(Perfect) Cell Games: You Thought It Was Just Surveillance...

Here for the first uh talk of this track is Mike Kerno and the talk is perfect cell games you thought it was just sury. >> Yeah. Thanks everyone for coming. Um it's really good to be here. I've done a few science before. Um I didn't know K had one. I didn't know those were great. So uh yeah here's my talk. Perfect cell games. I thought it was just surveillance. This is my true power. It's uh how impatchers and rogue cells can be kind of flipped on their head to actually affect critical infrastructure that uses cellular connectivity in a nation. So, uh quick agenda here are some bullet points of what I'm going to talk about. I'm going to try and go a

little bit quick because I do have a lot of slides and I'm going to try and brief through some stuff so I can get to the cool stuff. Me, it's all cool, but I got to get through some of it quickly. Um, okay. So this I didn't want to put a picture up. So this is me. >> Hold up. >> I am the man. That's so bright. >> I'm the man giving the presentation. Um I not going to talk too much about myself. Do the whole uh Sony is alphabet stuff. I'll just say that uh I fancy myself more as a systems architect that wears a cyber security skin suit little bit um in my entire cyber security

career uh as system architecture engineering is my true passion. >> But cyber is a great way to apply a lot of stuff. So kind of like uh like when I'm in the room with folks I'm kind of like like editor from Men in Black. So when everyone is talking about stuff and they go uh if you guys watch me. All right. So anyways, we'll get going here. One thing that I do want to make uh clear really quick is that um I I have to use this particular presentation with the web application. Uh the format gets all jacked up and which means I don't know what slide is coming next. So I'm kind of doing a lot of shooting from the

uh from the hips as I go. Uh >> yeah. Okay. Here's hills I will die on. Another P1. >> This one right here really pissed me off because I keep I I drove from North Carolina and people here just go like 20 like I'm pretty sure on the Merit Parkway was like people doing 80. It's 55. Ridiculous. >> Yeah, I I'll learn for next time. So I'm going to start off with uh getting into road cells and uh what what exactly they are. Um so I didn't have good pointer. So all right I'll I'll start off with the EFF. It was much more yellow this morning. I'll start off with the EFF definition. Um they're rogue based

stations also known as catchers. uh they look like that. They do stuff and they they essentially try to uh look like cellular uh uh infrastructure to user equipment. Uh another EFF uh slide here. So depending on the type they use, it can be a very simple passive INZY catcher or it can be something a little bit more complex where it's uh you know actually emulating real EPC and other uh like behind the RAM cloud infrastructure or the the the uh components behind the RAM that connect you to the internet and to the other cells from the cell towers and whatnot. Uh they go by a bunch of different names. I'm getting used to the lag here

when I hit the button. Uh they go by a bunch of different names. Uh these are all things that are recorded on different websites and government documents and whatnot, but I just call them rogue cells uh cuz that's easier and it's less to write and I'm lazy. So uh they look like this. Lots of different form factors. Uh some of these are meant for uh you know being mounted in vehicles and drive them around. something about airplanes. Uh BB handheld. Uh I've seen a few of these too. What was the next slide? Yes. Okay. So they essentially they look like this and they're trying to emulate clips. What you see here is a cell tower. In a cell

tower cells to provide uh like 360°ree directional cup. So it's like it's like a big it's like a pie. It's like a circle pie. It's like a pizza pie, right? Um, so you know, uh, when the cell hits your eye like a big pizza pie, that's Samore, right? So if you want to learn more about directional cell coverage, I do suggest checking out, uh, cellmapper.net. There we go. cellmapper.net. Uh, it you literally look like this is where we are now. Look, pizza. I don't want to be the guy getting this one. I want to be the guy that. Um, but yeah, that's just something that you all can check out, too. So next slide. Um also too if you sometimes

you might see devices like this too. They're like micro cells or pico uh pico cells that are to uh like assist with any they like supplementary coverage, right? Does that make sense? So like if you're laughing in one direction or one area or if you're in a city and there's lots of buildings there get cell signal. Like when I was driving up here, I was going through all through Baltimore and Philadelphia. Both bad ideas, but I did it. And I had 5G all of a sudden, which I never had 5G at all. I was like the entire I'm like, where are these cell towers? But they got these hanging off like light and stuff. Um

