Giters

Lofmir / Hacking-Mobile

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Awesome-Cellular-Hacking

Please note multiple researchers published and compiled this work. This is a list of their research in the 3G/4G/5G Cellular security space. This information is intended to consolidate the community's knowledge. Thank you, I plan on frequently updating this "Awesome Cellular Hacking" curated list with the most up to date exploits, blogs, research, and papers.

The idea is to collect information like the BMW article below, that slowly gets cleared and wiped up from the Internet - making it less accessible, and harder to find. Feel free to email me any document or link to add.

Rogue BTS & CDMA/GSM Traffic Impersonation and Interception

  • How to create an Evil LTE Twin/LTE Rogue BTS How to setup a 4G/LTE Evil Twin Base Station using srsLTE and a USRP SDR device.
  • How To Build Your Own Rogue GSM BTS For Fun and Profit "In this blog post I’m going to explain how to create a portable GSM BTS which can be used either to create a private ( and vendor free! ) GSM network or for GSM active tapping/interception/hijacking … yes, with some (relatively) cheap electronic equipment you can basically build something very similar to what the governments are using from years to perform GSM interception."
  • Practical attacks against GSM networks: Impersonation "Impersonating a cellular base station with SDR: With the flexibility, relative low cost of Software Defined Radio (SDR) and abundance of open source projects that emulate a cell tower, successfully impersonating a GSM Base Station (BTS) is not a difficult task these days."
  • Building a Portable GSM BTS Using BladeRF/PI "I was always amazed when I read articles published by some hackers related to GSM technology. However, playing with GSM technologies was not cheap until the arrival of Software Defined Radios (SDRs), besides not being something easy to be implemented."
  • rtl.sdr.com Tutorial-Analyzing GSM with-Airprobe and Wireshark "The RTL-SDR software defined radio can be used to analyze cellular phone GSM signals, using Linux based tools GR-GSM (or Airprobe) and Wireshark. This tutorial shows how to set up these tools for use with the RTL-SDR."
  • Traffic Interception for Penetration Testing Engagements "Within the penetration testing domain quite often we have to deal with different technologies and devices. It’s important to cover all aspects of connectivity of a device being tested which is why we have built a GSM/GPRS interception capability. There are a number of different devices and systems that make use of GSM/GPRS, non-exhaustively we commonly see:"

Rogue Base Stations or Evil BTS's, 2G/3G/4G

OpenBTS software is a Linux application that uses a software-defined radio to present a standard 3GPP air interface to user devices, while simultaneously presenting those devices as SIP endpoints to the Internet

YateBTS is a software implementation of a GSM/GPRS radio access network based on Yate and is compatible with both 2.5G and 4G core networks comprised in our YateUCN unified core network server. Resiliency, customization and technology independence are the main attributes of YateBTS

srsLTE is a free and open-source LTE software suite developed by SRS (www.softwareradiosystems.com)

Common issues:

  • Improper FW
  • Lack of proper antennas
  • Wrong cellular phone type
  • Wrong SIM
  • Not configured correctly - Mobile Country Codes (MCC) and Mobile Network Codes (MNC)
  • Incorrect software BTS settings
  • Virtualized platform is not fast enough
  • Wrong SDR firmware

CERT/Media Alerts

Recent Conference Talks/Presentations

Usenix

New Conference Talks

Cellular Attacks

SIM Specific Attacks

Stingray's

SS7/Telecom Specific

Github/Code Repo's

Misc IMSI/Cellular Tools

Resources

Misc

The Eagle Labs

About