Detect unusual 3G to 2G downgrade attempts

[andr3jx]

I propose to add an option to change preferred network type to "WCDMA only" (3G). This can be done at least in the hidden Android Testing menu. After you change this option you need to disable and enable the radio again. This should prevent downgrading attacks from IMSI Catchers. In case a user can't do without 2G: We should record which networks support 3G. If the phone has good signal and the network offers only 2G (known to support 3G) the user should get a warning.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[He3556]

It is the mutual authentication of 3G Base Stations, not the encryption that makes the difference. But also on UMTS a Man in the Middle is possible. Even if there are 3G stations with a good signal it is still common to switch to 2G for voice calls. 3G is often used for the data connection and for voice calls there is a "fall back to GSM" method. It depends on the release version of the mobile network and if there is a free slot for voice calls on 3G. There was another question before: "And if I'm not wrong, we have A5/3 encryption in 3G mode so shouldn't be a call in 3G network secure from IMSI Catchers? " That's why I said it is not the encryption in the first 2 sentence :) I am afraid this "simple" approach does not work.

[andr3jx]

Thanks for your input. Yes, I removed the sentence, I felt I was wrong - I don't like to be wrong ;).
So your point is, even if we turn "WCDMA only" on, the call will still go over 2G or will the call get aborted?
My understanding is that 3G-only should be safe from Man in the Middle (if they don't get e.g. a Femtocell from the provider). Otherwise IMSI Catchers wouldn't do the downgrade attack to GSM.

[E3V3A]

Just to clarify the project goals. We are trying to provide an IMSI-catcher detection mechanism, and not a secure line. There are plenty of other projects trying to provide a "secure calls", as stated on the Wiki. Of course it could be useful to "prevent 2G", but this is in no way preventing your phone calls of being monitored, just making it a bit harder for amateurs. So in the current situation, the only interest we have in 2G vs 3G is perhaps to try to detect an unusual 3G to 2G downgrade attempt, which would only trigger another warning flag in our additive detection scheme. So, if you were to force your phone into 3G mode (which is easy to do), then there would be fewer of these detection parameters, and more difficult to obtain others, with the result that IMSIC detection would be much harder. Now in a distant future version of AIMSICD, we plan to add some counter measures, that may include forcing certain telephony functionality states, perhaps including that one.

[andr3jx]

@E3V3A I see your point. For an IMSI-Catcher detector it is really better if can detect downgrade attacks than prevent them by forcing 3G. But I want some clarification regarding 3G-only security. 3G uses A5/3 as encryption which can't be decrypted passively by IMSI-Catchers in comparisson to A5/1 (known plaintext attacks). As He3556 said, 3G is also more secure because "By allowing the UE (User Equipment) to authenticate the network it is attaching to, the user can be sure the network is the intended one and not an impersonator." (Wikipedia). So how can an IMSI-Catcher intercept calls of an 3G only phone? If the phone can't get downgraded to 2G the calls can't be intercepted. Am I right? But we want to detect IMSI-Catchers because they are used to pin point the exact location of phones. Still we can inform the user that if he want to make a secure call, he should activate 3G-only?

[andr3jx]

I also captured logs of my modem and can verify that on my phone "WCDMA only" is really WCDMA only. The phone doesn't use GSM in any way in this mode. Of course there can be networks which don't support 3G calls, but my network here supports gsm and 3g-only calls so this isn't uncommon.

[andr3jx]

I think this issue should be changed to "Warn when phone uses 2G(with good signal quality) on networks known to support 3G" - do you agree?

[mr1smith]

@andr3jx "I also captured logs of my modem and can verify that on my phone "WCDMA only" is really WCDMA only. The phone doesn't use GSM in any way in this mode."

I can also confirm above.

[He3556]

we could inform if somebody is using 2G but not warn them, because there would be too many warnings, without any reason. 2G is shown in the display of all smartphone - so the informing part is there already.

Disable 2G is not a option because:

1. How should we detect a fake BTS if we turn off 2G? Like EVA said, this Project is about detecting and not about a secure line.
2. In some areas there is only 2G so if you turn off you won't have any connection.

UMTS MITM is possible but i don't know if this is already in use out there. I only found some scientific papers about this topic.

[SecUpwN]

@andr3jx, since @E3V3A elaborated on the current project goals, I've updated this Issue to the title Detect unusual 3G to 2G downgrade attempts which perfectly fits into the current project goal structure for IMSI-Catcher detection. Is that OK with you? If so, how to test for unusual downgrade attempts?

[andr3jx]

@He3556
Regarding UMTS MITM: I know there are scientific papers but what I found only describes possible attack vectors. There is no information about a real practical attack. This is also confirmed by papers of different IMSI-Catchers which are advertised with a capability of downgrading 3G to 2G. I think we can assume that an IMSI-Catcher can't offer 3G. Only hacked femtocells are a threat to 3G.

My point is: We should have data in which areas 3G is offered by different operators. If the phone is in a known 3G area but has only 2G with good signal the user should get a warning. There are free available coverage maps by different operators that we could use to obtain the data. There is also OpenSignal project which collects this data. We could also record which networks offer 3G. If the phone has good signal and has only 2G although it is known that the network supports 3G, there should be a warning. This is only relevant when an IMSI-Catcher clones all parameters of a cell (LAC, CID etc.)

An IMSI-Catcher should be seen as a 2G only base station with strong signal from the same operator.

Irrelevant but the "only 2G available"-problem could be solved with this approach: Use only 3G. If phone has no signal, switch to GSM/3G. If phone has 3G signal switch back to only 3G.

@SecUpwN: The title fits perfectly, thanks!

[He3556]

but if you use 3G - how could we detect a 2G Catcher? we don't want to hide - we want to fight! ;)

[He3556]

@SecUpwN yes detecting "fall back to GSM" could be a goal. But i would suggest to keep it on a low priority right now. There are many other things to do first. We would need to have something like a local db where we keep the data about Smartphone position, Cell ID's, Connection time, Signal Strength... like a history. Q: @SecUpwN: Is this implemented as "Cell tracing" already?

And then we need some calculation to get a statistic overview. Before we can detect unusual behavior at all. This belongs to the issue #71. Should we open a new issue like "detection strategies with db & statistics"? One could be if you get rejected by the same cell with a good or even the best signal strength. Because if you are near a catcher but you are not the victim, your mobile will try to connect but the catcher doesn't want that.

[andr3jx]

I want to add that this feature is also relevant because IMSI Catchers can force the phone to remain in 2G-mode until reboot. See:
"Force into 2G-Mode - 3G-Cat forces only selected 3G phones into 2G-mode for interception by other 2G systems. Once forced 3G phones will remain in 2G-mode forever until reboot." (page 2)

"This device will emulate a 3G network to attract 3G mobiles and, for designated Targets, selectively push them to GSM where they remain unless they are rebooted or pushed back to 3G by the GSM system."(page 39)