Android-based project to detect and avoid fake base stations (IMSI-Catchers) in GSM/UMTS Networks. Feel free to read the Press Releases about us, spread the word with our Media Material and help us solving current challenges!
- Introduction
- IMSI-Catchers
- Project Goals
- Limitations
- Roadmap
- WIP-RELEASES
- Requirements
- Installation
- General (non-geek)
- Technical (geek)
- User Guide
- Disclaimer
- Privacy
- Building
- Changelog
- Discussion
- Contributing
- Bugs
- FAQ
- Support
- Sources
- Credits
- License
- Sponsors
- Contact
- Recommendations
Both law enforcement agencies and criminals use IMSI-Catchers, which are false mobile towers acting between the target mobile phone(s) and the service providers real towers. As such it is considered a Man In the Middle (MITM) attack. It was patented and first commercialized by Rohde & Schwarz in 2003, although it would be hard to maintain such a patent, since in reality it is just a modified cell tower with a malicious operator. On 24 January 2012, the Court of Appeal of England and Wales held that the patent is invalid for obviousness. But ever since it was first invented, the technology has been used and "improved" by many different companies around the world. Other manufacturers (like Anite) prefer to refer to this spying and tracking equipment in cozy marketing words as "Subscriber Trackers". In the USA this technology is known under the name "StingRay", which is even capable to track the people who are traveling together with the owner of a targeted phone across the country. Here you can see alleged StingRay tracking devices mounted to the roof of three SUVs. The FBI or local police might deploy the device at a protest to obtain a record of everyone who attended with a cell phone. IMSI-Catchers also allow adversaries to intercept your conversations, text messages, and data. Police can use them to determine your location, or to find out who is in a given geographic area at what time. Identity thieves might operate an IMSI-Catcher in a parked car in a residential neighborhood, stealing passwords or credit card information from people nearby who make purchases on their phones.
There is more: Powerful, expensive IMSI-Catchers are in use at federal agencies and some police departments. And if you think that IMSI-Catchers are not used in your own town, think twice! If you ever happen to be near a riot or demonstration (hint: leave you phone at home if participating), pay close attention to cars standing along the path of the demonstration - those might be IMSI-Catchers. It is common practice for police to position IMSI-Catchers at the beginning as well as the end of roads where the demonstrating crowd moves to capture and compare data in order to find out who participated. But most of the time IMSI-Catchers are well hidden and can be even body-worn - therefore you won't even discover these creepy devices. Current technology shrinks them to be as tiny as your phone! So again, if you really have to participate in a riot or demonstration, leave your phones at home or build yourself a signal blocking phone pouch!
YouTube: DEF CON 18 - Practical Cellphone Spying with Kristin Paget (click picture)
Unfortunately it seems that IMSI-Catchers have been exponentially popular lately, with an explosion of various "bastards" with governments and criminals all the same, using it. Anyone can now buy an IMSI-Catcher (or build a cheap one on his own). Sending spam and phishing SMS via fake base stations is already a lucrative underground market, particularly in Russia, China and Brazil (see The Mobile Cybercriminal Underground Market in China). For example in China, 1.530 people got arrested for using this kind of equipment. Just recently, hackers decided to start reverse-engineering the NSA toolset and are releasing tools like TWILIGHTVEGETABLE - an easy to use, boot and pwn toolkit for passive monitoring of GSM communications as well as DRIZZLECHAIR as an extension to that system on a 2TB harddrive with all the tools required to crack A5/1 as well as the rainbow tables. It's just a matter of time of when your own neighbor will spy on you with simple self-build tools!
In addition, all IMSI-Catchers can crack A5/1 encryption, which is most commonly used for GSM traffic, on the fly (passively)! A5/3 encryption which is used for securing 3G and is offered as new security standard for GSM encryption remains secure in practice while susceptible to theoretical attacks. Although 3G and 4G offer sufficient protection from eavesdropping, the security measures can be bypassed by IMSI-Catchers forcing a mobile device into 2G mode and downgrade encryption to A5/1 or disable it. For further reading on the algorithms, check out the Cryptome GSM Files.
