summaryrefslogtreecommitdiffstats
path: root/Tex
diff options
context:
space:
mode:
authorTom2012-06-01 18:06:16 +0200
committerTom2012-06-01 18:06:16 +0200
commitd295a0cbff87fa0b87e37cf2dce9edb3c51222b7 (patch)
tree31bdac2a79597b3594ae3ade387086fd176df6ad /Tex
parentnew pictures (diff)
downloadimsi-catcher-detection-d295a0cbff87fa0b87e37cf2dce9edb3c51222b7.tar.gz
imsi-catcher-detection-d295a0cbff87fa0b87e37cf2dce9edb3c51222b7.tar.xz
imsi-catcher-detection-d295a0cbff87fa0b87e37cf2dce9edb3c51222b7.zip
finished suggestions on chapter 4
Diffstat (limited to 'Tex')
-rw-r--r--Tex/Content/Appendix.tex71
-rw-r--r--Tex/Content/Conclusion.tex38
-rw-r--r--Tex/Content/Detection.tex5
-rw-r--r--Tex/Content/Evaluation.tex162
-rw-r--r--Tex/Content/GSM_short.tex21
-rw-r--r--Tex/Content/Motivation.tex21
-rw-r--r--Tex/Master/Master.acn103
-rw-r--r--Tex/Master/Master.aux107
-rw-r--r--Tex/Master/Master.ist2
-rw-r--r--Tex/Master/Master.lof28
-rw-r--r--Tex/Master/Master.log214
-rw-r--r--Tex/Master/Master.lot9
-rw-r--r--Tex/Master/Master.pdfbin17995314 -> 18950381 bytes
-rw-r--r--Tex/Master/Master.synctex.gzbin740261 -> 733547 bytes
-rw-r--r--Tex/Master/Master.toc20
15 files changed, 342 insertions, 459 deletions
diff --git a/Tex/Content/Appendix.tex b/Tex/Content/Appendix.tex
index 00bd29c..5faf8de 100644
--- a/Tex/Content/Appendix.tex
+++ b/Tex/Content/Appendix.tex
@@ -124,14 +124,16 @@ For example, to conduct a scan on the PCH of ARFCN 127 one would call:
sudo ./pch_scan -a 127
\end{verbatim}
\newpage
+
\section{Serial Cable Schematics}
\label{sec:osmo_serial_schematics}
A T191 unlock cable used to connect the Motorola C123 can either be obtained by ordering it from one of the mentioned stores or by building it from scratch.
These are the schematics required for building the unlock cable taken from a GSM Blog \footnote{GSM Box Schematics, \url{http://gsmringtonefree.blogspot.de/} [Online; Accessed 05.2012]}, which features images of many more cables for different brands.
\vfill
-\begin{center}
+\begin{figure}[h!]
\includegraphics[width=.9\textwidth]{../Images/t191cable}
-\end{center}
+\caption{Serial cable schematics.}
+\end{figure}
\vfill
\chapter{IMSI Catcher Detection System}
This section will cover some code related topics of the ICDS.
@@ -324,7 +326,7 @@ Database_path = '''/home/tom/imsi-catcher-detection/Src
\chapter{System Information}
\label{sec:system_infos}
-The following pages contain parsed System Information Messages of type 1-4 for reference.
+The following pages contain parsed System Information Messages of type 1--4 for reference.
\begin{figure}
\centering
\includegraphics[width=.9\textwidth]{../Images/sysinfo1}
@@ -347,67 +349,26 @@ The following pages contain parsed System Information Messages of type 1-4 for
\end{figure}
\chapter{Evaluation Data}
\section{Rx and LAC Change Test}
-\label{sec_lac_change_test}
+\label{sec:lac_change_test}
The following table contains the four configuration that have been used to replace real base stations with the IMSI catcher.
-\begin{center}
+\begin{table}[h!]
+\centering
\begin{tabular}{lllll}
\toprule
&T-Mobile &O2 &E-Plus &Vodafone\\
\midrule
-ARFCN &50 &2 &978 &695 \\
+ARFCN &877 &877 &877 &877 \\
ShortName &T-Mobile &Vodafone &E-Plus &O2 \\
-MCC &262 &262 &262 &505 \\
+MCC &262 &262 &262 &262 \\
MNC &01 &02 &03 &07 \\
-LAC &21010 &793 &588 &50945 \\
-Cell ID &1 &2 &3 &4 \\
-Neighbours &- &1,2,3 &695, 20 &10, 20, 30\\
+LAC &666 &4711 &666 &4711 \\
+Cell ID &1 &1 &1 &1 \\
+Neighbours &--- &--- &--- &--- \\
\bottomrule
\end{tabular}
-\end{center}
+\caption{Configurations used for the rx\,/\,LAC Change Rules test.}
+\end{table}
\section{Long Term Test}
\label{sec:long_term_test}
The folliwing tables contain the configurations that have been used throughout the long term test period.
-The configurations have been used in the order they appear in the tables.
-\begin{center}
-\begin{tabular}{lllll}
-\toprule
- &Conf. 1 &Conf. 2 &Conf. 3 &Conf. 4\\
-\midrule
-ARFCN &50 &2 &978 &695 \\
-ShortName &T-Mobile &Vodafone &E-Plus &O2 \\
-MCC &262 &262 &262 &505 \\
-MNC &01 &02 &03 &07 \\
-LAC &21010 &793 &588 &50945 \\
-Cell ID &1 &2 &3 &4 \\
-Neighbours &- &1,2,3 &695, 20 &10, 20, 30\\
-\bottomrule
-\end{tabular}\\
-\vspace{1cm}
-\begin{tabular}{lllll}
-\toprule
- &Conf. 5 &Conf. 6 &Conf. 7 &Conf. 8\\
-\midrule
-ARFCN &50 &2 &978 &695 \\
-ShortName &T-Mobile &Vodafone &E-Plus &O2 \\
-MCC &262 &262 &262 &505 \\
-MNC &01 &02 &03 &07 \\
-LAC &21010 &793 &588 &50945 \\
-Cell ID &1 &2 &3 &4 \\
-Neighbours &- &1,2,3 &695, 20 &10, 20, 30\\
-\bottomrule
-\end{tabular}\\
-\vspace{1cm}
-\begin{tabular}{lllll}
-\toprule
- &Conf. 9 &Conf. 10 &Conf. 11 &Conf. 12\\
-\midrule
-ARFCN &50 &2 &978 &695 \\
-ShortName &T-Mobile &Vodafone &E-Plus &O2 \\
-MCC &262 &262 &262 &505 \\
-MNC &01 &02 &03 &07 \\
-LAC &21010 &793 &588 &50945 \\
-Cell ID &1 &2 &3 &4 \\
-Neighbours &- &1,2,3 &695, 20 &10, 20, 30\\
-\bottomrule
-\end{tabular}
-\end{center} \ No newline at end of file
+The configurations have been used in the order they appear in the tables. \ No newline at end of file
diff --git a/Tex/Content/Conclusion.tex b/Tex/Content/Conclusion.tex
index 2fc47c6..5effc8b 100644
--- a/Tex/Content/Conclusion.tex
+++ b/Tex/Content/Conclusion.tex
@@ -1,10 +1,11 @@
\chapter{Conclusion}
This chapter will give a short summary of the whole project and its findings.
-The second section will then bring up some aspects where the \gls{icds} could be improved to yield results either faster or more accurate.
+The first section starts by reviewing what has been done while the second section will then bring up some aspects where the \gls{icds} could be improved to yield results either faster or more accurate.
\section{Summary}
-The aim of this project was to find ways of unveiling whether an IMSI catcher is being operated in the close perimeter or not; in other words to find out whether it is safe to initiate a phone call or not.
-The main premise that distinguishes this project from other similar projects like the also OsmocomBB based 'catcher catcher' is that the system developed is operating in a completely passive manner.
+The aim of this project was to find ways of unveiling whether an IMSI catcher is being operated in the close perimeter or not.
+In other words to find out whether it is safe to initiate a phone call or not.
+The main premise that distinguishes this project from other similar projects like the also OsmocomBB based 'catcher catcher' is that the system is operating in a completely passive manner.
Therefore it can only operate on a limited amount of information, namely on information that is broadcasted on publicly available channels.
The benefit this yields over other projects is that the IMSI Catcher Detection System itself is completely invisible to the IMSI catcher.
@@ -12,42 +13,45 @@ Chapter 2 laid out basic concepts of \gls{gsm} communication to create a basis f
Some more detailed concepts on the $U_m$ interface were discussed to enable the reader to grasp the concept of logical channels and how they can later be used to harvest information in a passive manner.
The chapter concluded with an account of how an IMSI catcher operates by outlining the two main ways of attacking a subscriber --- one by creating a new cell for the subscriber to connect to and the other by overtaking an already existent cell.
-Chapter 3 started by explaining how the OsmocomBB framework was used to build the \gls{icds} as well as how to configure and use the system.
+Chapter 3 started by explaining how the OsmocomBB framework was used to build the \gls{icds}.
+It concluded with a summary of how to configure and use the system.
The two main sources of information, the \gls{bcch} and the \gls{pch} were introduced along with the different parameters that the \gls{icds} bases its findings on.
An outline of how this finding is reached is illustrated in Figure \ref{fig:decision_process}.
At first a sweep scan is conducted or an old project is loaded to supply the \gls{icds} with base information of the surrounding base stations.
-During the scan or after the data has been loaded the \gls{icds} evaluates different rules on the data either with or without consulting databases with local information depending on configuration and whether it is available or not.
+During the scan or after the data has been loaded the \gls{icds} evaluates different Rules on the data.
+This can be done with or without consulting databases containing local information.
\begin{figure}
\centering
\includegraphics{../Images/flowchart}
\caption{ICDS decision finding process outlined.}
\label{fig:decision_process}
\end{figure}
-The results show that some IMSI catcher configurations can be uncovered by these rules which check basic configuration data obtained from System Information messages.
+The results show that some IMSI catcher configurations can be uncovered by these Rules which check basic configuration data obtained from System Information messages.
In addition to this data broadcasted on the \gls{bcch} reception levels and \glspl{lac} are also monitored over time to unveil attacks in which existing base stations are replaced by IMSI catchers.
-This leaves IMSI catchers that have a consistent configuration and blend well in their surroundings concerning the reception levels as well as do not actively try to make mobile phones contact them by broadcasting a new \gls{lac}.
-To handle this case the \gls{icds} can monitor the \gls{pch} of the base station in question to gather Paging Messages and Immediate Assignments.
-Since an IMSI catcher is not part of the providers network no paging messages will be forwarded to the connected subscribers.
+This leaves IMSI catchers that have a consistent configuration and blend well in their surroundings concerning the reception levels.
