Open Source Cellular Test Beds for the EFF Rayhunter

Open Source Cellular Test Beds for the EFF Rayhunter

Speakers: Ron Broberg, Darkworth Solutions

Conference: RF Village

YouTube: https://www.youtube.com/watch?v=RkIz4VcsEdo

Overview

Ron Broberg's talk at RF Village, "Open Source Cellular Test Beds for the EFF Rayhunter," delves into the critical need for accessible, open-source tools to detect IMSI catchers, commonly known as Stingrays. Broberg, a seasoned professional from Darkworth Solutions with decades of experience at Lockheed Martin, highlights the pervasive and often invisible threat these devices pose to privacy and security. His presentation focuses on enabling security researchers and enthusiasts to build their own cellular test environments, thereby fostering a deeper understanding of cellular network vulnerabilities and empowering the development of detection mechanisms like the Electronic Frontier Foundation's (EFF) Ray Hunter project.

The core of the talk addresses the significant challenge of verifying Stingray detection software without access to actual, illicit devices. By meticulously outlining the hardware, software, and configuration steps required to establish a simulated cellular network, Broberg provides a blueprint for creating a safe and legal testing ground. This initiative is particularly vital given the widespread deployment of Stingrays by law enforcement and other entities, often without transparency or user notification. The ability to simulate these threats using open-source components allows for invaluable research into cellular protocol weaknesses and the validation of defensive tools, ultimately contributing to a more secure and privacy-aware mobile ecosystem.

The talk not only demystifies the technical complexities of cellular networks but also underscores the importance of community-driven efforts in cybersecurity. Broberg's journey from traditional RF engineering at Lockheed Martin to his current role at Darkworth Solutions, spurred by the intersection of RF and cyber, exemplifies the growing recognition of these interconnected domains. His work on the Ray Hunter testbed is a practical contribution to this evolving field, providing the necessary infrastructure for ongoing research and development in cellular security.

Background

▶ Watch: Speaker Introduction and RF/Cyber Background (0:00)

To appreciate the significance of the EFF Ray Hunter and the testbeds discussed, one must first understand the nature of Stingrays. These devices, also known as IMSI catchers, are simulated cellular base stations designed to intercept mobile phone communications. Typically deployed from vehicles, vans, or even helicopters, they operate by mimicking legitimate cell towers, tricking nearby mobile phones into connecting to them instead of the actual network. The critical issue is that this "hijack" of the connection is usually silent and unannounced to the user. While Google has recently made strides, announcing plans to alert users of suspected hijacked connections in future Android releases (presumably Pixel 10 with Android 10), this functionality has yet to be widely observed in the field.

A Stingray's internal architecture is not as complex as it might seem; it essentially comprises radio gear, often four Software-Defined Radios (SDRs), driven by a dedicated single-board computer. This setup allows it to simulate a cell station and effectively capture data about nearby phones and their connections, particularly in situations involving targeted surveillance or crowd monitoring. The data captured often includes the International Mobile Subscriber Identity (IMSI), a unique identifier for each mobile subscriber.

The EFF's Ray Hunter project emerged to counter this silent surveillance. As an open-source initiative, Ray Hunter aims to detect these attempted hijacks and alert users. However, developing and testing such a tool presents a significant hurdle: the illegality and inaccessibility of actual Stingrays. This is where the concept of an open-source cellular testbed becomes indispensable. Such a testbed allows researchers to create a controlled, simulated environment where a "fake" cell station can be stood up, enabling the safe and legal testing of detection software without interfering with commercial networks.

Understanding the underlying cellular infrastructure is crucial for building such a testbed. Modern cellular networks are well-decomposed into distinct components that communicate via well-defined protocols. Key components include the Evolved Packet Core (EPC), which is the core network, and the Evolved Node B (eNB) for 4G or Next Generation Node B (gNB) for 5G, which represent the radio interface (the "cell tower" part). While ideally, these components could be mixed and matched from different projects, practical challenges often lead to using a single project's ecosystem for both the EPC and eNB/gNB. The speaker also provides a crucial warning: it is illegal and highly discouraged to simulate commercial bands, impersonate them, or broadcast on their frequencies. Researchers must operate strictly within legal and ethical boundaries, typically using unlicensed or test frequencies, or within shielded environments.

