# Welcome! {% hint style="danger" %} **This documentation is intended solely for educational purposes and should not be used for ilegal services.** {% endhint %} * GSM Alarms * GSM-electric sockets * GSM-smarthomes controllers * Industrial controllers * Access control systems * GSM-trackers * Smartwatches for kids {% @mailchimp/mailchimpSubscribe %} This documentation covers a range of GSM-based devices including alarms, electric sockets, smarthome controllers, industrial controllers, access control systems, trackers, and smartwatches for kids, emphasizing that it is for educational purposes only and not a substitute for professional advice. {% embed url="" %} 1. Learn GSM 2. Build your GSM LAB 3. Hack GSM # Review ### Attacks on device * Caller ID check * SMS sender check * Bruteforce * Default passwords, stolen passwords * Lack of authorization * Online configurators * Hidden commands and passwords ### Attack on connection * Jamming connection modem - base station * Attacks on mobile networks * Spend all money in account or change tariff * Block SIM-card * Flood with calls ### Attack on other systems * Insecure security agency * Old protocols * Attacks on family/employees * Phishing * Spoofed reverse call from device * Reverse-attacks on mobile operator ### Common Types of Telecom Attacks #### Denial of Service (DoS) Attacks DoS attacks aim to make the telecom network unavailable to its intended users. Attackers typically flood the network with excessive traffic, causing legitimate users to experience service interruptions. #### Man-in-the-Middle (MitM) Attacks In a MitM attack, the attacker intercepts and potentially alters the communication between two parties without their knowledge. This can lead to data theft or unauthorized data manipulation. #### Eavesdropping Eavesdropping involves unauthorized interception of voice, data, or messaging services. Attackers can capture confidential information or conversations without the user's consent. #### SIM Card Cloning SIM card cloning allows an attacker to create a duplicate of a victim's SIM card. This enables the attacker to make calls, send messages, and access the victim's data plan, leading to potential financial loss. #### SMS Phishing (Smishing) Smishing involves sending fraudulent SMS messages to deceive users into revealing personal information, such as login credentials or financial information, which can then be used for malicious purposes. # Types of GSM 1. **GSM 900**: The original GSM system operating in the 900 MHz band. 2. **GSM 1800**: Also known as DCS 1800, operates in the 1800 MHz band. 3. **GSM 1900**: Known as PCS in North America, operates in the 1900 MHz band. 4. **GSM-R**: A special GSM version for railway communication systems. ### DCS 1800 DCS 1800, or Digital Cellular System 1800, is an adaptation of GSM technology operating in the 1800 MHz frequency band. It offers enhanced spectrum efficiency and supports higher data rates compared to GSM 900, making it suitable for densely populated urban areas. ### GSM-R GSM-R, or Global System for Mobile Communications – Railway, is a GSM variant tailored for railway communication. It supports secure and reliable communication between train drivers, dispatchers, and trackside workers, enhancing safety and operational efficiency. GSM-R operates in the 900 MHz or 1800 MHz bands and incorporates advanced features like group calls, voice broadcast services, and emergency calls tailored to the needs of the rail industry. ### PCS 1900 PCS 1900, or Personal Communications Service 1900, is a GSM variant used primarily in North America. Operating in the 1900 MHz frequency band, PCS 1900 provides high-capacity and improved coverage in metropolitan areas. Similar to other GSM systems, it supports various services such as voice, messaging, and data transmission, ensuring robust mobile communication. ### GSM 450 GSM 450, also known as GSM 400, is a version of the GSM mobile communications standard specifically adapted for the 450 MHz frequency band. It is designed for deployment in regions where lower frequencies are preferable for extended coverage, such as rural and remote areas. GSM 450 provides the usual GSM services like voice, SMS, and data transmission while facilitating better penetration through obstacles and longer cell ranges. ### GSM 480 GSM 480 is a variation of the GSM standard that operates in the 480 MHz frequency band. It is optimized for use in regions where this frequency is advantageous for achieving extended coverage and improved signal penetration. Like other GSM variants, GSM 480 supports a range of services including voice calls, SMS, and data transmission, making it suitable for both urban and rural deployments. ### GSM 850 GSM 850, also known as GSM 800, operates in the 850 MHz frequency band. It is primarily used in the Americas and Oceania. The lower frequency band allows for better signal penetration through buildings and extended coverage in both urban and rural areas. GSM 850 supports all standard GSM services such as voice, SMS, and data transmission, ensuring reliable and widespread mobile communication. # Description The goal of this project is to build a dedicated mobile network for security research in different Telecom technologies.
This specialized network will enable researchers to delve deep into various aspects of telecommunications security. By focusing on different technologies, including 4G, 5G, and beyond, the project aims to uncover vulnerabilities and develop robust security measures. The network will provide a controlled environment for testing, ensuring that findings can be safely evaluated and addressed. {% @mailchimp/mailchimpSubscribe %} {% embed url="" %} ## Testing Overview ### RAN Testing * Focuses on the Radio Access Network. * Ensures seamless communication between mobile devices and the network. ### Mobile Equipment Testing * Evaluates the performance and functionality of mobile devices. * Includes hardware and software assessments. ### SIM Cards Testing * Checks compatibility and security of SIM cards. * Tests network connectivity and data integrity. # Hardware * Magic SIM * OsmoSIM Cards * USB SIM Reader * Samsung S5 - Custom RFS ROM * GSM Embebed Board SIM9000 * RPI 4 8GB RAM * BladeRF * Desktop 32GB RAM + 4TB NVMe + 256GB NVMe (Core Network) # Setup LAB OS: Ubuntu 22.04 x64 * Magic SIM * OsmoSIM Cards * USB SIM Reader * Samsung S5 - Custom RFS ROM * GSM Embebed Board SIM9000 * RPI 4 8GB RAM * BladeRF * Desktop 32GB RAM + 4TB NVMe + 256GB NVMe (Core Network) ### Mobile Station Configuration | Hardware | | | | ------------------------- | - | - | | Samsung S5 | | | | Magic SIM | | | | GSM Embebed Board SIM9000 | | | ### srsRAN Configuration | Hardware | | | | ------------ | - | - | | RPI4 | | | | SD-Card 64GB | | | | BladeRF | | | | | | |
{% code overflow="wrap" %} ``` sudo apt-get install cmake make gcc g++ pkg-config libfftw3-dev libmbedtls-dev libsctp-dev libyaml-cpp-dev libgtest-dev ``` {% endcode %} ``` sudo apt-get install libzmq3-dev ``` ``` git clone https://github.com/srsRAN/srsRAN_Project.git ``` {% file src="/files/QC8euAC0iQh7NI4kJzSq" %} ``` sudo apt install libusb-dev sudo apt install libudev-dev ``` # AT Commands Extract all information about SIM cards using AT Commands ``` busybox microcom /dev/ttyUSB0 ```
FunctionalityStorage location in SIM and USIM cardsAT command
Extraction of IMSIStored in 6F07 (decimal 28423) for SIM and USIM

