3 ms·

It's in the chipset of the cellular radio (3G/4G/etc), whose source is generally not available to anyone. And, more to the point, the code running on the chip c

by ihsw 12y ago

It's in the chipset of the cellular radio (3G/4G/etc), whose source is generally not available to anyone. And, more to the point, the code running on the chip can deceive the operating system.

schoen 12y ago
Apparently there's an undocumented iOS API to let apps get some cellular base station data (though on iOS it additionally requires jailbreaking; I'm not sure if that's an app privilege issue or just an "Apple banning software that uses undocumented APIs from the App Store" issue). http://signal.kssh.ca/ http://signal.kssh.ca/ Current IMSI catcher devices aren't routinely attacking the baseband, so many of their targets could probably detect them with judicious use of these APIs. Perhaps more to the point, there is an "IMSI catcher catcher" project based on Osmocom-BB: https://opensource.srlabs.de/projects/mobile-network-assessment-tools/wiki/Tutorial https://opensource.srlabs.de/projects/mobile-network-assessm... The downside is that you need a handset that can run Osmocom (almost certainly not the case for your current handset). The upside is that you can actually get plausibly credible data about the GSM base stations around you, including data that might reveal if some of them are fake.
- schoen 12y ago
  ... maybe there's a documented Android API for a subset of this information? http://signalmonitoring.com/en/gsm-field-test http://signalmonitoring.com/en/gsm-field-test
- sah2ed 12y ago
  Well, iOS does offer a hidden Field Test app that can surface a subset of this cellular base station data. The code is * 3001#12345#* [1]. Tested on an iPhone 5S running iOS 7.1.1 that is not jailbroken. [1] http://www.cultofmac.com/128306/access-the-hidden-field-test-app-for-iphone-ios-tips/ http://www.cultofmac.com/128306/access-the-hidden-field-test...
  - schoen 12y ago
    Interesting! I'd imagine that the data from this app might identify some kinds of IMSI catchers, depending on how they're configured and how well the user knows what to expect in their local GSM environment.

by ihsw 12y ago

It's in the chipset of the cellular radio (3G/4G/etc), whose source is generally not available to anyone. And, more to the point, the code running on the chip can deceive the operating system.

schoen 12y ago

Apparently there's an undocumented iOS API to let apps get some cellular base station data (though on iOS it additionally requires jailbreaking; I'm not sure if that's an app privilege issue or just an "Apple banning software that uses undocumented APIs from the App Store" issue). http://signal.kssh.ca/ http://signal.kssh.ca/ Current IMSI catcher devices aren't routinely attacking the baseband, so many of their targets could probably detect them with judicious use of these APIs. Perhaps more to the point, there is an "IMSI catcher catcher" project based on Osmocom-BB: https://opensource.srlabs.de/projects/mobile-network-assessment-tools/wiki/Tutorial https://opensource.srlabs.de/projects/mobile-network-assessm... The downside is that you need a handset that can run Osmocom (almost certainly not the case for your current handset). The upside is that you can actually get plausibly credible data about the GSM base stations around you, including data that might reveal if some of them are fake.

schoen 12y ago
... maybe there's a documented Android API for a subset of this information? http://signalmonitoring.com/en/gsm-field-test http://signalmonitoring.com/en/gsm-field-test
sah2ed 12y ago
Well, iOS does offer a hidden Field Test app that can surface a subset of this cellular base station data. The code is * 3001#12345#* [1]. Tested on an iPhone 5S running iOS 7.1.1 that is not jailbroken. [1] http://www.cultofmac.com/128306/access-the-hidden-field-test-app-for-iphone-ios-tips/ http://www.cultofmac.com/128306/access-the-hidden-field-test...
- schoen 12y ago
  Interesting! I'd imagine that the data from this app might identify some kinds of IMSI catchers, depending on how they're configured and how well the user knows what to expect in their local GSM environment.