Key Findings

▶ Watch: Introducing EFF Ray Hunter: Open Source Stingray Detection (3:00)

The central finding of Ron Broberg's presentation is that it is entirely feasible to construct open-source cellular testbeds capable of simulating Stingray behavior, thereby enabling the effective testing of detection tools like the EFF Ray Hunter. This capability fills a critical gap, allowing researchers to explore cellular network vulnerabilities and validate defensive measures without resorting to illicit or dangerous real-world deployments.

Key findings and contributions include:

• Feasibility of Open-Source Testbeds: Broberg demonstrates that a complete cellular core network (EPC) and radio interface (eNB/gNB) can be assembled using readily available open-source software projects and commercial off-the-shelf (COTS) hardware, even on platforms as modest as a Raspberry Pi.
• Identification of Core Software Stacks: The talk highlights specific, viable open-source projects for building cellular networks: SRS RAN (including SRS LTE and SRS 5G) for its plug-and-play simplicity and OpenAirInterface (OAI) for its flexibility and documentation around IoT bands. He also mentions YateBTS for 2G networks.
• Hardware Recommendations: Specific SDRs are recommended, including the USRP (e.g., B210) for more professional setups and BladeRF (X9 being the minimum for 4G/5G due to FPGA capabilities) for enthusiasts. The importance of appropriate antennas covering the wide LTE/5G frequency range (400 MHz to 7 GHz) is stressed.
• Essential Diagnostic Tools: The "magic box" concept, often a Ublox chip-based modem, is identified as crucial for seeing cellular transmissions and validating testbed configurations, providing visibility into an otherwise opaque process.
• Stingray Detection Mechanism: The talk clarifies that Ray Hunter primarily flags on the IMSI request included in the "attach request" during a mobile device's initial connection to a cell station. Since Stingrays function as IMSI catchers, this initial request is a reliable indicator of their presence.
• Sim Card Requirements: Generic USIM cards from bulk suppliers (e.g., Amazon) can be used, with a specific configuration detail: setting the AD value to '9' to allow connectivity to simulated networks.
• Network Downgrade Attack Vector: As a tangential but important finding, Broberg illustrates how a simulated 4G/5G network can intentionally deny a connection, leading devices (especially IoT or older phones) to "fall over" to a less secure 2G network. This 2G network, easily configurable with YateBTS to accept all authentications, allows for the interception of traffic, highlighting a significant vulnerability for many devices.

These findings collectively empower researchers to establish controlled environments for testing cellular security tools, understanding network behaviors, and ultimately enhancing the security posture against sophisticated surveillance threats.

Technical Deep Dive

▶ Watch: Mapping Cell Networks and Crucial Legal Warnings (4:30)

Building an open-source cellular testbed, as outlined by Ron Broberg, involves a careful selection and configuration of both software and hardware components, mimicking the decomposed architecture of commercial cellular networks.

At the heart of a cellular network are two primary components: the Evolved Packet Core (EPC), which handles data routing, subscriber management, and authentication, and the Evolved Node B (eNB) or Next Generation Node B (gNB), which is the radio interface that communicates directly with user equipment (UEs) like cell phones. These components communicate over well-defined protocols, theoretically allowing for interoperability between different projects, though in practice, sticking to a single project's ecosystem often simplifies setup.

