Feeds

Cellular network hijacking for fun and profit

The Reg cut-out-and-keep guide

New hybrid storage solutions

Instant island of connectivity

This is what Ousama Abushagur and his team did in Misurata, though their kit was scaled to handle a lot more calls than the backpack version shown above, the principle remains the same. The brought-in kit was plugged into an Ericsson BSC that wasn't being used, providing an instant island of connectivity.

Next step up is the MSC, which will control a number of BSCs. MSCs are better secured, just hitting the reset button isn't going to work this time. Our engineers reckoned that older kit had exploitable vulnerabilities but that access to the passwords would be hugely beneficial.

From the MSC, the down-chain BSCs and BTSs can be remotely managed, so if the information is available then it's a much better point of attack. From a single MSC one can provide (or deny!) connectivity to large swaths of a country from a single location, assuming the remote locations still have power.

The next step is to get the users connected, ideally without having to issue replacement SIMs to all of them.

Have a squiz at the local subscriber list...

In setting up Free Libyana, Abushagur managed to grab the identities of local subscribers from a captured VLR (Visitor Location Registry). That enabled customers to be added to the new HLR (necessary for them to make and receive calls).

Without the customer data, your best bet is to change the ID of your new network, making every handset think it is suddenly roaming internationally. Roamed-to networks aren't expected to have the customer's details, but they are expected to have access to the results of cryptographic ciphers, which can only take place on the customer's original network.

That's because the cryptography in GSM is based around a shared secret which is embedded in the SIM and stored in the operator's Authentication Server (AuS). Authentication Servers are generally secured, so even if you grabbed one (unlikely in this instance as it will be located at the operator's hub), you would still need the passwords that will be known to only a few employees.

What's worse is that the same key is used to generate a session key to encrypt the communications, so without access to the AuS you are forced to run the network without any encryption at all.

What you end up with is a network similar to those run in countries not trusted (by the USA) to have proper encryption, to whom software using strong cryptography can't be exported. That gets people connected, but it's problematic from a business point of view as SIM-cloning becomes possible and clandestine listening becomes easy.

But once that's all working, then you can start the slow process of issuing replacement SIMs, and rebuilding the rest of the country, which hopefully will be a good deal easier now that everyone can talk to each other. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
'Serious flaws in the Vertigan report' says broadband boffin
Report 'fails reality test' , is 'simply wrong' and offers ''convenient' justification for FTTN says Rod Tucker
This flashlight app requires: Your contacts list, identity, access to your camera...
Who us, dodgy? Vast majority of mobile apps fail privacy test
Apple Watch will CONQUER smartwatch world – analysts
After Applelocalypse, other wristputers will get stuck in
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.