Feeds

Cellular network hijacking for fun and profit

The Reg cut-out-and-keep guide

Top 5 reasons to deploy VMware with Tegile

Instant island of connectivity

This is what Ousama Abushagur and his team did in Misurata, though their kit was scaled to handle a lot more calls than the backpack version shown above, the principle remains the same. The brought-in kit was plugged into an Ericsson BSC that wasn't being used, providing an instant island of connectivity.

Next step up is the MSC, which will control a number of BSCs. MSCs are better secured, just hitting the reset button isn't going to work this time. Our engineers reckoned that older kit had exploitable vulnerabilities but that access to the passwords would be hugely beneficial.

From the MSC, the down-chain BSCs and BTSs can be remotely managed, so if the information is available then it's a much better point of attack. From a single MSC one can provide (or deny!) connectivity to large swaths of a country from a single location, assuming the remote locations still have power.

The next step is to get the users connected, ideally without having to issue replacement SIMs to all of them.

Have a squiz at the local subscriber list...

In setting up Free Libyana, Abushagur managed to grab the identities of local subscribers from a captured VLR (Visitor Location Registry). That enabled customers to be added to the new HLR (necessary for them to make and receive calls).

Without the customer data, your best bet is to change the ID of your new network, making every handset think it is suddenly roaming internationally. Roamed-to networks aren't expected to have the customer's details, but they are expected to have access to the results of cryptographic ciphers, which can only take place on the customer's original network.

That's because the cryptography in GSM is based around a shared secret which is embedded in the SIM and stored in the operator's Authentication Server (AuS). Authentication Servers are generally secured, so even if you grabbed one (unlikely in this instance as it will be located at the operator's hub), you would still need the passwords that will be known to only a few employees.

What's worse is that the same key is used to generate a session key to encrypt the communications, so without access to the AuS you are forced to run the network without any encryption at all.

What you end up with is a network similar to those run in countries not trusted (by the USA) to have proper encryption, to whom software using strong cryptography can't be exported. That gets people connected, but it's problematic from a business point of view as SIM-cloning becomes possible and clandestine listening becomes easy.

But once that's all working, then you can start the slow process of issuing replacement SIMs, and rebuilding the rest of the country, which hopefully will be a good deal easier now that everyone can talk to each other. ®

Remote control for virtualized desktops

More from The Register

next story
Mighty Blighty broadbanders beg: Let us lay cable in BT's, er, ducts
Complain to Ofcom that telco has 'effective monopoly'
BT said to have pulled patent-infringing boxes from DSL network
Take your license demand and stick it in your ASSIA
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Fujitsu CTO: We'll be 3D-printing tech execs in 15 years
Fleshy techie disses network neutrality, helmet-less motorcyclists
Ofcom tackles complaint over Premier League footie TV rights
Virgin Media: UK fans pay the most for the fewest matches
FCC: Gonna need y'all to cough up $1.5bn to put broadband in schools
Kids need more fiber, says Wheeler, and you'll pay for it
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.