Broberg highlights several key open-source projects for these components:

1. YateBTS: This project is primarily used for 2G (GSM) networks. While older, it's valuable for understanding foundational cellular concepts and, as discussed later, for demonstrating network downgrade attacks. Its open-source nature for 2G makes it accessible for foundational experiments.
2. OpenAirInterface (OAI): OAI is a robust project supporting 4G (LTE) and 5G networks. It offers significant flexibility for engineers to modify and customize configurations, particularly beneficial for specialized applications like IoT devices (e.g., medical devices, drones) that might use specific M1 bands or other less common IoT frequencies. OAI provides numerous examples for different cell station types, bands, and radios. However, OAI presents several challenges: its documentation can be "rough" and outdated, often referencing older Ubuntu versions (e.g., 18.04), and while the eNB/gNB (modem side) is relatively easy to configure, the EPC (backend) is "quite difficult."
3. SRS RAN (Software Radio Systems Radio Access Network): This project, which recently split into SRS LTE (for 4G) and SRS 5G, is touted as the closest to "plug-and-play." It builds more easily than other projects and requires fewer configurations for out-of-box functionality. SRS RAN can provide both the eNB (radio front end) and the EPC (core network), and even offers a GUI for waterfall and demodulation visuals, aiding in verifying signal integrity and connections. Notably, SRS RAN can run both the EPC and eNB on a Raspberry Pi, making it highly accessible for enthusiasts, though external power for SDRs is crucial due to the Pi's limited power output. The main drawback is that for "odd things" like custom IoT bands, users might need to build radio definition files "pretty much from scratch."

For hardware, the selection of Software-Defined Radios (SDRs) and antennas is paramount. SDRs serve as the radio transmitters and receivers. Broberg specifically recommends:

• USRP (Universal Software Radio Peripheral): Specifically, the USRP B210 is mentioned as an "entry-level" option for companies, though its price point of around $2,500 pushes it out of the typical enthusiast's budget.
• BladeRF: The BladeRF X9 is recommended as the minimum for 4G/5G applications, though the X4 can be used for lower capabilities. The BladeRF's advantage is its FPGA, which allows for implementing a full Wi-Fi stack directly on the radio, offloading processing from software.
• Ant SDR: Mentioned as potentially up to snuff, but the speaker had no direct experience with it.
• Lime SDR and Lime Mini: These are suggested by SRS RAN for Raspberry Pi configurations, with the caveat of requiring external power.

Antennas must be carefully chosen to match the wide frequency ranges of LTE and 5G, which can span from approximately 400 MHz up to 7 GHz. Standard Wi-Fi antennas are insufficient.

A crucial diagnostic tool is what Broberg refers to as a "magic box" – essentially a Ublox chip-based modem. This device allows researchers to "see into the cellular transmissions," providing visibility into which cell stations are being picked up as valid and whether the simulated network is properly configured. This helps in distinguishing a functional setup from "misconfigured noise." However, these chips also have band limitations, so selecting one that matches the desired test bands is important.

Configuration involves several steps:

1. PLMN (Public Land Mobile Network) ID: This identifies the mobile network operator. Tools like cellmapper.net can help identify PLMNs and bands in a specific area.
2. Bands: The specific frequency bands to operate on, typically determined by the chosen SDR and the desired simulation.
3. SIM Cards: For User Endpoints (UEs) to connect, USIM cards are needed. While high-quality cards from Sysmocom are available, generic bulk USIMs from Amazon or China can be used for testing. A critical configuration detail for these generic SIMs is setting the AD (Authentication Data) value to '9' (instead of the default '0000'), which enables connectivity to simulated networks.

Once the EPC and eNB are configured and an SDR is connected, the network is ready to broadcast. User endpoints can be virtual UEs, actual phones performing LTE scans, or the Orbit modem (a handheld detection device). The Ray Hunter software analyzes captured traffic (e.g., PCAPs generated from a TCP dump) for specific protocols. A key trigger for Ray Hunter is the IMSI request contained within the "attach request" that occurs when a phone initially connects to a cell station. This is precisely what a Stingray, as an IMSI catcher, would elicit.

Demo / Proof of Concept

▶ Watch: Decomposed Cellular Infrastructure: EPC, ENB, OAI (6:00)

While Ron Broberg's presentation didn't feature a live, interactive demo in the traditional sense, he meticulously walked through the conceptual proof of concept for testing Ray Hunter using a simulated cellular environment. The core demonstration revolved around setting up an SRS RAN EPC with a 4G connection and observing the crucial attach request process.

Broberg illustrated how a user equipment (UE), such as the Orbit modem or a mobile phone, would attempt to connect to the simulated cell station. In this scenario, the simulated network is configured to broadcast a PLMN and band that might be faster or appear more attractive than a legitimate commercial tower nearby. The device, prioritizing speed, would then switch to the simulated tower.

The critical moment for Ray Hunter detection occurs during the initial attach request. For 4G and 5G networks, this process requires mutual authentication: both the user endpoint authenticates to the server, and, crucially, the server authenticates to the user endpoint. Broberg's simulated network, intentionally misconfigured for this demonstration (e.g., with an unconfigured user), would cause the server authentication to fail. However, the initial attach request from the UE still contains its IMSI. This IMSI request is what the Ray Hunter software is specifically designed to detect and flag. When such an event occurs, the Ray Hunter device, typically displaying a green bar for normal operation, would turn "red," indicating a suspicious cellular hijack attempt. Researchers could then connect to the Ray Hunter device to download captured PCAPs for detailed analysis, much like analyzing network traffic in Wireshark.

A tangential but significant "side divot" demonstrated the potential for network downgrade attacks. If a 4G/5G connection fails, some devices (especially older phones or IoT equipment) are configured to look for alternative networks. Broberg showed that if a simulated, fast 2G network (e.g., using YateBTS) is available, the device might "fall over" and connect to it. The critical vulnerability here is that 2G networks do not require the server to authenticate to the user endpoint. This allows an attacker to easily configure a 2G base station to accept all authentications, effectively capturing all traffic flowing through it. While this specific scenario isn't what Ray Hunter directly flags (as Ray Hunter triggers on the IMSI request during the initial attach), it illustrates the broader security implications and traffic interception capabilities of a controlled cellular testbed.

In essence, the proof of concept validated that by standing up an open-source EPC and eNB, researchers can force devices to attempt connections, generate the specific IMSI requests that Stingrays exploit, and thus reliably trigger and test the Ray Hunter detection mechanism in a safe, controlled, and legal environment.

Defensive Implications

▶ Watch: Using a 'Magic Box' for Cellular Transmission Debugging (9:00)

The insights gleaned from Ron Broberg's talk have profound defensive implications for individuals, organizations, and the broader cybersecurity community. Understanding how to build these open-source cellular testbeds empowers defenders in several key ways:

1. Empowering Individual Detection: For the average mobile user, Stingrays represent an invisible threat. The EFF Ray Hunter project, coupled with the ability to test it in a controlled environment, offers a tangible, open-source tool for individuals concerned about their privacy. While setting up a testbed is technical, it demystifies the threat and provides a pathway for advanced users to actively monitor for Stingray activity, moving beyond passive reliance on network providers. The ability to distinguish legitimate roaming IMSI requests (e.g., when traveling to a new city) from suspicious Stingray-induced ones is crucial.

1. Facilitating Research and Development of Countermeasures: The primary defensive implication is the creation of a safe and legal sandbox for security researchers. Prior to such testbeds, testing Stingray detection tools was either hypothetical or required dangerous, illegal experimentation. Now, researchers can:

• Validate Ray Hunter's Effectiveness: Test its detection logic against various simulated Stingray behaviors and cellular network conditions.
• Develop New Detection Techniques: Explore novel methods for identifying IMSI catchers, perhaps by analyzing subtle timing differences, signal characteristics, or protocol anomalies that a simulated network can precisely control.
• Analyze Cellular Protocol Vulnerabilities: Gain a deeper understanding of how mobile devices select cell towers (e.g., prioritizing speed over signal strength, as mentioned) and how these mechanisms can be exploited.

