OpenBSC

openbsc@lists.osmocom.org

10 participants
4188 discussions

(no subject)
by David A. Burgess 17 Jan '09

17 Jan '09

Holger, Harald - I've been observing TMSI-handling bugs in GSM handsets for a while and saw a really good one last night, so I'm going to offer some comments here. > On Sat, Jan 10, 2009 at 01:40:33AM +0100, Holger Freyther wrote: > > Hey Guys, > > > > I'm currently implementing the CM Service Request of GSM 04.08 > and I wonder > > about the following: > > > > 1.) Some phones send us the TMSI of their current network > > 2.) One can ask the phone for the IMEISV/IMSI > > 3.) One can accept the LOCATION UPDATING REQUEST (or wait) > > 4.) A rogue MS could now request a channel with the BTS of the > original > > network > > 5.) Could send a CM Service Request with the TMSI of the > original phone and > > claim to not support A5 and such... > > 6.) Could initiate a call on the behalf of the other phone...? > > I think this would work, if > * we had a MS that we could fully control. > * the old network would accept the sudden classmark change for no > A5 support, > which in fact also depends on the cell itself. I would assume > that most > BTS in real-world netwokrs never announce that they support A5/0 According to GSM 02.07 Section 2, all GSM handsets are required support A5/1 and A5/2. According to GSM 02.09 Section 3.3, the network is SUPPOSED to deny service to any handset that doesn't support either A5/1 or A5/2. I'd be curious to see who's enforcing that, though. And any prudent operator will do an authentication at the start of a call, even for A5/0. Again, I'd be curious to see who's really doing it, but I'll bet most European operators do. You may not need to fully controlled a handset to do this, though. This is where TMSI handling bugs come into play. Last night, I was playing with a Treo 650. Having last registered in an AT&T network, the Treo sent a location updating request to my system (MNC=910, MCC=55) using that AT&T TMSI, which it is not supposed to do. I removed the SIM and cycled power. THAT should have cleared the old TMSI, but it came back to register by TMSI again. I sent a location updating accept, without sending a new TMSI. THAT should have cleared the old TMSI, but when I tried to place a mobile-oridinated call the Treo sent the same old AT&T-assigned TMSI in the CM service request. I am certain that if I had assigned a new TMSI to this handset and then switched off my system, that Treo would have taken my TMSI back the the AT&T network and tried to use it there. I suspect this kind of bug is fairly common and may be exploitable by a rogue network, even if only to expose the IMSI-TMSI relationships in the real carrier's BSC. As Harald points out, the attack described in the original e-mail should not work in a properly managed network. But I'll wager that most of the world's networks are not properly managed. -- David David A. Burgess OpenBTS on the web: http://openbts.sourceforge.net http://openbts.blogspot.com http://en.wikipedia.org/wiki/OpenBTS http://www.gnuradio.org/trac/wiki/OpenBTS

2 1

svn
by Michael Bradley Jr 15 Jan '09

15 Jan '09

Hi, did subscribe to the list, got a password and now trying to get the svn trunk with zero success! What are the required credentials since my email & the provided password won't help Cheers, Mike

2 1

Re: TMSI's and Identity theft?
by Dieter Spaar 10 Jan '09

10 Jan '09

On Sat, 10 Jan 2009 12:38:54 +0900, "Harald Welte" <laforge(a)gnumonks.org> wrote: > The IMSI ATTACH/DETACH procedure is an optional procedure that the BTS can > demand by setting some flag in SYSTEM INFORMATION on the BCCH. > > If enabled, the MS will use a special IMSI ATTACH flag in the location update, > and it has to send an IMSI DETACH message before it is switched off. Not sure > how useful that really is... but I definitely want support for it in OpenBSC > (optionally). Probably time for a config file ;) As I understand it, the IMSI Attach/Detach, which is signaled by the ATT flag in SYS_INFO 3 is used to keep track if a phone is actually available. (IMSI Attach is used when the phone is turned on and IMSI Detach when it is turned off). This way the network does not need to page the phone if it knows that it is turned off and can immediately signal to the caller that the phone is not available. If I remember, the ATT flag is not set in the BS11_Init sample code. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

