[srslte-users] Possible to sniff Attach Requests?

Mon Nov 12 13:29:15 UTC 2018

Ahh thank you very much for that.

So this sounds like timing is super important, a reliable clock sounds like
it'd be required GPS DO.

As I understand it, the UE will "listen" to Paging Messages from the eNb at
specific times (sync you talked about), as you've mentioned PDSCH is one
channel, so spinning up an eNb on that specific frequency would drop all
paging messages (Essentially Paging DoS?) if you were wanting to target
_one specific_ UE, it should be possible to _only_ transmit when you know
the UE listening.

> Active radio connection (RRC Connected state) and registered in the core
network (EMM-REGISTERED). The latter one, is when you do not send on the
radio layer, but you are connected to the core network. I think it is only
possible to inject paging message in the emm-registered case, with
affordable resources.

EMM-Registered is perfect, the target device should be in this state,
_then_ with a modified srsENB, I'd want to provide synchronization
parameters, and send Paging Messages to the UE.

Simply following an attach request should give me everything I need to
address the UE

   - TMSI
   - Sync Paramaters (SSS & PSS)

This shouldn't be too hard, the LTEInspector Paper I linked above does
this. As I understand it, they're literally just injecting paging messages
to already connected UEs.

On Mon, Nov 12, 2018 at 9:53 AM David Rupprecht <david.rupprecht at rub.de>
wrote:

> Hi,
>
> Airscope is just an downlink analyzer, but you get also meta-information
> about the uplink traffic, as they are signaled in downlink direction via
> the DCI (Downlink Controll Information).
>
> LTE uses the concept of channels to distinguish between different kind
> of traffic. The PDSCH - is Physical downlink shared channel and a
> *Physical* channel. In contrast the PCCH Paging Control Channel is a
> *logical* channel. The PDSCH carrys more the only the PCCH, for example
> the user data itself. See [1].
>
> Yes, P_RNTI = 0xFFFE, but you need to include the RRC decoding in the
> pdsch_ue.c to get the actual paging messages or dump all messages with
> wireshark.
>
> The PSS & SSS are synchronization symbols on the physical cell that are
> used during the initial cell search [2]. Under the condition, the UE is
> in the radio connected state, it is synchronized to a cell and will not
> listen to the paging channels of other cells. Injecting paging messages
> to a UE with a active radio connection, would be an interesting research
> question. Under the condition the UE is not in the radio connected
> state, it will periodically check the paging channel of last
> synchronized cell. If the UE does can not synchronized to the cell
> again, it will trigger the cell reselection procedure [2]. In general
> you should distinguish between and active radio connection (RRC
> Connected state) and registered in the core network (EMM-REGISTERED).
> The latter one, is when you do not send on the radio layer, but you are
> connected to the core network. I think it is only possible to inject
> paging message in the emm-registered case, with affordable resources.
>
> [1] http://www.techplayon.com/wp-content/uploads/2017/08/Chan1.png
> [2]
>
> https://sites.google.com/site/lteencyclopedia/cell-reselection-procedures-in-lte
>
> Best regards,
> David
>
> On 09.11.18 19:24, Dylanger Daly wrote:
> > Thank you David,
> >
> > Is it possible to sniff UL with the AirScope?
> >
> > I understand there are 2 Paging Channels, PCCH and PDSCH, PCCH alerts
> > the UE of the fact that it's being paged, PDSCH contains the _actual_
> > paging information.
> >
> > What am I listening to with -r set to P-RNTI / 0xFFFE?
> >
> > Is PSS & SSS configuration present in the Attach Procedure?
> >
> > Would it be possible to spam PDSCH with Paging Requests consisting on an
> > IMSI, resulting in the UE detaching? Or do I still need to sync the
> PSS/SSS?
> >
> > Lastly, before I RTFM, is there somewhere in srsLTE/enb I can set the
> > PSS / SSS and _only_ send one Paging Request for example? After setting
> > the eNb up, will it straight up transmit **over** the legitimate eNb? So
> > no legitimate Paging Requests would make it thru?
> >
> > For reference, the research I'm mainly refering to is LTEInspector
> > (
> http://wp.internetsociety.org/ndss/wp-content/uploads/sites/25/2018/02/ndss2018_02A-3_Hussain_paper.pdf
> )
> >
> > End goal is to be able to send arbitrary Paging Requests to my device in
> > an already connected state.
> >
> > Cheers David! :)
> >
> > On Fri, Nov 9, 2018 at 6:28 PM David Rupprecht <david.rupprecht at rub.de
> > <mailto:david.rupprecht at rub.de>> wrote:
> >
> >     Hi,
> >
> >     you can use srsLTE/lib/examples/pdsch_ue.c to listing to the cell's
> >     paging requests setting the rnti=P-RNTI. This was first described in
> >     [1]. For further Downlink analyses, you can use Airscope an srsLTE
> based
> >     downlink analyzer [2]. Sniffing the Attach Request is a bit more
> >     difficult, as they are send in uplink direction. For injecting paging
> >     traffic the UE must be synchronized to the your PSS and SSS. For more
> >     information you can read [1] or [3].
> >
> >     Best regards,
> >     David
> >
> >
> >     [1] https://arxiv.org/pdf/1510.07563.pdf
> >     [2] http://www.softwareradiosystems.com/products/
> >     [3] https://comsecuris.com/papers/UMTSprivacy.pdf
> >
> >     On 09.11.18 16:02, Dylanger Daly wrote:
> >     > Hey Guys,
> >     >
> >     > Apologies if this is the wrong way to start threads, I've never
> used a
> >     > mailing list before.
> >     >
> >     > Is it possible to modify srsUE and sniff Paging Requests along side
> >     > Attach Requests from other UEs?
> >     >
> >     > I'm wanting to pickup the DRX_Cycle (Paging Cycle) for all UEs that
> >     > attach, it's my understanding this parameter is set in the Attach
> >     > Request, as well as SIB.
> >     >
> >     > Knowing this information, it _should_ be possible to then
> >     > transmit/inject Paging Messages to that UE, does anyone know if
> >     this is
> >     > possible?
> >     >
> >     > Thank you very much! Any help is greatly appreciated :)
> >     >
> >     > _______________________________________________
> >     > srslte-users mailing list
> >     > srslte-users at lists.softwareradiosystems.com
> >     <mailto:srslte-users at lists.softwareradiosystems.com>
> >     > http://www.softwareradiosystems.com/mailman/listinfo/srslte-users
> >     >
> >
> >     --
> >     M.Sc. David Rupprecht
> <https://maps.google.com/?q=M.Sc.+David+Rupprecht&entry=gmail&source=g>
> >
> >     Ruhr-University Bochum
> >     Research Group Information Security
> >     Universitätsstraße 150
> >     ID 2/130
> >     44780 Bochum / Germany
> >
> >     Phone: +49 234 / 32 - 23508 <+49%20234%203223508>
> <tel:+49%20234%203223508>
> >     Web: www.infsec.rub.de <http://www.infsec.rub.de>
> >
>
> --
> M.Sc. David Rupprecht
>
> Ruhr-University Bochum
> Research Group Information Security
> Universitätsstraße 150
> ID 2/130
> 44780 Bochum / Germany
>
> Phone: +49 234 / 32 - 23508 <+49%20234%203223508>
> Web: www.infsec.rub.de
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.srsran.com/pipermail/srsran-users/attachments/20181112/d436a350/attachment.htm>