I'm literally surprising myself with the slides come by. Uh so uh to kind of get into who is actually using these uh it's very generally just law enforcement and cred um it's showing much better on my screen. It's kind of laggy here but so this uh time Mr. Olympia Ronic Coleman. Uh he actually was a legit police officer. Pretty cool. That's Rockabot from back 64 hack. But uh in the in the uh in this particular threat in the threat model of the vulnerability that I want to uh talk about, it doesn't matter who's doing it because the end result is essentially the same. So whether it's a police driving by with their uh Izzy catchers

making things turn on and off and doing weird stuff or it's criminals actually pointing and making a concerted effort to target uh infrastructure. The outfit's the same so or the outcomes essentially the same. So I kind of consider these the same entity. Uh it's just actor. It's an actor. That's it. Right. So if it can happen on accident, it can happen on purpose. Uh, and so here's some I just have a few deployment pictures of what these look like out in the wild. >> Uh, if you have any kind of I'm gonna I'm gonna say this lightly. Uh, interesting large social gathering of people. Uh, you might see something like this. And no, they're not out there

providing free internet. They're looking to see who's out there because the international mobile subscriber ID, which is in your phone, uh links a a paying subscriber to that particular device. If it's in the area, they say, "Hey, subpoena the AT&T." Okay, now now I know who bas. Uh here is another scenario right here uh where the ATF has flown these under uh big swinging Cessna planes looking for criminals and then when they do that, you know, this is fun, right? Here's the park. So from the privacy perspective, it's just ridiculous. So getting into the personal privacy side um I'm not going to cover super much on the privacy side because this whole endeavor of mine, this this research that I've

been doing for the past six years started with privacy, but it pivoted to just infrastructure. And there's going to be another talk at the end of the day uh that is I believe it's a little bit more privacy focused on the cell side talking about like the EFF ray hunters and stuffers. Pretty cool which I brought mine too by the way. Um so yeah uh privacy implications uh identity exposure location tracking interception device exploit device exploitation and control and manipulation of service. Those are actually very very difficult to do from a technical perspective and it deter it's determining on the hardware that's actually being used to do it if it's a very advanced uh thing like if you have

one of those super stingrays with all the modules uh that you can put on it to actually facilitate full connectivity from uh your UEE user equipment phone other connected thing right just the acronym UE I'll say that a few times uh to the range which is a radio access network that sells on a cell tower and then facilitating that to another cell tower another backend cloud system internet right um that is difficult to do um but I am all but positive that it is possible to do through the radio interface uh then masterance which I talk a little bit about user behavior profile I'm not going to go too much into privacy uh beyond that because

privacy is a crime and I don't want to talk about it okay so physical safety pull physical safety. This is um getting more into the the actual meat of the topic here. So, a cellular in infrastructure uh it intelligent transportation systems. That's uh a very simple example of this would be like when you're driving on the highway, you see cameras on the side of the road, not the normal police cameras, but the ones that are actually looking at uh like road conditions, uh traffic backups, uh accidents and stuff like that, and they're reporting that information gets detected, sent to the traffic management center, uh analysts in the TMC then goes on their advanced traffic management

system and goes automate, sign to the dynamic messaging, right? That's it. That's the infrastructure uh that relies on detection of different environmental state uh um I'm not going to go through which one but you're fair uh okay chargers we know electro electric vehicle charges are we charge electric okay uh and then rail uh rail is a very interesting one too because passenger rail and freight rail are both doing uh CBTC and PTC so that's precision train control and communications based control uh understanding the state of the train and its application uh and a bunch of other metadata at all times so that you can have as rail as many as many rolling stock on the rail as possible and have

it as safe as possible. And those connected buses, which Connecticut has connected buses, too, which is pretty cool. You have silver connected buses that reach back to an op center report uh location, fire, data, stuff like that. Uh safety info uh truck. The general theme is uh connected vehicles, connected infrastructure, reports to a thing, and that thing makes you do other things. and they're using cellular as the medium of communication. Uh so it's it is everywhere. Uh it's in a lot of places. Yeah. So I got a few examples here. So this is I talked about uh uh uh it'll talk a little bit about CV2X. Uh so CV2X is uh uh cellular vehicle to everything.

