Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/3020 Thanks!
[Music]
communication contains precious data but
there are things your phone won't tell
you our next speaker likes to take
things apart and put them back together
in the wrong way Lucas Arnold studies
Computer Sciences in his Masters at the
T dad and will present very interesting
insights from his research please give a
very warm Applause to Lucas
[Music]
[Applause]
[Music]
Arnold welcome M catches are deployed
everywhere the German government for
example reported that the federal police
used them in at least 38 instances last
year and American government agencies
were also called using them even without
permission but we have no idea where
they are deployed they could even one
with us in the room right now how could
you know um the available Android
detector apps are outdated and that's
none fors while setting up an M cature
has become cheaper and easier you can
build a GSM MZ kitcher for around $20
and a more advanced LTE 4G MZ kitcher
for around 2,000 if you want to learn
more uh how companies abuse those tools
uh to Target for example journalists
take a look at the talk about ped files
from day
two but before we dive into our research
let me introduce myself to you I'm Lucas
and I'm studying computer science at T
Dam
and I started my bachelor thesis about
the qualcom MSN interface in iPhones
more than that later at Z1 October 2022
and thanks to the funding from the
projects emerg City Entertainer I could
continue the research on those topics
with my supervisor
yisa and but first let's take a look at
the sell um security
considerations for our research we
assumed that an attacker has a defined
set of capabilities they can block
intercept and modify over theair signals
however they cannot access their target
device in any way beforehand or infected
that would make our research bit useless
and by default your device connects to
the base station of its S network that
provides the strongest
signal but within our model ADV service
can establish Rogue base stations they
trick the device into connecting as they
advertise has stronger
signal and using Rog base stations
adversaries can exploit some known
attack vectors for real world attacks um
a very common one is the missing Mutual
authentication
2G um only your user equipment so your
smartphone authenticates itself to the
network and but not the other way around
and the best thing you can do to improve
your Security is to disable 2G on your
phone right now it's possible in newer
Android versions and also on iPhones
with iOS 17 and the enabled lockdown
mode um but there are also some flaws in
3G and 4G networks uh with regards to
Integrity checks they can also be
exploited in realware attacks uh to
intercept and manipulate
traffic as most smartphones still
support um the 2G radio access
technology for the for future
um and techers usually try to downgrade
their target uh to a 2G Connection by
for example jamming frequency bands of
NE radio access
Technologies but in 2G 3G and 4G
networks SIM cards have a unique
identifier the MZ and phones also got a
unique identifier the
IMI and adversaries who would like to
know which humans are around at a
certain location and and try to recorde
those identifiers and with so-called imy
catchers they fake the authentication
process where the MZ and EM Emi are
transmitted in plain text in 5G we got
some improvements as the those
identifiers are now concealed and for
example the m is becomes a Zuki however
there are takes in all radio access
Technologies to track the location of of
a known Target and adversaries can also
try to exploit vulnerabilities in the
firmware of smartphones especially Basin
over the air to extract even more
information and to infect devices
without being
detected and in our research we look at
attackers with two types of abilities we
got regular attackers who got a
reasonable budget and can employ open
source software
and access public knowledge in contrast
state sponsored actors have unlimited
resources and can also Force Network
operators in their jurisdiction to
collaborate with them and our goal is to
defend against regular attackers and to
make attack for state sponsored
attackers more expensive as they usually
find a way to attack the target but may
not be willing to pay the full
price and there are already some
mitigations available against stroke
base stations first with appid Solutions
usually an app on your phone monitors
some parameters for example of the
basent and if it detects a specific
activity it instantly wants the user
however um as mentioned earlier there
are no free upto-date solutions for
Android iOS uh are available right
now sensor-based mitigations usually
rely on a network of dedicated sensors
which work in collaboration to uncover
newly set up Rogue base stations for
example by scanning the frequency bands
but such a network is expensive to run
and it's not usually everywhere where
users are and finally Network operators
