Thereโs little rest for your hard-working smartphone. If youโre like manyย professionals today, youย useย itย for work, play, and a mix of personal business in between.ย Now, what if something went wrong with that phone, like lossย orย theft? Worse yet, what if your smartphone gotย hacked?ย Letโs try and keep that from happening to you.ย
Globally, plenty of people pull double duty with their smartphones.ย In Spain,ย one surveyย found that 55% of people use the same phoneย for a mix ofย personal andย and workย activity.ย The same survey showed thatย up toย half of people interviewed inย Japan, Australia, and the U.S.ย do so as well, whileย nations like the UK and Germanyย trailedย at 31% and 23% respectively.ย
Whether these figuresย trendย on theย low or highย end, the security implications remain constant. Aย smartphone loaded with business and personal data makes for a desirable target.ย Hackers targetย smartphonesย because theyโre often unprotected, which gives hackers an easy โinโ to your personal information and to any corporate networksย you may use.ย ย Itโs like two hacks with one stone.ย ย
Put simply, asย a working professional with a smartphone, youโre a high-value target.ย ย
As both aย parent and a professional,ย Iย put together aย few things you can do to protect your smartphone from hacksย so that you can keep your personal and work life safe:ย
First up, the basics. Locking your phone with facial ID, a fingerprint,ย patternย or a pin is your most basic form of protection, particularly in the event of loss or theft.ย (Your options will vary depending on the device, operating system, and manufacturer.)ย Take it a step further for even more protection. Secure the accounts on yourย phoneย withย strong passwordsย andย useย two-factor authenticationย on the apps that offer it, whichย doubles your line of defense.ย ย ย ย
Or, put another way,ย donโt hop onto public Wi-Fi networks without protection. Aย VPN masks your connection from hackers allowing you to connect privately when you are on unsecure public networks at airports, cafes, hotels, and the like.ย With a VPN connection, youโll know that your sensitive data, documents, and activitiesย you do are protected from snooping, which is definitely a great feeling given the amount of personal and professional business we manage with our smartphones.ย
Both Google Play and Appleโs App Store have measures in place to help prevent potentially dangerousย appsย from makingย itย intoย their stores.ย Malicious appsย are often found outside of theย appย stores, whichย can run in the background and compromise your personal dataย like passwords, credit card numbers, and moreโpractically everything that you keep on your phone.ย Further,ย when you are in the app stores,ย look closely at the descriptions and reviews for appsย before you downloadย them. Malicious apps and counterfeits can still find their way into stores, andย here are a few ways you can keep those bad apps from getting onto your phone. ย ย ย
Backing up your phoneย is always a good idea for two reasons:ย
Bothย iPhonesย andย Android phonesย have straightforward ways of backing up your phone regularly.ย
Worst case scenarioโyour phone is gone. Really gone.ย Eitherย itโsย hopelesslyย lost or gotย stolen.ย What now?ย Lock it remotely or even wipe its data entirely. While that last bit about wiping the phone seems like a drastic move, if you maintain regular backups as mentioned above, your data is secure in the cloudโready for youย toย restore.ย In all, this means that hackers wonโt be able to access you, or your companyโs, sensitive informationโwhich can keep you out of trouble and your professional businessย safe.ย Apple provides iOS users with a step-by-step guide for remotely wiping devices, andย Google offers up a guide for Android users as well.ย
We all download apps, use them once, and then forget they are on our phone.ย Take a few moments to swipe through your screen and see which ones youโre truly done with and delete themย along withย their data. Some apps have an account associated with them that may store data off your phone as well. Take the extra stepย and delete those accounts so any off-phone data is deleted.ย ย
The reason for this is that every extra app is another app that needs updating or that may have a security issue associated with it. In a time of data breaches and vulnerabilities, deleting old apps is a smart move.ย As for the ones you keep, update them regularly and turn on auto-updates if thatโs an option. Updates not only introduce new features to apps,ย but they also oftenย address security issues too.ย
With so much of your life on your phone, getting security software installedย onย it can protect you and the things you keep on your phone. Whether youโre anย Androidย owner orย iOSย owner,ย mobile security software canย keepย yourย data, yourย shopping, andย paymentsย secure.ย
The post 7 Tips to Protect Your Smartphone from Getting Hacked appeared first on McAfee Blog.