(SIM/USIM)

AT+CRSM=176,28423,0,0,3

Extraction of Ciphering

Indicator

Stored in 6FAD (decimal 28589) for SIM and USIM

(SIM/USIM)

AT+CRSM=176,28589,0,0,3

Extraction of Ciphering

Key Kc

Stored in 6F20 (decimal 28448 for SIM and 4F20 (decimal 20256) for USIM

(SIM)

AT+CRSM=176,28448,0,0,9

(USIM)

AT+CRSM=176,20256,0,0,9

Extraction of Ciphering

Key KcGPRS

Stored in 6F52 (decimal 28498 for SIM and 4F52 (decimal 20306) for USIM

(SIM)

AT+CRSM=176,28498,0,0,9

(USIM)

AT+CRSM=176,20306,0,0,9

Extraction of Ciphering

Key CK and Integrity Key

IK

Stored in 6F08 (decimal 28424), applied to USIM only

(USIM)

AT+CRSM=176,28424,0,0,33

Extraction of TMSI,

TMSI TIME and LAI

Stored in 6F7E (decimal 28542 for SIM and USIM

(SIM/USIM)

AT+CRSM=176,28542,0,0,11

Extraction of PTMSI,

PTMSI Signature Value,

RAI and RAUS

Stored in 6F53 (decimal 28499 for SIM and 6F73

(decimal 28531) for USIM

(SIM)

AT+CRSM=176,28499,0,0,14

(USIM)

AT+CRSM=176,28531,0,0,14

Extraction of

THRESHOLD

Stored in 6F5C (decimal 28508), applied to USIM only

(USIM)

AT+CRSM=176,28508,0,0,3

xtraction of Provider-AT+COPS?

