Abro
62
As demonstrated in Figure 3.2, a cell phone cloning attacker requires certain hardware and software tools to impersonate a legitimate network subscriber. A radio receiver
is used to sniff and intercept the user call targeting at the cell tower. The ESN (Electronic
Serial Number) and mobile number information is stolen through the receiver. The
attacker will use a PC with software to burn the stolen ESN and mobile identity information to clone a copy of the original cell phone. Attackers are able to use off‐the‐shelf
tools like Oki 900 to impersonate and eavesdrop on communications over AMPS [3]. It
was hard to distinguish between the victim and the cloned phone.
Such threats have forced carriers to disrupt many legitimate subscriber connections
and introduce new identification mechanism, such as a unique pin code for each
customer to remove nefariously cloned mobile devices from their network.
3.2.2 Security Threats and Protection for 2G
User authentication remained a key focus while developing 2G standards, as the goal
was to reduce the call charge fraud, channel hijack and mobile cloning attack surface.
The subscriber identity module (SIM) was first used to assign unique identification
for mobile phones and could be securely stored as a computer chip inside the
cell phone.
As user identity protection began to be taken seriously, a new threat was introduced
in 2G, masquerading as a carrier base station with a rogue base station (also called
IMSIcatcher) to perform a man‐in‐the‐middle‐attack (MitM).
The IMSI (International Mobile Subscriber Identity) catcher threat is demonstrated
in Figure 3.3. This attack exploited the lack of 2‐way authentication between the cell
phone and the mobile network. Attackers would install a rogue base station that could
impersonate a valid BTS (Base Transceiver Station) and let the user transmit the critical
identity information such as IMSI over an unsecure channel. A rogue base station attack
User
phone
Network BTS
Man-in-themiddle Attack
Rogue BTS
IMSI Catcher
2G Network
2G Rogue Base Station Attack
Figure 3.3 IMSI Catcher attack in 2G network.
62
As demonstrated in Figure 3.2, a cell phone cloning attacker requires certain hardware and software tools to impersonate a legitimate network subscriber. A radio receiver
is used to sniff and intercept the user call targeting at the cell tower. The ESN (Electronic
Serial Number) and mobile number information is stolen through the receiver. The
attacker will use a PC with software to burn the stolen ESN and mobile identity information to clone a copy of the original cell phone. Attackers are able to use off‐the‐shelf
tools like Oki 900 to impersonate and eavesdrop on communications over AMPS [3]. It
was hard to distinguish between the victim and the cloned phone.
Such threats have forced carriers to disrupt many legitimate subscriber connections
and introduce new identification mechanism, such as a unique pin code for each
customer to remove nefariously cloned mobile devices from their network.
3.2.2 Security Threats and Protection for 2G
User authentication remained a key focus while developing 2G standards, as the goal
was to reduce the call charge fraud, channel hijack and mobile cloning attack surface.
The subscriber identity module (SIM) was first used to assign unique identification
for mobile phones and could be securely stored as a computer chip inside the
cell phone.
As user identity protection began to be taken seriously, a new threat was introduced
in 2G, masquerading as a carrier base station with a rogue base station (also called
IMSIcatcher) to perform a man‐in‐the‐middle‐attack (MitM).
The IMSI (International Mobile Subscriber Identity) catcher threat is demonstrated
in Figure 3.3. This attack exploited the lack of 2‐way authentication between the cell
phone and the mobile network. Attackers would install a rogue base station that could
impersonate a valid BTS (Base Transceiver Station) and let the user transmit the critical
identity information such as IMSI over an unsecure channel. A rogue base station attack
User
phone
Network BTS
Man-in-themiddle Attack
Rogue BTS
IMSI Catcher
2G Network
2G Rogue Base Station Attack
Figure 3.3 IMSI Catcher attack in 2G network.