+Additionally these catchers do not actively try to make mobile phones contact them by broadcasting a new \gls{lac}.
+To handle this case the \gls{icds} can monitor the \gls{pch} of the base station in question to gather Paging Messages and \glspl{ia}.
+Since an IMSI catcher is not part of the provider's network no paging messages will be forwarded to the connected subscribers.
These findings have been confirmed with the experiments in Chapter 4 where different attack scenarios have been tested.
-In cases where the \gls{icds} was not able to uncover the IMSI catcher by rule evaluation the \gls{pch} scan yielded the desired result.
+In cases where the \gls{icds} was not able to uncover the IMSI catcher by Rule evaluation the \gls{pch} scan yielded the desired result.
\section{Future Work}
There are several ways in which the \gls{icds} could be improved.
The experiments showed that one of the main issues is the duration of the sweep scans.
-If a \gls{bts} is replaced right after it has been scanned it can take up to six minutes until it is scanned again and the IMSI catcher is uncovered.
+If a \gls{bts} is replaced right after it has been scanned it can take up to seven minutes until it is scanned again and the IMSI catcher is uncovered.
That is the time that is needed to do a complete sweep scan.
-The \gls{icds} could be refined so that only base stations of a particular provider are monitored so the duration of sweep scans is cut down, this could also be done upon entering User Mode.
+The \gls{icds} could be refined so that only base stations of a particular provider are monitored so the duration of sweep scans is cut down, this could also be done upon entering \emph{User Mode}.
In case of the Open Source IMSI Catcher no Paging Messages were sent.
However it would be possible for a catcher that is aware of this evaluation criterion to send fake Paging Messages to arbitrary \glspl{tmsi} to deceive the \gls{icds}.
To face this the \gls{icds} could be extended.
-Since Paging Messages would be unreliable in such a case one would have to use Immediate Assignments.
+Since Paging Messages would be unreliable in such a case one would have to use \glspl{ia}.
The experiments have shown that this might increase scanning time on the \gls{pch} since these messages are much more rare than pagings.
-An Immediate Assignment sent to a subscriber contains the dedicated channel on which the conversation between the base station and the mobile phone is to continue.
-At this point the \gls{icds} already uses the information about dedicated channel to see whether frequency hopping is used or not.
-If an Immediate Assignment is caught by the \gls{icds} one could follow on the assigned channel and catch the Cipher Mode Message.
+An \gls{ia} sent to a subscriber contains the dedicated channel on which the conversation between the base station and the mobile phone is to continue.
+At this point the \gls{icds} already uses the information about dedicated channels to see whether frequency hopping is used or not.
+If an \gls{ia} is caught by the \gls{icds} one could follow on the assigned channel and catch the Cipher Mode Message.
Since an IMSI catcher will disable encryption to tap into calls, the Cipher Mode Message would contain A5/0 as its encryption algorithm.
-This feature could be used to handle cases of fake Paging Messages or Immediate Assignments, however it would take longer to conduct the \gls{pch} scan.
+This feature could be used to handle cases of fake Paging Messages or \glspl{ia}, however it would take longer to conduct the \gls{pch} scan.
Another problem would be that it requires another subscriber that is connected to the IMSI catcher initiating a call.
On the other hand a regular base station using encryption can also be verified this way.
diff --git a/Tex/Content/Detection.tex b/Tex/Content/Detection.tex
index b6d4073..7367322 100644
--- a/Tex/Content/Detection.tex
+++ b/Tex/Content/Detection.tex
@@ -320,11 +320,12 @@ For the Freiburg area a 1\% threshold for the deviation yielded good results.
\paragraph{Neighbourhood Structure}
The neighbourhood structure is the graph that is described by the Neighbouring Cell List located in the System Inforamtion 2\,/\,2bis\,/\,2ter constructs.
-Figure \ref{fig:neighbourhood_example} shows an example of the neighbourhood graphs at the Faculty of Engineering of the University of Freiburg\footnote{Georges Koehler Allee, Freiburg}.
+Figure \ref{fig:neighbourhood_example} shows an extract of the neighbourhood graphs at the Faculty of Engineering of the University of Freiburg\footnote{Georges Koehler Allee, Freiburg}.
+The E-Plus subgraph has been enlarged.
\begin{figure}
\centering
\includegraphics[width=.9\textwidth]{../Images/neighbourhoods_fak}
-\caption{Base stations and their neighbourhood connections at the Faculty of Engineering.}
+\caption{Some base stations and their neighbourhood connections at the Faculty of Engineering.}
\label{fig:neighbourhood_example}
\end{figure}
It can be seen that for each provider, the neighbourhood forms an isolated, nearly fully connected subgraph.
diff --git a/Tex/Content/Evaluation.tex b/Tex/Content/Evaluation.tex
index 6651fda..ffaa953 100644
--- a/Tex/Content/Evaluation.tex
+++ b/Tex/Content/Evaluation.tex
@@ -1,16 +1,16 @@
\chapter{Evaluation}
-The following chapter presents the results of some experiments done with the \gls{icds}.
+The following chapter presents the results of the experiments done with the \gls{icds}.
Evaluation has been done in different areas to give a complete impression of how the \gls{icds} performs.
In the first section some general findings will be described that affect overall performance.
Afterwards the test environment and setup of the IMSI catcher is discussed.
-The last two sections evaluate the \gls{icds} against a configured catcher, first to test the individual rules and second against the attacks that were listed earlier.
+The last two sections evaluate the \gls{icds} against a configured catcher.
+At first the individual Rules are tested, then the two attacks described in the theory section were conducted.
\section{Performance Evaluation}
In order to evaluate general performance it has to be considered that the \gls{icds} can be deployed in different environments.
-To reflect different compositions and densities of base stations form different areas, four distinct data sets will be used for the experiments in this section.
+To reflect different compositions and densities of base stations from different areas, four distinct data sets will be used for the experiments in this section.
The data sets have been taken in areas surrounding the city of Freiburg.
-Table shows some of data sets' key values.
-
+Table \ref{tab:key_data} shows some of the data sets' key values.
\begin{table}
\centering
\begin{tabular}{llrr}
@@ -31,10 +31,11 @@ Name &Description &Number of BTS &Scan Duration\\
\label{tab:key_data}
\end{table}
-Apart from nodes from the four public \gls{gsm} providers E-Plus, T-Mobile, Vodafone and O2, nodes from Deutsche Bahn also occur in these scans.
-These nodes form a private network used for internal communications by Deutsche Bahn.
-They are identified by their broadcast name 'DB Systel GSM-R' and their frequency which is outside the regular bands.
-Since the distribution of these nodes is very sparse, only one node can be found in each scan they yield a false positive for no neighbouring nodes can be discovered.
+Apart from nodes of the four German \gls{gsm} providers E-Plus, T-Mobile, Vodafone and O2, nodes from the Deutsche Bahn also occur in these scans.
+These nodes form a private network used for internal communications by the Deutsche Bahn.
+They are identified by their broadcast name \emph{DB Systel GSM-R} and their frequency which is a in a range registered to the Deutsche Bahn.
+Since the distribution of these nodes is very sparse, only one node can be found in each scan.
+They yield a false positive for no neighbouring nodes can be discovered.
These nodes are not relevant to subscribers because they are not able to connect to them.
Therefore they will be ignored and factored out for the remainder of this evaluation.
@@ -60,27 +61,27 @@ Therefore they will be ignored and factored out for the remainder of this evalua
\caption{Scan durations for the sample data sets.}
\label{fig:durations}
\end{figure}
-Table \ref{tab:key_data} shows that the times for scans in the Freiburg area can differ by large amounts depending on how many base stations are scanned.
-Generally said it takes longer the more dense the base station distribution is in the scanned area.
+Table \ref{tab:key_data} shows that the time needed for a sweep scan in the Freiburg area can differ by large amounts depending on how many base stations have been scanned.
+Generally said it takes longer the more dense the base station distribution is in the area.
This is however not the only factor, as Figure \ref{fig:durations} visualises.
-If the scan duration would only depend on the number of base station scanned, a linear growth could be expected.
+If the scan duration would only depend on the number of base stations scanned, a linear growth could be expected.
There is a large increase in scan duration between the \texttt{ind\_park} and the \texttt{cbd} data sets although only one more base station was detected.
This jump can be explained considering the context of the scan.
The scans were done on a Saturday between 14:00 and 16:00.
The Freiburg CBD was crowded at the time of the scan as was the university campus due to an event held there.
-Contrary to that the industrial park area was very calm, as was the housing area.
-Whenever the \gls{icds} discovers a \gls{bts} it needs to wait until all system information messages are gathered before it can continue scanning for further base stations.
+In contrast the industrial park area was very calm, as was the housing area.
+Whenever the \gls{icds} discovers a \gls{bts} it needs to wait until all System Information messages are gathered before it can continue scanning for further base stations.
In a crowded area reception is far worse due to radio inference therefore it takes longer to accumulate the information needed resulting in increased scanning times.
A crowded area with high density of \glspl{bts} could be seen as a worst case for scan duration.
-Re-evaluation of a base station based on its own parameters thus occurs only every 7 minutes in this worst case.
-This is an inherent problem to the approach of scanning and updating all base stations and not only monitoring a subset from a single provider.
+Re-evaluation of a base station based on its own parameters thus occurs only every 7 minutes in this worst case scenario.
+This is an inherent problem to the approach of scanning and updating all base stations and not only monitoring a subset belonging to a single provider.
If an IMSI catcher replaces a base station directly after it was scanned, it could take up to 7 minutes until it is discovered.
-To lessen this threat, if the \gls{icds} is used in user mode, the base station with the strongest reception is scanned again, to eliminate the possibility of having been taken over and not being detected.
+To lessen this threat, if the \gls{icds} is used in User Mode, the base station with the strongest reception is scanned again, to eliminate the possibility of having been taken over and not being detected.
\subsection{Cell ID Databases}
-The usefulness of the Cell ID Rule is subject to the completeness of the database that is used.
+The usefulness of the \emph{Cell ID Rule} is subject to the completeness of the database that is used.
That is even more so since a database with a low coverage will yield false positives, \eg legitimate base stations will be evaluated as being IMSI catchers because they are not found in the database.
The coverage for the OpenCellID database and the Google Mobile Maps service evaluated against the data sets can be seen in Table \ref{tab:coverage}.
@@ -103,14 +104,14 @@ Google Mobile Maps service scored a complete coverage on all the data sets while
The reason the Google service had only a 99\% coverage on the \texttt{airport} data set is that base station that has not been found was the one operated by the chair of communication systems, therefore it can be factored out.
The OpenCellID database is not a good source of information for this project as is shown by its coverage scores.
However it must be said that these two services are intended for localisation and thus do not have the demand to yield a complete coverage of all the base stations in the area.