It's uh using uh cellular I'm going to broaden the term a little bit here um because CV2X is a cellular vehicle to everything but um there's also uh uh more short range uh DSRC communications as well which is already out there. It's a little more prevalent than CB2X which is its own 3GPP standard um for doing uh like you know near communication off of PC5 interface directly. So, um, yeah, I got a little scenario here. It's just, uh, you know, hey, there's an accident up here. Camera sees the accident, alerts the TNC up in there, and they push out the message. They can do this manually, they can do it automatically depending on the scenario. Okay, there's like hand

scenarios that can be on that. And what it does here is it not only signals uh sorry not only updates the the uh connect DNS, it also will update uh connecting vehicles whether they're 4G or 5G. Here I got an example of actual CB2X or lead in this case >> uh using the the C2F communicating from a vehicle >> which is based at all direct uh devicesation for like pre-programming and helps for like safety safety communications. Uh then from there there's uh you can go to 5G or 4G do network assistance 2x get information about each other data connection fill alerts and whatnot some of this not rolled out yet it's in the works some of

it's already out uh just as an I got a couple examples here uh sale infrastructure for EV charging scenario where cellular is paramount here is uh in this scenario we've got um a uh a battery electric storage site as the distributed energy resource with the E where charging uh EV charger where sometimes it can connect right to the grid too like it you can connect to micro grids you can connect to regular grid it's uh you know diversity is one of the options here and these uh require cell in most cases they require cell mutations uh they need to talk to some kind of back end to do management monitoring and help people maintain do

all of that stuff uh so if you were to make those communications. Uh you can definitely I'm with this guy right here. >> Uh >> you got in this month's dual home Wi-Fi as well. Um and rail. So red rail is another one. Uh commuter rail, passenger rail or uh light rail, subway, freight rail. just have uh some wayside units which are kind of like roadside units for uh ICO films but they're wireless boxes and pictures that sit on the side of rail. So everyone they can communicate certain data. They can announce positive location of where the transible times. The dream can also connect to the ROC the rail operations control center. Sometimes it be called something

different but specifically an OCC in these uh uh transit uh administrations that we use. So is that does that make sense? Okay.

like all this honey is not helping. Um, okay. So, getting into a little bit more on how it looks. Um, okay. We'll talk we'll start kind of the whole idea here is kind of start fade and kind of drill down to the real like we'll start, right? So, we'll get you to the bassband processor first. Uh, who knows what who has heard a bassband processor? Yes. Okay. Okay. Cool. So, can you come up? No. Okay. Um, so it's it Yeah, it's uh it's essentially a another So, like when you have I'll use phones actually. Can I get five more real quick? >> Uh, okay. So, I'll time these uh on this and other cell. You've got Katie Cross is like a pocket.

Check my email. Um, reachable that >> you've also got him. Uh you also got uh separate there's multiple computers in a user equipment right but you've got one called a bassband processor and its job is to um uh help there's a lot of logic in it and uh what we're going to be talking here is about how it helps to uh allocate radio resources that are appropriate for uh uh like LTE or 5G communications. So, you have this computer in here that you don't have really any access to. Um, forgot why I enlarged that, but I made it bigger for you if you needed to see it bigger. Okay. Uh, okay. So, we have I think I made

this bigger too. There we go. Okay. So, we got like some basic uh like air texture here. Uh, B processor and input signal. Put this up your phone. You make a phone call. Go index. egg will go out and then it will come in. So it modulates out, he modulates in. Uh essentially that's what it does on that hardware side. But it also contains uh logic uh to do things like radio resource control uh which is very important for the non-acess stratum portion of trying to connect to the radio access network to connect to a cell from the phone. Um I save this is this talk is mostly about critical infrastructure. Uh but I use one a lot

because it's analog that we all have. But imagine this stuff and some stuff that can make things go boom, right? So there we go. So I have um uh uh yeah getting into the application processor bassband processor. These things have a relationship with one another. You do not necessarily uh access the bassband processor from the application side. So depending on what kind of hardware you have uh what what chipset you have they they open up a hardware abstraction layer. So you may be able to find a how access might be able to find a diagnostic access like in here the bro I think there you got okay here again so there's no Verizon I catches because

