SRLabs Open Source

This list: https://opensource.srlabs.de/projects/mobile-network-assessment-tools/… ... continues to be the best checklist of suspicious or incorrect behavior that would indicate the base station to which you were connected was not a real base station. Scroll down to the "IMSI catcher detection" table and see behaviors like: - Cell is not advertising any neighbor cells - The LAC of a base station changes - Your phone sends at the highest possible power Many of these behaviors to test are GSM specific however the attacker can perform a downgrade attack and force your 4G phone to collapse down to 2G service, thus exposing you to these.

I'm not going to say 'no', but I would highly doubt it. If you're wondering what the 'state of the art' in disguising components to look like other components is, this [1] is probably the best example. It's a guy that turned a LED into an LED and an inductor, and put transistors inside of switches. What you're proposing -- basically putting a USB-capable microcontroller inside something that looks like resistor -- isn't impossible. I can imagine that it could be done, but I would have no idea how. You would probably go with a very small (physically) microcontroller, maybe one of the SOT-23-6 PIC or AVR packages. I don't think it's possible to write a USB stack for those, and you only have 1-2kB to implement a BadUSB [2] sort of thing. It might be possible, but I doubt it. Still, that size of package could be disguised as a (large) SMD resistor, although the PCB would look odd with the addition of extra traces. To be honest, it really wouldn't make sense to disguise a microcontroller as passive components. It's already been demonstrated journalists will gladly plug random USB devices into their computer. If you wanted the device to just pass a cursory investigation, you'd just put a glob of black epoxy over the USB port. Hiding a microcontroller as a pair of resistors might be possible, but it's far more effort than what is really needed. [1] https://www.youtube.com/watch?&v=RkTvDjhImwo [2] https://opensource.srlabs.de/projects/badusb

The A/51 rainbow tables can be found here: https://opensource.srlabs.de/projects/a51-decrypt/files It can be made to work using a 10 bucks RTLSDR for RX. Had they used a legal provider for the TX, they would not have been caught. This smells like yet another case of children at work and police officers trying to sell themselves as super heroes. This is getting old.

It sure is. Look up the SnoopSnitch project, https://opensource.srlabs.de/projects/snoopsnitch. It will alert you if your phone connects to a fake cell tower aka stingray device.

Interesting. Requires root and a Qualcomm chipset, compatible device list here: https://opensource.srlabs.de/projects/snoopsnitch/wiki/DeviceList

>can we at least have a link to a copy of their statement as posted securely on their own domain? https://opensource.srlabs.de/projects/snoopsnitch with fdroid link if you want that

You could possibly achieve interesting results with a single handset to keep in your pocket as you go about your day. The Samsung Galaxy S3 is ideal due to the fact that Android apps are written to access low level data from it's baseband which is normally not available to end-user applications. In fact there is a company that sells re-modded S3's at a decent price for this exact purpose [1]. Save some money and find an old handset and load on free IMSI catcher detection software. [2] EDIT: It seems SnoopSnitch [3] which is used in the SeaGlass project works on rooted Android phones with that use Qualcomm chipsets. [1] https://www.wired.com/2014/09/cryptophone-firewall-identifies-rogue-ce… [2] https://cellularprivacy.github.io/Android-IMSI-Catcher-Detector/ [3] https://opensource.srlabs.de/projects/snoopsnitch

Their development roadmap has some details, not all of which seem viable. They want to make 2-3 apps: 1. Detect hidden SMS and (SIM card?) app installations through public APIs. I don't think this will work. 2. Send AT commands to the baseband processor and use the results to detect anomalies. My guess is that the baseband doesn't expose enough information for this to work. 3. Connect to an OsmocomBB phone running CatcherCatcher [0] via USB. This should work, since CatcherCatcher seems to work. [0] https://opensource.srlabs.de/projects/mobile-network-assessment-tools/…

>Would it be possible to determine if your phone was connected to a Stingray instead of a regular cell phone tower? Yep. https://opensource.srlabs.de/projects/mobile-network-assessment-tools/…