1. Securing IoT and Legacy Devices Against Downgrade Attacks: The discussion of 2G fallback vulnerabilities is a critical defensive concern, especially for Internet of Things (IoT) devices and older mobile phones. Many medical devices and drones, as Broberg notes, still rely on 2G networks. Since 2G does not require mutual authentication (server-to-user), it becomes a prime target for downgrade attacks. Defenders responsible for securing IoT deployments must:

• Audit Device Capabilities: Identify which devices are capable of falling back to 2G and assess the necessity of this capability.
• Implement Network Segmentation/Hardening: Isolate critical IoT devices on networks that strictly enforce 4G/5G or higher standards, or implement additional security layers if 2G is unavoidable.
• Educate and Patch: Ensure devices are running the latest firmware and that users are aware of the risks associated with older cellular technologies.

1. Informing Network Operator Practices: While Stingrays are often used by law enforcement, the technical insights from this talk can also inform legitimate network operators. Understanding how devices prioritize connections (e.g., "faster" connections, even if weaker or simulated) and fallback mechanisms can help operators design more resilient and secure networks, potentially by:

• Improving Handover Security: Strengthening the security of cell tower handovers and attachment procedures to better detect and prevent malicious interventions.
• Enhancing Anomaly Detection: Implementing robust systems to detect unusual IMSI requests or connection patterns that might indicate a Stingray.

1. Legal and Ethical Considerations: A crucial defensive implication is the reinforcement of legal boundaries. Broberg explicitly warns against broadcasting on commercial bands. This underscores the need for researchers to conduct all testing within shielded environments or on legally allocated experimental frequencies to avoid interfering with legitimate services and incurring legal penalties. The testbed provides a method to achieve this ethical and legal compliance while still performing valuable research.

In summary, the ability to construct open-source cellular testbeds transforms the defensive landscape against Stingrays from a reactive, speculative effort into a proactive, evidence-based discipline, empowering a wide range of stakeholders to build and validate more robust security measures.

Key Takeaways

• Stingrays are a pervasive and often undetectable surveillance threat, mimicking legitimate cell towers to intercept mobile device data, including IMSI.
• The EFF Ray Hunter project offers an open-source solution to detect these Stingray hijacks by identifying suspicious IMSI requests during the initial cellular attach process.
• Open-source cellular testbeds are feasible to build, enabling researchers to safely and legally simulate Stingray behavior and test detection tools using projects like SRS RAN, OpenAirInterface, and YateBTS.
• Hardware selection is critical, with SDRs like USRP (B210) and BladeRF (X9 minimum for 4G/5G) being key components, along with specific antennas and diagnostic tools like Ublox chip-based modems.
• 2G fallback presents a significant security vulnerability, especially for IoT devices and older phones, as 2G networks do not require mutual authentication, making them susceptible to traffic interception via downgrade attacks.
• Adherence to legal and ethical guidelines is paramount, ensuring all testing is conducted in controlled environments and avoiding any broadcasting on commercial cellular frequencies.

About the Speaker(s)

Ron Broberg is a seasoned professional with a unique background spanning decades in the defense industry and the burgeoning field of cybersecurity. He spent a significant portion of his career at Lockheed Martin, where he gained extensive experience in radio frequency (RF) engineering. Broberg candidly admits to experiencing a "culture clash" over time at Lockheed, which ultimately led him to seek new challenges.

Approximately four years prior to this talk, Ron transitioned to Darkworth Solutions, a move he thoroughly enjoys. This transition was partly inspired by his involvement in the RF Capture The Flag (CTF) events, where he witnessed the "intersection between RF and cyber." This realization, which he noted "scared the hell out of every RF engineer I talked to at Lockhee," empowered him to delve deeper into this combined domain. In his current role, Ron Broberg primarily works with drones, applying his expertise in RF and cyber to this dynamic field. His passion for exploring the security implications of RF technologies is evident in his work on projects like the Ray Hunter testbed.