5 ms·

This machine catches stingrays: Pwnie Express demos cellular threat detector

95 points by gregcohn 11y ago

Animats 11y ago
That's useful. It should be possible to do almost as well with a suitably programmed phone, if you can get to the RF control level. What's needed is something that gives to the app level the same kind of info that's available for nearby WiFi stations. Then anyone could write analysis apps. "Cell tower pinning", so that your phone remembers the cell towers in an area and reports new ones, would be useful. When a new one pops up, that's an interesting event. That capability would be useful for other purposes, such as finding and reporting coverage holes.
- alfiedotwtf 11y ago
  Like this? * https://secupwn.github.io/Android-IMSI-Catcher-Detector/ https://secupwn.github.io/Android-IMSI-Catcher-Detector/ * https://github.com/SecUpwN/Android-IMSI-Catcher-Detector https://github.com/SecUpwN/Android-IMSI-Catcher-Detector
  - deleted 11y ago
    [deleted]
- rsync 11y ago
  It's actually not that easy to get those events or debug info. There is one class of intel chipset that you can get it from, though: https://github.com/2b-as/xgoldmon https://github.com/2b-as/xgoldmon
rsync 11y ago
Here is the matrix of "odd events" that you need to be able to detect in a GSM network: https://opensource.srlabs.de/projects/mobile-network-assessment-tools/wiki/CatcherCatcher https://opensource.srlabs.de/projects/mobile-network-assessm... (scroll down to table) So while these very high level alerts from Pwnie are nice, I want to see what is really happening. Have I gotten any silent SMS or silent calls ? What network am I on and what cellID am I on ? Do I have an encrypted connection ? I'm fairly certain that Pwnie does not have a baseband that they control and so there is a lot they (and we) cannot do, but there are things that can be done, and that outdated table of suspicious events can probably be expanded (and updated for LTE). Comments ? I was at their booth today at RSA and they confirmed that these cellular functions are not available on the PWN Phone, which makes me suspicious that the cell modem they are using is not a USB modem, but rather a minipci module that goes into their box. Would like to know what modem they chose...
- im3w1l 11y ago
  A silent sms is like a ping. It generates a delivery receipt but doesn't display in the inbox. But what do you mean by silent call?
  - tmosleyIII 11y ago
    A silent call is when the phone is connected to a base station and forced into transmitting, you don't notice your phone is doing it.
universaltest 11y ago
I kind of wish we would just use a more secure cellular protocol to begin with. And I know that's a lot to ask for, but can't we just have nice things?
- exarch 11y ago
  Not when the people who design the things are being paid to make them not-nice.
- gregcohn 11y ago
  Encrypted content over the cellular protocol seems more plausible than a secure protocol, given that a) it's a feature that phones can roam across networks and b) the way these "exploits" work is for LE to emulate an endpoint in a system whose principles actively collaborate with LE (to some degree under force of law).

95 points by gregcohn 11y ago

That's useful. It should be possible to do almost as well with a suitably programmed phone, if you can get to the RF control level. What's needed is something that gives to the app level the same kind of info that's available for nearby WiFi stations. Then anyone could write analysis apps. "Cell tower pinning", so that your phone remembers the cell towers in an area and reports new ones, would be useful. When a new one pops up, that's an interesting event. That capability would be useful for other purposes, such as finding and reporting coverage holes.

alfiedotwtf 11y ago
Like this? * https://secupwn.github.io/Android-IMSI-Catcher-Detector/ https://secupwn.github.io/Android-IMSI-Catcher-Detector/ * https://github.com/SecUpwN/Android-IMSI-Catcher-Detector https://github.com/SecUpwN/Android-IMSI-Catcher-Detector
- deleted 11y ago
  [deleted]
rsync 11y ago
It's actually not that easy to get those events or debug info. There is one class of intel chipset that you can get it from, though: https://github.com/2b-as/xgoldmon https://github.com/2b-as/xgoldmon

rsync 11y ago

Here is the matrix of "odd events" that you need to be able to detect in a GSM network: https://opensource.srlabs.de/projects/mobile-network-assessment-tools/wiki/CatcherCatcher https://opensource.srlabs.de/projects/mobile-network-assessm... (scroll down to table) So while these very high level alerts from Pwnie are nice, I want to see what is really happening. Have I gotten any silent SMS or silent calls ? What network am I on and what cellID am I on ? Do I have an encrypted connection ? I'm fairly certain that Pwnie does not have a baseband that they control and so there is a lot they (and we) cannot do, but there are things that can be done, and that outdated table of suspicious events can probably be expanded (and updated for LTE). Comments ? I was at their booth today at RSA and they confirmed that these cellular functions are not available on the PWN Phone, which makes me suspicious that the cell modem they are using is not a USB modem, but rather a minipci module that goes into their box. Would like to know what modem they chose...

im3w1l 11y ago
A silent sms is like a ping. It generates a delivery receipt but doesn't display in the inbox. But what do you mean by silent call?
- tmosleyIII 11y ago
  A silent call is when the phone is connected to a base station and forced into transmitting, you don't notice your phone is doing it.

universaltest 11y ago

I kind of wish we would just use a more secure cellular protocol to begin with. And I know that's a lot to ask for, but can't we just have nice things?

exarch 11y ago
Not when the people who design the things are being paid to make them not-nice.
gregcohn 11y ago
Encrypted content over the cellular protocol seems more plausible than a secure protocol, given that a) it's a feature that phones can roam across networks and b) the way these "exploits" work is for LE to emulate an endpoint in a system whose principles actively collaborate with LE (to some degree under force of law).