it's great right but in here it opens up a diagnostic uh interface on the MBM9 9207 I forgot the it's a bunch of numbers uh the Qualcomm chip that's in here um sometimes they'll open up a diagnostic interface the hardware itself too. Uh so like I think it's Verizon that makes this. Yeah, it's Verizon. They could uh they could have closed or messed up now too. Um but how you interface with it is dependent on vendor hardware, what they want open up and closed off and what you can kind of like sneak under the hood too. Uh okay. So yeah, here is some of some of uh some of the protocol stack for 4G. It's pretty similar for 5G. Um but in

this particular scenario where the catchers and the uh uh ro self and all that is going to be an issue is radio resource control and NAS which is the uh non-access stratum. Non-access stratum means it's part of the radio access network conversation that doesn't have to deal with allocating radio resources directly. It's just sharing the information to the user equipment. Yeah. So, that's what I'm talking about right there. Uh, so getting into the basic RAN, uh, RAN just means radio access network, whether it's a a 4G or a 5G. And, uh, you know how this works. We have phones, we have connected vehicles, we have a bunch of other here. Um and so this scenario is just supposed to show

uh how two phones can connect to each other in a very simple simple uh topology and then how connected vehicle would have some kind of fleet back end or something that they need to connect to uh the vehicle themselves or the ECUs in the vehicle. You can have multiple cell connections uh if you have multiple cellular enabled ECUs in the vehicular network. So what the issue is here with radio resource control with uh uh how this gets done from the user equipment to the uh real access network is part uh it's something called cell selection. So when you do a sales selection um there is a very simple uh formula right there first it does a

PLM selection which other plan network selection uh what country are you what area are you and this country here once that passes uh it's looking for the cell selection reception level the cell selection body level to be about a uh in relative you're assuming different stuff based on network conditions environment here, but it's got to be about so uh very quickly here we've got the epic access attaching attack procedure. So, uh random access is just when a so like people think phones ping out. Phones don't really ping out. They don't start with conversation. Vegas received something called a master information block which tells then what uh what to allocate to then take the next set of

information which is a a system information blocks and these tell you the selection criteria the different neighbors selection priorities should you pick me over someone else uh what is the minimum quality level that you need to have before you can talk to me and that kind of stuff and so here uh this is what I call the uh uh cellular islanding. It's this idea of a directed attack where you are getting connected infrastructure convincing it you know beyond a shadow of a doubt you're the best thing out there. It needs to connect to you and to continuously fail the NASA attach procedure over and over again. That way it's stuck to you but it's going nowhere.

Uh so here here's uh very amusing connected buses here. Uh on the left side it is like what it's supposed to look like, right? That's the typical scenario. On the right side is connected to a bad cell and it's just kind of black phone traffic, right? This it's not going in. So if there's a fire on that bus and the fire safety mechanisms get tripped and normally the administrative operation center would get a notification of that self connection. Even if it's dual home, you can still uh because you do get dual home with different uh service providers, but you can tune these just have two just have tunes and catches, right? Have two devices and tune them to

the PLN of uh AT&T area that you know they're talking to. So, uh where where are we on where are we on time? I'm going to talk super fast. Okay, I'm not going to do the exercise. I had an exercise but anyways I got proposed countermeasures I've been working on uh since 2022 at this point in the research. The first one was called uh cell selection integrity verification algorithmically algorithmically determining whether or not a cell a cell is worthy of and safe enough of being a serving cell that you want to camp on. um and doing that initially it was written for a b uh for uh a firmware implementation but I've been working on

ways to kind of abstract it out and simplify it to something a little bit more user space based on how much interaction you have with the uh with with the chipset that's being used in that device. Uh and then the second one is route lock cell enforcement which is uh I'll get into that momentarily here. Uh there should be a oh yeah I got some docs to share. Let me go ahead and do this. Okay so I'm going to go quick uh I have links and stuff things to share. Um, escape out of here. Go here. Go here. So, I've got uh all right way. Okay. So, yeah. Uh, seller se cell selection integrity verification taking that

things have to this and that have to be over zero for me to consider connecting. See, there's got to be a little bit more than that. And this persists by the way 2G, 3G, 4G and 5G. Um, a lot of it has to do with backwards compatibility to like 2G and 3G. Uh, and it's also in things like uh like narrowand IoT and other cellular protocols that were uh you know written for these low-level computing devices that have limited computing resources like the smartwatches and smart meters and all that. Uh I will blow through this one here but there is just something I want to get across. Uh this consists this consists of nine different uh

verification uh verification algorithms uh that check things that are one uh deterministic and known about the uh 3GPPB standards and then two it's doing things to uh check it does a lot of uh like uh like zcore calculations and whatnot and how to determine uh whether or not the broadcasting cell you're talking to is trying to be like a pickme of cell towers uh or And sometimes it can get a little bit uh complicated too. So there is uh I just want to get to the state machine real quick because that's going to be get down here. There's a uh essentially it's using math to just keeps keep track of a uh the state of a cell that you're

uh uh talking to or trying to talk to. Uh because that the the the catchers are rogue cells. are trying to pretend to be part of infrastructure so that they can say hey you should connect and consider me part of the infrastructure but they look weird though like there's things with them that look weird there's things with that uh with them that are just not going to look legitimate no matter how well they tune uh so there is uh the verification algorithm process is essentially a uh state machine that's keeping things in the state of being suspect and probation uh these words I'm not going to describe what they mean But, you know, being good, suspect, he looked a little bit

weird. Whatever. Uh, Bard, you did something bad and probation means uh, you know, maybe over time you were not bad. So, we're going to add you into this uh, state where you can go back to the back to clean. Then, it'll just recycle that. So, I'm going to do here is I got a little demo to show how that works. Uh, okay. Bam. Let's see if this will work. Okay. So, I got a demo here. And what what this or it's demo. It's a visualization to just better communicate uh how this how this works. In the middle there's a square. That square is me. I'm not actually the square, but I'm controlling the square. So, I'm going to

move around. And this is supposed to approximate like city blocks and whatnot, right? Like uh you're in a city somewhere and you have cells nearby. And as we move, it's procedurally generating different buildings, different cells, and it's showing different states. You'll see the color changes, right? it goes from from blue to yellow to red to green and whatnot. And that's it's just going through the flow of that state machine of looking at everything that cell is broadcasting and and comparing that to what we know with cells in the in the in the area um and what we know it should be broadcasting based on uh uh static configs of what 3GPP standards are supposed to be. So, it's kind of a

mix of different ways of trying to verify it. Um I'm going to stop this because I know we're getting low here. Uh, low on time. Not not get That's a different thing. Um, okay. Let me escape out of here and try not to do it. Uh, okay. I'll just exit out. I built it escape from there. So, you should just be able to double tap escape, but I guess it doesn't work. Uh, then next I'm going to get into uh this one here. This is a recent one. Uh this is a recent one that I came up with. I'll kind of breeze through this one here. It's called Roblock Cell Enforcement. This is not so much on the

firmware. Oh crap. Drop like problems. Dude, I don't want to do that. Anyways, uh we had um or I had to work this out. It's uh when you have uh fixed uh you know, fixed transportation, rail, bus, subway, whatever, right? And it's going to static routes. These are like routes that you just don't because they're on the web, right? They're just in static routing. uh at the user space level. Uh plus you bless you was that right? Some I heard someone say I don't preemptive. Okay. Anyway, so the the the idea is uh allocating different uh segments, sections and blocks and whatnot of a route and then be able to simply simply just assign what the good cells are that

you know you pre-ervey everything look what the cells are supposed to be connecting with and from there uh kind of like a like not hard coding but you know configuring it so that as you're moving at different parts of the segment you're only actually connecting to certain servant cells that you've already pre-erveyed. a minute. It's it's a dynamic process because it'll detect new cells that are also good. It can report that back and then, you know, folks can determine whether or not they want to actually advocate. I have uh a visualization for this one as well to kind of help show how that uh works. Uh bam. Okay. Uh so here this is modeled after the

Charlotte area transit system, blue lock. Um and this this is a place I I've worked out some of their rail for and I do uh like that area. So if I hit if I hit uh space, this is just supposed to be a train uh >> or bus. No, the blue lines train uh light rail. It's just going through the different stops. Uh it's more fluid on my screen, but it's lagging a little bit for the with the zoom chop. So we can see that as it's going through it's got actual blue hybrid cells that and you can program you can actually configure how uh I believe it's this one uh you can actually configure

how big or small uh your segment or or block is uh because that's something that's built into the protocol. Um, but yeah, so we got that and I'm going to exit that. All right, I got something in my eye like the crappiest time. Okay. Uh, so let me go back to the presentation. Of course, it's going to load. Okay, there we go. Uh, it's going to get to the end here. There is a call to action down here uh that I'll just share real quick.

All right. So, call to action. These are things you can do if you want to. The content's cool, too. I'm not going to judge anyone uh for it. Um there there there's a there's a few things. Uh one, there is a uh there is a bill now, sales site simulator acts. um it's not really directed at the critical infrastructure stuff. It's just saying it's basically trying to make it harder for law enforcement to end up using these and especially to use it as like a is like a a first resort. Um that can drastically reduce some of the issues that I see here for sure. Uh second off is uh contracts. If you're in positions like

I'm in positions where in contracting and procurement I start putting cell provisions into these requirements uh cellular connectivity because people always look at oh we're good we vual authenticationalisms we do the TO do the TLC right that's what it is um and so that what goes over the wire is fine but we don't look at the wire itself I look at the wire itself so I start building some to send to uh contract departments and I'm doing work with different uh take transit places and folks that need to either procure or deploy or uh you know stand up sites and equipment. Uh that's that's one way of going about it. Uh then there's also uh

research. Um research on cell security typically goes with um is typically a lot of like what happens after you've already authenticated to make it so that you can't be knocked off the active connection. uh not so much what happens before like in radio resource control and the random access and all that stuff that we talked about before or that I talked about before that you listened I hope um so that um that's what I have right now. That's that's the whole presentation for sure. Uh I've got some got some links too. Uh I don't I tried to have a super big footprint but I I told myself that um that's that's actually not my YouTube.

That's a buddy of mine's YouTube. Uh his work actually got me started into the cellular space in general, so I give him credit here. Um, but yeah, I just I've got like GitHub and link and stuff. Um, that's pretty much it. I I don't know if I'm going to have answers when anyone has questions. Uh, I don't know if I'm gonna have answers. We'll uh we'll go ahead and see. Uh, yeah. So, we been on time for a few questions or >> Yeah. >> Okay. Uh, yes.

No, but I want to. Um, so there so that whole like on the different uh specs I wrote, they have it the logo C6 on it and all that. That's a thing that I'm working on which is uh it's security specifically for the conduit. So if it's like a physical conduit, broadcast conduit, logical combination of them. Um so it having a repository is right now it's it's in my git oh so I put it here but I'm going to make its own git repos uh there will be procurement language um kind of like how the DOE has electric vehicle charging station procurement uh which is all monument because I wrote the first uh EV chart on the cyersp

so now that was picked up from the dot I wrote they just propagate that out and I was like that would be a cool thing to do with something like this you know that that's a good question um yes I would say just keep track of that uh that GitHub Uh because I do I do plan on actively updating that with different documents. >> Yes. >> Uh so sorry but related topics >> right here. Yeah. >> So I think you have any plans cooperate because I feel like research and >> um I mean it's hard to anyone from the EA back. I just go to their website a lot. Uh because they have a lot of cool

stuff. We even have the um the NSA NSA training materials on how to use insty catches. >> Um yeah, I haven't talked to anyone from there. Uh I was looking into crocodile hunter for a bit. Uh but when they came out with this, it was actually much easier. So I might action three chats to whoever's working on the development for this. Um because it was very creative and because like this doesn't open up any actual interfaces for you to do it. They they slipped in a um a rust binary root shell to go in there. That was pretty cool. So, I did get to play with this a lot and I get to use their uh

root shell. They slips in there. Nice. The answer is no. I didn't Yeah, but it would be cool though. Uh so, they had a different you know different name but similar uh similar aspects to it. All right. Let's thank Mike for the presentation.