can also try to uncover Rog base
stations and with the data they collect
from their genuine base stations and
also the data that is available in their
core networks but so far there hasn't
been a single Silver Bullet to uh defend
against those kinds of attacks and
instead um it requires continuous
efforts from all
parties but with those theoretical
considerations in mind let's have some
fun with base BS um but what are even
base B modern smartphones include an
application processor and it runs the
devices primary operating system however
it does not implement the complex s
protocol deck this is the Tas of the
basement
and the Bas band then transmits data
using the device transceiver and
antennas to cell base stations and now a
simple model multiple cellular base
stations just from a cellular network
and our primary research device was an
iPhone 12 and it includes an apple A14
bionic application processor and a
Snapdragon x55
baseband and modern iPhones use basins
of two manufacturers first we got
qualcom and they were the primary focus
of my bachelor thesis and you they use
the Qualcomm MSN interface or short qmi
uh for communication between iOS and the
bben
firmware and we also got Intel modems in
some iPhones they use the Apple remote
invocation protocol and Tobias call also
from Zemo weever engineered that
protocol and in in sorry in 2019 Intel
Sal its modern division to Apple uh so
maybe we can expect The Comeback of this
protocol uh but it's still some years in
the future Apple switched to quarum MMS
exclusively with the iPhone 12 and the
introduction of 5G and in September of
this year they renewed their contract
with Qualcomm until
2026 so qmi will be remain valent for
the coming
years and the Bas interface protocols
qmi and Ari use similar Concepts but
encode the data differently both use
packet like structures to exchange data
between iOS and the basement firmware
and those packets usually consists of
some kind of binary headers defining the
packets type A broader group ID and a
more cular message ID and together they
Define the packet's exact purpose when
it arrives on iOS or the Bas
band and data is encoded with so-called
typ length value
structures and I is also used in Android
and on some modems with qualcom chips
but its documentation is hidden behind
non-disclosure agreements from qualcom
but lucky for us uh we got some open
source project that uncovered its
structure and the more prominent one is
lium I the same is true for the AR
protocol which was uncovered by tobas
and his I totalist
project and on iOS we got the system
process com Center that handles all
things related to sell communication
that includes the Basin communication
and to examine that we got multiple
tools
available first um we can use official
Base bank debug profiles from Apple when
we install them on our device the device
lcks all packets in a binary format and
we can can just access the system locks
to see those binary packets you can also
apply reverse engine sorry reverse
engineering tools such as the
interactive debugger frider and CD
compiler gitra and Yar already fed the
iOS interface for incoming packets and
she discovered multiple vulnerabilities
so it's interesting to look into that
you can find more about that in our talk
fing the phone and the
iPhone and by reverse
engineering um we found the relevant iOS
functions responsible for receiving and
transmitting qip packets in iPhones and
based on the name we assume that the
communication between iOS and the Bas
band happens over the iPhone's powerful
component
interconnect and we can use that
knowledge to pain together what belongs
together so we want to connect lipc ey
and the iPhone space Band and for that
we slightly modify lip cumi apply a FID
script on the iPhone that intercepts
incoming and outgoing packets and then
also can inject packets and to connect
both we create a f python script in
between sets up fidder and establishes a
link to liumi over Unix man
socket and now effectively lip cumi and
the Bas band can exchange binary qmi
packets so we can interact from the
iPhone space band from the outside we
find that the basic commun commun
communication just works fine as both
employes simar qmi structure but the
iPhone space Band only supports 22 of
out of 94 State retrieving operations
implemented in lip Qi common line client
so there's some kind of
mismatch um that's why we take a look at
the available qmi services and qmi
services bundle similar qmi messages as
I also showed earlier every message has
a group ID or a service ID and we are
able to retrieve a list of qmi
Services um from the Bas band and if we
can do that we get a rough overview of
the Bas band's
capabilities and one successful
operation from lipi allows us to do that
and we find that the baseband in the
iPhone 12 the snaptron x55 baseband
implements 39 Qi Services whereas iOS
just implements 31 so iOS doesn't
utilize the full capabilities
of the Bas band inside the phone and we
assume that's just the case because the
