3 ms·

How would it distinguish from mobile cell sites[1], which are deployed by carriers to areas where temporary higher capacity necessitates their use, and IMSI cat

by ihsw 12y ago

How would it distinguish from mobile cell sites[1], which are deployed by carriers to areas where temporary higher capacity necessitates their use, and IMSI catchers operated by law-enforcement? It does mention protection against attacks which downgrade secure connections to insecure connections, which is good. [1] http://en.wikipedia.org/wiki/Mobile_cell_sites http://en.wikipedia.org/wiki/Mobile_cell_sites

schoen 12y ago
There are a few different strategies for detecting IMSI catchers (though I'm not convinced that everybody working in this space has completely thought the threats through: some of the tools seem very focused on a single attribute they expect to see from the IMSI catcher). The mobile sites may conceivably still have proper encryption support, so if the feature you're looking for is "ciphering absent or downgraded", you shouldn't necessarily get false positives from them.
- schoen 12y ago
  There's now a front page HN item submitted by alexduggleby which points to https://www.sba-research.org/wp-content/uploads/publications/AdrianDabrowski-IMSI-Catcher-Catcher-ACSAC2014-preprint-20140820.pdf https://www.sba-research.org/wp-content/uploads/publications... which is a new academic paper on catching IMSI catchers. Their Table 1 (on page 5 of the paper) lists 12 possible ways of detecting IMSI catchers. I suspect there are still others, but that list is pretty thorough! I would add "implausible service area overlap" (the basic case being seeing a tower of carrier A and a tower of carrier B simultaneously, when carrier A and B serve different countries that don't have territory within 50 km of one another). For example, there was a report that a Uganda Telecom tower was seen near the Ecuadorian embassy in London, where Julian Assange is staying. Even without a tower-by-tower location database, you could conclude that Ugandan and UK base station signals shouldn't be observed at the same location.

by ihsw 12y ago

schoen 12y ago

There are a few different strategies for detecting IMSI catchers (though I'm not convinced that everybody working in this space has completely thought the threats through: some of the tools seem very focused on a single attribute they expect to see from the IMSI catcher). The mobile sites may conceivably still have proper encryption support, so if the feature you're looking for is "ciphering absent or downgraded", you shouldn't necessarily get false positives from them.

schoen 12y ago
There's now a front page HN item submitted by alexduggleby which points to https://www.sba-research.org/wp-content/uploads/publications/AdrianDabrowski-IMSI-Catcher-Catcher-ACSAC2014-preprint-20140820.pdf https://www.sba-research.org/wp-content/uploads/publications... which is a new academic paper on catching IMSI catchers. Their Table 1 (on page 5 of the paper) lists 12 possible ways of detecting IMSI catchers. I suspect there are still others, but that list is pretty thorough! I would add "implausible service area overlap" (the basic case being seeing a tower of carrier A and a tower of carrier B simultaneously, when carrier A and B serve different countries that don't have territory within 50 km of one another). For example, there was a report that a Uganda Telecom tower was seen near the Ecuadorian embassy in London, where Julian Assange is staying. Even without a tower-by-tower location database, you could conclude that Ugandan and UK base station signals shouldn't be observed at the same location.