start	end	text
0	3860	My name is Cooper Quinton, and thank you for coming to my talk,
3860	10700	Detecting 4G Base Stations in Real Time. First, a little about me. I am a senior
10700	16440	security researcher at the EFF Threat Lab. I have a toddler, so you'll have to forgive
16440	21620	the dad jokes and possible baby noises in the background. I'm also a former teenage phone freak.
21620	25580	I may have built some boxes to do some nefarious things back in the day,
25580	28480	which might explain why I got into the work that I do now.
30000	34440	If you're not familiar with EFF, we are a member-supported non-profit.
34440	39780	Over half of our annual funding comes from small donations from our members,
39780	44520	individual donations, and we defend civil liberties online. So we think that when you get
44520	49000	online, your rights come with you, and that when you're using technology, you still have rights,
49000	52440	such as freedom of speech and the right to privacy. And we've been doing this work for
52440	58780	30 years this year. We started in 1990. So we have a lot of experience under our belt.
58780	62220	We've been defending the internet and defending hackers for a long time.
62820	67280	I work in the EFF Threat Lab, and I'll talk a little bit more about that in a second.
67360	73800	But I want to first introduce my colleague Yamna. She can't be here with me on the DEF CON stage
73800	79360	today, but none of this research would have been possible without her hard work. This is as much
79360	85200	her project as it is mine, and she is an incredibly smart, incredibly talented person. So if you see
85200	90600	her in the virtual halls of DEF CON safe mode, please buy her a virtual beer, or follow her on
90600	96000	Twitter. Her name is at RivalElf, and she is a giant, sentient, very excitable radish, so don't
96000	103060	be scared when you meet her. This is an actual photo of her. A bit about Threat Lab. We look at
103060	110300	technology that targets at-risk people. So by at-risk, I mean people who are at risk of harm
110300	115240	just for being who they are, having the beliefs that they do. And this includes activists,
115240	121340	human rights defenders, journalists, domestic abuse victims, immigrants, sex workers, minority
121340	128260	groups, political dissidents, and so on. Basically anybody who is at risk. So this is the sort of
128260	135620	technology that we research and try to get a handle on. And we do this work because even though
135620	141920	cybersecurity teams and antivirus companies are doing a good job of what they do, they mostly
141920	146460	care about the types of malware that affect their customers, which are usually enterprise customers.
146460	152740	And this is things like ransomware, banking Trojans, things that steal sensitive corporate
152740	158400	data, things that affect bigger businesses. And we get to care about the types of technology
158400	164860	that infringe on civil liberties and human rights of at-risk people. Because these people don't
164860	171700	necessarily have the budget to pay a security team. But we also, by virtue of working for a
171700	175860	nonprofit, don't have to worry about meeting a bottom line at the end of the day. So we like
175860	180440	to think of ourselves as the security team for people who need it most and yet can afford it the
180440	185720	least. Our goals in this work are, of course, first and foremost, to protect people. We want
185720	191640	to make sure that the people in the communities that we work with are safe and able to express
191640	197340	themselves and able to exercise their human rights. We want to broaden the community's
197340	201920	understanding of the sorts of threats they face, who the threat actors are, what their capabilities
201920	207860	are, and what sorts of technologies they might be facing. And we want them to better understand
207860	212500	their defenses as well, how they can protect themselves, in what ways and what sort of
212500	218420	measures they might need to take. We want to expose bad actors, such as nation states or
218420	225340	companies or cyber mercenaries, that are going after people that are building technology to spy
225340	229900	on civilians and violate human rights. And we want to make better laws, because we're a legal
229900	235000	nonprofit at the end of the day. We want to make better norms and better laws and better norms in
235000	241040	civil society so that these sorts of things don't keep happening again and again. What I want to
241040	247680	talk to you about today is cell site simulators, also known as stingrays or MC catchers. I want to
247680	253000	talk about how they work, some previous efforts to detect them, and why I think that those efforts
253000	258660	aren't so great, and a new method that we've come up with to detect them here at EFF. And also how
258660	265140	to fix the problem of cell site simulators once and for all. First, a little bit of terminology.
265720	270420	The UE is the phone. It's just the phone. It stands for user equipment, but it's just the
270420	276120	phone, the thing you're making the calls on. The MC is the International Mobile Subscriber ID.
276120	282240	This is the ID that is burned into the sim card and unique for each sim card. The IMEI is the
282240	287320	International Mobile Equipment ID, and this is the unique ID for the hardware that's burned into the
287320	293120	hardware and can't be changed. The eNodeB, or the base station, this is what the UE, or user
293120	298760	equipment, again, the phone, this is what the UE is actually communicating with. This is the thing
298760	306920	that's at the end of the antennas that you're talking to. The EARFCN, or E-A-R-F-C-N, this is
306920	313640	the frequency that the UE and eNodeB are communicating on. The sector is a specific
313640	320240	antenna that is attached to the base station or eNodeB, and eNodeB can have multiple sectors,
320240	325080	and each sector basically is an antenna pointing in a specific direction.