Bas band is an off the shelf
component and I also brought a little
demo of that uh first we forward fighs
tcps port to a veral machine then we
start our script in between and then we
can execute a command to request all qmi
services provided by the iPhone space
Band there you can see binary qmi
packets are sent and we also receive a
response from the Bas band including all
those services and lium I tries to
translate those services but it doesn't
know all the services provided from the
basement as you can see here um but we
also got some services like the sir
service which is implemented in the
basement but not in iOS and we can also
query that using another command and we
get a successful answer so we know the
basement doesn't lie about its
capabilities and now we can do more with
it than
before um but we also want to gain a
better insight into the communication
between the base bin and IRS there's
already an existing wire sh sector for
qmi out there but it's built for USB
modems and we adapt it to iOS and we
provide three approaches to extract qmi
packets from the iPhone and they work
without and with a direct connection to
the device and they support all types of
iPhones even those without a
jailbreak H but we noticed that the
dissector cannot translate all message
identifiers to text presentations but
those are crucial for understanding
what's happening between the base band
and iOS um therefore we research how IRS
passes and compiles binary qmi packets
and using the tools ipsw and frider we
discover in two new processes location D
and wires radio manager d uh in addition
to the com Center process and all three
of them pass and compile binary qmi
packets and the two other processes get
those via the xpc process communication
but all three processes use the message
based class to create qmi packets so we
took a look at that and deviced a
semi-automatic message ID extraction
workflow first we download the firmware
we want to inspect we load the relevant
libraries into gitra um we apply some
scripts that search for references to
this message b class and then extract
the uh for example function names put
them in a CSV file and finally another
script convert that to lipi definitions
and now we got a better overview of
what's happening between the Basin and
IRS we can use that wire shark dis
sector to inspect the novel emergency
SOS via satellite service which is
implemented in the iPhone 40 lineup and
was available in Germany since December
2022 and that's when we also started to
look into that and first we found a
novel qmi 3 service on the iPhone 14
space Band and as you might remember
cumi Services bundle similar messages so
the stud service is responsible for
everything satellite related in the
iPhone and if you want to learn more
about that there was an excellent talk
about the iPhone satellite communication
by is and Alex on day
one but let's put our practical
understanding of the basement
communication into practice for
detecting road base stations um but
before we got another puzzle piece for
our detection algorithm because base
stations as you might have seen those
structures um usually hold multiple
cells pointing in different directions
and each cell broadcasts a unique
identification and cell location
databases link this unique
identification with location
information and they can be used to find
an approximate location just based on
the unique cell identification which is
available to your
phone and also to get an overview of the
coverage provided by a Ser network if we
able to retrieve a full list of cells
from that database and iPhones use a
multisensory approach for Gathering
location data
this includes cell towers nearby Wi-Fi
and
GPS and Wi-Fi and cell tower uh location
is powered by app location services
Apple's internal cell location database
it provides aggregated data to devices
and Inter turn devices also contribute
data to that
database and there was already some
research into extracting Wi-Fi Mac
addresses from this database by Mika
Tupa um and our Focus was on tracking
cellies and Apple's database has an
https endpoint and its requests and
responses have custom binary headers and
that data is encoded with protuff and we
monitor those request with men in the
middle proxy and we decoded the protuff
structure with ID Pro and uh found that
a request to Apple's database just
includes the identification data for one
cell the cell you're currently connected
to and if a cell is an Apple's database
their servers usually respond with
location data of 100 nearby cells and 20
larger cellular
areas and for example a protuff
definition for an LTE cell looks like
this we got some cell identification
data the cell's location and some
information about the frequency
bands and 2 billion Apple devices
interact with this database if you turn
on Apple location services on your
iPhone then your iPhone is one of them
as written in Apple's terms of services
and we found throughout our research
that the database provides good coverage