Extraction of

Lac and

Cell ID

-AT+CREG?
### AT Commands for SIM Cards AT commands are a standardized set of text strings used to communicate with modems, including those embedded in SIM cards. Here's a list of common AT commands used for SIM card operations: #### General Commands * **AT:** Checks the modem's readiness. * **ATE0:** Turns off echo. * **ATZ:** Resets the modem. * **AT+CGMI:** Gets the manufacturer ID of the SIM card. * **AT+CGMM:** Gets the model name of the SIM card. * **AT+CGMR:** Gets the revision number of the SIM card. #### SIM Card Status and Information * **AT+CREG?:** Queries the registration status of the SIM card on the network. * **AT+CSCS?:** Gets the character set used for SMS messages. * **AT+CPIN?:** Checks the SIM card PIN status. * **AT+CPIN=1234:** Unlocks the SIM card with the PIN "1234". * **AT+CPMS?:** Gets the memory locations for storing SMS messages. #### SMS Commands * **AT+CMGF=1:** Sets SMS mode to text mode. * **AT+CMGS="+1234567890"** Sends an SMS to the number "+1234567890". * **AT+CMGL=1,4** Reads SMS messages 1 to 4. * **AT+CMGD=1** Deletes SMS message 1. #### Phone Book Commands * **AT+CPBF?** Checks the phone book storage. * **AT+CPBS=1,1** Sets the phone book storage to SIM card. * **AT+CPBA=1,1234567890,John Doe** Adds a contact to the phone book. * **AT+CPBR=1,1** Reads a contact from the phone book. #### Call Control Commands * **ATD+1234567890;** Dials a phone number. * **ATH:** Hangs up a call. * **ATA:** Answers an incoming call. * **AT+CLCK=1** Locks the keypad. #### Network Settings * **AT+CREG=2** Sets the registration status to manual. * **AT+CGATT=1** Attaches to the GPRS network. * **AT+CGACT=1,1** Activates the GPRS context. The specific AT commands and their parameters may vary depending on the SIM card manufacturer and network provider. It's essential to consult the documentation provided by your SIM card or modem manufacturer for accurate information. # Description Debian 12 RPI4 8GB BladeRF LimeSDR
### RAN * OsmoBTS - A BTS implementation * OsmoBSC - GSM Base Station Controller with support for many different BTS vendors and models attached via Abis (over E1 and IP). * OsmoTRX - A transceiver for OsmoBTS to use with SDR hardware * OsmoPCU - A packet control unit for GPRS/EDGE enabling the BTS. ### Core * OsmoMSC - GSM/UMTS Mobile Switching Center with support for AoIP as well as IuCS. SCCPlite support is work in progress. * OsmoHLR - minimal implementation of a Home Location Register * OsmoSTP - SS7 Transfer Point to connect MSC and BSC * OsmoMGW - Media GateWay to relay RTP streams ### GPRS * OsmoSGSN - A Serving GPRS Support Node * OsmoGGSN - A Gateway GPRS Support Node
# SIM Cards LTE WCDMA ICCID SIM USIM 4G secure card reader writer programmer with 5pcs blank programable card +SIM personalize tools MagicSIM {% embed url="" %} # BTS Here we need to configure 2 parts
``` sudo vi /etc/osmocom/osmo-bts.cfg ``` ``` phy 0 instance 0 osmotrx rx-gain 30 ! Set the receiver gain (configured in the hardware) in dB. osmotrx tx-attenuation 30 ! Set the transmitter attenuation (configured in the hardware) in dB. osmotrx ip local 127.0.0.1 osmotrx ip remote 127.0.0.1 no osmotrx timing-advance-loop ``` ``` bts 0 oml remote-ip 127.0.0.1 ipa unit-id 6969 0 gsmtap-sapi pdtch gsmtap-sapi ccch band 900 trx 0 phy 0 instance 0 ``` {% embed url="" %} # BSC - Base Station Controller ``` sudo vi /etc/osmocom/osmo-bsc.cfg ``` #### Log Configuration ``` log stderr logging color 1 logging print category-hex 0 logging print category 1 logging timestamp 0 logging print file basename last logging print level 1 ``` #### E1 Configuration ``` e1_input e1_line 0 driver ipa ``` #### Network Configuration ``` network network country code 001 mobile network code 10 encryption a5 0 neci 1 paging any use tch 0 handover 0 handover algorithm 1 handover1 window rxlev averaging 10 handover1 window rxqual averaging 1 handover1 window rxlev neighbor averaging 10 handover1 power budget interval 6 handover1 power budget hysteresis 3 handover1 maximum distance 