE 56

#OMW2 Scan Your GSM