[srslte-users] Possible to sniff Attach Requests?

[David Rupprecht]

Hi,

Airscope is just an downlink analyzer, but you get also meta-information
about the uplink traffic, as they are signaled in downlink direction via
the DCI (Downlink Controll Information).

LTE uses the concept of channels to distinguish between different kind
of traffic. The PDSCH - is Physical downlink shared channel and a
*Physical* channel. In contrast the PCCH Paging Control Channel is a
*logical* channel. The PDSCH carrys more the only the PCCH, for example
the user data itself. See [1].

Yes, P_RNTI = 0xFFFE, but you need to include the RRC decoding in the
pdsch_ue.c to get the actual paging messages or dump all messages with
wireshark.

The PSS & SSS are synchronization symbols on the physical cell that are
used during the initial cell search [2]. Under the condition, the UE is
in the radio connected state, it is synchronized to a cell and will not
listen to the paging channels of other cells. Injecting paging messages
to a UE with a active radio connection, would be an interesting research
question. Under the condition the UE is not in the radio connected
state, it will periodically check the paging channel of last
synchronized cell. If the UE does can not synchronized to the cell
again, it will trigger the cell reselection procedure [2]. In general
you should distinguish between and active radio connection (RRC
Connected state) and registered in the core network (EMM-REGISTERED).
The latter one, is when you do not send on the radio layer, but you are
connected to the core network. I think it is only possible to inject
paging message in the emm-registered case, with affordable resources.

[1] http://www.techplayon.com/wp-content/uploads/2017/08/Chan1.png
[2]
https://sites.google.com/site/lteencyclopedia/cell-reselection-procedures-in-lte

Best regards,
David

On 09.11.18 19:24, Dylanger Daly wrote:
> Thank you David,
> 
> Is it possible to sniff UL with the AirScope?
> 
> I understand there are 2 Paging Channels, PCCH and PDSCH, PCCH alerts
> the UE of the fact that it's being paged, PDSCH contains the _actual_
> paging information.
> 
> What am I listening to with -r set to P-RNTI / 0xFFFE?
> 
> Is PSS & SSS configuration present in the Attach Procedure?
> 
> Would it be possible to spam PDSCH with Paging Requests consisting on an
> IMSI, resulting in the UE detaching? Or do I still need to sync the PSS/SSS?
> 
> Lastly, before I RTFM, is there somewhere in srsLTE/enb I can set the
> PSS / SSS and _only_ send one Paging Request for example? After setting
> the eNb up, will it straight up transmit **over** the legitimate eNb? So
> no legitimate Paging Requests would make it thru?
> 
> For reference, the research I'm mainly refering to is LTEInspector
> (http://wp.internetsociety.org/ndss/wp-content/uploads/sites/25/2018/02/ndss2018_02A-3_Hussain_paper.pdf)
> 
> End goal is to be able to send arbitrary Paging Requests to my device in
> an already connected state.
> 
> Cheers David! :)
> 
> On Fri, Nov 9, 2018 at 6:28 PM David Rupprecht <david.rupprecht at rub.de
> <mailto:david.rupprecht at rub.de>> wrote:
> 
>     Hi,
> 
>     you can use srsLTE/lib/examples/pdsch_ue.c to listing to the cell's
>     paging requests setting the rnti=P-RNTI. This was first described in
>     [1]. For further Downlink analyses, you can use Airscope an srsLTE based
>     downlink analyzer [2]. Sniffing the Attach Request is a bit more
>     difficult, as they are send in uplink direction. For injecting paging
>     traffic the UE must be synchronized to the your PSS and SSS. For more
>     information you can read [1] or [3].
> 
>     Best regards,
>     David
> 
> 
>     [1] https://arxiv.org/pdf/1510.07563.pdf
>     [2] http://www.softwareradiosystems.com/products/
>     [3] https://comsecuris.com/papers/UMTSprivacy.pdf
> 
>     On 09.11.18 16:02, Dylanger Daly wrote:
>     > Hey Guys,
>     >
>     > Apologies if this is the wrong way to start threads, I've never used a
>     > mailing list before.
>     >
>     > Is it possible to modify srsUE and sniff Paging Requests along side
>     > Attach Requests from other UEs?
>     >
>     > I'm wanting to pickup the DRX_Cycle (Paging Cycle) for all UEs that
>     > attach, it's my understanding this parameter is set in the Attach
>     > Request, as well as SIB.
>     >
>     > Knowing this information, it _should_ be possible to then
>     > transmit/inject Paging Messages to that UE, does anyone know if
>     this is
>     > possible?
>     >
>     > Thank you very much! Any help is greatly appreciated :)
>     >
>     > _______________________________________________
>     > srslte-users mailing list
>     > srslte-users at lists.softwareradiosystems.com
>     <mailto:srslte-users at lists.softwareradiosystems.com>
>     > http://www.softwareradiosystems.com/mailman/listinfo/srslte-users
>     >
> 
>     -- 
>     M.Sc. David Rupprecht
> 
>     Ruhr-University Bochum
>     Research Group Information Security
>     Universitätsstraße 150
>     ID 2/130
>     44780 Bochum / Germany
> 
>     Phone: +49 234 / 32 - 23508 <tel:+49%20234%203223508>
>     Web: www.infsec.rub.de <http://www.infsec.rub.de>
> 

-- 
M.Sc. David Rupprecht

Ruhr-University Bochum
Research Group Information Security
Universitätsstraße 150
ID 2/130
44780 Bochum / Germany

Phone: +49 234 / 32 - 23508
Web: www.infsec.rub.de