If you want to detect the presence of an IMSI catcher such as the Stingray system, you won't be able to do that on Android, iPhone or basically any phone out there you can buy today. What you need is a phone that has been hacked to run the osmocomBB firmware and baseband software: http://bb.osmocom.org/trac/wiki/Hardware/Phones You can then use the CatcherCatcher software from SRLabs who have been working on this GSM/mobile security stuff since forever: https://opensource.srlabs.de/projects/mobile-network-assessment-tools/…

Android app: https://opensource.srlabs.de/projects/snoopsnitch/wiki/FAQ#What-does-S… > SnoopSnitch offers tests to assess whether a device is exposed to attacks or surveillance from the mobile network. Here, the primary goal is to help mobile users detect network originated attacks, such as via SS7, SMS, or ISMI catchers. Our secondary goal is to provide a fact-based incentive to Mobile Network Operators to better improve the security of their networks. GSM ratings: https://gsmmap.org/#!/about > GSM Security Map compares the protection capabilities of mobile networks. Networks are rated in their protection capabilities relative to a reference network that implements all protection measures that have been seen “in the wild”. The reference is regularly updated to reflect new protection ideas becoming commercially available. Networks, therefore, have to improve continuously to maintain their score, just as hackers are continuously improving their capabilities.

I spent the last year researching, designing, then implementing an IMSI Catcher detector at first as a hobby then as my capstone project. There already exists working fairly mature solutions for this and they are very open about their detection metrics, specifically SnoopSnitch [1]. The major drawback of the SnoopSnitch solution is that they are phone apps and are tightly coupled with the hardware and drivers. We were attempting to demonstrate that it could be done in a way portable across desktop operating systems and phones and we succeeded in creating a proof of concept at a cost of $200 [2]. This solution is also better suited to use as a centralized device for organizations to use that can be audited by security personnel to protect against corporate espionage. This is a real threat demonstrated by the fact that by simply changing a few lines of code in the IMSI Catcher detector a few undergrads built we could have an IMSI Catcher. This need is often left out of the arguments for IMSI Catcher detectors and I think that is very harmful because the first thing said about the project has always been "They will just make it illegal." This is much more unlikely when you consider that anyone can build one. I would like to continue development beyond the proof of concept but have lost most of my team now that school is out if anyone would be interested you can contact me. Some commercial IMSI Catcher detectors sell for as much as $40,000. [1]…

There are several public GSM/Cell databases[1], the largest of which are probably OpenCellID[2] and the Mozilla Location Service[3]. Their coordinate points are estimations from user observations, so the accuracy may leave something to be desired. Perhaps it could be combined with the OpenStreetMap database which has data for observable cell towers in places where contributors have added them. There are also a couple Android applications[4][5] that claim to detect IMSI-catchers, but I'm not sure what data they use or how publicly available their findings are. Either way, we are living in a golden age of sousveillance and great opportunity to use collaborative technological systems to increase transparency. [1]https://en.wikipedia.org/wiki/Cell_ID [2]http://opencellid.org/ [3]https://location.services.mozilla.com/downloads [4]https://secupwn.github.io/Android-IMSI-Catcher-Detector/ [5]https://opensource.srlabs.de/projects/snoopsnitch

Apparently there's an undocumented iOS API to let apps get some cellular base station data (though on iOS it additionally requires jailbreaking; I'm not sure if that's an app privilege issue or just an "Apple banning software that uses undocumented APIs from the App Store" issue). http://signal.kssh.ca/ Current IMSI catcher devices aren't routinely attacking the baseband, so many of their targets could probably detect them with judicious use of these APIs. Perhaps more to the point, there is an "IMSI catcher catcher" project based on Osmocom-BB: https://opensource.srlabs.de/projects/mobile-network-assessment-tools/… The downside is that you need a handset that can run Osmocom (almost certainly not the case for your current handset). The upside is that you can actually get plausibly credible data about the GSM base stations around you, including data that might reveal if some of them are fake.