9999 ! T3212 is in units of 6min, so below we set 5 * 6 = 30min timer net T3212 5 ``` #### Media Gateway Configuration ``` mgw 0 remote-ip 127.0.0.1 remote-port 2427 local-port 2727 ``` #### BTS Configuration ``` bts 0 type osmo-bts band GSM900 cell_identity 777 location_area_code 0x0001 base_station_id_code 7 ms max power 10 cell reselection hysteresis 4 rxlev access min 0 radio-link-timeout 32 channel allocator mode set-all ascending rach tx integer 9 rach max transmission 7 channel-description attach 1 channel-description bs-pa-mfrms 5 channel-description bs-ag-blks-res 1 early-classmark-sending forbidden ipa unit-id 6969 0 oml ipa stream-id 255 line 0 codec-support fr gprs mode none trx 0 rf_locked 0 arfcn 21 nominal power 23 ! to use full TRX power, set max_power_red 0 max_power_red 20 rsl e1 tei 0 timeslot 0 phys_chan_config CCCH+SDCCH4 hopping enabled 0 timeslot 1 phys_chan_config TCH/F hopping enabled 0 timeslot 2 phys_chan_config TCH/F hopping enabled 0 timeslot 3 phys_chan_config TCH/F hopping enabled 0 timeslot 4 phys_chan_config TCH/F hopping enabled 0 timeslot 5 phys_chan_config TCH/F hopping enabled 0 timeslot 6 phys_chan_config TCH/F hopping enabled 0 timeslot 7 phys_chan_config TCH/F hopping enabled 0 ``` #### MSC Configuration ``` msc 0 ! Do not allow emergency calls unless you can route ! them to the local emergency services allow-emergency deny ``` #### BSC Configuration ``` bsc mid-call-timeout 0 ``` # MSC - Mobile Switching Center # STP - Signal Transfer Point # MGW - Media Gateway # SGSN - Serving GPRS Support Node ``` sudo vi /etc/osmocom/osmo-sgsn.cfg ``` ``` ! ! Osmocom SGSN configuration ! ! line vty no login ! sgsn gtp local-ip 127.0.0.1 ggsn 0 remote-ip 127.0.0.6 ggsn 0 gtp-version 1 ! auth-policy closed ! accept-all, closed, acl-only, remote auth-policy accept-all ns timer tns-block 3 timer tns-block-retries 3 timer tns-reset 3 timer tns-reset-retries 3 timer tns-test 30 timer tns-alive 3 timer tns-alive-retries 10 encapsulation udp local-ip 127.0.0.1 encapsulation udp local-port 23000 encapsulation framerelay-gre enabled 0 ! bssgp ! ``` # OpenGGSN ``` SUDO VI /etc/osmocom/osmo-ggsn.cfg ``` ``` ! ! OpenGGSN (0.94.1-adac) configuration saved from vty !! ! ! stats interval 5 ! line vty no login ! ggsn ggsn0 gtp state-dir /tmp gtp bind-ip 127.0.0.6 apn internet gtpu-mode tun tun-device tun4 type-support v4 ip prefix dynamic 176.16.1.1/24 ip dns 0 192.168.8.1 ip dns 1 8.8.8.8 ip ifconfig 176.16.1.1/24 no shutdown default-apn internet no shutdown ggsn ``` # Page 1 * LimeSuiteHeaders, The lime suite headers * LimeSuiteLibrary, The lime suite library * ConnectionFX3, FX3 Connection support * ConnectionFTDI, FTDI Connection support * ConnectionXillybus, PCIE Xillybus Connection support * LimeSuiteGUI, GUI Application for LimeSuite * LimeSuiteExamples, LimeSuite library API examples * LimeRFE, LimeRFE support * LimeUtilCommand, Command line device discovery utility * LimeQuickTest, LimeSDR-QuickTest Utility * LimeSuiteDesktop, LimeSuite freedesktop integration # Intro ### GSM Radio Stack The GSM Radio Stack comprises multiple layers, each responsible for different communication aspects in GSM mobile networks: 1. **Physical Layer (Layer 1)**: Manages the actual radio transmission and reception. 2. **Data Link Layer (Layer 2)**: Includes protocols like LAPDm, responsible for error correction and reliable data transfer. 3. **Network Layer (Layer 3)**: Consists of sub-layers for call control, mobility management, and radio resource management. ![](/files/UkncANO64M6Uui4zi9uO) This layered approach ensures efficient management and operation of GSM mobile communications. # Page # Passive Sniffing Learn how to Sniff GSM Broadcast data around you and understand what capabilities the BTS has. ### Detect BTSs Around ``` grgsm_scanner --band=GSM900 --gain=34 --speed=5 --args=rtl=0 ``` ### Capture Broadcast packets from BTS ``` grgsm_capture --arfcn=11 --rec-length=70 --args="hackrf,num_recv_frames=1024" --gain=34 arfcn_11.cfile ``` ### Decode BCCH Channels The Broadcast