across Europe and network generations
with a Mis rate lower than 1% and new
cells usually take up multiple days to
enter in this database and we also
assume multiple measurements from
distinct
devices and there are also other cell
databases like open cell ID and its data
set provides uh 74 million cells and we
can just download the whole data set but
as you can see in this map it misses
some significant parts of the globe um
the same is true for Mill location
services or short MLS they operate by a
similar principle and for both databases
members collect measurements and
contribute that to the
database uh from milla's database it
contains 63 3 million cells but only
provides the cells confirmed in the last
year to download so effectively we only
get 9 million cells and we want to
validate the database quality a bit and
first we plot the number of cells
updated each year and we find that there
are some pretty old cells in open
cellard uh and the cells from ailla are
quite
new and we also want to compare it to
Apple's database and we for that we
sample 5,000 cells from an open database
for a given country um we check if
Apple's database contains them we
collect all cells we get back from
Apple's database and then check again if
they are in the open
database and we found that from aill
data base it only provides a low
percentage of out of serice cells which
is good uh but covers only a small
percentage of a country's networks which
which is bad uh in contrast the open
cell ID database covers a larger
percentage of out of service cells um
but only
contains uh but also contains a larger
percentage of a country's Network which
is like the opposite and it's a
trade-off between those two databases
but in the end Apple's database is just
the best because lot of devices
contribute to it and our use case for
that is the Bas station detection as out
as outlined earlier and our algorithm
for that is based on Cell measurements
those are basically IRS internal
property sets qmi and AR packets
location data of your phone and we use
multiple horis STS to evaluate the
combined data sets and those
characteristics assign a score from 0 to
100 points to each cell measurement and
the measurements are then grouped into
three categories untrusted cells are
with a high likely load roog base
station for susp special cells usually
one detection crer failed but could be
also caused by just a misconfigured cell
um or just some other
problem and for trusted cells our
algorithm indicates that it's a cell you
can connect to and it's genuine from the
network operator but still there could
be some kind of nech our algorithm can
detect and it's based on six detection
criteria and first we check if a sell is
in Apple's database because usually
workbase stems are only active for a
short amount of time and those then not
present in Apple's database we calculate
the distance between the location we get
from Apple's database and the user
location and if that's larger than 75 km
um the maximum range of a 2G cell plus a
lot of error margin then the cell could
be a rck base station because sells
usually remain in one place you also
compare the sets frequencies set Channel
and physical CID with the data from
Apple um as attackers may use other
channels and physical cidies to delay
the detection we check the S bands as
more expensive software defined radius
are required to achieve the full Channel
bandwith of for example 20 MHz we search
for a network rejection packet which
appears doing a failed authentication
between smartphone and base station um
and implementing a full authentication
mechanism for R base stations and 3G 4G
is quite difficult and thus making it
more costly for attackers to set up rck
base stations we also extract the signal
strength from the basement packets as
Rog Bas STS usually Dr their targets
into connecting by advertising a higher
signal
strength so let's continue with our
defense against rck base stations the
sard IOS app implements the detection
algorithm and it records and links we we
require data points such as s
measurements packets and location ations
and it's compatible with iOS 14 up to is
17 and we use Swift and Swift UI to
create it and our app gets us data on
jprog phones using tweaks tweaks are
external components uh with evaluated
Privileges and modify the default
behavior of iOS but require a jailbreak
with Tre injection to do so and sard
relies on two tricks they hook into iOS
core telepon framework to collect data
and namely sales and packets in the
background and then cach that data and
provide it via TCP socket to the app and
as you can see here this function is
used to get data about the cell you
currently connected to and but J
breaking exploits vulnerabilities to
gain system level access and we wanted
to sard also to be able
to um run on non-jp phones so that users
can install the latest Patches from
Apple on their devices luckily that's
possible some manual
interaction uh namely system diagnosis
they are diagnostics for Apple devices