325760	333080	The MIM, or master information block, is broadcast by the eNodeB and tells phones where to find the
333080	339780	SIB, or system information block, which contains more details about the eNodeB, such as the cell
339780	345660	ID, the MCC, MNC, and TAC, which are the mobile country code, the mobile network code, and the
345660	351540	tracking area code, respectively. So, finally, I'm going to use the terms MCCatcher, Stingray,
351540	357240	Hailstorm, fake base station, and cell site simulator, all kind of interchangeably. These
357240	363400	don't mean exactly the same thing. A cell site simulator and a fake base station are fake cell
363400	370920	towers. A Stingray and a Hailstorm are two brands of cell site simulator, and MCCatcher is sort of
371020	376300	a common term for one of the things that cell site simulators do, although not all MCCatchers
376300	383220	are cell sites that fully emulate a cell site. Some MCCatchers can run passively and not actually
383220	388340	transmit anything, thus not emulating a cell site. But for our purposes, we're going to use
388340	396330	them interchangeably, and that's okay for the purposes of this talk. So, here we have a diagram
396330	402830	of the 4G network. This is a pretty high-level diagram, but you can see here that the user
402830	409050	equipment, the phone, connects to the eNodeB using the LTVU protocol. Through the uplink,
409050	413350	the eNodeBs can talk to each other through another protocol, and the eNodeBs exist in
413350	420250	the network called the EUTRAN. And then you have a network called the Enhanced Packet Core,
420250	425710	which is behind the eNodeBs, and this contains the MME, or Mobility Management Engine,
425710	430730	serving gateway, and the PDN gateway, which connect to the public data network,
430730	437470	which connect back to the phone network, and the EPC is also responsible for authenticating
437470	443570	user billing, etc. We're not going to focus on the EPC today. There are issues there that we
443570	449250	could talk about, but it's out of scope for this talk. We're instead going to focus specifically
449250	454010	on the communication between the user equipment and the eNodeB, and that is sort of the area
454010	462210	inside of this red circle. So, we started this project because
462970	469710	we already knew a lot about the Stingray. Some law enforcement agencies had had the Stingray.
469710	475310	The Stingray had been around for a while, and it was pretty well understood how it worked.
475310	480450	Kristen Paget did a really great talk at DEF CON several years ago, where she demonstrated
480450	485350	building her own homemade Stingray, and it's pretty well understood the vulnerabilities.
485790	489930	But what we were noticing was that law enforcement was starting to upgrade
491410	496450	their cell-site simulator devices to newer devices, such as the Hailstorm,
496450	503550	which purported to be able to operate natively in 4G. And we started wondering, well,
503550	508590	we have a pretty good idea of how the Stingray works, but we have no idea of how the Hailstorm
508590	514010	and these newer devices operating in 4G, how they might work. So, let's dig into this,
514010	519210	and let's start by figuring out how they could possibly work. And the first thing we want to
519210	526050	look at is what changed between 2G and 4G. And there are three significant changes that affect
526050	532870	the way that a cell-site simulator might work. The first, and most important, is that the
532870	537750	eNodeB and the UE in 4G mutually authenticate each other.
539330	547030	In 2G, the user equipment or the phone had to authenticate itself to the eNodeB or the
547030	551890	base station, but the base station never had to prove that it was a real base station.
552210	556250	And this was the source of a lot of fake base station attacks, such as the ones that the
556250	565590	Stingray used in 2G. With 4G, this is no longer a problem. Also, in 2G, you had terrible encryption.
566370	571810	The base station would dictate to the user equipment what cipher to use, and it could
571810	578150	even dictate that the user equipment use a null cipher. What's more, the ciphers that were used
578150	585050	by 2G were actually quite weak and could be broken in real-time or near real-time by anybody
585050	591390	recording the packets between the base station and the phone, without even having to transmit
591390	598030	anything. This is no longer the case in 4G, now that eNodeB and UE mutually agree on what
598030	605390	encryption to use, and the ciphers are much, much better. Also, in 2G, the phone would always just
605390	612410	connect to the strongest tower that it could see, and in 2G, you could even dictate how strong
612410	618210	your signal was, telling the phone to ignore the actual signal strength and just trust what you
618210	623630	were saying the signal strength was. Neither of these are the case anymore in 4G. The phone no
623630	627950	longer naively connects to the strongest tower. Instead, there are a set of cell selection criteria
628490	634870	that it follows. So, great, we've solved all the problems, right? Well, clearly not, because there
634870	641310	are still cell site simulators that are operating natively in 4G. So, me and Yamna, set to work
641310	648250	reading all of the academic literature that we could about vulnerabilities in 4G, and what
648250	653410	could possibly be making cell sites and next generation cell sites and simulators work.
654190	660870	And after several months of reading, over a year of reading really, Yamna wrote a really
660870	666890	amazing paper called Gotta Catch Em All, which summarizes all of our findings, everything that
666890	673690	we learned, about what vulnerabilities next gen CSSs might be taking advantage of.
673930	681250	And we really figured out that there's one specific area where 4G is extremely vulnerable.