There are almost no phones on the market which offer an option to check what kind of encryption is used to secure GSM traffic. And although the Issue of not having a convenient display of the Ciphering Indicator has been assigned to Google since 2009, it seems they're getting paid (or are forced to) blatantly ignoring it. Just recently, a new open source project called the "Android-CipheringIndicator-API" opened its doors to finally craft an API which fixes this Issue and merge the resulting API into the Android AOSP branch. But currently, the only way to protect a mobile device from downgrade attacks is to disable 2G if this option is available. In this case, the phone will not be able to receive or make calls in areas without 3G coverage. This is why the original author named "E:V:A" started this project. Let's detect and protect against these threats! Never think you've got "nothing to hide".
Some examples to make you familar with current IMSI-Catcher threats:
- Espionage on Norwegian Politicians
- NSA-Killings with IMSI-Catcher drones
- How easy it is to clone phones
- 28c3: Defending mobile phones
- Stingrays: Biggest Technological Threat
- GSOC reveals hidden IMSI-Catcher
- Secret U.S. Spy Program on Planes
They come in uncountable shapes and sizes:
- Current IMSI-Catchers can be as tiny as the portable Septier IMSI-Catcher Mini.
- Below, the smartphone takes up the most space. IMSI-Catchers will even get smaller!
- This picture has been taken during the riots on Taksim Square in Instanbul:
- Above example is way too conspicuous and you'll likely never encounter these.
- Todays IMSI-Catchers can be body-worn or are hidden in GSM Interceptor vehicles:
Search for "GSM Interceptor", "IMSI-Catcher", "StingRay" or a combination thereof.
- Detect IMSI based device location tracking
- Detect and prevent the use of false BTS towers used for illegal interception
- Detect and prevent the use of broken ciphering algorithms (A5/1) during calls
- Detect and prevent remote hidden application installation
- Detect and prevent remote hidden SMS-based SIM attacks
- Provide counter measures against tracking
- Prevent leakage of sensitive GPS data
- Provide swarm-wise-decision-based cellular service interruption
- Provide secure wifi/wimax alternative data routes through MESH-like networking
- Aims to be recommended and added to the Guardian Project's list of secure Apps
- Aims to be recommended by the SSD Project of the Electronic Frontier Foundation
- Aims to be recommended by Privacy International (and like-minded organizations)
- Does not secure any data transmissions
- Does not prevent already installed rogue applications from full access and spying
- Provide full device encryption
- Provide secure data transmission (VPN, Tor)
- Provide secure phone calls (we recommend: RedPhone)
- Provide secure SMS (we recommend: TextSecure)
- Provide secure application sand-boxing
- Provide application permission control (we recommend: XPrivacy)
- Provide firewalls (we recommend: AFWall+)
- Provide ROOT and remove bloatware (we recommend: search XDA)
In order to accomplish the goals set above, we'll need to overcome some of the deeply worrying and unfounded AOS limitations, as imposed by Googles API, in regard to relevant network variables and data. These include highly relevant and important things such as displaying the SIM/phone Ciphering Indicator, which tells you if your calls are being encrypted or not. This has been a required 3GPP feature for the last 15 years, but which Google and most Mobile Network providers have choosen to mostly ignore, although it has been requested by users since 2009. Another is finding the Timing Advance (TA) and various Network Timers, like those used in Radio Resource Control (RRC), that can give very useful information regarding the status of the connections your phone is making.
All this can be fairly easily accomplished, given that we can have access to some of the lower level radio related information coming from the Baseband Processor (BP). But that is exactly our challenge. All the software and information about the interfaces providing this, is hidden from the user and developers by a huge amount of proprietary OEM Non Disclosure Agreements (NDA). But in the last years, there has been great progress in reverse enginering these protocols and interfaces. The use of these open source tools are the basis of our successful development of this app.