and officially supported by Apple and
contain logs of various components to
import data into our app users just
install a basement debug profile as
mentioned earlier on their device and
then they create a system diagnose by
pressing like all the devices buttons
and share that from the settings app to
Sout and then we extract all data from
it uh using the Mac OS unified locks
Library um by medent and while the
official Apple tooling to process that
binary lock format only runs on Max and
takes a lot of time this library is
quite fast it usually takes 30 seconds
to read all locks and we can just
integrate it in our app because it's
written rust and the time frame of
extracted data depends on the locks uh
of the devices activity so if you're
using your device a lot then there are a
lot of locks and you only get like the
last three hours of data but if your
device is use less you can also get
sales from the last 12 hours and packets
so let's explore a bit how app works
first we got a risk indicator and right
now we're in Hamburg and you can see the
cell we're currently connected to and we
also got a list of all cells we've been
connected to in the past and we can
check out each cell individually and
inspect also each measurement and dig
into how the detection algorithm works
and also see the internal I data that we
recorded and we can also on the map view
all cells that we got from Apple's
database they are quite a lot and the
green ones are GSM cells the blue ones
are LTE cells and we can tap on them
also get more data as outlined
before and we can go to the packets to
just see all packets which are
transmitted between iOS and your Bas
band and also filter them for example by
Kimi
services and all dig into each packet um
because we also implemented a basic diss
sector which um passes the packet and
shows its contents you can also export
all of that data for later analysis on
your computer with wi shock for example
and to evaluate our app we set up an Aly
catcher in our lab tested multiple
iPhones with ar and qmi base bands and
also based on our findings we improved
the detection algorithm however we
couldn't convince any iPhones to connect
to a 5G Standalone or even like a
non-standalone network that might be
interesting but that's that's a thing
for the future and we also used our app
in the wild and traveled through six
Europe countries for about 6 months um
but it also works quite well we got a
lot a low Force positive rate but if
you're moving over 500 km per hour with
an iPhone that doesn't measure speed uh
we got a problems so maybe you should
just turn on flight mode while you're
flying but that's the reason for the
spiking data set 8 so far we haven't
found a Rog base station um which we
could confirm but that's quite difficult
because you can't just go to base
station and take it apart um but overall
the majority of celles we connected to
were present in Apple's database making
a good mirror of actual networks out
there and by recording such amounts of
data we could evaluate sard with all
radio access Technologies we support so
when can you try it out um Al our goals
were to provide insights into is
processing of basement packets monitor
the elicit use of Base stations and to
protect high-risk groups such as human
right activists or journalists and so
far we already created novel tooling to
inspect qmi PS on iPhones we reverse
engineered and evaluate data from
Apple's database and we created the
sagard IOS app to monitor cells around
you and hopefully uncover some Rog base
stations and but we still have some work
ahead before we can release the app
first we want to improve the detection
algorithm maybe some machine learning
might be helpful to uncover patterns we
also want to enhance the app's user
friendliness and finally we're working
on Smart notifications that alert you
when you should import data on non-jp
iPhones and we aim for release next year
um but right now we already open for a
small circle of beta testers so if
you're interested just write me an email
thank you for listening to my talk and
thanks to Yar and profess Professor
Matias holik for the guidance throughout
this journey and I also update you on my
social channels thank you now it's time
for your
questions thank you so much Lucas for
your insight into your research and we
have some time for questions left and I
see there are already some people
waiting in line but I want to remind you
you can all so post questions via the
internet via IC or via Mason but we will
start with number one uh okay uh just a
quick question uh which SDR did you use
um you said that it was very expensive
to do uh an M catcher for LTE and uh
maybe LTE has some bandwidth issues so
you couldn't use a hacker F or something
for example yeah we used a US RPX
310 for our test in the lab okay thanks
yeah next question would be number two
yeah yeah so you said that 5G doesn't
transport IMI and MZ directly yeah okay
can I consider 5G more secure than 4G in
that regard yeah definitely um it has a
lot of improvements in that area and the
MZ and Emi basically are encrypted with
the operator key there are some attacks
if you Google like Suki catchers around
that um but it's definitely more secure
than 4G what does it mean that the the
group defining the standards have an
actual interest in making it secure or
is it just fake security to calm us down
what do you think no I I think the group
that defines the standards actually has
an interest to make user secure but I
think there are also some interests to
um not include all measures we could
include
thanks next question would be over there
uh is it possible to create a cell Rogue
cell with a same ID with of a legitimate
one or maybe uh further one but what
which is not like further than 75 km to
bypass that detection um so it's
definitely possible to create a cell
with the same ID um some attacks rely on
that the you that the iPhone switches to
a new cellular area um to basically
force it to reauthenticate to the
network um but you can also create a
cell with the same ID and that also
works quite well and that's why we also
included the other detection criteria
but still um I think there's possibility
to even Implement
more and we have another question from
the internet uh the internet would like
to know what are the ways to query or
download the Apple cell tower a database
without having an iPhone um I created a
just a python client for it so you can
just input the cell identification and
then you get back a l list of cells and
we also going to release that together
with the app just as open source
software and then you can just uh car
the database as much as you want because
that was quite interesting the database
has no access control or whatever can
just send request without any special
headers identifying your
phone next one is number two okay so
I've got the iners question is the
writing to the database protected in any
way I the attacker could just push their
fake sell there yeah so that's still
ongoing research we're trying to look
into it um so far we just noticed how
everything works but we still have to
exactly find out the end points how data
is pushed into the database but we
assume that's not not like the same end
point as quaring
data thank you next one number
one there are a number of attempts that
have been made to detect uh fake base
stations employed by government actors
often local police
agencies uh and one of the problems is
that there have not been many true
positives this ends up informing the
research to where tools for example
crock Hunter have criteria that don't
necessarily align with the properties
that a deployed base station would have
uh one exception is the Oslo study from
Aon potit in
2014 uh have you compared uh your
diagnostic criteria to the ones
evidenced by the findings of Base
stations in the Raw data from that study
in
Norway um so far we didn't do that but
um would be nice if it just can could
send me an email U we definitely plan to
look into it um
but same is true for the detection
algorithm there's still a lot of room
for improvement and we also want to base
that on the findings of other studies
that's why we also don't want to release
the app right now because I think it's
still in
progress and another question from the
internet the internet would also like to
know uh you in your work you focused on
uh Rogue base stations but uh are such
things also done by normal base stations
did you have a look into that um so we
collected data over the six month period
and um we usually found that some kind
of error if you moving to fast or so
some kind usually we get some true
positives
like 1% or so for either cells which are
quite new installed or um there are also
some cells which can move around like
mobile base stations um so those are
also properties of cells and we also aim
to include that and that's why we also
got the
categories um to not alert the user if
just one thing goes
wrong and one last question from number
two we have a sponsorship package for
the research uh we have this zero qyc
totally Anonymous isim for your mobile
phone here it
thanks thanks okay so this is my my my
question so some European countries
including the UK and
Denmark okay yeah so some European
countries incl including UK and Denmark
have their their own National databases
for for the the locations of the base
stations have you also consider those
kind of data sets when you are
evaluating the accuracy of the the the
the ERS
database um so far we didn't do that but
I think I also um found a database of
France for example but um like quaring
these datab bases so far we didn't do
that but that's also a very good idea to
Compare the Apple database to official
databases and see which one is updated
more recently for example and where are
the
differences thank
you Lucas thank you so much for your
insights for your talk for your time for
your answers for our questions and uh
please give a warm Applause to Lucas
[Applause]
Arnold
[Music]
la