682590	688270	So, 4G has a bit of a glass jaw. Even though the UE authenticates with the tower, or
688270	693510	authenticates the tower now, there are still several messages that get sent, received, and
693510	698850	trusted, before that authentication ever happens, or without authentication ever happening in the
698850	704410	first place. And this is the weak spot in which the vast majority of 4G attacks happen.
704770	709030	I'm not going to get into those attacks here today, because Yamna has already done a really
709030	713950	excellent job of summarizing those in that paper, and I highly suggest that you go read it. It's an
713950	722270	excellent paper. But to give a high level summary, this is the handshake protocol between the user
722270	728570	equipment, the phone, again, and the base station. And it starts with the user equipment looking on
728570	733950	each ERF SIN, or frequency, for a frame synchronization signal from a base station.
733950	739290	Once it finds synchronization signals, it is able to find the MIB, master information block,
739290	744030	and decode that, which lets it find the SIN and decode that, which gives it enough information
744710	750890	about the mobile country code, the mobile network code, to decide whether it wants to connect,
750890	758170	and then send an RRC, radio resource control, RRC connection request. It does that handshake,
758170	764890	and then it begins the attach request. And here, in step 7, is where the authentication finally
764890	772430	starts. All of the messages before that are never authenticated. And some of the messages that get
772430	780550	sent in that area can contain things like the IMSI of the phone, allowing you to uniquely identify it,
780890	785610	it can contain even the GPS coordinates of the phone, allowing you to locate it,
785610	789610	and a bunch of other things. Attacks that allow you to downgrade it to TeamG,
789610	792490	or allow you to kick it off the mobile network entirely.
793310	798270	So this is where the heart of all of the vulnerabilities lie at 4G, and this is the
798270	806450	part that we find really interesting. So now that we had a pretty good handle on how 4G
806450	813350	cell-site simulators are probably being used, we wanted to get an idea of how often they're
813350	819490	being used. And if we want to learn how often they're being used by U.S. law enforcement,
819490	827870	the best way to do this is to file FOIA requests. ACLU filed a really excellent FOIA request,
827870	835210	which came back, which just got published this year, in 2020, about ICE and DHS's use of cell-site
835210	840890	simulators. And in it, they discovered that ICE, or U.S. Immigration and Customs Enforcement,
840890	849770	used cell-site simulators between 2017 and 2019 a total of 466 times, hundreds of times per year.
850050	858490	DHS, on the other hand, used their cell-site simulator 1,885 times between 2013 and 2017.
858590	864710	We also found out that Customs and Border Patrol, or CBP, owns 33 cell-site simulators,
864710	868230	which is a ton. And we don't know how often they're being used,
868230	872390	but we can assume that it's probably on par with ICE and DHS.
873850	881030	Oakland, on the other hand, the Oakland PD, Oakland's local police department in California,
881530	888510	they used their cell-site simulator, which is a hailstorm, three times in 2017. In 2018,
888510	895790	it was used four times, and in 2019, it was used only once. But on the other hand,
895790	901750	Santa Barbara PD, the local police department for Santa Barbara, California, used their cell-site
901750	908590	simulator 231 times in 2017, roughly matching up with the numbers from ICE and DHS.
908990	913490	So, what makes Oakland so much different in this case? Well, we think that it's because
913490	920890	Oakland has stronger privacy laws. Oakland has pretty strong regulations about when and where
920890	926010	the cell-site simulator can be used, how it can be used, and what sort of reporting, public
926010	932570	reporting, needs to happen afterwards. And we think that that has really kept Oakland PD on a
932570	940110	leash as far as their use of cell-site simulators is concerned. So, we encourage other communities
940110	945910	to come up with similar rules and regulations about how these can be used. But of course,
945910	951070	not everybody using a cell-site simulator is going to follow rules and regulations,
951710	957850	nor can they be FOIAed. We have pretty good evidence that foreign spies are using cell-site
957850	962830	simulators. The Department of Homeland Security put out a report last year where they demonstrated
962830	967550	that they found several cell-site simulators around the White House and around Washington,
967550	974750	D.C., which almost certainly belong to foreign spies trying to spy on the political class in
974750	981370	Washington, D.C. We also have reason to believe that cyber mercenaries such as NSO Group have
981370	987530	access to cell-site simulators. A report from Amnesty International that was put out this year
987530	995810	in 2020 detailed a campaign against a Moroccan journalist to spy on a Moroccan journalist
995810	1002590	by NSO Group, where they also use cell-site simulators to intercept his calls. And finally,
1002590	1008050	we think that just straight-up criminals have access to these. There's rumors that drug cartels
1008050	1013290	have access to a cell-site simulator, and it makes sense. Cell-site simulators are pretty
1013290	1018150	easy and pretty cheap to build at this point. And if you don't want to build one, you can acquire
1018150	1025630	them from companies in Israel, companies in Saudi Arabia. They're really pretty ubiquitous and pretty
1025630	1031610	easy to acquire. And of course, these people can't be FOIA. We can't ask them how often they're
1031610	1038170	being used, so we have no idea how often these groups are using these. So that being the case,
1038170	1044950	our next step is we start to think about, okay, how can we detect cell-site simulators?
