Previous discussion: https://news.ycombinator.com/item?id=35705683 (256 points, 55 comments)

It is what it is, no need for posts like this.

I find references like this to other posts with good commentary to be useful in understanding the discourse surrounding the topic.

Does anyone know the encryption schema of LTE? Does the key change with each message or is it for a longer period of time? I'm wondering how feasible it is for an attacker to capture and then break the encryption (obviously if we're talking 2048-bit that wont be happening anytime soon)

This looks like a good overview of the subject. https://www.eecis.udel.edu/~salehi/files/asee13_lte.pdf

why bother? Just force the handset down to 2G and intercept that.

There is nothing to intercept on 2G in Canada and USA, 2G was decommissioned.

These attacks are generally carried out by a “rogue base station” that simulates being a cell tower. It doesn’t require that there be a local 2G infrastructure.

SIMs from my two different Canadian operator doesn't allow downgrade to 2G for the home networks.

That's pretty cool, any idea how it works?

Authentication profiles. Basically one can specify on the SIM profile that for the certain PLMN (mobile operator) only certain authentication methods are allowed (2G, 3G, 4G use different auth methods).

that is good. from what i understand we dont have that in the US

What prevents these from simulating a non-"home" network?

You could by suddenly roaming when you're in your home country is a massive red flag and even normal people are aware and terrified of roaming fees.

Are you sure your information isn't outdated by a decade or two? Providers have free roaming data nowadays, e.g. https://www.t-mobile.com/support/coverage/domestic-roaming-d...

...and that also locked to a certain auth profiles in Canada.

Most of the world isn't the U.S. E.g. in the UK operators recently rescinded free roaming in the EU.

The EU? Weren't we talking about the US and Canada in [1]?

[1] https://news.ycombinator.com/item?id=35953970

The decommission of 2G/3G and removal of downgrades applies pretty much everywhere these days (my operator doesn't even allow 3G downgrades on their 5G plans), I read it as just an example rather than starting a very specific conversation.

That's the towers. All the handsets still support 2G, and will happily let themselves be downgrade-attacked to it.

2G lacks even the most rudimentary authentication, so you don't even have to try to look like a tower once you've done this. Just say you're a tower.

2G is deprecated so a lot of the newer phones won’t even support that..?

I can't even turn off 2G on my relatively new Samsung handset, so I find it hard to believe it is "deprecated".

There are likely zero 2G towers in my area, but that doesn't mean handset suppliers don't ship it still.

As long as there are countries with GSM service, it's not going to stop being shipped.

Yea relatively speaking…

On an Android smartphone you can disable it usually, via *#*#4636#*#*

There's a frontend for this on F-Droid if you prefer that [1]

[1] https://f-droid.org/en/packages/pl.lebihan.network/

This doesn't work on Samsung phones

Not really no. Newer phones absolutely support 2G.

Surely a phone would rather connect to a moderately strong 3/4/5G tower than a very strong 2G tower, right? So that'd limit you to settings where people otherwise wouldn't have a connection at all. IDK, genuinely curious.

i hope that would be expensive, isnt it?

It’s a key set per session. See https://arxiv.org/pdf/1510.07563.pdf to answer your other question

The authentication model is based on Radius with EAP, the main point is that anything after and including 3G does mutual authentication and in 4G/5G this is based on IETF protocols, in theory, you can associate with 4G network with whatever authentication supplier that works with WPA-Enterprise (and in theory that even works the other way around). The idea there is that 4G/5G is simply an physical layer for Ethernet2 frames with some kind of access control and QoS layer. And quite obviously the frames are encrypted and authenticated on L2. And as the whole thing is IP, some carriers just tunnel the whole thing in additional layer of IPSec tunnels.

Um, yeah, I don’t have $20k to drop on an Ettus USRP X310 and two daughterboards. I would have liked to have played with it but that is too rich for me.

A B210 with GPSDO is expensive, but considerably cheaper than $20k. Granted the functionality would be limited but it is possible for hobbyists to play with this.

This is usually the very inspiration for a hacker to pull out the soldering iron to make one themselves because the off-the-shelf item is too damn expensive

I don't know for this particular case but usually expensive stuff has expensive components too, especially in low quantity

I have a B210 but the project indicated that it was only compatible with the X310 with two daughterboards.

From Hardware Requirements > SDR: "To sniff only downlink traffic from the base station, one can operate LTESniffer with USRP B210 which is connected to PC via a USB 3.0 port. Similarly, USRB B210 should be equipped with GPSDO and two RX antennas to decode downlink messages in transmission modes 3 and 4."

That’s one of the lessons learned when hacking your own thing. After enough projects and buying the parts & pieces (you never buy just one component), you end up with a stash that eventually means you don’t have to buy anything for a future project. It’s part of the cost of being a hacker.

From rather ancient memory, the high-end Ettus stuff is much, much more expensive than its BOM cost. You're paying for a well-designed and well-tested product with excellent RF performance and a good ecosystem. You buy it and it works.

You could design your own board(s) with the same parts, and you could build it for much less money. But you'd need to know what you're doing, and the design stage would be expensive.

Is it just me, or should you be able to do this with a pair of HackRFs with a clock jumper between the two? Or possibly a clock-sync pin tied between the CPLDs?

An RFSoC 2x2 kit [1] could handle the RF part (with an FPGA included!), it's 2k, still expensive.

1: https://www.xilinx.com/support/university/xup-boards/RFSoC2x...

You might not like what you find anyway...

Eavesdropping tool with eavesdropping name with a little disclaimer about not being responsible for illegal use

Yeah this is the kind of repository that you clone immediately

Clone, dont just Fork

The FBI got caught doing something kind of similar in a pretty hilarious way (the full story is nuts) using a device called a "stingray" - https://www.aclu.org/news/privacy-technology/surreal-stingra...

Although in this case, they were disguising themselves as a cell tower and intercepting traffic that way.

If I recall correctly, what this software is capable of doing is not what the Stringray debacle was about.

While the Stringray could also be used as a passive sniffer, the FBI Stringray debacle was about it being used as an active fake cell site, in proximity to a target, to intercept communications.

if you control the access point, you can block or modify traffic. listen to the traffic and get inside.

"Fake" cell towers, imsi catchers and similar tech is a rather common way for to spy on people, it's certainly not just FBI.

the stingray was a long time ago and it was not known at the time. go ahead and read the story, it’s interesting