6 ms·

Sounds cool, but how many people have the 9k USD to sink on the radio required? Security through price barriers. Except it’s not security of course; the diffic

Sounds cool, but how many people have the 9k USD to sink on the radio required? Security through price barriers. Except it’s not security of course; the difficulty in obtaining hardware is a large reason as to why industrial control systems had such abysmal security for as long as they did.

jrexilius 4y ago
for passive sniffing, it looks like you can run the cheaper module at only $2k, which is approachable for researchers.. actually fully loaded price tag is $11k or $4k as you need GPSDO also.. but $4k is almost approachable I guess.. [edit to add] https://www.ettus.com/all-products/ub210-kit/ https://www.ettus.com/all-products/ub210-kit/
- tonyarkles 4y ago
  Amazingly, you can probably get a reasonable GPSDO from eBay for a couple hundred dollars. I was running an Ettus B210 off of an eBay GPSDO and had about a 1Hz frequency offset relative to an LTE tower at 1800MHz. Pretty cool!
  - zer0_duck 4y ago
    Did you test that LTESniffer by USRP B210?
    - tonyarkles 4y ago
      Sadly not yet. I’m very intrigued though! At one point I was going to try setting up a similar project using a… BladeRF? I forget which open LTE project it was.
nickphx 4y ago
It can be done for under $600 using a bladeRF.. https://docs.srsran.com/projects/4g/en/latest/app_notes/source/hw_packs/source/index.html https://docs.srsran.com/projects/4g/en/latest/app_notes/sour...
- tibbon 4y ago
  Similarly a LimeSDR perhaps?
nikau 4y ago
> why industrial control systems had such abysmal security for as long as they did. Bold of you to use past tense there
- brookst 4y ago
  They've really improved a lot. They used to be abysmal, but all of the scrutiny and high profile attacks have forced vendors to invest in bringing them up to merely terrible.
  - jeroenhd 4y ago
    Vendors upgrading to simply terrible security doesn't mean their customers are protected. After all, why not use the opportunity to sell the Super Security Plus+ version of the existing hardware for a nice fee?
    - rickdeckard 4y ago
      Because the majority of your customers and you yourself sit in the working groups which created that "non-secure version" of the standard. Either your customer would disagree with the premise of the standard implementation being "insufficiently secure" or your contribution to security should be reviewed as an evolution to the standard. Result: Security is not being questioned in this realm of commercial discussion.
nimbius 4y ago
>how many people have the 9k USD to sink on the radio required? its a soft target. US telecom has habitually revealed their almost contemptuous disinterest in security and rely almost entirely on price barriers or law. It would be trivial to pivot your narcotics racket to digital for only 9k or your online ransomware to LTE snooping.
userbinator 4y ago
Perhaps also "security through complexity" --- the specs for LTE and the previous mobile network protocols are freely available, but huge and very difficult to understand for someone not already familiar with the system (in comparison to e.g. Internet RFCs).
xfitm3 4y ago
A lot of people on this site earn a shit ton of money.

jrexilius 4y ago

for passive sniffing, it looks like you can run the cheaper module at only $2k, which is approachable for researchers.. actually fully loaded price tag is $11k or $4k as you need GPSDO also.. but $4k is almost approachable I guess.. [edit to add] https://www.ettus.com/all-products/ub210-kit/ https://www.ettus.com/all-products/ub210-kit/

tonyarkles 4y ago
Amazingly, you can probably get a reasonable GPSDO from eBay for a couple hundred dollars. I was running an Ettus B210 off of an eBay GPSDO and had about a 1Hz frequency offset relative to an LTE tower at 1800MHz. Pretty cool!
- zer0_duck 4y ago
  Did you test that LTESniffer by USRP B210?
  - tonyarkles 4y ago
    Sadly not yet. I’m very intrigued though! At one point I was going to try setting up a similar project using a… BladeRF? I forget which open LTE project it was.

nickphx 4y ago

It can be done for under $600 using a bladeRF.. https://docs.srsran.com/projects/4g/en/latest/app_notes/source/hw_packs/source/index.html https://docs.srsran.com/projects/4g/en/latest/app_notes/sour...

tibbon 4y ago
Similarly a LimeSDR perhaps?

nikau 4y ago

> why industrial control systems had such abysmal security for as long as they did. Bold of you to use past tense there

brookst 4y ago
They've really improved a lot. They used to be abysmal, but all of the scrutiny and high profile attacks have forced vendors to invest in bringing them up to merely terrible.
- jeroenhd 4y ago
  Vendors upgrading to simply terrible security doesn't mean their customers are protected. After all, why not use the opportunity to sell the Super Security Plus+ version of the existing hardware for a nice fee?
  - rickdeckard 4y ago
    Because the majority of your customers and you yourself sit in the working groups which created that "non-secure version" of the standard. Either your customer would disagree with the premise of the standard implementation being "insufficiently secure" or your contribution to security should be reviewed as an evolution to the standard. Result: Security is not being questioned in this realm of commercial discussion.

nimbius 4y ago

>how many people have the 9k USD to sink on the radio required? its a soft target. US telecom has habitually revealed their almost contemptuous disinterest in security and rely almost entirely on price barriers or law. It would be trivial to pivot your narcotics racket to digital for only 9k or your online ransomware to LTE snooping.

userbinator 4y ago

Perhaps also "security through complexity" --- the specs for LTE and the previous mobile network protocols are freely available, but huge and very difficult to understand for someone not already familiar with the system (in comparison to e.g. Internet RFCs).

xfitm3 4y ago

A lot of people on this site earn a shit ton of money.