โMy phoneโs been hacked!โ Words you probably donโt want to hear or say. Ever.โฏย
Yes, a smartphone can get hacked just like any other device. And they make prize targets as well. Loaded as they are with personal and financial information, access to payment apps, files, photos, and contacts, bad actors have plenty to gain by tapping into your smartphone.ย ย ย
How do bad actors pull it off? They have several attack vectors they can choose from.ย ย
Todayโs attackers have gotten cagier as well. It used to be that a hacked phone would run sluggishly or hot after it got infected by malware. The battery might have drained quickly as well. That was because the malware ate up system resources, created conflicts with other apps, and used your data or internet connection to pass along your personal informationโall of which could make your smartphone feel a little off.โฏThat still might be the case with some mobile malware today, yet much of it works far more efficiently. The old telltale physical signs of a hacked phone might not present themselves at all.ย
However, you can spot several indications that might indicate your phone has been hacked.ย
Aโฏfew examples follow.โฏNote that theseโฏmightโฏbe signsโฏof a hacked phone, yet not always.โฏย
Install and runโฏonline protection software on your smartphoneโฏif you havenโt already. From there, delete any apps you didnโt download, delete risky texts, and then run your mobile security software again.โฏย
If you still have issues,โฏwipingโฏand restoringโฏyour phoneโฏis an option. Provided you have your photos, contacts, and other vital info backed up in the cloud,โฏitโs a relatively straightforward process. A quick search onlineโฏcan showโฏhow to wipe and restore your model of phone.โฏย
Lastly, check your accounts and your creditโฏcard statementsโฏto see if any unauthorized purchases have been made. If so, you can go through the process of freezing those accounts and getting new cards and credentials issued.โฏFurther, update yourโฏpasswords for your accountsโฏwithโฏa password that is strong and uniqueโฏto prevent furtherโฏtheft.โฏโฏย
Toโฏhelpโฏkeepโฏyour phone from getting hacked inโฏthe first place,โฏthere are a few relatively easy steps you can take. Insideโฏofโฏa few minutes, you can find yourself much safer than you were before.โฏโฏย
The post Help! I Think My Phoneโs Been Hacked appeared first on McAfee Blog.
LTESniffer is An Open-source LTE Downlink/Uplink Eavesdropper
It first decodes the Physical Downlink Control Channel (PDCCH) to obtain the Downlink Control Informations (DCIs) and Radio Network Temporary Identifiers (RNTIs) of all active users. Using decoded DCIs and RNTIs, LTESniffer further decodes the Physical Downlink Shared Channel (PDSCH) and Physical Uplink Shared Channel (PUSCH) to retrieve uplink and downlink data traffic.
LTESniffer supports an API with three functions for security applications and research. Many LTE security research assumes a passive sniffer that can capture privacy-related packets on the air. However, non of the current open-source sniffers satisfy their requirements as they cannot decode protocol packets in PDSCH and PUSCH. We developed a proof-of-concept security API that supports three tasks that were proposed by previous works: 1) Identity mapping, 2) IMSI collecting, and 3) Capability profiling.
Please refer to our paper for more details.
LTESniffer is a tool that can capture the LTE wireless messages that are sent between a cell tower and smartphones connected to it. LTESniffer supports capturing the messages in both directions, from the tower to the smartphones, and from the smartphones back to the cell tower.
LTESniffer CANNOT DECRYPT encrypted messages between the cell tower and smartphones. It can be used for analyzing unencrypted parts of the communication between the cell tower and smartphones. For example, for encrypted messages, it can allow the user to analyze unencrypted parts, such as headers in MAC and physical layers. However, those messages sent in plaintext can be completely analyzable. For example, the broadcast messages sent by the cell tower, or the messages at the beginning of the connection are completely visible.
The main purpose of LTESniffer is to support security and analysis research on the cellular network. Due to the collection of uplink-downlink user data, any use of LTESniffer must follow the local regulations on sniffing the LTE traffic. We are not responsible for any illegal purposes such as intentionally collecting user privacy-related information.
LTESniffer-multi-usrp
branch and its README for more details.LTESniffer is implemented on top of FALCON with the help of srsRAN library. LTESniffer supports:
Currently, LTESniffer works stably on Ubuntu 18.04/20.04/22.04.
Achieving real-time decoding of LTE traffic requires a high-performance CPU with multiple physical cores. Especially when the base station has many active users during the peak hour. LTESniffer was able to achieve real-time decoding when running on an Intel i7-9700K PC to decode traffic on a base station with 150 active users.
The following hardware is recommended
LTESniffer requires different SDR for its uplink and downlink sniffing modes.
To sniff only downlink traffic from the base station, LTESniffer is compatible with most SDRs that are supported by the srsRAN library (for example, USRP or BladeRF). The SDR should be connected to the PC via a USB 3.0 port. Also, it should be equipped with GPSDO and two RX antennas to decode downlink messages in transmission modes 3 and 4.
