On the impact of modified cellular radio equipment

Telecommunication protocols are considerably complex and both hardand software have been traditionally kept out of reach of security researchers and attackers with regard to understanding its internal details or modifying equipment. While protocol details are open and publicly available via a large set of telecommunication speciications, the inner workings of mobile devices are proprietary and software stacks running on this hardware are closed. Also, the number of system information leaks from this industry has been traditionally very low and to a large extent mobile phones are still a black box. However, this is more and more changing due to an active Open Source and hacker community with the goal to enable free research on open hardand software in this space. This has lead to new research and particularly the accessibility of mobile technology to adversaries that do not operate standard compliant equipment. Such research is particularly interesting for several reasons. First, mobile networks are critical infrastructure and a large extent of the population relies on its security and availability under diferent circumstances. Second, the telecommunication industry is driven by big international corporations and diferent aspects of monetary interests are at stake. Third, no proximity is required to communicate with the network, which makes it highly ineicient to trace back certain types of attacks to attackers in practice. The goal of this research is to build up on newly available hardand software components for radio communication. Therefore, this work investigates the potential and impact of attacks based on modiied hardand software without exploiting application-speciic software vulnerabilities directly. We demonstrate that an attacker in such a position can pose a signiicant threat both to subscribers and to the carrier itself. While we highlight individual security vulnerabilities in this work, the practical impact of these can be attributed towards the inherent lack of accounting for adversaries operating intentionally misbehaving equipment in standards. We exhibit that it is fundamentally wrong to assume a trusted serving network, unmodiied baseband irmware, and rely on security through obscurity principles in the context of mobile telecommunication. We split this challenge into two diferent aspects, carrier-grade equipment such as used on the network operator side and traditional handsets used by subscribers in the ield. On the network side, we conducted a study of the security of low-power cellular base stations called femtocells to attack both subscribers of such technology and the carrier providing access to the cellular network. This is enhanced by studying the impact of an attacker with arbitrary access to over-the-air traic on certain privacy properties of modern 3G networks. On the phone side, we focused on modifying the baseband software to evaluate the feasibility of attacks against other subscribers in the network. In both cases, we demonstrate that an attacker with access to carrier equipment, subscriber equipment, and baseband software can “On the Impact of Modiied Cellular Radio Equipment”