You are on page 1of 39

GSM Mobile Security

Prepared by: Leen F. Arikat

With GSM, systems for mobile communication reached a global scale. In the western world, it seems everyone has their own mobile phone, and GSM has taken more and more of the market. GSM allows users to roam seamlessly between networks, and separate the user identity from the phone equipment. In addition the GSM system provides the functional basis for the 3rd generation mobile system, UMTS.

Some GSM Facts
Nearly 1 billion subscribers worldwide Estimated that worldwide mobile phone fraud will reach $40 billion dollars US Law enforcement agents have found that 80% of drug dealers arrested in US using cloned mobile phones. Ironically, Pablo Escobar the top Columbian drug dealer was tracked down by monitoring his mobile phone activity. Two aspects relevant to a Forensic Analyst 

Has the phone been used for a criminal act? Can the phone be used to secure a conviction?

Any equipment used on a GSM network has to have approval by the ETSI.Some GSM Facts The European Telecommunication Standards Institute (ETSI) regulates the GSM standard (all 4000 pages of it!). . All MS¶s are independent from any network.

What are the components of a GSM network? Subscriber Equipment  The Mobile Station (MS) is the user equipment in GSM.  The station consists of two entities: ‡ The Mobile Equipment (the phone itself) ‡ The Subscriber Identity Module (SIM) . It is what the user can see of the GSM system.

.  Visitor Location Register (VLR) .  Authentication Center (AUC) .A database which stores data about GSM subscribers.A database which contains information about the identity of mobile equipment in order to prevent calls from stolen.  Mobile Services Switching Center (MSC) .The network element which performs the telephony switching functions of the GSM network.) The Switching System (SS)  Home Location Register (HLR) . unauthorized.A database which contains the International Mobile Subscriber Identity (IMSI) the Subscriber Authentication key (Ki). including the Individual Subscriber Authentication Key (Ki) for each Subscriber Identity Module (SIM). and the defined algorithms for encryption. .Components of a GSM network (cont.  Equipment Identity Register (EIR) .A database which stores temporary information about roaming GSM subscribers. or defective mobile stations.

. The BTS is the radio equipment (transceivers and antennas) needed to service each cell in the network.Components of a GSM network (cont. The BSC provides functions such as handover..The network element which handles the radio interface to the mobile station. cell configuration data. and control of radio frequency (RF) power levels in Base Transceiver Stations.The network element which provides all the control functions and physical links between the MSC and BTS.  Base Transceiver Station (BTS) .) The Base Station System (BSS)  Base Station Controller (BSC) .

) The Operation and Support System (OSS)  Message Center (MXE) .A network element used to interconnect two GSM networks.A network element which provides Short Message Service (SMS).. . fax mail.  Gateway Mobile Services Switching Center (GMSC) .Components of a GSM network (cont. voice mail. email. and paging.

The Subscriber .

How to Identify a Subscriber Every mobile subscriber is issued with a smart card called a Subscriber Identity Module (SIM) As physical evidence the SIM provides details printed on the surface of.   Name of the Network Provider Unique ID Number .

Electronic Access to the SIM Every SIM can be protected by a Personal Identification Number (PIN)     Set at point of manufacture Can be changed by the Subscriber Four digit code Usually 3 attempts before phone is blocked Bypassing the PIN requires the Pin Unblocking Key (PUK)    8 digit code Set by manufacturer Maximum 10 attempts before phone is permanently blocked .

What Can Be Extracted From A SIM? As SIM is a smart card it has   A processor NonNon-volatile memory Processor is used for providing access to the data and security To access the data we need.   Standard smart card reader SIM access Software Data stored in binary files .

29 files stored on a SIM .What Can Be Extracted From A SIM? Ideally an Analyst would download an image of the contents and compute a hash value of the contents as a means of validating originality of content At present files are downloaded traditionally  Software Sim Manager Pro ChipIt SimScan  Cards4Labs only available to Law Enforcement Agencies Produces a text report of content rather than downloading.

.Location Information File File Purpose LOCI Location Information Size 11 bytes The bytes 5-9 of the LOCI contain the network 5Location Area Identifier (LAI) code Network Operator specific This data is retained when the MS is powered down Updated as MS moves from one location to another Analyst can determine which location the MS was present in when last used. LOCI DOES NOT DETAIL WHICH CELL! Cell data not stored on SIM. Location Areas can contain many cells.

Serial Number File ICCID Purpose Serial Number Size 10 bytes Integrated Circuit Card Identifier Corresponds to the number printed on the surface of the SIM Identifies the SIM .

Subscriber Identifier File IMSI Purpose Subscriber ID Size 9 bytes International Mobile Subscriber Identity As stored in the HLR/VLR¶s on the networks Unique ID for every subscription on the Operator¶s network .

Phone Number File MSISDN Purpose Phone Number Size variable Mobile Station International ISDN number .

Text Message Data (SMS) File SMS SMSP SMSS Purpose The text messages Message parameters Status of the message Size n * 176 bytes variable variable Short Message Service is a popular communication method Most SIM¶s have 12 slots for storing messages  Modern MS¶s allow storage on the device as well .

read Mobile terminated message.Text Message Data (SMS) Status Value 00000000 00000001 00000011 00000101 00000111 Interpretation Unused Mobile terminated message. not sent When user deletes a message only the status flag is changed  Therefore. sent Mobile originated message. unread Mobile originated message. providing the message has not been overwritten any message in a slot can be recovered and translated using software .