On the other hand, to sniff uplink traffic from smartphones to base stations, LTESniffer needs to listen to two different frequencies (Uplink and Downlink) concurrently. To solve this problem, LTESniffer supports two options:
main
branch of LTESniffer.LTESniffer-multi-usrp
branch of LTESniffer and its README.Important note: To avoid unexpected errors, please follow the following steps on Ubuntu 18.04/20.04/22.04.
Dependencies
UHD dependencies:
sudo apt update
sudo apt-get install autoconf automake build-essential ccache cmake cpufrequtils doxygen ethtool \
g++ git inetutils-tools libboost-all-dev libncurses5 libncurses5-dev libusb-1.0-0 libusb-1.0-0-dev \
libusb-dev python3-dev python3-mako python3-numpy python3-requests python3-scipy python3-setuptools \
python3-ruamel.yaml
Clone and build UHD from source (make sure that the current branch is higher than 4.0)
git clone https://github.com/EttusResearch/uhd.git
cd <uhd-repo-path>/host
mkdir build
cd build
cmake ../
make -j 4
make test
sudo make install
sudo ldconfig
Download firmwares for USRPs:
sudo uhd_images_downloader
We use a 10Gb card to connect USRP X310 to PC, refer to UHD Manual [1], [2] to configure USRP X310 and 10Gb card interface. For USRP B210, it should be connected to PC via a USB 3.0 port.
Test the connection and firmware (for USRP X310 only):
sudo sysctl -w net.core.rmem_max=33554432
sudo sysctl -w net.core.wmem_max=33554432
sudo ifconfig <10Gb card interface> mtu 9000
sudo uhd_usrp_probe
sudo apt-get install build-essential git cmake libfftw3-dev libmbedtls-dev libboost-program-options-dev libconfig++-dev libsctp-dev
sudo apt-get install libglib2.0-dev libudev-dev libcurl4-gnutls-dev libboost-all-dev qtdeclarative5-dev libqt5charts5-dev
Build LTESniffer from source:
git clone https://github.com/SysSec-KAIST/LTESniffer.git
cd LTESniffer
mkdir build
cd build
cmake ../
make -j 4 (use 4 threads)
LTESniffer has 3 main functions:
After building from source, LTESniffer
is located in <build-dir>/src/LTESniffer
Note that before using LTESniffer on the commercial, one should have to check the local regulations on sniffing LTE traffic, as we explained in the Ethical Consideration.
To figure out the base station and Uplink-Downlink band the test smartphone is connected to, install Cellular-Z app on the test smartphone (the app only supports Android). It will show the cell ID and Uplink-Downlink band/frequency to which the test smartphone is connected. Make sure that LTESniffer also connects to the same cell and frequency.
sudo ./<build-dir>/src/LTESniffer -A 2 -W <number of threads> -f <DL Freq> -C -m 0
example: sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -C -m 0
-A: number of antennas
-W: number of threads
-f: downlink frequency
-C: turn on cell search
-m: sniffer mode, 0 for downlink sniffing and 1 for uplink sniffing
Note: to run LTESniffer
with USRP B210 in the downlink mode, add option -a "num_recv_frames=512"
to the command line. This option extends the receiving buffer for USRP B210 to achieve better synchronization.
sudo ./<build-dir>/src/LTESniffer -A 2 -W <number of threads> -f <DL Freq> -C -m 0 -a "num_recv_frames=512"
example: sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -C -m 0 -a "num_recv_frames=512"
Note: In the uplink sniffing mode, the test smartphones should be located nearby the sniffer, because the uplink signal power from UE is significantly weaker compared to the downlink signal from the base station.
sudo ./<build-dir>/src/LTESniffer -A 2 -W <number of threads> -f <DL Freq> -u <UL Freq> -C -m 1
example: sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -u 1745e6 -C -m 1
-u: uplink frequency
sudo ./<build-dir>/src/LTESniffer -A 2 -W <number of threads> -f <DL Freq> -u <UL Freq> -C -m 1 -z 3
example: sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -u 1745e6 -C -m 1 -z 3
-z: 3 for turnning on 3 functions of sniffer, which are identity mapping, IMSI collecting, and UECapability profiling.
2 for UECapability profiling
1 for IMSI collecting
0 for identity mapping
LTESniffer can sniff on a specific base station by using options -I <Phycial Cell ID (PCI)> -p <number of Physical Resource Block (PRB)>
. In this case, LTESniffer does not do the cell search but connects directly to the specified cell.
sudo ./<build-dir>/src/LTESniffer -A 2 -W <number of threads> -f <DL Freq> -I <PCI> -p <PRB> -m 0
sudo ./<build-dir>/src/LTESniffer -A 2 -W <number of threads> -f <DL Freq> -u <UL Freq> -I <PCI> -p <PRB> -m 1
example: sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -u 1745e6 -I 379 -p 100 -m 1
The debug mode can be enabled by using option -d
. In this case, the debug messages will be printed on the terminal.
LTESniffer provides pcap files in the output. The pcap file can be opened by WireShark for further analysis and packet trace. The name of downlink pcap file: sniffer_dl_mode.pcap
, uplink pcap file: sniffer_ul_mode.pcap
, and API pcap file: api_collector.pcap
. The pcap files are located in the same directory LTESniffer
has been executed. To enable the WireShark to analyze the decoded packets correctly, please refer to the WireShark configuration guide here. There are also some examples of pcap files in the link.
Note: The uplink pcap file contains both uplink and downlink messages. On the WireShark, use this filter to monitor only uplink messages: mac-lte.direction == 0
; or this filter to monitor only downlink messages: mac-lte.direction == 1
.
The effective range for sniffing uplink is limited in LTESniffer due to the capability of the RF front-end of the hardware (i.e. SDR). The uplink signal power from UE is significantly weaker compared to the downlink signal because UE is a handheld device that optimizes battery usage, while the eNB uses sufficient power to cover a large area. To successfully capture the uplink traffic, LTESniffer can increase the strength of the signal power by i) being physically close to the UE, or ii) improving the signal reception capability with specialized hardware, such as a directional antenna, dedicated RF front-end, and signal amplifier.
Downlink Sniffing Mode
Processed 1000/1000 subframes
: Number of subframes was processed by LTESniffer last 1 second. There are 1000 LTE subframes per second by design. RNTI
: Radio Network Temporary Identifier of UEs. Table
: The maximum modulation scheme that is used by smartphones in downlink. LTESniffer supports up to 256QAM in the downlink. Refer to our paper for more details. Active
: Number of detected messages of RNTIs. Success
: Number of successfully decoded messages over number of detected messages (Active
). New TX, ReTX, HARQ, Normal
: Statistic of new messages and retransmitted messages. This function is in development. W_MIMO, W_pinfor, Other
: Number of messages with wrong radio configuration, only for debugging.
Uplink Sniffing Mode
Max Mod
: The maximum modulation scheme that is used by smartphones in uplink. It can be 16/64/256QAM depending on the support of smartphones and the configuration of the network. Refer to our paper for more details. SNR
: Signal-to-noise ratio (dB). Low SNR means the uplink signal quality from the smartphone is bad. One possible reason is the smartphone is far from the sniffer. DL-UL_delay
: The average of time delay between downlink signal from the base station and uplink signal from the smartphone. Other Info
: Information only for debugging.
API Mode
Detected Identity
: The name of detected identity. Value
: The value of detected identity. From Message
: The name of the message that contains the detected identity.
We sincerely appreciate the FALCON and SRS team for making their great softwares available.
Please refer to our paper for more details.
@inproceedings{hoang:ltesniffer,
title = {{LTESniffer: An Open-source LTE Downlink/Uplink Eavesdropper}},
author = {Hoang, Dinh Tuan and Park, CheolJun and Son, Mincheol and Oh, Taekkyung and Bae, Sangwook and Ahn, Junho and Oh, BeomSeok and Kim, Yongdae},
booktitle = {16th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec '23)},
year = {2023}
}
Q: Is it mandatory to use GPSDO with the USRP in order to run LTESniffer?
A: GPSDO is useful for more stable synchronization. However, for downlink sniffing mode, LTESniffer still can synchronize with the LTE signal to decode the packets without GPSDO. For uplink sniffing mode, GPSDO is only required when using 2 USRP B-series, as it is the time and clock reference sources for synchrozation between uplink and downlink channels. Another uplink SDR option, using a single USRP X310, does not require GPSDO.
Q: For downlink traffic, can I use a cheaper SDR?
A: Technically, any SDRs supported by srsRAN library such as Blade RF can be used to run LTESniffer in the downlink sniffing mode. However, we only tested the downlink sniffing function of LTESniffer with USRP B210 and X310.
Q: Is it illegal to use LTESniffer to sniff the LTE traffic?
A: You should have to check the local regulations on sniffing (unencrypted) LTE traffic. Another way to test LTESniffer is setting up a personal LTE network by using srsRAN - an open-source LTE implementation in a Faraday cage.
Q: Can LTESniffer be used to view the content of messages between two users?
A: One can see only the "unencrypted" part of the messages. Note that the air traffic between the base station and users is mostly encrypted.
Q: Is there any device identity exposed in plaintext in the LTE network?
A: Yes, literature shows that there are multiple identities exposed, such as TMSI, GUTI, IMSI, and RNTI. Please refer to the academic literature for more details. e.g. Watching the Watchers: Practical Video Identification Attack in LTE Networks