1 0

TMSI's and Identity theft?
by Holger Freyther 10 Jan '09

10 Jan '09

Hey Guys, I'm currently implementing the CM Service Request of GSM 04.08 and I wonder about the following: 1.) Some phones send us the TMSI of their current network 2.) One can ask the phone for the IMEISV/IMSI 3.) One can accept the LOCATION UPDATING REQUEST (or wait) 4.) A rogue MS could now request a channel with the BTS of the original network 5.) Could send a CM Service Request with the TMSI of the original phone and claim to not support A5 and such... 6.) Could initiate a call on the behalf of the other phone...? 7.) What is IMSI detached, I have not yet seen it... but it could solve such things? So far I have only seen TMSI reallocation complete messages... what am I missing? These messages are not encrypted right? One just would need to know the right channel/paging group and such? Is this known? plausible? totally off? z. _______________________________________________ OpenBSC mailing list OpenBSC(a)lists.gnumonks.org https://lists.gnumonks.org/mailman/listinfo/openbsc

2 1

commitlog mailingliste
by Harald Welte 10 Jan '09

10 Jan '09

Hi! I have created openbsc-commits(a)lists.gnumonks.org which carries all commits to our svn server. I thought some people might like to receive all the diffs in their inbox to stay up-to-date with the code... Cheers, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

legal
by Marcus Specht 06 Jan '09

06 Jan '09

Hi all, what ist the best/fastest way to get a license from Bundesnetzagentur? Thanks Marcus -- Marcus Specht open|MVNO c/o Cyber-Dynamix Gesellschaft für Systemintegration GmbH Heiner-Stuhlfauth-Str. 28 90480 Nürnberg Tel.: 0911 / 1809105 Fax.: 0911 / 1809109 Geschäftsführer: Heiko Thierbach, Gerhard Feder Sitz der Gesellschaft ist Nürnberg Amtsgericht Nürnberg, HRB 16704 Ust-Id.-Nr. DE204640808 ------------------------------------------------------------------------------ Diese Nachricht ist eine nicht öffentliche Mitteilung. Sollten Sie diese Nachricht versehentlich erhalten haben und nicht der gewünschte Empfänger sein, so bitten wir Sie, diese Nachricht zu löschen, keine Kopien anzufertigen und nicht weiterzuleiten. Bitte informieren Sie uns per eMail über den Zustellungsfehler und entschuldigen Sie die Unannehmlichkeit. Bitte beachten Sie: Unabhängig vom Inhalt stellt diese Nachricht keinerlei vertragliche Verpflichtung, Zusicherung, Bestellung, Angebot oder ähnliches dar, solange keine schriftliche Bestätigung von uns vorliegt. _______________________________________________ OpenBSC mailing list OpenBSC(a)lists.gnumonks.org https://lists.gnumonks.org/mailman/listinfo/openbsc

1 0

[PATCH] user-configurable ARFCN
by Harald Welte 05 Jan '09

05 Jan '09

Hi! One of the most important features missing is the ability to run on a user-configured ARFCN (frequency). This patch should fix the problem, but I didn't apply it since I cannot test right now while travelling. zecke, daniel: Can you please test 1) if the patch doesn't break anything (i.e. if no '-f' parameter is specified, it should continue to use ARFCN 123) 2) if the '-f' commandline argument works, e.g. running the BTS on ARFCN 122 or similar. Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6) _______________________________________________ OpenBSC mailing list OpenBSC(a)lists.gnumonks.org https://lists.gnumonks.org/mailman/listinfo/openbsc

2 1

Neu / New
by Markus Zielonka 03 Jan '09

03 Jan '09

Hallo / Hello i am new here. :) Bye Markus -- Markus Zielonka Tel.: +49(0)32 224040302 Fax.: +49(0)1805 06034504323 _______________________________________________ OpenBSC mailing list OpenBSC(a)lists.gnumonks.org https://lists.gnumonks.org/mailman/listinfo/openbsc

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC