10 ms·
LTESniffer: An open-source LTE downlink/uplink eavesdropper [pdf]
- newsclues 3y agohttps://github.com/SysSec-KAIST/LTESniffer https://github.com/SysSec-KAIST/LTESniffer
- lll-o-lll 3y agoSounds cool, but how many people have the 9k USD to sink on the radio required? Security through price barriers. Except it’s not security of course; the difficulty in obtaining hardware is a large reason as to why industrial control systems had such abysmal security for as long as they did.
- jrexilius 3y agofor passive sniffing, it looks like you can run the cheaper module at only $2k, which is approachable for researchers.. actually fully loaded price tag is $11k or $4k as you need GPSDO also.. but $4k is almost approachable I guess.. [edit to add] https://www.ettus.com/all-products/ub210-kit/ https://www.ettus.com/all-products/ub210-kit/
- tonyarkles 3y agoAmazingly, you can probably get a reasonable GPSDO from eBay for a couple hundred dollars. I was running an Ettus B210 off of an eBay GPSDO and had about a 1Hz frequency offset relative to an LTE tower at 1800MHz. Pretty cool!
- zer0_duck 3y agoDid you test that LTESniffer by USRP B210?
- tonyarkles 3y agoSadly not yet. I’m very intrigued though! At one point I was going to try setting up a similar project using a… BladeRF? I forget which open LTE project it was.
- nickphx 3y agoIt can be done for under $600 using a bladeRF.. https://docs.srsran.com/projects/4g/en/latest/app_notes/source/hw_packs/source/index.html https://docs.srsran.com/projects/4g/en/latest/app_notes/sour...
- tibbon 3y agoSimilarly a LimeSDR perhaps?
- nikau 3y ago> why industrial control systems had such abysmal security for as long as they did. Bold of you to use past tense there
- brookst 3y agoThey've really improved a lot. They used to be abysmal, but all of the scrutiny and high profile attacks have forced vendors to invest in bringing them up to merely terrible.
- jeroenhd 3y agoVendors upgrading to simply terrible security doesn't mean their customers are protected. After all, why not use the opportunity to sell the Super Security Plus+ version of the existing hardware for a nice fee?
- rickdeckard 3y agoBecause the majority of your customers and you yourself sit in the working groups which created that "non-secure version" of the standard. Either your customer would disagree with the premise of the standard implementation being "insufficiently secure" or your contribution to security should be reviewed as an evolution to the standard. Result: Security is not being questioned in this realm of commercial discussion.
- nimbius 3y ago>how many people have the 9k USD to sink on the radio required? its a soft target. US telecom has habitually revealed their almost contemptuous disinterest in security and rely almost entirely on price barriers or law. It would be trivial to pivot your narcotics racket to digital for only 9k or your online ransomware to LTE snooping.
- userbinator 3y agoPerhaps also "security through complexity" --- the specs for LTE and the previous mobile network protocols are freely available, but huge and very difficult to understand for someone not already familiar with the system (in comparison to e.g. Internet RFCs).
- xfitm3 3y agoA lot of people on this site earn a shit ton of money.
- MuffinFlavored 3y agoHow illegal is this from an FCC or cell phone carrier perspective? I would have guessed LTE traffic was "HTTPS" levels of encrypted?
- xen2xen1 3y agoNo, IIRC it isn't anywhere near real encryption.
- nicce 3y agoHmm… LTE stands for 4G and they use 128-EEA2 (AES-CTR) or 128-EIA2 (AES-CMAC) which are kinda same as TLS 1.2 and TLS 1.3. Where the latter suppors chacha additionally. GCM on TLS gives greater performance and the integrity can be confirmed earlier, but there are no serious security problems on algorithm side.
- bryancoxwell 3y agoImportant to note that the encryption you mention applies to user data traveling between the UE and the eNodeB. Some control plane data between the UE and eNB is unencrypted and no encryption of user data is done between the eNB and the network (unless it’s done at a higher layer).
- jiggunjer 3y agoNah, 4g stands for 4g.
- nicce 3y agoLTE is industry jargon for the fastest type of 4G
- offmycloud 3y agoLTE stands for Long-Term Evolution
- jcrawfordor 3y ago
- mig_ 3y agoIs any device identifying information exposed unencrypted ? Thinking if you can use this to tell who is in the proximity.
- a6 3y agoYou can use 2G sniffers for that which require much less expensive hardware.