Public Sources for the Um Security Workshop

Introduction

This is a catalog of public sources used as supporting references in the DeepSec 2009 workshop on GSM Air Interface security. Some people will assert that these materials form some kind of trade secret, but the presence of this material on the public internet shows us that they are clearly dead wrong. Make your own downloads now, though, before these links go stale; some of them changed within the last six weeks.

IMSI-Catchers

Theory

Daehyun Strobel paper, a good academic presentation of the theory of IMSI-catcher operation.
Instant Ciphertext-Only Cryptanalysis of GSM Encrypted Communication. Describes attacks on A5/1 and A5/2, IMSI-catcher attacks that can reproduce compromised or previously used Kc and gives a good description of general IMSI-catcher operation.

Products

Datong DX 300, probably based on an IP-Access nano-BTS.
C.I.A. This looks like the Datong DX 300, resold under another name.
IJS 6000, an "intelligent jammer" for the prison market.
Tecore iNAC, another intelligent jammer.
Tecore Intellijam, an earlier Tecore product.
MRT BTS-Geo. This speaks for itself.

Legal Documents

Intellectual Property Disputes

Lawsuits are interesting because they force the exposure of information. The plaintiffs in such cases often argue for sealed records, but the courts and the defendants may be of a different mind.

MMI v. Cellxion in the UK High Court. This gives a good summary of IMSI-catcher theory and exposes some of the connections among companies in this market.

Passive Interceptors

There is less public avertising of interceptors than of IMSI-catchers.

Smith-Myers CSM88xxG series.
Some random passive interceptor. It's not clear made this, but there are many like it in the market. Note the comments on "Encyption Modes".

DF/Geolocation

Berkeley student seminar on using MUSIC and antenna arrays for AOA estimation.
A detailed performance analysis of diffent array types and parameter selections for MUSIC-based AOA estimation.
MRT Artemis. A particularly good unit for urban operations.

STK/Applet Attacks

Mobile Terminal Security. Describes GSM Java security mechanisms and a trojan horse applet for obtaining SIM PINs.
SIM Attack Scenario, a less technical description of a Trojan horse for SIM PINs.