-Therefore it must be kept in mind when using this rule for analysis that false positives might still be brought forth.
+Therefore it must be kept in mind when using this Rule for analysis that false positives might still be brought forth.
What can be said though is that a base station that has been found may only be subject to a type of attack that replaces an existing base station and can thus be investigated more specifically.
\subsection{PCH Scans}
In order to establish a baseline on what to expect from the \gls{pch} scans different measurements have been done.
Table \ref{tab:pagings} shows scans that have been done in three different areas.
In each area the cell with the strongest reception for each provider was chosen as a representative for the respective provider.
-The duration of each scan was set to 60\;s, while the values in the table have been averaged for 10\;s since this is the unit the \gls{icds} is using.
+The duration of each scan was set to 60\,s, while the values in the table have been averaged for 10\,s since this is the unit the \gls{icds} is using.
A comparison of the results suggests that the different providers also have different policies when to page.
Vodafone has about six times the paging rate O$_{2}$ has but only half the Immediate Assignments.
@@ -140,12 +141,12 @@ O2& 117&9& &106&16& &94&11\\
\section{IMSI Catcher Detection}
Before using an IMSI catcher for testing purpose or a launching an OpenBTS base station it should be ensured that licenses for the specific frequencies that are used, have been obtained.
This way it can be ensured that the operation does not interfere with regular radio communication.
-Extra care should be taken when configuring the IMSI catcher to simulate a real base station to reject incoming connections when the experiments are done within a radio sealed room.
+Extra care should be taken when configuring the IMSI catcher to simulate a real base station to reject incoming connections when the experiments are not done within a radio sealed room.
Otherwise subscribers might get caught by the catcher and might not be able to initiate calls.
How this can be done for the Open Source IMSI Catcher that is used to test the \gls{icds} is explained in the next section.
\subsection{Open Source IMSI Catcher}
-The rules themselves cannot be tested without an active IMSI catcher.
+Some of the Rules cannot be tested without an active IMSI catcher.
For this purpose the Open Source IMSI Catcher \cite{dennis} is used.
This project builds up an IMSI catcher using only Open Source systems and freely available hardware so it can basically be used by anybody.
@@ -163,9 +164,9 @@ On the software side GNU Radio\footnote{GNU Radio Project Wiki, \url{http://gnur
\label{fig:setup}
\end{figure}
The raw data that is received by the \gls{usrp} is sent to the GNU Radio component which works as a software side interface to the \gls{usrp}.
-This data is taken by the OpenBTS software that emulates base station behaviour and has an integrated module simulating a \gls{vlr} and handing out \glspl{tmsi}.
+This data is taken by the OpenBTS software that simulates base station behaviour and has an integrated module simulating a \gls{vlr} and handing out \glspl{tmsi}.
OpenBTS implements an open source version of the \gls{gsm} stack with the goal to provide cheap access points to the \gls{gsm} network in areas with bad coverage.
-The user accounts are as well as encoding of voice data and recording of calls is handled inside the Asterisk software, basically combining the \gls{trau}, \gls{hlr} and authentication centre of a real \gls{gsm} network.
+The user accounts as well as encoding of voice data and recording of calls is handled inside the Asterisk software, basically combining the \gls{trau}, \gls{hlr} and authentication centre of a real \gls{gsm} network.
Calls are routed from here on to the \gls{voip} network of the university.
Since we do not want to actually connect to the IMSI catcher, the Asterisk part and user configuration will be omitted here.
@@ -201,23 +202,16 @@ GSM.T3212 1
More precisely this will only let users connect that have been set up in the \texttt{sip.conf} of the Asterisk server.
Only the test phone does have a valid account.
-\begin{figure}
-\centering
-\subfigure[Connected cell information.]{}
-\subfigure[Neighbouring cell measurements.]{}
-\caption{Nokia 3310 NetMonitor screenshots.}
-\label{fig:netmonitor}
-\end{figure}
+\subsubsection{Modifications to the ICDS Configuration}
+A few small modifications have to be made to the configuration of the \gls{icds} to not instantly evaluate the university base station and the IMSI catcher as \emph{Critical}.
+The configuration of the \emph{ARFCN\,/\,Provider Mapping Rule} has been changed to include the \gls{arfcn} 877 as valid \gls{arfcn} for each provider since the is the frequency that we are allowed to send on.
+In one experiment this rule was tested by faking a T-Mobile station on \gls{arfcn} 50.
+This experiment was done in a radio sealed room.
+
-\subsubsection{Nokia 3310}
-To get feedback on whether the IMSI catcher is working as intended or see if an attack succeeded a Nokia 3310 phone can be used.
-Nikia has a software called NetMonitor\footnote{Nokia Net Monitor Manual, \url{www.nobbi.com/download/nmmanual.pdf} [Online; Accessed 05.2012]} that can be used to measure base stations in the perimeter and gives feedback when the \gls{ms} is going to switch to a new cell.
-This NetMonitor consists of several pages, of which the first shows the active cell that the phone is connected to.
-On the following pages neighbouring cell measurements can be seen ordered by a score that is used by the phone to determine when and if to change the cell.
-Figure \ref{fig:netmonitor} shows the home screen with information on the connected cell (a) as well as the first page of the neighbouring cell measurements (b).
\subsection{Rule Evaluation}
-With the environment set up we will now evaluate the individual rules.
+With the environment set up we will now evaluate the individual Rules.
The IMSI catcher was launched with the four different configurations shown in Table \ref{tab:err_configs}.
\begin{table}
\centering
@@ -225,13 +219,13 @@ The IMSI catcher was launched with the four different configurations shown in Ta
\toprule
&Conf. 1 &Conf. 2 &Conf. 3 &Conf. 4\\
\midrule
-ARFCN &50 &2 &978 &695 \\
+ARFCN &50 &877 &877 &877 \\
ShortName &T-Mobile &Vodafone &E-Plus &O2 \\
MCC &262 &262 &262 &505 \\
MNC &01 &02 &03 &07 \\
LAC &21010 &793 &588 &50945 \\
Cell ID &1 &2 &3 &4 \\
-Neighbours &- &10,11,12 &695, 20 &1022, 1001 \\
+Neighbours &--- &10,11,12 &695, 20 &1022, 1001 \\
\bottomrule
\end{tabular}
\caption{Erroneous configurations for the IMSI catcher.}
@@ -243,8 +237,8 @@ With each of these configurations the \gls{icds} detected the catcher for variou
Apart from that the \gls{lac} differed from the ones found in the Freiburg area and thus different from the neighbouring \glspl{lac}.
The neighbouring cell list was also empty which is a strong indication for an IMSI catcher.
An interesting fact to be noted here is, when an empty neighbourhood list is given to OpenBTS it still transmits a neighbourhood list containing the element '0'.
- The Neighbourhood Structure Rule triggered nevertheless since no other T-Mobile station in the area had \gls{arfcn} 0 as a neighbour, nor was it discovered during the scan.\\
- Rules triggered: LAC/Provider Mapping, Neighbourhood Structure, ARFCN/Provider Mapping, LAC Median Deviation
+ \emph{The Neighbourhood Structure Rule} triggered nevertheless since no other T-Mobile station in the area had \gls{arfcn} 0 as a neighbour, nor was it discovered during the scan.\\
+ Rules triggered: LAC\,/\,Provider Mapping, Neighbourhood Structure, ARFCN\,/\,Provider Mapping, LAC Median Deviation
\item Config 2: The detected errors within this configuration are that none of the neighbours mentioned was in range to be detected, which is very unlikely for a normal base station.\\
Rules triggered: Neighbourhood Structure
\item Config 3: In this configuration one of the neighbours, namely 695 is not consistent with the set provider.
@@ -252,41 +246,41 @@ With each of these configurations the \gls{icds} detected the catcher for variou
Rules triggered: Pure Neighbourhoods
\item Config 4: The chosen provider is not consistent with the country set.
Additionally another warning is thrown since the neighbourhood list only contained nodes that were only found indirectly.\\
- Rules triggered: Country/Provider Mapping, Neighbourhood Structure (warning)
+ Rules triggered: Country\,/\,Provider Mapping, Neighbourhood Structure (warning)
\end{itemize}
-The \emph{LAC Change} and the \emph{rx Change} rules remain to be tested.
+The \emph{LAC Change Rule} and the \emph{rx Change Rule} remain to be tested.
For this purpose the procedure was as follows.
At first the \gls{icds} was turned on an scanning commenced.
Afterwards the IMSI catcher was turned on, operating on the same frequency as a base station that was previously discovered.
-This was repeated several times with the IMSI catcher replacing another node each time.
+This was repeated several times with different configurations of the IMSI catcher.
Table \ref{tab:par_change} summarises the findings.
-The configurations used can be found in Appendix \ref{sec:config_data}.
-In all cases the \gls{icds} was able to detect the IMSI catcher after about 2 minutes.
+The configurations used can be found in Appendix \ref{sec:lac_change_test}.
+In all cases the \gls{icds} was able to detect the IMSI catcher after about 6 minutes which corresponds to the time that is needed to conduct a complete sweep scan.
These times can vary however depending on the timing of the catcher being turned on and the time it takes for rescanning a base stations as described in the beginning of this chapter.
\begin{table}
\centering
-\begin{tabular}{lrrcrrrllr}
+\begin{tabular}{lrcrrrllr}
\toprule
- & &\multicolumn{2}{c}{rx} &\phantom{a} &\multicolumn{2}{c}{LAC} & & & \\
- \cmidrule{3-4} \cmidrule{6-7}
-Config &Cell &Old &New & &Old &New &rx det. &LAC det. &Time\\
+ &\multicolumn{2}{c}{rx} &\phantom{a} &\multicolumn{2}{c}{LAC} & & & \\
+ \cmidrule{2-3} \cmidrule{5-6}
+Config &Old &New & &Old &New &rx det. &LAC det. &Time\\
\midrule
-T-Mobile &17 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
-O2 &877 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
-E-Plus &877 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
-Vodafone &877 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
+T-Mobile &-92 dB &-45dB & &4711 &666 &Yes &Yes &6:31\,m\\
+O2 &-91 dB &-46dB & &4711 &4711 &Yes &No &6:22\,m\\
+E-Plus &-89 dB &-41dB & &4711 &666 &Yes &Yes &5:59\,m\\
+Vodafone &-93 dB &-41dB & &4711 &4711 &Yes &No &6:35\,m\\
\bottomrule
\end{tabular}
-\caption{failzor}
+\caption{Results obtained testing the \emph{rx} and \emph{LAC Change rules}.}
\label{tab:par_change}
\end{table}
-\subsection{Long Term Test}
-To evaluate the \emph{Location Area Database} rule a long term test has been carried out.
