3

I am currently working on a Project where I am doing a downgrade attack from LTE to GSM. I am using OpenLTE and OpenBTS for creating the fake base stations.

When the phone connects to the fake GSM Network, SMS and calls are not encrypted because A5/0 is used. When i setup Asterisk to communicate via a VoIP provider, it is possible to send for example SMSs to other phones which are in a "real" network. Of course I can intercept those messages which means I can read outgoing messages from phones which are in my fake GSM network.

Now the question: Is it in any way possible to do the same for incoming messages (which have as destination my "real" phone number and not the number which is associated with my VoIP provider)? So that I could for example intercept 2FA codes sent from Google or whatever. In my opinion this is not possible because I have no way of impersonating the user (because I do not know the secret key) but maybe you guys have a clue - there are so many vulnerabilities in GSM, maybe one of them can be of use for this.

4

The problem here is that the phone is connected to your network instead of the provider's network. To the eyes of the provider the phone is offline.

What you need to try and do is instead downgrade the phone's connection to the provider to a bad enough encryption that you can crack. I would first start with jamming the strong encryption bands like 3G and 4G/LTE, and go from there.

Another option is to proxy the phone's connection to the provider through your fake BTS. I am not sure if it's possible but the idea is that your BTS appears as a phone to the provider's network while appearing as the provider to the phone, and proxies everything in between (while logging it). I'm not that familiar with how GSM encryption works and whether it's possible to become a man-in-the-middle this way. You'd most likely have to write custom code to do this.

Finally another option is to hijack calls/texts through SS7. This requires an active connection to the global SS7 network, and then you basically say to the provider "hey I'm one of your roaming partners and your customer just connected to our network" and the provider's network will now send you all their calls. You don't even need to have the phone or the SIM, and you can do that with any mobile provided you know their IMEI and IMSI. This works even if the phone is still on their network. You would guess the network infrastructure is smart enough to realize that a phone attached to their BTS can't be roaming at another provider and it's probably an attacker doing nasty things, but the idiots at Ericsson, Alcatel & co thought otherwise.

Obviously the last option is probably illegal unless you have permission from the carrier which you'll probably never get, because 1) scamming customers is more important so why waste time on this and 2) the network infrastructure is so fragile that even benign stuff can bring the whole network down and they obviously don't want that. For example see the Telenor incident where a totally unrelated pentest in a different country crashed their HLR (and thus brought down the entire network) for several hours :

– The analysis reveals that at the time of the crash irregular signaling was sent into the Telenor network. This irregular signaling was sent by another international operator and contained types of messages that appear very rarely, the company said in a statement. – This signaling was misinterpreted in the software that Ericsson has delivered to Telenor’s mobile network and lead to part of the mobile traffic stopping, according to the company, which states that the error is corrected.

I suggest you check out P1 Security's presentations about SS7. Make sure to also check out the related/suggested ones as they are interesting and outline some of the attacks I described above.

  • Thank you for your answer. Downgrading the connection of the provider and attacking this connection is hard because at least here in Austria, strong encryption like A5/3 is mostly in use. SS7 is not an option because like you said, you won't get access to it. The proxying seems the way I would like to go but like I said, I think it's not possible to appear to the network "as the victim phone" because I do not have the authentication key. I am wondering if it is possible to catch a user into a fake BTS and release him into the real network and telling the phone to use weak or no ciphers. – slashcrypto Apr 7 '17 at 13:42
  • @slashcrypto when proxying you may be able to get the key - I doubt GSM uses something like Diffie-Hellmann where even being in the middle doesn't allow you to get the key. – André Borie Apr 11 '17 at 9:36
  • The authentication key is never sent over the network - it is a shared secret between the provider and the USIM and never leaves the SIM card. Authentication works via Challenge-Response. – slashcrypto Apr 11 '17 at 12:00
  • @slashcrypto are you sure? I would expect something to be possible if you jam the more secure bands, leaving only GSM and then when proxying make the tower look like it's requesting weak/no encryption. Then the phone would be talking in the clear and you can capture its traffic. – André Borie Apr 14 '17 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.