Practical Cellphone Spying

Name: Practical Cellphone Spying
Uploaded: 2013-11-08
Duration: 52 min 33 s
Channel: Chris Paget
Description: A classic demonstration of physical layer cellular vulnerabilities. Chris Paget showcases a functional, DIY IMSI catcher using low-cost hardware and open-source base station software, showing how devices are forced to downgrade to GSM and route calls through a rogue tower.

Speaker Chris PagetEvent DEF CON 18Broadcast 2013-11-08Duration 53m

Preview frame from Practical Cellphone Spying

SIGNAL LIVE53M

INTEL TIMELINE // 6 CHAPTERS

CLICK SEGMENT OR TIMESTAMP TO SEEK

Speed:

A/B Loop:→

KEY CONCEPTS MAP // DISCOVERY TIMESTAMPS 3 TOPICS IDENTIFIED

Student Briefing Notes

0 / 3 Mastered (0%)

🎯 Core Key Takeaways

Understand core imsi-catchers signaling vulnerability mechanisms
Identify protocol weakness patterns in rogue base station attacks, sdr over-the-air decoding, imsi catcher detection
Analyze real-world SIGINT exploitation vectors and mitigation strategies

🛠️ Practical Lab & Hands-On Guidance

Apply packet filtering in Wireshark for imsi-catchers traffic, verify firewall rules at signaling boundaries, and audit protocol parameter bounds.

📖 Briefing Coverage Scope

A classic demonstration of physical layer cellular vulnerabilities. Chris Paget showcases a functional, DIY IMSI catcher using low-cost hardware and open-source base station software, showing how devices are forced to downgrade to GSM and route calls through a rogue tower.

STUDY BRIEFING DOSSIER EXPORTER EXPORT COMPLETE LAB NOTES & TIMESTAMPS FOR NOTION / OBSIDIAN

5G SBA NRF Service Discovery & OAuth2 Token Abuse

5G-SBA

Call flow illustrating how an unauthenticated Network Function (Rogue NF Consumer) queries the NRF for discovery and retrieves access tokens without adequate TLS mutual auth or token scoping.

Entity 01Rogue NF Consumer (AMF)

Entity 02NRF (Discovery & Auth)

Entity 03Target NF Producer (UDM)

1. GET /nnrf-disc/v1/nf-instances?target-nf-type=UDMREQUEST

Rogue NF Consumer (AMF) ➔ NRF (Discovery & Auth)

2. 200 OK (UDM Endpoint URI & Supported Services)RESPONSE

NRF (Discovery & Auth) ➔ Rogue NF Consumer (AMF)

3. POST /oauth2/token (grant_type=client_credentials, scope=nudm-sdm)EXPLOIT

Rogue NF Consumer (AMF) ➔ NRF (Discovery & Auth)

4. 200 OK (Access Token: Bearer eyJhbGciOi...)RESPONSE

NRF (Discovery & Auth) ➔ Rogue NF Consumer (AMF)

5. GET /nudm-sdm/v1/imsi-208950000000001/am-dataEXPLOIT

Rogue NF Consumer (AMF) ➔ Target NF Producer (UDM)

6. 200 OK (Subscriber Subscription Data & Keys)RESPONSE

Target NF Producer (UDM) ➔ Rogue NF Consumer (AMF)

🔍 PROTOCOL MESSAGE PARAMETERSStep 1 of 6

Rogue NF queries NRF discovery endpoint to enumerate registered UDM instances in PLMN.

Technical Term & Subtitle Translator

Inspect Technical Acronym:

5G-SBA — 5G Service Based Architecture

5G Core

🇺🇸 English

Core network architecture in 5G Standalone (SA) where Network Functions (AMF, SMF, NRF, UDM) communicate via HTTP/2 REST APIs with OAuth2 authentication.

⚠️ Security Vectors & Exploitation Note:

Vulnerable to NRF token abuse, unauthorized REST discovery, and API gateway parameter tampering.

IMSI Catchers & Rogue Base Stations SDR & RF Decoding rogue base station attacks sdr over-the-air decoding imsi catcher detection

About this signal

Technical Intelligence

Briefing FAQs

How does a rogue base station force a phone to connect?

Rogue base stations transmit a cellular signal with the same PLMN (Network Code) as legitimate operators but at a higher power level. Since phones naturally register on the strongest cell tower, they connect to the fake station.

Why are IMSI catchers able to bypass encryption?

In legacy GSM (2G) networks, the network authenticates the subscriber, but the subscriber does not authenticate the network. The fake base station can instruct the client device to turn off encryption entirely, transmitting data in plain text.

INTELLIGENCE TRANSCRIPT & TIMESTAMPS

6 LOGS

Chris Paget: Today at DEF CON 18, we are demonstrating how physical layer cellular vulnerabilities allow practical cellphone spying using off-the-shelf equipment.

We built a fully operational GSM base station right here on stage using OpenBTS, Asterisk, and a Software Defined Radio transceiver for under $1,500.

Cellular phones are programmed to connect unconditionally to whichever tower emits the strongest signal in their frequency band. By broadcasting at maximum legal power and jamming 3G beacons, we force nearby handsets to camp on our rogue 2G cell.

In GSM 2G specifications, mutual authentication does not exist: the tower authenticates the handset, but the handset never authenticates the tower. Our fake BTS harvests IMSI identifiers instantly upon registration.

By sending a Cipher Mode Command with A5/0 (null cipher), we instruct the phone to disable all radio encryption. We can now record outgoing calls and intercept SMS in cleartext.

Defending against this requires disabling 2G at the OS baseband level, enforcing mutual authentication across all carrier bands, and auditing rogue RF transmitters.