+\subsection{Long-Term Test}
+To evaluate the \emph{Local Area Database Rule} a long-term test has been carried out.
This has been done to find out whether base stations in the surrounding area change on a regular basis or stay the same (including their respective configurations and reception levels).
This is essential for a Location Area Database to be usable over a longer period of time.
-The database itself has been built over the course of one week in Freiburg, Thuner Weg.
+The database itself has been built over the course of one week in Freiburg, Georges Koehler Allee.
During this period no parameter changes were detected and the reception of base stations only varied inside a very small interval.
After that each day for another week, two scans per day were done.
One of them while the IMSI catcher was operating, the other without the device present.
@@ -316,12 +310,12 @@ Date &Time &Catcher &Detected &Detected by &False positives &False negatives\\
& & & & & & \\
\bottomrule
\end{tabular}
-\caption{Results of the long term evaluation.}
+\caption{Results of the long-term evaluation.}
\label{tab:longterm_test}
\end{table}
\subsection{Attack Scenarios}
-Since all the configuration rules have been tested we assume from this point on that the IMSI catcher is configured correctly, meaning that parameters like the \gls{arfcn}, \gls{lac} or provider have been set up in correct and consistent way so the respective rules will not show an alarm.
+Since all the Rules have been tested we assume from this point on that the IMSI catcher is configured correctly, meaning that parameters like the \gls{arfcn}, \gls{lac} or provider have been set up in correct and consistent way so the respective Rules will not show an alarm.
Consistent parameters for the four providers in Germany can be found in Table \ref{tab:consistent_parameters}.
\begin{table}
\centering
@@ -339,29 +333,37 @@ MNC &01 &02 &03 &07\\
\caption{Consistent parameter configurations in the Freiburg area for the four German providers.}
\label{tab:consistent_parameters}
\end{table}
-Note that the Cell ID can be a arbitrary value as long as it is unique in the area of reception.
-Cell IDs measured from different base stations do not follow any particular schema.
+Note that the \gls{cid} can be a arbitrary value as long as it is unique in the area of reception.
+\glspl{cid} measured from different base stations do not follow any particular schema.
The scenarios are built after the attacks described in Section \ref{sec:attacks}.
Local information in terms of a Local Area Database was available.
\subsubsection{IMSI Catcher as a new Cell}
The first scenario will simulate the case where the catcher opened up a new cell with a good reception and forced the \gls{ms} into normal cell selection mode by disconnecting it from the current base station via a jammer.
-First the IMSI catcher was turned on, faking a legitimate T-Mobile cell with a new cell ID.
+First the IMSI catcher was turned on, faking a legitimate T-Mobile cell with a new \gls{cid}.
Afterwards the \gls{icds} was started and a sweep scan was performed.
-As soon as the cell was scanned which occurred very early since the reception was very good (-45) it was detected that this cell was not in the Local Area Database.
-After the sweep scan cell IDs from Google were also fetched.
-Both the Local Area Database Rule and the Cell ID Database Rule indicated a Critical status.
+As soon as the cell was scanned which occurred very early since the reception was very good (-45\,dB) it was detected that this cell was not in the Local Area Database.
+After the sweep scan \glspl{cid} from Google were also fetched.
+Both the \emph{Local Area Database Rule} and the \emph{Cell ID Database Rule} indicated a \emph{Critical} status.
-As a further step to simulate the case where no local information is available, the Local Area Database and Cell ID Rules were turned off.
-The \gls{icds} then yielded an Ok evaluation since the configuration of the catcher cell was consistent.
-The next step was to put the \gls{icds} into User Mode with T-Mobile as its fixed provider.
-It selected the IMSI catcher cell as its target cell because of the good reception level and since it's evaluation was 'Ok' an additional PCH scan was started.
-No paging messages or Immediate Assignments were caught so the end result was a 'Critical' status for the IMSI catcher cell.
+As a further step to simulate the case where no local information is available, the \emph{Local Area Database Rule} and \emph{Cell ID Rules} were turned off.
+The \gls{icds} then yielded an \emph{Ok} evaluation since the configuration of the catcher cell was consistent.
+The next step was to put the \gls{icds} into \emph{User Mode} with T-Mobile as its fixed provider.
+It selected the IMSI catcher cell as its target cell because of the good reception level and since it's evaluation was \emph{Ok} an additional PCH scan was started.
+No paging messages or \glspl{ia} were caught so the end result was a \emph{Critical} status for the IMSI catcher cell.
+
+\begin{figure}
+\centering
+\includegraphics{../Images/replace_attack}
+\caption{Takeover attack of an IMSI catcher on a base station.}
+\label{fig:takeover_attack}
+\end{figure}
\subsubsection{IMSI Catcher replacing an old Cell}
The second scenario simulated the attack where the IMSI catcher replaces a base station with a bad reception in the neighbourhood of the cell the \gls{ms} is connected to.
-This way the reception drastically improves on that particular frequency suggesting to the \gls{ms} that the subscriber moved to the close perimeter of that \gls{bts} and initiating a handover.
+This way the reception drastically improves on that particular frequency suggesting to the \gls{ms} that the subscriber moved to the close perimeter of that \gls{bts} and .
Figure \ref{fig:takeover_attack} illustrates this particular attack.
+
The station with the \gls{arfcn} 42 has the lowest reception with its signal to noise ratio of -95\,dB.
In this particular scenario the \gls{ms} would first connect to the station on 23 because of its good reception.
After that the IMSI catcher is turned on also on \gls{arfcn} 42.
@@ -369,14 +371,10 @@ Due to its location it has the best reception level of all the available base st
Since it replaced station 42 it is most likely in the neighbourhood list of 23.
When the \gls{ms} conducts a neighbouring cell measurement it will find that the catcher has the best reception and will switch to it.
Disconnection and cell re-selection of the \gls{ms} could also be achieved instantly by jamming \gls{arfcn} 23.
+For this experiment, the cell to be replaced was the universities own base station at \gls{arfcn} 877.
+
Since the catcher sends a different \gls{lac} the \gls{ms} will send a location update to the IMSI catcher announcing its presence.
-\begin{figure}
-\centering
-\includegraphics{../Images/replace_attack}
-\caption{Takeover attack of an IMSI catcher on a base station.}
-\label{fig:takeover_attack}
-\end{figure}
-Due to its strong increase in reception and the change in the \gls{lac} the IMSI catcher cell obtained a 'Critical' status immediately after it had been scanned a second time.
-Also due to this fact the reception level differed too much from the interval that had been measured for this Cell ID in the Local Area Database and received as a result also a 'Critical' rating from the respective rule.
-User Mode did not start a PCH scan since the evaluation had already been 'Critical'. \ No newline at end of file
+Due to its strong increase in reception and the change in the \gls{lac} the IMSI catcher cell obtained a \emph{Critical} status immediately after it had been scanned a second time.
+Also due to this fact the reception level differed too much from the interval that had been measured for this \gls{cid} in the \emph{Local Area Database} also yielded a \emph{Critical} rating.
+\emph{User Mode} did not start a PCH scan since the evaluation had already been \emph{Critical}. \ No newline at end of file
diff --git a/Tex/Content/GSM_short.tex b/Tex/Content/GSM_short.tex
index 1cf898b..4d73706 100644
--- a/Tex/Content/GSM_short.tex
+++ b/Tex/Content/GSM_short.tex
@@ -693,24 +693,25 @@ This protocol handles configuration and allocation of radio channels as well as
Therefore in a strict sense \gls{mm} and \gls{cc} information does not belong to Layer 3 functionality but is only transported via \gls{rr} between \gls{ms} and the \gls{nss} \cite{protocols1999}.
\section{IMSI-Catcher}
-%TODO more motivation (espacially fact that everyone is concerned)
\label{sec:catcher}
-An \gls{imsi}-Catcher is a technical device that is used to capture the \gls{imsi} and \gls{imei} numbers of mobile subscribers.
+An \gls{imsi}-Catcher is a device that is used to capture the \gls{imsi} and \gls{imei} numbers of mobile subscribers.
The knowledge of the \gls{imsi} and \gls{imei} numbers can be exploited to either tap into the participant's calls or pinpoint the location of the subscriber \cite{fox}.
Another less known functionality is that if catchers do not relay intercepted calls they can be used to suppress mobile communication in a certain area \eg during a police operation \cite{imsi_wiki}.
This topic came up in conjunction with crime fighting and prevention with the advent of mobile telephones.
-A mobile phone cannot be tapped in the same way as a landline phone since the subscriber can change places and also phones thus there is no designated line associated with him/her.
+A mobile phone cannot be tapped in the same way as a landline phone since the subscriber can change places and also phones thus there is no designated line associated with him\,/\,her.
This has proven to be a challenge to the authorities.
-In 1996 Rohde \& Schwarz a company based in Munich, Germany has developed a device called ''GA 090'' which was the first \gls{imsi}-catcher.
+In 1996 Rohde \& Schwarz a company based in Munich, Germany has developed a device called \emph{GA 090} which was the first \gls{imsi}-catcher.
Its was capable of yielding a list with all the \gls{imsi} numbers in the perimeter as well as pinpointing the location of a subscriber given the \gls{imsi}.
-Short thereafter the ''GA 900'' was presented which had the additional capability of tapping into calls that originated from a particular \gls{imsi}.
+Short thereafter the \emph{GA 900} was presented which had the additional capability of tapping into calls that originated from a particular \gls{imsi}.
These commercial versions of catchers produced by Rohde \& Schwarz were priced between 200\,000\,\euro{} and 300\,000\,\euro{} in 2001 \cite{fox}.
-Regulations prohibit the use of \gls{imsi}-catchers for individuals since the frequency bands the \gls{gsm} network uses are reserved for providers.
+Regulations prohibit the use of IMSI catchers for individuals since the frequency bands the \gls{gsm} network uses are reserved for providers.
However it cannot be guaranteed that such a catcher is not used illegally.
In addition to these commercial products different projects \cite{dennis, def_catcher} have shown that such devices can be built at a very low budget.
This only intensifies the risk that is imposed by the abusive usage of such a catcher.
+Examples would be curious neighbours eavesdropping, or a jealous husband tapping into phone calls of his wife.
+On a more large scale, these devices are of great value for industrial espionage.
Figure \ref{fig:catchers} shows a commercial model side by side with a self built catcher.
\begin{figure}
\centering
@@ -719,14 +720,15 @@ Figure \ref{fig:catchers} shows a commercial model side by side with a self buil
\label{fig:catchers}
\end{figure}
-Section \ref{sec:catcher_operation} will show how an \gls{imsi}-catcher works and how subscribers can be caught.
+Section \ref{sec:catcher_operation} will show how an \gls{imsi} catcher works and how subscribers can be caught.