1045430	1053840	And there are two schools of thought for how to detect cell-site simulators.
1055300	1063040	One is app-based, and this is applications like Aim60 or Android MCCatcher Detector,
1063040	1069560	Snoop Snitch, or Darshark. The strengths of these are that they're cheap. It's an app,
1069560	1073980	you install it on your Android phone, and they're easy to use. You start the app,
1073980	1080320	you let it run, it lets you know if it finds something that's suspicious. All you need is
1080320	1085320	an Android phone. And it might need to be rooted, it might need to be a specific type of phone,
1085320	1089760	but you don't really, as long as you have that phone already, you don't have to spend any further
1089760	1097500	money. The weaknesses of these are that you're going to get very limited data. Aim60 only gives
1097500	1105520	you, on an unrooted phone at least, only gives you the MCC, MNC, and the location and the location
1105520	1111460	area. And some information about the signal strength. Snoop Snitch and Darshark get more
1111460	1115180	info because they're able to read baseband messages on the phones that they support,
1115180	1122620	but still you're only getting the info about cells that your phone is connected to. And
1123220	1127960	you're getting a lot of information about weird things happening, but a lot of those end up being
1127960	1134760	false positives, because many of the things that could be indicators of cell-site simulators
1135520	1143780	are also just weird, these sorts of weird things that happen in the cell network quite often.
1144140	1148580	And because of that, you get a lot of false positives, and it's hard to tell
1149240	1155700	what is actually a cell-site simulator and what is maybe just the cell network being the cell
1155700	1164580	network. The other school of thought is radio-based, and this is basically things where you have a
1164580	1169200	software-defined radio or a cellular modem, and you're getting information about all of the towers
1169200	1173700	around you, and you're putting that in a database and running some heuristics to determine what's
1173700	1179200	suspicious. Projects that are examples of this are Seaglass from the University of Washington,
1179960	1184800	Sitch from Ashwilson, and Overwatch, which is a commercial product. The strengths of these are
1184800	1189280	that you can get better data. You can get data from all of the towers in an area, not just the
1189280	1195660	ones that you're connecting to. You can also get lower-level information. You can get as low-level
1195660	1202940	information as you want based on what you can program with your radio, right? The weaknesses
1202940	1209140	of these are that they're harder to set up. They can be harder to use and interpret because you
1209140	1214480	maybe have to run Linux and set up a server, and you have to put together some hardware,
1214480	1218420	and maybe even have to know a little bit of programming. Also, the weaknesses that you have
1218420	1222740	to buy that hardware, and hardware can be expensive. You might have to spend a couple
1222740	1227860	hundred dollars to get running, whereas the app is free. So there are strengths and weaknesses
1227860	1236540	to both of these. But armed with this knowledge, we started hearing rumors about cell-site
1236540	1245120	simulators being used at the Standing Rock protest, or at the Dakota Access Pipeline protest
1245120	1253080	in Standing Rock, North Dakota. And given that we had some ideas about how maybe one could detect
1253080	1257500	cell-site simulators, and we wanted to know if they were being used at protests, we decided to
1257500	1263100	go down to Standing Rock and see what we could find. So I armed my phone with Snoop Snitch and
1263100	1269260	AimSickD, and I brought along a couple of RTL-SDRs, which I figured I could do some spectrum analysis
1269260	1277900	with, and made my way down to Standing Rock. And what I figured out was that I had no idea
1277900	1284620	what I was doing. And by the way, this dog is, I don't know, our patronus is canceled now?
1284840	1290160	If not, this dog is my patronus. I very much identify with this dog.
1290360	1296420	But we had no idea what we were doing. When we got there, what we realized was there were no
1296420	1305220	2G towers anywhere to be found, whether they be legitimate or illegitimate. And all of our
1305220	1313380	detection methods were focused on detecting 2G towers. If a 2G cell had shown up all of a sudden,
1313380	1318720	that would have been a pretty strong indicator. But we weren't able to find any evidence of 2G
1318720	1328140	cells while we were at Standing Rock. And the conclusion that we came to is that if cell site
1328140	1333660	simulators were being used at Standing Rock, they must be next generation cell site simulators that
1333660	1341000	were operating natively on 4G. Which leaves us with the question, how can we detect 4G-based
1341000	1347960	cell site simulators? And how can we improve on previous attempts to detect cell site simulators?
1348720	1355860	Well, first off, I think that the radio-based method is solid. SeaGlass had already put up
1355860	1361660	some pretty interesting results. And the idea of getting information about all of the cells in an
1361660	1366880	area, everything that's broadcasting, not just the ones that your phone's connecting to, and comparing
1366880	1373080	that data over time, I think are really interesting. So let's add on top of that, looking
1373720	1381020	specifically at 4G transmissions, having heuristics based on what we've learned from
1381020	1388160	mine and Yamna's research, and let's verify the results. When we find a suspicious tower,
1388160	1395300	let's go track it down and see what it actually is. Is it on top of a cell tower? Yeah, great.
1395300	1400820	It's probably fine. Is it on top of a building? Yeah, that's fine. It's probably a small cell.
1400820	1405060	Is that building an embassy? Well, that's a lot more suspicious.
1405460	1411320	And finally, is it in an unmarked van or in a van surrounded by police officers? Well,
1411320	1417770	that's very suspicious. So without further ado, I introduce to you Crocodile Hunter.
1418880	1424760	Crocodile Hunter is an open source project that we've been working on at EFF for the last couple
1424760	1431820	of years and are releasing here at Virtual Black Hat and DEF CON this week. Crocodile Hunter is a
1431820	1439320	hardware and software based. It uses an SDR and the software, the backend is based on SRS-LTE,
1439320	1445980	which is an open source LTE software stack that's able to emulate both the Enhanced Packet Core,
1446600	1453880	the eNodeB, and also the user equipment, which we use to measure the cell network in the area.
1453880	1464340	It's written in C++ and we wrote a program in the SRS-LTE API to scan the cell network for us.
1464340	1471360	The frontend, which it communicates with over a local socket, is written in Python 3.
1472020	1476600	The frontend is responsible for getting data from the socket from SRS-LTE,
1477460	1482940	adding it to the database, running heuristics, and displaying tower locations.
1482940	1489280	And we also have an API so that if you want to gather data from multiple sensors or if you want
1489280	1495860	to share data between multiple researchers, you can. Here's an example of what the user interface
1495860	1501840	looks like. This is from a scan that me and my colleague Dave Moss did in downtown San Francisco
1501840	1509620	during the Dreamforce conference last year. Each of these points on this map is, we think,
1509620	1515840	probable location of a cell in downtown San Francisco on that day. The orange points are
1515840	1520640	cells that we didn't find to be suspicious, and the black skulls are cells that we did think
1520640	1526480	were suspicious. And I should note here that certainly there's no way that each of these
1526480	1532920	black skulls is a cell site simulator. In fact, probably none of them are cell site simulators.
1532920	1536560	But we think they're suspicious and require further checking.
1538260	1544640	And I'll go into more depth about that later. On the hardware side, the hardware stack is a
1544640	1549720	laptop or a Raspberry Pi running Ubuntu, and you need a battery for the Pi if you want it to be
1549720	1557640	mobile, a USB GPS dongle, and an SDR with some LTE antennas. For the SDRs, we've tested it with
1557640	1565660	BladeRF and an Edis B200. It should support all models of Edis and BladeRF. It also theoretically
1565660	1570680	could support a Lime SDR, which is significantly cheaper. I think the BladeRF will run you about
1570680	1576820	$500, whereas a Lime SDR will run you about $250. But we have not tested it with that. But that is
1576820	1580600	on the roadmap because we would like for this hardware stack to be cheaper.
1582100	1586060	Here's what the hardware looks like sitting on my kitchen counter. As you can see, it's actually
1586060	1593060	pretty compact, and you can easily put it into a backpack or load it into your car and go for a
1593060	1600440	drive around your city. And it's pretty... and you can do it pretty discreetly.
1600440	1605140	So the general workflow is we start by scanning all of the frequencies that we know about
1605140	1610560	and decoding each MIB and SIB that we find. We record those into a database, we map the
1610560	1615640	probable location of those cells, we look for any anomalies in the readings, and then we locate
1615640	1620320	suspicious cells and confirm the results. And I'll go into each one of those in more depth.
1621000	1627200	So we start by scanning a list of ERFsens, again, frequencies. We start by scanning a list of ERFsens
1627200	1632980	that we get from an open source database called Wiggle. Wiggle is an open source database of
1632980	1639500	war driving readings of Wi-Fi networks and also of cell networks. So we get all of the ERFsens for
1639500	1644960	the given geographical region we are in, and then we scan each of those. And our theory behind this
1644960	1650240	is that we think that a cell-site simulator is going to have to operate on the same frequencies
1651000	1655340	that real cells are, so that phones will be more inclined to connect to them.
1655920	1661920	So we scan each of these frequencies, and if we find a MIB, we decode the MIB and the SIB,
1661920	1667860	and we send it to the front end over our socket. The front end stores the information in a database,
1667860	1674160	and it stores in that database the mobile country code, the network code, the tracking area code,
1674160	1680040	physical ID and ERFsens, the latitude and longitude of where the reading was made,
1680040	1685680	the timestamp, the signal strength, the e-node BID, the sector ID, and a few other IDs,
1685680	1694180	and finally the raw data from the SIB1. And then the next step is that we try to map out
1694180	1700560	the antennas in real time. And we map them out using a process called trilateration,
1701280	1706840	which is a process where we have distance estimates that we're able to get from a combination of the
1706840	1711580	frequency of the transmission and the signal strength. We can estimate the distance and then
1711580	1717600	with multiple readings, figure out where the towers are. And then we can compare this to a
1717600	1723840	ground truth such as wiggle or open cell ID or the FCC database to see if other people have seen
1723840	1730220	a cell with those identifiers in that area historically. A quick explanation of trilateration
1730220	1737820	versus triangulation. So trilateration is where you have a measurement of the distance away from
1737960	1744760	a transmitter that you are, but not what direction the transmitter is in. So you draw a circle around
1744760	1750880	the point where you're at, and somewhere on the edge of that circle is where the transmitter is
1750880	1757760	going to be. Once you've made three measurements, you can draw three circles, and the place where
1757760	1762670	those three circles intersect is the place where the transmitter is going to be located.
1763540	1768360	Triangulation, on the other hand, is where you have a bearing, that is to say a direction of the
1768360	1776980	signal, but you don't know how far away the signal is. With triangulation, you get two readings with
1779260	1787200	a bearing, with a direction, and then you can make a triangle with one line between the two readings
1787200	1792100	and the other two sides with the direction of the readings. And where those two directions intersect
1792800	1801000	is where the location of the tower will be. So triangulation is good if you have direction,
1801000	1806160	direction but not distance, and trilateration is good if you have distance but not direction.
1806160	1811480	For trilateration, you only need one omni-directional antenna. But for triangulation,
1811480	1816340	you either need three omni-directional antennas with all of their clocks synced,
1816340	1820680	so that you can actually measure the angle that the signal is coming from,
1820680	1826940	or you need a directional antenna that's constantly spinning so that you can figure
1826940	1832320	out which direction it points has the strongest signal and thus figure out the bearing.
1834100	1838080	Given that we figured most people running this would only have one omni-directional antenna
1838080	1843640	and not a spinning antenna or three clock-synced antennas and thus three clock-synced radios,
1843640	1846720	we figured that trilateration was our best bet.
1847400	1852320	So finally, we look for anomalies. And what are we looking for in terms of anomalies?
1852520	1857760	We're, well, looking for things like cells that move over time, cells where the signal
1857760	1862600	strength changes, cells that aren't where they should be, in other words, cells that are here
1862600	1870720	and also across the city, cells that change parameters. Suddenly this node BID is broadcasting
1870880	1876120	a different country code or a different network code or suddenly it's broadcasting a different
1876120	1881560	bandwidth or something like that. We're also looking for cells that are missing some of
1881560	1887040	the more obscure parameters in the SID or higher SIDs. And we're looking for new cells that are
1887040	1892380	showing up. And again, it's important to mention here that just because we find an anomaly doesn't
1892380	1896580	mean we've found a cell-site simulator. We actually need to go verify it.
1898820	1903960	So if you know anything about 4G attacks and know how they work, you might be thinking at this
1903960	1909840	point, but there's a lot of heuristics that you could have if you could actually connect to the
1909840	1915360	tower. And that is true. There are a lot of really cool heuristics that we could get if we could
1915360	1920340	connect to a cell. We could see if we got a reject message or we could see if it accepted us. Either
1920340	1925340	one of those might be interesting. We could see if it was missing some of the higher level or more
1925340	1931700	esoteric parts of the LTE stack. Or there's all sorts of things we could measure. We could see
1931700	1936840	how many paging messages it's sending out or how many other UEs are connected to the cell.
1936840	1942280	But all of those would require connecting to the cell. And connecting to the cell requires
1942280	1948300	transmitting. We thought it'd be a great idea until the EFF lawyers pointed out that that's
1948300	1955000	illegal. Because we're using a software-defined radio, it's not actually licensed to communicate
1955900	1961860	to transmit on the cellular bandwidths. Whereas your cellular modem in your phone
1961860	1967440	is licensed to transmit on those bands. So we can't transmit on those bandwidths without violating
1967440	1972780	on those bands on those frequencies without violating the law. And we don't want to go to
1972780	1980040	jail. So we decided not to transmit. But despite that, we still got some results.
1980040	1985480	So what we've found so far. Our first test was at the Dreamforce conference,
1985480	1989880	which I mentioned previously, with my colleague Dave Moss. Me and Dave spent all day running
1989880	1994120	around downtown San Francisco. And for those of you who aren't familiar with Dreamforce,
1994120	1999200	lucky you. Dreamforce takes over all of downtown San Francisco. And there's sales
2000600	2006220	people running around everywhere. We wandered around the main park where Dreamforce was
2006220	2013680	happening. And we noticed this little cluster of suspicious cells here on the park near the where
2013680	2021860	the event was taking place. So we started walking down Third Street and getting to the point where
2021860	2026000	we thought the suspicious cells were. And we're thinking, hey, yeah, I think it's probably right
2026000	2031880	about here. When we looked up and saw this giant black truck with a satellite dish on top of it.
2031880	2035760	The satellite dish was pointing at a building about a block away that had a couple of cell
2035760	2043520	antennas on top of it that we had noted previously. After looking at the truck, looking up the company
2043520	2047760	that was listed on the side of the truck and talking to the guys in the truck, we determined
2047760	2053600	that this is in fact a cell on wheels and not a cell-side simulator. A cell on wheels is a
2053600	2061620	portable cell tower that people bring out, companies bring out, to expand the cellular
2061620	2066960	capacity in a given area, usually for large events. In fact, there was even one at Stading Rock.
2069000	2072600	We don't think that this was a cell-side simulator. And in fact, cells on wheels are
2072600	2078220	pretty common. But they have some interesting similarities to cell-side simulators.
2081880	2087780	Namely, in that they are a portable cell that shows up that isn't usually there, is suddenly
2087780	2096580	there, and then leaves. And that they are acting like legitimate cells.
2096580	2104180	The main differences are that they're not actually trying to exploit any of the characteristics of
2104180	2110080	the 4G network, and the people operating them are probably not using them to spy on you.
2110440	2117340	But we still think that this is a successful test. We were able to use our heuristics to find a new
2117340	2122900	cell that had just showed up, and we were able to use our map to actually track that down and see
2122900	2128160	what it was. If we had just been using an app, maybe that app would have called this out, maybe
2128160	2133240	it wouldn't have. And even if it had called it out, we wouldn't have known what to go look for or what
2133240	2141080	it might have been. So, we considered this a success. Earlier this year, we did a second test
2141800	2144940	at ShmooCon in Washington, D.C.
2145960	2153740	So, I loaded up Crocodile Hunter on a Raspberry Pi running around ShmooCon with it in my
2153740	2160360	backpack for the entire time. And what we discovered at ShmooCon was two really interesting sets of two
2160360	2167260	different ENOBs that would occasionally broadcast, instead of the country code and network code of
2167260	2174060	310410, which maps to USA and AT&T, would broadcast a completely different country code
2174060	2182400	and a completely different network code. Looking into it further, the first one was broadcasting
2182400	2188120	on the same ERCIN as what we think is the legitimate tower, but would broadcast a different
2188120	2199480	MCC and MNC of 350 and 490. 350 is the country code for Bermuda, and the MNC 490 is not used by
2199480	2205800	any network in Bermuda. In the U.S., it's used by Sprint and T-Mobile, but again, this is an AT&T
2205800	2213680	network. It was also broadcasting the same physical ID, but a different sector ID and a different
2213680	2220500	tracking area code. So we find this really interesting. In another instance, there was
2221360	2226860	another ENOB broadcasting on the same ERCIN as what we think is a legitimate ENOB,
2226860	2232760	this time broadcasting a country code of 308 for St. Pierre and Miquelon, which, if you need a
2232760	2237720	point of reference, these are a couple of small islands off the coast of Nova Scotia. I was also
2237720	2243020	not aware of them until I looked them up for this talk. And the network code 451
2243020	2250120	is not used by any network for anything ever anywhere in the world. This network was also
2250120	2255640	broadcasting the same physical ID, and in this case was broadcasting the same sector ID as the
2255640	2260240	legitimate tower and the same tracking area code as the legitimate tower. So these were really
2260240	2266160	interesting. Unfortunately, I, as I said, was running around with the Crocodile Hunter in my
2266160	2271280	backpack and didn't notice these results until after the fact, so I didn't get a chance to go
2271280	2275720	track them down. So hopefully in the future, we'll find something like this and actually get
2275720	2283420	to go physically look at them. We do have ongoing tests, though. Our partners in Latin America with
2283420	2289220	the Fake Intended Detection Project have previously run around Mexico City and other places
2290480	2294680	with SeaGlass and have gotten some really interesting results there, and are planning
2294680	2299040	next to run around there with Crocodile Hunter and see what they can find. And I'm really excited
2299040	2305780	for what they will find. We also have partners running Crocodile Hunter in Washington, D.C.
2305880	2310320	and in New York City, and we hope now that the project is open source that you'll want to run
2310320	2319960	this in your hometown as well. In the future, we hope to get better heuristics for Crocodile Hunter.
2320320	2325560	Some of the heuristics I have right now aren't great, and I think that there are other ones
2325560	2331000	that we could do. We have a lot of ideas. We also can improve these once we get a
2331000	2336240	better sense of how ABC catchers and cell site simulators are operating in the wild.
2336700	2341020	Speaking of heuristics, once we get a lot of readings, we think that we can start to do some
2341020	2347020	machine learning to build a classifier for what towers are behaving normally and giving normal
2347020	2353020	characteristics and what towers are suspicious, maybe in ways that a human wouldn't notice.
2353280	2357760	I also want to get better location finding. Right now, my location finding can sometimes be about
2357760	2363720	50 meters off, and that's not great. It's still pretty close, and I'm okay with it. I think it's
2363720	2371420	good enough. But I would like to get it much better, and that means we need better distance
2371420	2378700	estimates, which is beyond my math and physics knowledge, unfortunately. And the other thing we
2378700	2383680	need is we want to port it to cheaper hardware. Like I said, the Blade RF will ring you about
2383680	2391780	$500. We think that it can work on the Lime SDR, which is cheaper at $250. My dream is that it
2391780	2398300	would work on the RTL SDR, which would cost like $20, but I'm not convinced that the RTL SDR and
2398300	2403940	Raspberry Pi are actually powerful enough or have the bandwidth to do what we need them to do,
2403940	2411540	so that's still up in the air. And finally, what's with the name? Well, you may remember
2411540	2417760	that one of the brand names for a cell-site simulator is the StingRam. You may also
2417760	2424040	remember that the StingRam is the animal that finally killed Steve Irwin, the crocodile hunter.
2424320	2428360	So, we named it Crocodile Hunter to press F for Steve.
2430320	2438180	Finally, what can we do to stop cell-site simulators? Well, we can start by having a
2438180	2445440	toggle on iOS and Android to turn off 2G support. One of the main attacks for native 4G cell-site
2445440	2452000	simulators is to use that pre-authentication area to downgrade your connection to 2G. And once your
2452000	2457920	phone is downgraded to a 2G connection, they can do things like inspect content or do passive
2457920	2464600	attacks to decrypt the messages between you and the cell tower, or they can emulate a 2G base
2464600	2471180	station. So, your phone still supports 2G, and the reason for that, there's a good reason for that.
2471180	2477400	It's because many people in the world still use 2G cells as their primary form of communication,
2477400	2485440	and lots of 2G networks are still up. So, iOS and Android can't just disable 2G by default,
2485440	2490060	but what they could do is build in a toggle for users who are concerned about this to be able to
2490060	2497060	turn off their 2G radios if they wish. And we've written a blog post that encourages them to do so.
2498020	2501680	The main thing we need to fix, though, is these pre-authentication messages.
2501680	2506740	All of the messages that happen after your phone connects to the tower, but before the authentication
2507980	2514020	starts. And that's a problem not in 4G, but not just in 4G, but in 5G as well.
2514020	2523420	There's a pretty interesting proposal for covering all of the messages, or authenticating
2523420	2528460	all of the messages between the tower and the user equipment with TLS. There's a pretty good
2528460	2535800	paper about this, and it'll be linked here in the notes for this presentation, that proposes a way,
2535800	2539480	and it's still in its infancy, and it's going to take some more work, but we really think that
2539480	2545960	long-term, that's the solution. But that's going to have to be implemented by a standards body,
2545960	2552340	such as the 3GPP. And the 3GPP is the standards body that makes all of the standards for cell
2552340	2557600	networks. It's also going to have to be implemented by carriers, manufacturers, and OEMs, and we need
2557600	2565440	more incentives for the standards, or as the carriers and the OEMs, to care about user privacy.
2565440	2570680	Right now, it often feels as though user privacy is an afterthought, and connectivity is really the
2570680	2578700	most important, the primary goal of these organizations. And we need to change that.
2578700	2585460	The 3GPP costs several tens of thousands of dollars to get a seat on, and as such, there are no
2585460	2590280	representations from civil society, from privacy organizations, from non-profits, and that needs to
2590280	2595780	change. None of these solutions are going to be tool-proof, of course, and our detection, and
2595780	2600960	Carcine Hunter is tool-proof, but we're not even doing the bare minimum yet, and I think that we
2600960	2608460	should be doing at least that. So what do I want you to take away from this? Well, we have a pretty
2608460	2613260	good understanding of the vulnerabilities in 4G, which commercial cell site simulators might
2613260	2617880	exploit. And if you want to read more about those, I really highly suggest you read Yama's paper,
2617880	2623520	Gotta Catch Em All. None of the previous MCCatcher detector apps really do the job anymore.
2623520	2629300	CGLASS could certainly still detect older MCCatchers, but none of them are able to detect
2629300	2635520	newer MCCatchers. But we've come up with a method similar to established methods, but targeting 4G
2635520	2642300	natively. And we think that the worst problems of CSS abuse can be solved with a little bit of elbow
2642300	2649500	grease and a lot of politics. Finally, thanks to the following people. Yamna, of course. I couldn't
2649500	2653640	have done this project without her, and she did so much amazing work. Thanks so much to Yamna,
2653640	2658820	and please buy her a virtual beer, or just challenge her to a game of Dance Dance Revolution
2658820	2663400	if you see her. And of course, thanks to the whole EFF crew, and especially Threat Lab,
2663400	2668140	who have been a huge support through all of this. Huge thanks to Andy and Bob at Wiggle for a lot
2668140	2673360	of programming help and a lot of... for giving me unfettered access to their API. Thanks to Roger
2673360	2678840	Piqueros-Jover, who is one of the smartest people in the world about cell networks. He really knows
2678840	2684300	his stuff, and he gave a lot of advice and a lot of encouragement. Thanks to my test crew, Neema
2684300	2691160	Fatemi with CanDo, and Surya, Matthew, and Simon from the Markup. Simon Fondry-Tiedler, thank you.
2691780	2696320	Carlos with the Fade Project, and everybody else involved in the Fade Project, thanks for
2696320	2702200	running Practical Hunter in South America. Carl Kosher and Peter Ney and others at the University
2702200	2709280	of Washington, who authored Seagloss, as well as giving me tons of advice, tons of support,
2709280	2714200	coming out to Standing Rock with me. Really fantastic people. And of course, thanks to Ash
2714200	2718420	Wilson, the author of Siege, and Eric Escobar, Defcon Justice Beaver, who also gave me a lot
2718420	2722820	of inspiration and advice. And last but not least, thanks to Kristen Padgett for doing all the
2722820	2727420	research on suicide simulators and really paving the way for hackers to start looking at these.
2727420	2732640	And also, thanks for the Geophones, Kristen. And finally, thank you for coming to the talk.