[srslte-users] Possible to sniff Attach Requests?

[Dylanger Daly]

Thank you David,

Is it possible to sniff UL with the AirScope?

I understand there are 2 Paging Channels, PCCH and PDSCH, PCCH alerts the
UE of the fact that it's being paged, PDSCH contains the _actual_ paging
information.

What am I listening to with -r set to P-RNTI / 0xFFFE?

Is PSS & SSS configuration present in the Attach Procedure?

Would it be possible to spam PDSCH with Paging Requests consisting on an
IMSI, resulting in the UE detaching? Or do I still need to sync the PSS/SSS?

Lastly, before I RTFM, is there somewhere in srsLTE/enb I can set the PSS /
SSS and _only_ send one Paging Request for example? After setting the eNb
up, will it straight up transmit **over** the legitimate eNb? So no
legitimate Paging Requests would make it thru?

For reference, the research I'm mainly refering to is LTEInspector (
http://wp.internetsociety.org/ndss/wp-content/uploads/sites/25/2018/02/ndss2018_02A-3_Hussain_paper.pdf
)

End goal is to be able to send arbitrary Paging Requests to my device in an
already connected state.

Cheers David! :)

On Fri, Nov 9, 2018 at 6:28 PM David Rupprecht <david.rupprecht at rub.de>
wrote:

> Hi,
>
> you can use srsLTE/lib/examples/pdsch_ue.c to listing to the cell's
> paging requests setting the rnti=P-RNTI. This was first described in
> [1]. For further Downlink analyses, you can use Airscope an srsLTE based
> downlink analyzer [2]. Sniffing the Attach Request is a bit more
> difficult, as they are send in uplink direction. For injecting paging
> traffic the UE must be synchronized to the your PSS and SSS. For more
> information you can read [1] or [3].
>
> Best regards,
> David
>
>
> [1] https://arxiv.org/pdf/1510.07563.pdf
> [2] http://www.softwareradiosystems.com/products/
> [3] https://comsecuris.com/papers/UMTSprivacy.pdf
>
> On 09.11.18 16:02, Dylanger Daly wrote:
> > Hey Guys,
> >
> > Apologies if this is the wrong way to start threads, I've never used a
> > mailing list before.
> >
> > Is it possible to modify srsUE and sniff Paging Requests along side
> > Attach Requests from other UEs?
> >
> > I'm wanting to pickup the DRX_Cycle (Paging Cycle) for all UEs that
> > attach, it's my understanding this parameter is set in the Attach
> > Request, as well as SIB.
> >
> > Knowing this information, it _should_ be possible to then
> > transmit/inject Paging Messages to that UE, does anyone know if this is
> > possible?
> >
> > Thank you very much! Any help is greatly appreciated :)
> >
> > _______________________________________________
> > srslte-users mailing list
> > srslte-users at lists.softwareradiosystems.com
> > http://www.softwareradiosystems.com/mailman/listinfo/srslte-users
> >
>
> --
> M.Sc. David Rupprecht
>
> Ruhr-University Bochum
> Research Group Information Security
> Universitätsstraße 150
> ID 2/130
> 44780 Bochum / Germany
>
> Phone: +49 234 / 32 - 23508 <+49%20234%203223508>
> Web: www.infsec.rub.de
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.srsran.com/pipermail/srsran-users/attachments/20181109/0c6f4825/attachment.htm>