In addition the potency of these attacks will be evaluated and what risks these impose from a technical perspective.
The next section will explain under which circumstances a catcher can be used in Germany from a legal perspective and show that this handling poses the risk of privacy breach to citizens.
\subsection{Mode of Operation}
\label{sec:catcher_operation}
Basically an \gls{imsi}-Catcher masks itself as a base station and lures subscribers in its perimeter to connect to it without their knowledge.
-The attack shown in Figure \ref{fig:catcher_catch} is broadcasting a new \gls{lai} to the \gls{ms} at very high power, suggesting that the \gls{ms} entered a new area and has to re-authenticate \cite{mueller}.
+In the attack\cite{mueller} shown in Figure \ref{fig:catcher_catch} the IMSI catcher is broadcasting a new \gls{lai} to the \gls{ms} at very high power.
+This lures the \gls{ms} to connect to the alleged base station due to stronger reception and announce itself since the \gls{lac} has changed.
\begin{figure}
\centering
@@ -738,8 +740,7 @@ The attack shown in Figure \ref{fig:catcher_catch} is broadcasting a new \gls{la
Once a subscriber connects to the device, a command is sent to the \gls{ms} which asks for the \gls{sim}'s \gls{imsi}.
This command is normally only used in case of an error \cite{fox} but can be abused this way.
-%TODO übergang verfeinern
-This is only possible since authentication in a \gls{gsm} network is one-sided as discussed earlier in Section \ref{sec:authentication}.
+An IMSI catcher can only impersonate a base station because authentication in a \gls{gsm} network is one-sided as discussed earlier in Section \ref{sec:authentication}.
The subscriber has no way of checking the authenticity of a base station but rather has to trust the broadcasted identifier which can be easily forged by a catcher.
At this stage, the subscriber can already be localized as being in a certain distance of the catcher.
diff --git a/Tex/Content/Motivation.tex b/Tex/Content/Motivation.tex
index ddc5b12..71c4ad4 100644
--- a/Tex/Content/Motivation.tex
+++ b/Tex/Content/Motivation.tex
@@ -7,31 +7,30 @@ Considering its reception and growth \cite{GSM2009,GSM_history2011,GSM_stats2011
Since the advent of portable radio equipment and portable microprocessors, mobile phones became technologically possible in the 80's.
From that point on commercialisation started with more and more providers emerging.
-With more and more users, security became an ever more important aspect since important telephone calls were now made over radio instead of fixed landlines.
+With more users, security became an ever more important aspect since confidential telephone calls were now made over radio instead of fixed landlines.
In 1996 a device was released that took advantage of a security hole in the \gls{gsm} protocol which enabled it to record phone calls and track users.
This device was developed by Rhode \& Schwartz and was called IMSI catcher.
The name refers to the IMSI number, a unique identification of the user inside the \gls{gsm} network.
It can be obtained by the device by impersonating a base station, which is the entry point of the subscriber to the network.
-In the way of a classical man-in-the-middle attack the IMSI catcher gets the subscriber to connect to it and relay the information to a real base station while harvesting the needed information like calls or IMSI numbers.
+By means of a classical man-in-the-middle attack the IMSI catcher lures the subscriber to connect to it and relay the information to a real base station while harvesting the needed information like calls or IMSI numbers.
This risk is intensified by the fact that several other projects like the Open Source IMSI catcher \cite{dennis} succeeded in building such an IMSI catcher at a very low cost, using hardware and software that is freely available.
-With this hardware it is considerably easier to eavesdrop on and thus breach the privacy of a neighbour or other person than it was when only landlines were used.
-Industrial espionage is another, higher impact area where these devices can be used.
+With this hardware it is considerably easier to eavesdrop on and thus breach the privacy of a neighbour or record corporate phone calls than it was when only landlines were available.
-Up until now countermeasures to IMSI catchers have been given much attention since the commercial grade devices were only available to authorities and abuse was thus not a large topic.
+Up until now countermeasures to IMSI catchers have not been given much attention to since the commercial grade devices were only available to authorities and private abuse was thus not a large topic.
This is where this project is aimed at.
Different ways will be explored on how to identify an IMSI catcher based on its differences to a regular base station.
Additionally information of the surrounding area and tracking of different parameters over time is used to isolate suspicious base stations in the perimeter.
A toolbox is developed that makes it possible to gather and analyse information from all available base stations in an easy manner, the IMSI Catcher Detection System.
-It is also designed to operate in an end user mode where only the provider of the subscriber has to be given to the system and an evaluation is yielded of whether it is safe to place a phone call or not.
+It is also designed to operate in an end user mode where only a very simplified version of the GUI is presented and an evaluation is yielded of whether it is safe to place a phone call or not at the moment.
The tool operates in a completely passive manner only on information that is freely broadcasted, never connecting to base stations in question.
This way the system itself stays invisible to the base stations and thus potential IMSI catchers while evaluating them.
\section{Structure}
The remainder of this thesis is structured as follows:
-The second chapter will give an overview of how a \gls{gsm} network is build up to create a general understanding of the infrastructure in which an IMSI catcher and the detection system work.
+The second chapter will give an overview of how a \gls{gsm} network is built up to create a general understanding of the infrastructure in which an IMSI catcher and the detection system work.
Protocol specifics of the interface on which the two systems operate, the interface between a mobile phone and the base station will be discussed in the second part.
-The chapter concludes with a description of how an IMSI catcher works and which attacks are possible.
+The chapter concludes with a description of how an IMSI catcher works and give an account of what kind of attacks are possible.
In the third chapter, the software framework and hardware that is used to develop the IMSI Catcher Detection System is introduced.
The different procedures used for information gathering and evaluation are also discussed in this chapter based on possible attacks an IMSI catcher can perform and differences in parameters to a valid base station.
@@ -39,13 +38,13 @@ Finally a explanation of how to set up and operate the system together with some
The fourth chapter contains an evaluation of how the system performs in several categories.
First some general performance statistics and results on the individual methods used are collected.
-Afterwards a long term test over the course of a week is done to examine the false positive and false negative rate considering the discovery of an IMSI catcher.
-The chapter ends with a two simulated attack scenarios.
+Afterwards a long-term test over the course of a week is done to examine the false positive and false negative rates of IMSI catcher detection.
+The chapter ends with two simulated attack scenarios.
In the last chapter, a short summary of the results will be given as well as am outlook of how the system can be extended.
\section{Disclaimer}
-During the practical part of this thesis precautions have been made, not to interrupt or influence radio transmissions made by regular subscribers.
+During the practical part of this thesis precautions have been taken not to interrupt or influence radio transmissions made by regular subscribers.
They main part of the experiments is passive information gathering which only harvests information that is freely available and thus does not influence regular communication procedures.
The IMSI catcher was configured in a way to not let subscribers connect, therefore it is not interfering with regular connection procedures.
diff --git a/Tex/Master/Master.acn b/Tex/Master/Master.acn
index 492e0fc..08ab0b0 100644
--- a/Tex/Master/Master.acn
+++ b/Tex/Master/Master.acn
@@ -356,13 +356,13 @@
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
@@ -373,7 +373,7 @@
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{28}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{30}
@@ -514,12 +514,12 @@
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{47}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{47}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{47}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{47}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{47}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{47}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{47}
\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{47}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{47}
@@ -534,7 +534,7 @@
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{48}
\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{48}
\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{48}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{48}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
@@ -547,44 +547,44 @@
\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{50}
\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{50}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{51}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{51}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{CSV?\glossaryentryfield{csv}{\glsnamefont{CSV}}{Comma Separated Value}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{54}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{CSV?\glossaryentryfield{csv}{\glsnamefont{CSV}}{Comma Separated Value}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{54}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{54}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{56}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{55}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{55}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{55}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{55}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{55}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{55}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{58}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{58}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{58}
-\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{58}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{59}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{59}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
@@ -602,7 +602,7 @@
\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{64}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{64}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{64}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{64}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{65}
\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{65}
\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{65}
\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{65}
@@ -614,33 +614,43 @@
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{65}
\glossaryentry{VoIP?\glossaryentryfield{voip}{\glsnamefont{VoIP}}{Voice over IP}{\relax }|setentrycounter{page}\glsnumberformat}{65}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{65}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{66}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{67}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{67}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{67}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{66}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{66}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{66}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{66}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{66}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{66}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{66}
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{67}
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{67}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{67}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{67}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{69}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{68}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{70}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{70}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{70}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{70}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{70}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{70}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{70}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{70}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{70}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{71}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{71}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{71}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{71}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{71}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{71}
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{71}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{71}
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{71}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{71}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{73}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
@@ -654,6 +664,7 @@
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
@@ -662,8 +673,12 @@
\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{75}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
diff --git a/Tex/Master/Master.aux b/Tex/Master/Master.aux
index 2d4ca48..06a1a16 100644
--- a/Tex/Master/Master.aux
+++ b/Tex/Master/Master.aux
@@ -178,13 +178,11 @@