Control Channel (BCCH) is a critical component in GSM networks that carries network-specific and cell-specific information. This data includes the identity of the network and associated parameters, information about neighboring cells, and other details necessary for mobile stations to connect to the network. By regularly monitoring the BCCH, mobile devices can maintain proper communication with the network and ensure seamless handovers between cells. This channel operates continuously, providing essential data to facilitate efficient network operations. ``` grgsm_decode --arfcn=11 --mode=BCCH --timeslot=0 --cfile=arfcn_11.cfile ``` ### Decode SDCCH/8 Channels Standalone Dedicated Control Channel (SDCCH/8) is a crucial element in GSM networks used primarily for signaling and control. SDCCH/8 facilitates non-traffic purposes such as call setup, SMS delivery, and location updates. It operates independently of voice channels, ensuring efficient network management without occupying significant bandwidth. By utilizing SDCCH/8, mobile networks can efficiently handle control tasks, leading to streamlined operations and improved resource allocation. ``` grgsm_decode --cfile=arfcn_11.cfile --arfcn=11 --mode=SDCCH8 --timeslot=0 --print-bursts ``` ### A5/1 Cracking with Kc Key A5/1 is a stream cipher used to encrypt voice and data communications in GSM cellular networks. Designed to provide confidentiality, A5/1 works by encrypting the data stream between mobile devices and base stations. It operates on a 64-bit key (Kc), which is generated during the authentication process and shared between the mobile device and the network. #### Key Features of A5/1 Encryption: * **Stream Cipher**: Encrypts data on-the-fly as it is transmitted, allowing for real-time communication. * **64-bit Key Length**: Uses a 64-bit key, making it a relatively lightweight encryption mechanism. * **Fast and Simple**: Designed to suit the processing capabilities of mobile devices and support high-speed transmission. * **Uses Kc**: The ciphering key (Kc) is a central part of the encryption process, ensuring that communication remains secure. Despite its widespread use, A5/1 has been shown to have vulnerabilities, which have led to considerations of stronger encryption alternatives in modern networks. ``` grgsm_decode --cfile=arfcn_11.hrf.cfile --arfcn=11 --mode=SDCCH8 --timeslot=0 --a5=1 --kc=KEY-HERE ``` # Passive IMSI Catcher {% embed url="" %} # Descrypt SMSs # Capture Voice # Rogue BTS ``` pi@raspberry:~$ sudo su root@raspberry:/home/pi# apt-get update ``` ``` root@raspberry:/home/pi# apt-get -y install git telnet apache2 php5 libusb-1.0-0 libusb-1.0-0-dbg libusb-1.0-0-dev libgsm1 libgsm1-dev cmake automake ``` ``` root@raspberry:/home/pi# dmesg ``` ``` root@raspberry:/home/pi# cd /tmp root@raspberry:/tmp# wget -c https://github.com/Nuand/bladeRF/archive/master.zip root@raspberry:/tmp# unzip master.zip root@raspberry:/tmp# cd bladeRF-master root@raspberry:/tmp/bladeRF-master# cd host root@raspberry:/tmp/bladeRF-master/host# mkdir build root@raspberry:/tmp/bladeRF-master/host# cd build root@raspberry:/tmp/bladeRF-master/host/build# cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr/local -DINSTALL_UDEV_RULES=ON ../ root@raspberry:/tmp/bladeRF-master/host/build# make -j4 root@raspberry:/tmp/bladeRF-master/host/build# make install > install.log root@raspberry:/tmp/bladeRF-master/host/build# ldconfig ``` ``` root@raspberry:/tmp/SubversiveBTS/yatebts# cd /tmp root@raspberry:/tmp/# wget -c http://www.nuand.com/fx3/bladeRF_fw_v1.9.1.img root@raspberry:/tmp/# bladeRF-cli -f bladeRF_fw_v1.9.1.img -v verbose ``` ``` root@raspberry:/tmp/# bladeRF-cli -i bladeRF> version bladeRF-cli version: 1.3.1-git-unknown libbladeRF version: 1.6.1-git-unknown Firmware version: 1.9.1 FPGA version: Unknown (FPGA not loaded) bladeRF> ``` ``` sudo raspi-config ``` # Articles {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} # Docs {% file src="/files/UwHgPJoCaGGi2HbCbX7U" %} {% embed url="" %} {% embed url="" %} {% embed url="" %}