To summarize the main stages of this development:
A. Using all available network data, implement the correct detection matrix consisting of a number of items, that each participate in detection of abnormal or abusive network bahaviour. This is the application Beta stage.
B. Using all possible interfaces to obtain the many variables in (A). These interfaces include:
- QMI/Sahara protocols for using on Qualcomm based devices (Gobi3000, qmilib)
- Samsung IPC protocol for using on Intel XMM (XGOLD) based devices (xgoldmon, Replicant)
- Direct use of AOS standard RIL interfaces (/dev/rild and /dev/rild-debug)
- SIM ICC interface for accessing SIM EF filesystem to provide deep access (SEEK)
- Scraping Service Mode menus for relevant radio info
- Scrape
logcat -b radiofor relevant radio info - Use AT Command Processor (ATCoP) interface to get/set network parameters/bahaviour
C. Make (A) and (B) transparent across as many Android devices as possible.
Make a baseline App that contains the basic functionality for collecting and presenting all available network variables and the detection results.
- a. Collects relevant RF related variables using public AOS API calls. (LAC, CID, TA etc)
- b. Collects detailed BTS information from a pulic database such as OpenCellID or Mozilla Location Services
- c. Save everything in our SQLite database
- d. Detect hidden/silent (Type-0) SMS's
- e. Detect hidden App installations (Googles INSTALL/REMOVE_ASSET)
Improve ALPHA for leveraging and tune our detection matrix/algorithm.
- f. Implement any of the detection schemes we have
- g. Implement any of the interfaces in (B)
- h. Test AIMSICD in a real IMSI-catcher environment
- i. Fine-tune our detection matrix
- j. Implement our first counter interception measures
- k. Planning alternative data routes through MESH-like networking, when cellular services have been interrupted
- l. Planning swarm-wise decision-based cellular service analysis (advanced BTS statistics)
This stage is essentially the completion of this project. However, we expect that long before this happens, the entire network industry will have changed to such a degree that many new privacy and security issues will have arised. Thus, we will likely have more things to add and maintain in this project. We are of the current understanding that this project is a never ending story, all for the peoples benefit and a more privacy oriented future.
- m. Implement all of the detection schemes we have
- n. Implement all of the interfaces in (B)
- o. Test AIMSICD in a real IMSI-catcher environment
- p. Continue Fine-tune our detection matrix
- q. Complete alternative data routes using MESH-like networking, when cellular services have been interrupted
- r. Complete advanced statistical analysis of fake BTS towers
Safety first: Here's our Disclaimer.
Please follow how to correctly submit Issues!
Although this project is fully Open Source, developing AIMSICD is a lot of work and done by enthusiastic people during their free time. If you're a developer yourself, we welcome you with open arms! To keep developers in a great mood and support development, please consider making a fully anonymous donation through sending DarkCoin to our DONATION ADDRESS: XxEJvrYtkTZzvMUjtbZwPY34MyCGHSu4ys
All collected donations will be split into appropriate pieces and directly sent to developers who contribute useful code. The amount of DarkCoins each developer receives will vary with the value of each merged commit. To be perfectly clear: We will NOT reward junk, only awesome stuff. Additionally, donations will be used to support these organizations (contact us if you want to join our movement):
If you are unsure how to donate, visit our WIKI-Page on Anonymous Donations.
This project is completely licensed GPL v3+.
Our project would not have been possible without these awesome people. HUGE THANKS!
Our gratitude flies out to our great Sponsors:
| Developer | Task |
|---|---|
| E:V:A | Project Initiator |
| xLaMbChOpSx | Code-Monkey |
| tobykurien | Code-Monkey |
| He3556 | Vulnerability Analyzer |
| Sgt-Obst | Graphical Designer |
| andr3jx | Chief Cook and Bottle Washer |
| SecUpwN | Public Speaker |
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent
