|
|
These are the **detection test results** for our [Detection List](https://github.com/SecUpwN/Android-IMSI-Catcher-Detector/issues/230) created with an [OsmocomBB phone](http://bb.osmocom.org/trac/wiki/Hardware/Phones).
|
|
These are the **detection test results** for our [Detection List](https://github.com/SecUpwN/Android-IMSI-Catcher-Detector/issues/230) created with an [OsmocomBB phone](http://bb.osmocom.org/trac/wiki/Hardware/Phones).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| ID | SHORT NAME | STATUS |
|
|
| ID | SHORT NAME | STATUS |
|
|
|
|----|---------------------------|--------|
|
|
|----|---------------------------|--------|
|
|
|
| 1 | DBe Consistency Check | - |
|
|
| 1 | DBe Consistency Check | - |
|
| ... | @@ -39,30 +38,34 @@ Implementation Status: |
... | @@ -39,30 +38,34 @@ Implementation Status: |
|
|
|
|
|
|
|
3 = deprecated
|
|
3 = deprecated
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
* `ID:2` - OsmocomBB BTS 'clones' an actual BTS with variable consistency and a legit BTS
|
|
|
|
* `ID:4` - OsmocomBB BTS doesn't allow TMSI allocation (red flag to tell if one is camped into a fake BTS)
|
|
|
|
* `ID:5` - OsmocomBB BTS allows choice of ciphering without droping/changing but doesn't allow A5/3 (not supported yet)
|
|
|
|
* `ID:6` - OsmocomBB BTS allows cipher downgrade
|
|
|
|
* `ID:7` - OsmocomBB BTS (tested with one BTS hence detectable as no neighbouring BTS are noted)
|
|
|
|
* `ID:18` - OsmocomBB BTS possible use of a jammer otherwise on its own OsmocomBB BTS cannot downgrade cell phone at will
|
|
|
|
|
|
|
|
On the above image: OsmocomBB + OpenBTS(with smqueue) running to create a fake BTS(IMSI catcher) with some IMSIs captured
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
|
|
OsmocomBB + OpenBTS (with smqueue) running to create a fake BTS with some IMSIs captured.
|
|
|
|
|
|
|
|
On the above image: you can visibly see the that no neighboring cells are found as our BTS at the time of testing did not have this facilitated
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
On the above image: Our Phone details, when connected to the IMSI catcher
|
|
No neighboring cells are found as our BTS at the time of testing did not have this facilitated.
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
On the above image:Sample of an SMS sent to the target phone from the BTS without causing alarm
|
|
|
|
|
|
|
|
|
|
|
Our Phone details, when connected to the IMSI-Catcher.
|
|
|
|
|
|
|
|
* OsmocomBB BTS 'clones' an actual BTS hence the consistency is variable with a legit BTS ID:2.
|
|
---
|
|
|
* OsmocomBB BTS doesnt allow TMSI allocation this is a red flag that can be used to tell if one is camped to a fake BTS ID:4.
|
|
|
|
|
* OsmocomBB BTS allows choice of ciphering without droping/changing but doesnt allow A5/3 as its not supported yet on the current OpenBTS used in this test ID:5.
|
|
|
|
|
* OsmocomBB BTS allows cypher downgrade ID:6.
|
|
|
|
|
* OsmocomBB BTS (tested with one BTS hence detectable as no neighbouring BTS are noted ID:7.
|
|
|
|
|
* OsmocomBB BTS (see ID:3).
|
|
|
|
|
* OsmocomBB BTS possible use of a jammer otherwise on its own OsmocomBB BTS cannot downgrade cell phone at will ID:18.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Sample of an SMS sent to the target phone from the IMSI-Catcher without causing alarm. |