Directly from the SIM using a scanning software EavesEaves-dropping on the networks for unencrypted transmission of the IMSI  Ki cannot normally be obtained directly as it is derived from an encryption algorithm stored on the SIM However.Threats to SIM Data Knowledgeable criminals will be aware of the properties of the SIM and thus manipulate them. Greater threat is that of cloning SIM data for illicit use  Two key pieces of data IMSI The data encryption key (Ki)  IMSI can be obtained. if the encryption algorithm is weak then it is possible to feed numbers .

 An attacker could also get hold of a generic smart card and smart card programmer.  The card must then be programmed with a special tool for programming of fresh cards.Threats to SIM Data Obtaining blank SIMs  These cards can be ordered from the same source where network providers get their cards. and then program the card to act as a SIM. . Such a tool is distributed together with the Sim-Scan package.

The Equipment .

Have to request the SIM PIN if activated May have optional MS PIN .Generic Properties All MS¶s have GSM standards on how they access and communicate with the network and SIM card Every MS has a unique ID called the International Mobile Equipment Identity (IMEI) Everything else is manufacturer dependent     File system Features Interface Etc.

WAP and Internet settings . tone/volume etc) Stored Audio Recordings Stored images/multimedia Stored Computer Files Logged incoming calls and dialled numbers Stored Executable Progams (eg J2ME) Stored Calendar Events GPRS.            IMEI Short Dial Numbers Text/Multimedia Messages Settings (languge.MS Data Very much dependent on the model. may include. date/time.

 Detecting changes to the IMEI Compare the electronic IMEI with that printed on the inside of the device .Threats to MS Data Tools such as Flashers and Data Suites can be used to directly manipulate MS data Common threat is removing the Service Provider Lock (SP-Lock) limiting the MS to a single (SPnetworked.  Can also be used to avoid tracing an MS. Changing the IMEI on stolen phones  Networks blacklist stolen IMEI¶s in the EIR.

The Network .

data transferred and connection location/timing The HLR can provide. message traffic.          Customer name and address Billing name and address (if other than customer) User name and address (if other than customer) Billing account details Telephone Number (MSISDN) IMSI SIM serial number (as printed on the SIM-card) SIMPIN/PUK for the SIM Subscriber Services allowed .Network Operator Data The Network Operators can provide detailed data on calls made/received.

The Call Data Records (CDR¶s) Produced in the originating MSC transferred to the OMC   Every call Every message Originating MSISDN Terminating MSISDN Originating and terminating IMEI Duration of call Type of Service Initial serving Base Station (BTS) (not subsequent BTSs after handover) Each CDR contains.       .

Threats to Network Operator GSM not immune to interception It is possible for the network to order the MS to switch on and off encryption at times of high loading  This signal can be spoofed using a man-in-the-middle attack man-in-the- .

GSM Security Operation GSM networks utilize encryption for three purposes:  Authentication  Encryption  Key generation .

the network authenticates the user by sending a random number (challenge) to the mobile. Each time the mobile connects to the network.. This 128-bit number is stored 128on the SIM-card. This is accomplished by giving the user and network a shared secret.) GSM provides authentication of users and encryption of the traffic across the air interface.GSM Security Operation (Cont. called Ki. The SIM then uses an authentication algorithm to compute an authentication token SRES using the random number and Ki. and is not directly accessible to the SIMuser. .

even if an attacker listening to the air traffic could crack the encryption key Kc. This key is used for encryption of subsequent traffic across the air interface. At the same time. the attack would be of little value.GSM Security Operation (Cont. Thus. since this key changes each time the authentication procedure is performed .) The mobile sends the SRES back to the network which compares the value with an independently computed SRES. an encryption key Kc is computed..

SIMIS has become an integral tool for law enforcement and digital investigators.Forensics Tools SIMIS  SIM card Interrogation System is the world's leading forensic tool for examining SIM cards forensically.  The SIMIS desktop software has been evaluated by the DoD. and is complimented by a mobile handheld device for data collection in the field .  Used throughout the world since 1997.

Forensics Tools Cell Seizure: Paraben Cell Seizure is a piece of software that serves the main purpose of collection and examining data pulled from various types of cell phones. phones. .

Cell Seizure is able to generate comprehensive HTML reports of acquired data. The software is able to retrieve deleted files and check for file integrity.Cell Seizure Tool The main goal of Cell Seizure is to organize and report various types of files. integrity. .

Cell Seizure does not allow data to be changed on the phone.  In fact. even some forensic software warns of possible data loss.Advantages of Cell Seizure  It is designed not to change the data phone. all of the data can be examined while keeping the process undetected. . stored on the SIM card or cell phone. In other words.

Disadvantages of Cell Seizure  It does not support all models of cell phones. . and can also acquire GSM SIM Cards. However. this application can acquire information from most models made by the following companies: Nokia. Motorola.  Another disadvantage would be that the format of acquired data can sometimes be confusing. The data is not organized nice and neat and given to the user in a way that they can easily understand what they are seeing. Cards. SonyLG. Ericcson. Samsung. Motorola. Samsung. Nokia. SonyEriccson. LG. Siemens. Siemens.

call logs. Acquires text messages. etc. Acquires complete GSM SIM card Recovers deleted data and full flash downloads Supports multiple languages Contains comprehensive HTML reporting and other reporting formats Provides advanced searching including text & hex values Contains viewers for proprietary media file formats Allows viewing of multiple workspaces at one time .Cell Seizure Features Supports GSM. TDMA. address books. and CDMA cell phones GSM. TDMA.

it is important to recognize the need to study the methods and tools for forensic analysis of the GSM system.Conclusion The sources of evidence  The subscriber  The mobile station  The network Since GSM is the worlds largest system for mobile communication today and also lay the foundation for the future UMTS. .