AIDA ANALYSE IDENTIFY DETECT ALLOCATE GSM/UMTS

Transcription

1 AIDA ANALYSE IDENTIFY DETECT ALLOCATE INTERCEPTION DEVICE IN GSM/UMTS NETWORK Pavel Bezpalec, Michal Kašík Department of telecommunication engineering Czech Technical University in Prague Access IT s.r.o. 1

2 Current situation GSM protocol is no longer safe, it is 25 years old GSM ciphers A5/1 a A5/2 are broken Development is rapid Namely in the telecommunications, safety of UMTS and LTE systems is on much higher level, than GSM ones GSM networks are mostly still operated in all areas covered by UMTS, the investments are still utilised and there are no plans to change things soon Dual phones using GSM/UMTS/LTE bandwith are very common The people are the same Nobody is really worrying about the radio bandwith used for a voice call

3 The principal questions Is the illegal GSM interception really a threat? Is it complicated to buy such interception device? Is it possible to protect yourself against such device? How? For how much?

4 The appearance of GSM interception devices in the Czech Republic Tomáš Almer, director of legal interception department of Czech Police We are facing the appearance of these devices in the Czech Republic ČT We are detecting the presence of illegal GSM interception devices during our legal interception operations. Our estimate is of at least twenty such devices and their occurrence is increasing ČT

5 Where to buy:

6 Where to buy:

7 How to protect ourselves Cipherlocking phones Your partner must use the same system but the protection is limited. Only Peer-to-Peer devices are safe. The cipherlocked services are vulnerable against DDoS attack Terrestrial lines Effective but these lines are not available everywhere and it is not easy to persuade people to stop using mobiles. The prophylactic scanning of the offices Ineffective in cases where the intruder is a hundred meters from your office Detection The only solution It enables the prey to become the hunter.

8 MAN IN THE MIDDLE The old method often used from the time of the invention of the telegraph The basic principle The intruder enters the communication as an active mediator This is possible generally in any network, which uses the verification only in direction user network Usually the only different parameter in such a mediated communication is the difference between the distance to the expected and the real end of the communication line. The basic low end cost device you can have for 3000 USD, the fully sophisticated one costs USD.

9 GSM network with no intruder

10 The intruder arrives in the area and identifies the target

11 The intruder commences interception

12 The supervising centre of the GSM operator does not see anything unusual GSoperatoroperator

13 AIDA arrives - scanning

14 Detection from the expected/measured distance

15 How the intruder forces the target s phone to leave the safe UMTS bandwidth? The intruder deploys a small jammer in the UMTS network The power transmitted is relatively small; the directional antenna is deployed. The target s phone will return to the GSM bandwidth automatically and the target will be unaware of this change

16 AIDA - the functionality The goal To create system, which will do 80% of the job for 20% of the price. Main functionality scanning of the GSM channels Processes 1. GSM bandwith local table This is created by scanning of all GSM channels and identification of all BTS occurence in the spectre (cell id, LAC, channel, MNC, MCC) 2. Time Advance parameter measurement on all active BTS 3. The comparison of the scanned data with expected table The expected local table from database is compared with obtained data Conflict detected Alert is sent via or sms In the case of the identification of the intruder it is possible to find its location approximately by TriAngulation

17 TriAngulation using Time Advance parameter

18 AIDA - interface

19 AIDA the scheme of the processes

20 Department of Telecommunications Engineering of Czech Technical University in Prague ( is one of major players of the Czech telecommunications environment. Access IT, s.r.o. ( is the producer of the device and the AIDA patent holder.