\citation{def_catcher}
\citation{fox}
\citation{def_catcher}
-\citation{mueller}
\@writefile{toc}{\contentsline {paragraph}{Network (Layer 3):}{27}}
\@writefile{toc}{\contentsline {section}{\numberline {2.4}IMSI-Catcher}{27}}
\newlabel{sec:catcher}{{2.4}{27}}
\citation{mueller}
\citation{mueller}
-\citation{fox}
\citation{mueller}
\citation{fox}
\@writefile{lof}{\contentsline {figure}{\numberline {2.11}{\ignorespaces A commercial catcher by Rhode \& Schwarz \cite {fox} and a self built catcher introduced at Defcon 2010 \cite {def_catcher}.}}{28}}
@@ -193,6 +191,8 @@
\newlabel{sec:catcher_operation}{{2.4.1}{28}}
\@writefile{lof}{\contentsline {figure}{\numberline {2.12}{\ignorespaces IMSI catching procedure. Adopted and simplified from \cite {mueller}.}}{29}}
\newlabel{fig:catcher_catch}{{2.12}{29}}
+\citation{mueller}
+\citation{fox}
\citation{dennis}
\citation{imsi_wiki}
\citation{fox}
@@ -260,65 +260,65 @@
\@writefile{toc}{\contentsline {paragraph}{Neighbourhood Structure}{44}}
\FN@pp@footnote@aux{11}{44}
\FN@pp@footnote@aux{12}{44}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.5}{\ignorespaces Base stations and their neighbourhood connections at the Faculty of Engineering.}}{45}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.5}{\ignorespaces Some base stations and their neighbourhood connections at the Faculty of Engineering.}}{45}}
\newlabel{fig:neighbourhood_example}{{3.5}{45}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.6}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{45}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Normal neighbourhood}}}{45}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Tainted neighbourhood}}}{45}}
-\newlabel{fig:structure_comparison}{{3.6}{45}}
-\citation{wiki_cells}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.6}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{46}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Normal neighbourhood}}}{46}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Tainted neighbourhood}}}{46}}
+\newlabel{fig:structure_comparison}{{3.6}{46}}
\@writefile{lot}{\contentsline {table}{\numberline {3.5}{\ignorespaces Database Rules implemented inside the ICDS.}}{46}}
\newlabel{tab:database_rules}{{3.5}{46}}
\@writefile{toc}{\contentsline {subsubsection}{Database Rules}{46}}
-\FN@pp@footnote@aux{13}{46}
-\@writefile{lot}{\contentsline {table}{\numberline {3.6}{\ignorespaces Scan Rules implemented inside the ICDS.}}{47}}
-\newlabel{tab:scan_rules}{{3.6}{47}}
+\citation{wiki_cells}
+\FN@pp@footnote@aux{13}{47}
\FN@pp@footnote@aux{14}{47}
\FN@pp@footnote@aux{15}{47}
\@writefile{toc}{\contentsline {subsubsection}{Scan Rules}{47}}
+\@writefile{lot}{\contentsline {table}{\numberline {3.6}{\ignorespaces Scan Rules implemented inside the ICDS.}}{48}}
+\newlabel{tab:scan_rules}{{3.6}{48}}
\@writefile{toc}{\contentsline {subsubsection}{Remaining Issues and Paging}{48}}
\newlabel{sec:paging}{{3.2.2}{48}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.3}Base Station Evaluation}{49}}
\newlabel{sec:evaluators}{{3.2.3}{49}}
\@writefile{toc}{\contentsline {section}{\numberline {3.3}Implementation}{49}}
\newlabel{sec:icds}{{3.3}{49}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Architecture}{49}}
\@writefile{lof}{\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{50}}
\newlabel{fig:architecture}{{3.7}{50}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Architecture}{50}}
\@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{51}}
\newlabel{fig:python_dict}{{3.8}{51}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{51}}
\newlabel{sec:configuration}{{3.3.2}{51}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{52}}
-\newlabel{fig:icds}{{3.9}{52}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Graphical User Interface}{52}}
\newlabel{sec:icds_operation}{{3.3.3}{52}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.4}Usage}{54}}
-\newlabel{sec:user_mode}{{3.3.4}{54}}
-\newlabel{fig:databases_window}{{3.10(a)}{55}}
-\newlabel{sub@fig:databases_window}{{(a)}{55}}
-\newlabel{fig:rules_window}{{3.10(b)}{55}}
-\newlabel{sub@fig:rules_window}{{(b)}{55}}
-\newlabel{fig:filters_window}{{3.10(c)}{55}}
-\newlabel{sub@fig:filters_window}{{(c)}{55}}
-\newlabel{fig:pch_window}{{3.10(d)}{55}}
-\newlabel{sub@fig:pch_window}{{(d)}{55}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{55}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Databases window.}}}{55}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Rules window.}}}{55}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Filters window.}}}{55}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(d)}{\ignorespaces {PCH scan window.}}}{55}}
-\newlabel{fig:dialogs}{{3.10}{55}}
-\@writefile{toc}{\contentsline {paragraph}{Conducting sweep scans:}{56}}
-\@writefile{toc}{\contentsline {paragraph}{Using and obtaining Cell ID Information:}{56}}
-\@writefile{toc}{\contentsline {paragraph}{Building or using a Local Area Database:}{56}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.11}{\ignorespaces The User Mode window.}}{57}}
-\newlabel{fig:user_mode}{{3.11}{57}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{53}}
+\newlabel{fig:icds}{{3.9}{53}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.4}Usage}{55}}
+\newlabel{sec:user_mode}{{3.3.4}{55}}
+\@writefile{toc}{\contentsline {paragraph}{Conducting sweep scans:}{55}}
+\@writefile{toc}{\contentsline {paragraph}{Using and obtaining Cell ID Information:}{55}}
+\newlabel{fig:databases_window}{{3.10(a)}{56}}
+\newlabel{sub@fig:databases_window}{{(a)}{56}}
+\newlabel{fig:rules_window}{{3.10(b)}{56}}
+\newlabel{sub@fig:rules_window}{{(b)}{56}}
+\newlabel{fig:filters_window}{{3.10(c)}{56}}
+\newlabel{sub@fig:filters_window}{{(c)}{56}}
+\newlabel{fig:pch_window}{{3.10(d)}{56}}
+\newlabel{sub@fig:pch_window}{{(d)}{56}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{56}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Databases window.}}}{56}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Rules window.}}}{56}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Filters window.}}}{56}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(d)}{\ignorespaces {PCH scan window.}}}{56}}
+\newlabel{fig:dialogs}{{3.10}{56}}
+\@writefile{toc}{\contentsline {paragraph}{Building or using a Local Area Database:}{57}}
\@writefile{toc}{\contentsline {paragraph}{Conducting a PCH Scan:}{57}}
-\@writefile{toc}{\contentsline {paragraph}{Utilising User Mode:}{57}}
-\citation{catcher_catcher}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.11}{\ignorespaces The User Mode window.}}{58}}
+\newlabel{fig:user_mode}{{3.11}{58}}
+\@writefile{toc}{\contentsline {paragraph}{Utilising User Mode:}{58}}
\@writefile{toc}{\contentsline {section}{\numberline {3.4}Related Projects}{58}}
-\FN@pp@footnote@aux{16}{58}
+\citation{catcher_catcher}
+\FN@pp@footnote@aux{16}{59}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{61}}
@@ -347,27 +347,22 @@
\FN@pp@footnote@aux{19}{65}
\@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{66}}
\newlabel{fig:openbts_parameters}{{4.3}{66}}
-\@writefile{toc}{\contentsline {subsubsection}{Nokia 3310}{66}}
-\FN@pp@footnote@aux{20}{66}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.4}{\ignorespaces Nokia 3310 NetMonitor screenshots.}}{67}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Connected cell information.}}}{67}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Neighbouring cell measurements.}}}{67}}
-\newlabel{fig:netmonitor}{{4.4}{67}}
+\@writefile{toc}{\contentsline {subsubsection}{Modifications to the ICDS Configuration}{66}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{66}}
\@writefile{lot}{\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{67}}
\newlabel{tab:err_configs}{{4.4}{67}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{67}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.5}{\ignorespaces failzor}}{68}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.5}{\ignorespaces Results obtained testing the \emph {rx} and \emph {LAC Change rules}.}}{68}}
\newlabel{tab:par_change}{{4.5}{68}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Long Term Test}{68}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long term evaluation.}}{69}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Long-Term Test}{68}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{68}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long-term evaluation.}}{69}}
\newlabel{tab:longterm_test}{{4.6}{69}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{69}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{70}}
-\newlabel{tab:consistent_parameters}{{4.7}{70}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{69}}
+\newlabel{tab:consistent_parameters}{{4.7}{69}}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.4}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{70}}
+\newlabel{fig:takeover_attack}{{4.4}{70}}
\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher as a new Cell}{70}}
\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{70}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{71}}
-\newlabel{fig:takeover_attack}{{4.5}{71}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{73}}
@@ -443,7 +438,8 @@
\newlabel{sec:osmo_usage}{{B.2}{84}}
\@writefile{toc}{\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{85}}
\newlabel{sec:osmo_serial_schematics}{{B.3}{85}}
-\FN@pp@footnote@aux{21}{85}
+\FN@pp@footnote@aux{20}{85}
+\@writefile{lof}{\contentsline {figure}{\numberline {B.1}{\ignorespaces Serial cable schematics.}}{85}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\@writefile{toc}{\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{87}}
@@ -472,7 +468,8 @@
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
\@writefile{toc}{\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{99}}
-\newlabel{sec_lac_change_test}{{E.1}{99}}
+\newlabel{sec:lac_change_test}{{E.1}{99}}
+\@writefile{lot}{\contentsline {table}{\numberline {E.1}{\ignorespaces Configurations used for the rx\tmspace +\thinmuskip {.1667em}/\tmspace +\thinmuskip {.1667em}LAC Change Rules test.}}{99}}
\@writefile{toc}{\contentsline {section}{\numberline {E.2}Long Term Test}{99}}
\newlabel{sec:long_term_test}{{E.2}{99}}
\FN@pp@footnotehinttrue
diff --git a/Tex/Master/Master.ist b/Tex/Master/Master.ist
index 4153d4d..74b626a 100644
--- a/Tex/Master/Master.ist
+++ b/Tex/Master/Master.ist
@@ -1,5 +1,5 @@
% makeindex style file created by the glossaries package
-% for document 'Master' on 2012-5-31
+% for document 'Master' on 2012-6-1
actual '?'
encap '|'
level '!'
diff --git a/Tex/Master/Master.lof b/Tex/Master/Master.lof
index e3fcc68..2b0b39f 100644
--- a/Tex/Master/Master.lof
+++ b/Tex/Master/Master.lof
@@ -18,31 +18,29 @@
\contentsline {figure}{\numberline {3.2}{\ignorespaces Interaction of the OsmocomBB components with the ICDS software.}}{37}
\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 2 Message \cite {protocols1999}.}}{39}
\contentsline {figure}{\numberline {3.4}{\ignorespaces Procedure taken when the network has a call/text waiting for a passive subscriber.}}{41}
-\contentsline {figure}{\numberline {3.5}{\ignorespaces Base stations and their neighbourhood connections at the Faculty of Engineering.}}{45}
-\contentsline {figure}{\numberline {3.6}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{45}
-\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Normal neighbourhood}}}{45}
-\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Tainted neighbourhood}}}{45}
+\contentsline {figure}{\numberline {3.5}{\ignorespaces Some base stations and their neighbourhood connections at the Faculty of Engineering.}}{45}
+\contentsline {figure}{\numberline {3.6}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{46}
+\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Normal neighbourhood}}}{46}
+\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Tainted neighbourhood}}}{46}
\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{50}
\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{51}
-\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{52}
-\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{55}
-\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Databases window.}}}{55}
-\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Rules window.}}}{55}
-\contentsline {subfigure}{\numberline {(c)}{\ignorespaces {Filters window.}}}{55}
-\contentsline {subfigure}{\numberline {(d)}{\ignorespaces {PCH scan window.}}}{55}
-\contentsline {figure}{\numberline {3.11}{\ignorespaces The User Mode window.}}{57}
+\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{53}
+\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{56}
+\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Databases window.}}}{56}
+\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Rules window.}}}{56}
+\contentsline {subfigure}{\numberline {(c)}{\ignorespaces {Filters window.}}}{56}
+\contentsline {subfigure}{\numberline {(d)}{\ignorespaces {PCH scan window.}}}{56}
+\contentsline {figure}{\numberline {3.11}{\ignorespaces The User Mode window.}}{58}
\addvspace {10\p@ }
\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{62}
\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{65}
\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{66}
-\contentsline {figure}{\numberline {4.4}{\ignorespaces Nokia 3310 NetMonitor screenshots.}}{67}
-\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Connected cell information.}}}{67}
-\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Neighbouring cell measurements.}}}{67}
-\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{71}
+\contentsline {figure}{\numberline {4.4}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{70}
\addvspace {10\p@ }
\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{74}
\addvspace {10\p@ }
\addvspace {10\p@ }
+\contentsline {figure}{\numberline {B.1}{\ignorespaces Serial cable schematics.}}{85}
\addvspace {10\p@ }
\addvspace {10\p@ }
\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{94}
diff --git a/Tex/Master/Master.log b/Tex/Master/Master.log
index 199423c..a1cd983 100644
--- a/Tex/Master/Master.log
+++ b/Tex/Master/Master.log
@@ -1,4 +1,4 @@
-This is pdfTeX, Version 3.1415926-1.40.10 (TeX Live 2009/Debian) (format=pdflatex 2012.1.7) 31 MAY 2012 21:15
+This is pdfTeX, Version 3.1415926-1.40.10 (TeX Live 2009/Debian) (format=pdflatex 2012.1.7) 1 JUN 2012 17:55
entering extended mode
%&-line parsing enabled.
**Master.tex
@@ -1141,14 +1141,14 @@ LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <14.4> not available
]
LaTeX Font Info: Font shape `T1/pcr/bx/n' in size <10.95> not available
-(Font) Font shape `T1/pcr/b/n' tried instead on input line 61.
+(Font) Font shape `T1/pcr/b/n' tried instead on input line 60.
-Underfull \hbox (badness 10000) in paragraph at lines 54--66
+Underfull \hbox (badness 10000) in paragraph at lines 53--65
[]
-Underfull \vbox (badness 4403) has occurred while \output is active []
+Underfull \vbox (badness 2302) has occurred while \output is active []
[2])
(../Content/GSM_short.tex [3] [4
@@ -1268,56 +1268,53 @@ ne 191.
File: ../Images/Paging.png Graphic file (type png)
<use ../Images/Paging.png> [40] [41 <../Images/Paging.png (PNG copy)>] [42]
-[43] <../Images/neighbourhoods_fak.png, id=217, 907.39pt x 941.5175pt>
+[43] <../Images/neighbourhoods_fak.png, id=217, 1829.83624pt x 2708.1175pt>
File: ../Images/neighbourhoods_fak.png Graphic file (type png)
<use ../Images/neighbourhoods_fak.png>
-Underfull \hbox (badness 1675) in paragraph at lines 327--327
-[]\T1/ptm/m/n/10.95 Base sta-tions and their neigh-bour-hood con-nec-tions at t
-he Fac-ulty of
- []
+
+LaTeX Warning: Float too large for page by 3.59608pt on input line 330.
LaTeX Font Info: Font shape `T1/phv/bx/n' in size <14.4> not available
-(Font) Font shape `T1/phv/b/n' tried instead on input line 364.
-[44] [45 <../Images/neighbourhoods_fak.png>] [46] [47] [48]
-<../Images/Architecture_software.png, id=235, 341.76483pt x 182.91537pt>
+(Font) Font shape `T1/phv/b/n' tried instead on input line 365.
+[44] [45 <../Images/neighbourhoods_fak.png (PNG copy)>] [46] [47] [48] [49]
+<../Images/Architecture_software.png, id=238, 341.76483pt x 182.91537pt>
File: ../Images/Architecture_software.png Graphic file (type png)
-<use ../Images/Architecture_software.png> [49] [50 <../Images/Architecture_soft
-ware.png (PNG copy)>]
+<use ../Images/Architecture_software.png> [50 <../Images/Architecture_software.
+png (PNG copy)>]
LaTeX Font Info: Font shape `T1/pcr/m/it' in size <10.95> not available
-(Font) Font shape `T1/pcr/m/sl' tried instead on input line 577.
- [51]
-<../Images/ICDS.png, id=247, 1287.81125pt x 881.2925pt>
+(Font) Font shape `T1/pcr/m/sl' tried instead on input line 578.
+ [51] <../Images/ICDS.png, id=246, 1325.95375pt x 864.22874pt>
File: ../Images/ICDS.png Graphic file (type png)
-<use ../Images/ICDS.png> [52 <../Images/ICDS.png>] [53]
-<../Images/databases_window.png, id=255, 366.36874pt x 459.7175pt>
+<use ../Images/ICDS.png> [52] [53 <../Images/ICDS.png (PNG copy)>] [54]
+<../Images/databases_window.png, id=256, 366.36874pt x 459.7175pt>
File: ../Images/databases_window.png Graphic file (type png)
<use ../Images/databases_window.png>
-<../Images/rules_window.png, id=256, 284.06125pt x 568.1225pt>
+<../Images/rules_window.png, id=257, 284.06125pt x 568.1225pt>
File: ../Images/rules_window.png Graphic file (type png)
<use ../Images/rules_window.png>
-<../Images/filter_window.png, id=257, 332.24126pt x 293.095pt>
+<../Images/filter_window.png, id=258, 332.24126pt x 293.095pt>
File: ../Images/filter_window.png Graphic file (type png)
<use ../Images/filter_window.png>
-<../Images/pch_window.png, id=258, 270.00874pt x 273.02pt>
+<../Images/pch_window.png, id=259, 270.00874pt x 273.02pt>
File: ../Images/pch_window.png Graphic file (type png)
-<use ../Images/pch_window.png> [54] [55 <../Images/databases_window.png> <../Im
+<use ../Images/pch_window.png> [55] [56 <../Images/databases_window.png> <../Im
ages/rules_window.png> <../Images/filter_window.png (PNG copy)> <../Images/pch_
-window.png>] [56] <../Images/user_window.png, id=272, 368.37625pt x 469.755pt>
+window.png>] [57] <../Images/user_window.png, id=273, 368.37625pt x 469.755pt>
File: ../Images/user_window.png Graphic file (type png)
-<use ../Images/user_window.png> [57 <../Images/user_window.png>]
+<use ../Images/user_window.png> [58 <../Images/user_window.png>]
-LaTeX Warning: Citation `catcher_catcher' on page 58 undefined on input line 76
-6.
+LaTeX Warning: Citation `catcher_catcher' on page 59 undefined on input line 76
+7.
-[58]) (../Content/Evaluation.tex [59] [60
+) (../Content/Evaluation.tex [59] [60
]
@@ -1327,117 +1324,27 @@ Overfull \hbox (3.33815pt too wide) in paragraph at lines 16--30
[][]
[]
-[61] [62] [63] <../Images/catcherICDS.jpg, id=296, 3474.9825pt x 1906.12125pt>
+[61] [62] [63] [64]
+<../Images/catcherICDS.jpg, id=297, 3474.9825pt x 1906.12125pt>
File: ../Images/catcherICDS.jpg Graphic file (type jpg)
-<use ../Images/catcherICDS.jpg> [64] [65 <../Images/catcherICDS.jpg>]
-Overfull \hbox (9.98987pt too wide) in paragraph at lines 206--206
-[]\T1/ptm/m/n/9 (a)
- []
-
-
-Overfull \hbox (17.9999pt too wide) in paragraph at lines 206--206
-\T1/ptm/m/n/9 Con-
- []
-
-
-Overfull \hbox (23.48973pt too wide) in paragraph at lines 206--206
-\T1/ptm/m/n/9 nected
- []
-
-
-Overfull \hbox (12.9957pt too wide) in paragraph at lines 206--206
-\T1/ptm/m/n/9 cell
- []
-
-
-Overfull \hbox (9.99887pt too wide) in paragraph at lines 206--206
-\T1/ptm/m/n/9 in-
- []
-
-
-Overfull \hbox (13.31093pt too wide) in paragraph at lines 206--206
-\T1/ptm/m/n/9 for-
- []
-
-
-Overfull \hbox (13.99481pt too wide) in paragraph at lines 206--206
-\T1/ptm/m/n/9 ma-
- []
-
-
-Overfull \hbox (16.25381pt too wide) in paragraph at lines 206--206
-\T1/ptm/m/n/9 tion.
- []
-
-
-Overfull \hbox (10.49393pt too wide) in paragraph at lines 207--207
-[]\T1/ptm/m/n/9 (b)
- []
-
-
-Overfull \hbox (24.99278pt too wide) in paragraph at lines 207--207
-\T1/ptm/m/n/9 Neigh-
- []
-
-
-Overfull \hbox (19.31396pt too wide) in paragraph at lines 207--207
-\T1/ptm/m/n/9 bour-
- []
-
-
-Overfull \hbox (11.5019pt too wide) in paragraph at lines 207--207
-\T1/ptm/m/n/9 ing
- []
-
-
-Overfull \hbox (12.9957pt too wide) in paragraph at lines 207--207
-\T1/ptm/m/n/9 cell
- []
-
-
-Overfull \hbox (17.99075pt too wide) in paragraph at lines 207--207
-\T1/ptm/m/n/9 mea-
- []
-
-
-Overfull \hbox (17.99077pt too wide) in paragraph at lines 207--207
-\T1/ptm/m/n/9 sure-
- []
-
-
-Overfull \hbox (23.75066pt too wide) in paragraph at lines 207--207
-\T1/ptm/m/n/9 ments.
- []
-
-
-Underfull \vbox (badness 10000) has occurred while \output is active []
-
- [66]
-Overfull \hbox (13.2843pt too wide) in paragraph at lines 242--248
+<use ../Images/catcherICDS.jpg> [65 <../Images/catcherICDS.jpg>]
+Overfull \hbox (20.58582pt too wide) in paragraph at lines 236--242
\T1/ptm/m/n/10.95 Rules trig-gered: LAC/Provider Map-ping, Neigh-bour-hood Stru
-c-ture, AR-FC-N/Provider
+c-ture, AR-FCN/Provider
[]
-[67]
-
-LaTeX Warning: Reference `sec:config_data' on page 68 undefined on input line 2
-63.
-
-[68]
-Underfull \vbox (badness 10000) has occurred while \output is active []
-
- [69]
-<../Images/replace_attack.png, id=316, 356.94153pt x 162.67976pt>
+[66] [67] [68] [69]
+<../Images/replace_attack.png, id=314, 356.94153pt x 162.67976pt>
File: ../Images/replace_attack.png Graphic file (type png)
-<use ../Images/replace_attack.png> [70]) (../Content/Conclusion.tex [71 <../Ima
-ges/replace_attack.png (PNG copy)>] [72
+<use ../Images/replace_attack.png> [70 <../Images/replace_attack.png (PNG copy)
+>]) (../Content/Conclusion.tex [71] [72
]
Chapter 5.
-<../Images/flowchart.png, id=326, 340.31943pt x 407.31372pt>
+<../Images/flowchart.png, id=324, 340.31943pt x 407.31372pt>
File: ../Images/flowchart.png Graphic file (type png)
<use ../Images/flowchart.png> [73] [74 <../Images/flowchart.png (PNG copy)>])
@@ -1560,7 +1467,7 @@ Overfull \hbox (5.81935pt too wide) in paragraph at lines 115--115
n[]
[]
-[84] <../Images/t191cable.jpg, id=365, 702.625pt x 609.27625pt>
+[84] <../Images/t191cable.jpg, id=363, 702.625pt x 609.27625pt>
File: ../Images/t191cable.jpg Graphic file (type jpg)
<use ../Images/t191cable.jpg> [85 <../Images/t191cable.jpg>] [86
@@ -1569,32 +1476,32 @@ File: ../Images/t191cable.jpg Graphic file (type jpg)
]
Appendix C.
-Underfull \hbox (badness 10000) in paragraph at lines 145--161
+Underfull \hbox (badness 10000) in paragraph at lines 147--163
[]
-Underfull \hbox (badness 10000) in paragraph at lines 145--161
+Underfull \hbox (badness 10000) in paragraph at lines 147--163
[]
-Underfull \hbox (badness 10000) in paragraph at lines 145--161
+Underfull \hbox (badness 10000) in paragraph at lines 147--163
[]
-Underfull \hbox (badness 10000) in paragraph at lines 162--194
+Underfull \hbox (badness 10000) in paragraph at lines 164--196
[]
-Underfull \hbox (badness 10000) in paragraph at lines 162--194
+Underfull \hbox (badness 10000) in paragraph at lines 164--196
[]
-Underfull \hbox (badness 10000) in paragraph at lines 162--194
+Underfull \hbox (badness 10000) in paragraph at lines 164--196
[]
@@ -1603,22 +1510,22 @@ Underfull \vbox (badness 7981) has occurred while \output is active []
[87]
[88]
-Overfull \hbox (5.4829pt too wide) in paragraph at lines 318--319
+Overfull \hbox (5.4829pt too wide) in paragraph at lines 320--321
[][][][][][][][][][][][][][][][][][][][][][][][][][]
[]
-Underfull \hbox (badness 10000) in paragraph at lines 197--324
+Underfull \hbox (badness 10000) in paragraph at lines 199--326
[]
-Underfull \hbox (badness 10000) in paragraph at lines 197--324
+Underfull \hbox (badness 10000) in paragraph at lines 199--326
[]
-Underfull \hbox (badness 10000) in paragraph at lines 197--324
+Underfull \hbox (badness 10000) in paragraph at lines 199--326
[]
@@ -1631,23 +1538,23 @@ Underfull \vbox (badness 10000) has occurred while \output is active []
]
Appendix D.
-<../Images/sysinfo1.png, id=392, 260.172pt x 393.1488pt>
+<../Images/sysinfo1.png, id=390, 260.172pt x 393.1488pt>
File: ../Images/sysinfo1.png Graphic file (type png)
<use ../Images/sysinfo1.png>
-LaTeX Warning: Float too large for page by 0.9002pt on input line 332.
+LaTeX Warning: Float too large for page by 0.9002pt on input line 334.
File: ../Images/sysinfo2.png Graphic file (type png)
<use ../Images/sysinfo2.png>
-LaTeX Warning: Float too large for page by 61.98238pt on input line 337.
+LaTeX Warning: Float too large for page by 61.98238pt on input line 339.
-<../Images/sysinfo3.png, id=393, 284.45473pt x 373.49136pt>
+<../Images/sysinfo3.png, id=391, 284.45473pt x 373.49136pt>
File: ../Images/sysinfo3.png Graphic file (type png)
<use ../Images/sysinfo3.png>
-<../Images/sysinfo4.png, id=394, 252.07776pt x 370.0224pt>
+<../Images/sysinfo4.png, id=392, 252.07776pt x 370.0224pt>
File: ../Images/sysinfo4.png Graphic file (type png)
<use ../Images/sysinfo4.png> [93] [94 <../Images/sysinfo1.png (PNG copy)>]
@@ -1657,7 +1564,10 @@ copy)>] [98
]
Appendix E.
-[99]) (./Master.acr [100]
+) (./Master.acr [99] [100
+
+
+]
Underfull \hbox (badness 2626) in paragraph at lines 73--74
[]|\T1/ptm/m/n/10.95 Conférence Eu-ropéenne des Ad-min-is-tra-tions des
[]
@@ -1670,18 +1580,16 @@ Underfull \hbox (badness 10000) in paragraph at lines 89--90
[101
-
-
] [102] [103]) [104] (./Master.aux)
LaTeX Warning: There were undefined references.
)
Here is how much of TeX's memory you used:
- 25032 strings out of 493848
- 468954 string characters out of 1152824
- 738813 words of memory out of 3000000
- 27635 multiletter control sequences out of 15000+50000
+ 25028 strings out of 493848
+ 468895 string characters out of 1152824
+ 738794 words of memory out of 3000000
+ 27631 multiletter control sequences out of 15000+50000
83343 words of font info for 111 fonts, out of 3000000 for 9000
714 hyphenation exceptions out of 8191
61i,13n,72p,1076b,1344s stack positions out of 5000i,500n,10000p,200000b,50000s
@@ -1701,9 +1609,9 @@ nts/type1/urw/helvetic/uhvb8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/tim
es/utmb8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/
share/texmf-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/share/texmf-texlive/
fonts/type1/urw/times/utmri8a.pfb>
-Output written on Master.pdf (116 pages, 17995314 bytes).
+Output written on Master.pdf (116 pages, 18950381 bytes).
PDF statistics:
- 494 PDF objects out of 1000 (max. 8388607)
+ 492 PDF objects out of 1000 (max. 8388607)
0 named destinations out of 1000 (max. 500000)
178 words of extra memory for PDF output out of 10000 (max. 10000000)
diff --git a/Tex/Master/Master.lot b/Tex/Master/Master.lot
index f20b78b..3613df8 100644
--- a/Tex/Master/Master.lot
+++ b/Tex/Master/Master.lot
@@ -10,15 +10,15 @@
\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{42}
\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{43}
\contentsline {table}{\numberline {3.5}{\ignorespaces Database Rules implemented inside the ICDS.}}{46}
-\contentsline {table}{\numberline {3.6}{\ignorespaces Scan Rules implemented inside the ICDS.}}{47}
+\contentsline {table}{\numberline {3.6}{\ignorespaces Scan Rules implemented inside the ICDS.}}{48}
\addvspace {10\p@ }
\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{61}
\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in s for fetching the information.}}{63}
\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Pagings and Immediate Assignments (per 10\tmspace +\thickmuskip {.2777em}s) for the four German providers at different locations.}}{64}
\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{67}
-\contentsline {table}{\numberline {4.5}{\ignorespaces failzor}}{68}
-\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long term evaluation.}}{69}
-\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{70}
+\contentsline {table}{\numberline {4.5}{\ignorespaces Results obtained testing the \emph {rx} and \emph {LAC Change rules}.}}{68}
+\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long-term evaluation.}}{69}
+\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{69}
\addvspace {10\p@ }
\addvspace {10\p@ }
\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{81}
@@ -27,3 +27,4 @@
\addvspace {10\p@ }
\addvspace {10\p@ }
\addvspace {10\p@ }
+\contentsline {table}{\numberline {E.1}{\ignorespaces Configurations used for the rx\tmspace +\thinmuskip {.1667em}/\tmspace +\thinmuskip {.1667em}LAC Change Rules test.}}{99}
diff --git a/Tex/Master/Master.pdf b/Tex/Master/Master.pdf
index 05bd7d7..37d64f1 100644
--- a/Tex/Master/Master.pdf
+++ b/Tex/Master/Master.pdf
Binary files differ
diff --git a/Tex/Master/Master.synctex.gz b/Tex/Master/Master.synctex.gz
index a62a4cc..5562cbe 100644
--- a/Tex/Master/Master.synctex.gz
+++ b/Tex/Master/Master.synctex.gz
Binary files differ
diff --git a/Tex/Master/Master.toc b/Tex/Master/Master.toc
index 08bfdfb..7370e46 100644
--- a/Tex/Master/Master.toc
+++ b/Tex/Master/Master.toc
@@ -53,15 +53,15 @@
\contentsline {subsubsection}{Remaining Issues and Paging}{48}
\contentsline {subsection}{\numberline {3.2.3}Base Station Evaluation}{49}
\contentsline {section}{\numberline {3.3}Implementation}{49}
-\contentsline {subsection}{\numberline {3.3.1}Architecture}{49}
+\contentsline {subsection}{\numberline {3.3.1}Architecture}{50}
\contentsline {subsection}{\numberline {3.3.2}Configuration}{51}
\contentsline {subsection}{\numberline {3.3.3}Graphical User Interface}{52}
-\contentsline {subsection}{\numberline {3.3.4}Usage}{54}
-\contentsline {paragraph}{Conducting sweep scans:}{56}
-\contentsline {paragraph}{Using and obtaining Cell ID Information:}{56}
-\contentsline {paragraph}{Building or using a Local Area Database:}{56}
+\contentsline {subsection}{\numberline {3.3.4}Usage}{55}
+\contentsline {paragraph}{Conducting sweep scans:}{55}
+\contentsline {paragraph}{Using and obtaining Cell ID Information:}{55}
+\contentsline {paragraph}{Building or using a Local Area Database:}{57}
\contentsline {paragraph}{Conducting a PCH Scan:}{57}
-\contentsline {paragraph}{Utilising User Mode:}{57}
+\contentsline {paragraph}{Utilising User Mode:}{58}
\contentsline {section}{\numberline {3.4}Related Projects}{58}
\contentsline {chapter}{\numberline {4}Evaluation}{61}
\contentsline {section}{\numberline {4.1}Performance Evaluation}{61}
@@ -70,10 +70,10 @@
\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{63}
\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{64}
\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{64}
-\contentsline {subsubsection}{Nokia 3310}{66}
-\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{67}
-\contentsline {subsection}{\numberline {4.2.3}Long Term Test}{68}
-\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{69}
+\contentsline {subsubsection}{Modifications to the ICDS Configuration}{66}
+\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{66}
+\contentsline {subsection}{\numberline {4.2.3}Long-Term Test}{68}
+\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{68}
\contentsline {subsubsection}{IMSI Catcher as a new Cell}{70}
\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{70}
\contentsline {chapter}{\numberline {5}Conclusion}{73}