summaryrefslogtreecommitdiffstats
path: root/Tex
diff options
context:
space:
mode:
authorTom2012-05-28 22:48:08 +0200
committerTom2012-05-28 22:48:08 +0200
commitded6b56b3c24ec2f1fc1544c4bc872c71e54c99f (patch)
tree37aae445e53e2d0ba90fee7a1a8234443d826649 /Tex
parentpaging image added (diff)
downloadimsi-catcher-detection-ded6b56b3c24ec2f1fc1544c4bc872c71e54c99f.tar.gz
imsi-catcher-detection-ded6b56b3c24ec2f1fc1544c4bc872c71e54c99f.tar.xz
imsi-catcher-detection-ded6b56b3c24ec2f1fc1544c4bc872c71e54c99f.zip
some more tex changes and experiments
Diffstat (limited to 'Tex')
-rw-r--r--Tex/Content/Appendix.tex22
-rw-r--r--Tex/Content/Conclusion.tex3
-rw-r--r--Tex/Content/Detection.tex3
-rw-r--r--Tex/Content/Evaluation.tex60
-rw-r--r--Tex/Master/Master.acn45
-rw-r--r--Tex/Master/Master.aux20
-rw-r--r--Tex/Master/Master.ist2
-rw-r--r--Tex/Master/Master.lof4
-rw-r--r--Tex/Master/Master.log137
-rw-r--r--Tex/Master/Master.pdfbin13163027 -> 13383627 bytes
-rw-r--r--Tex/Master/Master.synctex.gzbin668170 -> 677922 bytes
-rw-r--r--Tex/Master/Master.toc9
12 files changed, 182 insertions, 123 deletions
diff --git a/Tex/Content/Appendix.tex b/Tex/Content/Appendix.tex
index 65c6fdf..11613d3 100644
--- a/Tex/Content/Appendix.tex
+++ b/Tex/Content/Appendix.tex
@@ -220,8 +220,26 @@ The following pages contain parsed System Information Messages of type 1-4 for
\caption{System Information 4 Message}
\end{figure}
\chapter{Evaluation Data}
-\section{IMSI Catcher Configurations}
-\label{sec:config_data}
+\section{Rx and LAC Change Test}
+\label{sec_lac_change_test}
+The following table contains the four configuration that have been used to replace real base stations with the IMSI catcher.
+\begin{center}
+\begin{tabular}{lllll}
+\toprule
+ &T-Mobile &O2 &E-Plus &Vodafone\\
+\midrule
+ARFCN &50 &2 &978 &695 \\
+ShortName &T-Mobile &Vodafone &E-Plus &O2 \\
+MCC &262 &262 &262 &505 \\
+MNC &01 &02 &03 &07 \\
+LAC &21010 &793 &588 &50945 \\
+Cell ID &1 &2 &3 &4 \\
+Neighbours &- &1,2,3 &695, 20 &10, 20, 30\\
+\bottomrule
+\end{tabular}
+\end{center}
+\section{Long Term Test}
+\label{sec:long_term_test}
The folliwing tables contain the configurations that have been used throughout the long term test period.
The configurations have been used in the order they appear in the tables.
\begin{center}
diff --git a/Tex/Content/Conclusion.tex b/Tex/Content/Conclusion.tex
index bce8092..6d2a593 100644
--- a/Tex/Content/Conclusion.tex
+++ b/Tex/Content/Conclusion.tex
@@ -1,2 +1,5 @@
\chapter{Conclusion}
+
+\section{Summary}
+
\section{Future Work} \ No newline at end of file
diff --git a/Tex/Content/Detection.tex b/Tex/Content/Detection.tex
index 306520b..c31455d 100644
--- a/Tex/Content/Detection.tex
+++ b/Tex/Content/Detection.tex
@@ -436,11 +436,12 @@ If a mobile phone is connected to a base station and not actively participating
As mentioned in Section \ref{sec:log_channels} the network contacts the \gls{ms} on the \gls{pch} if there is a text message or a call waiting to be delivered.
\begin{figure}
\centering
+\includegraphics{../Images/Paging}
\caption{Procedure taken when the network has a call/text waiting for a passive subscriber.}
\label{fig:paging}
\end{figure}
The procedure is outlined in Figure \ref{fig:paging}.
-A paging request by the network is answered by the \gls{ms} by requesting a dedicated channel, which is assigned by the network in turn with an Immediate Assigmnemt message.
+A paging request by the network is answered by the \gls{ms} by requesting a dedicated channel, which is assigned by the network in turn with an Immediate Assignment message.
From this point on the connection can be set up.
An IMSI catcher however is not part of a provider's network, it is merely a proxy for a base station.
diff --git a/Tex/Content/Evaluation.tex b/Tex/Content/Evaluation.tex
index 77a8f4d..bd37b6c 100644
--- a/Tex/Content/Evaluation.tex
+++ b/Tex/Content/Evaluation.tex
@@ -164,6 +164,8 @@ GSM.T3212 1
\label{fig:openbts_parameters}
\end{figure}
\texttt{Control.OpenRegistration} is explicitly set to 0 which prevents anyone from connecting to the IMSI catcher since connections are not part of the test and we do not want to interfere with other peoples' communications in the area.
+More precisely this will only let users connect that have been set up in the \texttt{sip.conf} of the Asterisk server.
+Only the test phone does have a valid account.
\begin{figure}
\centering
@@ -192,30 +194,31 @@ The IMSI catcher was launched with the four different configurations shown in Ta
ARFCN &50 &2 &978 &695 \\
ShortName &T-Mobile &Vodafone &E-Plus &O2 \\
MCC &262 &262 &262 &505 \\
-MNC &01 &02 &03 &07 \\
+MNC &01 &02 &03 &07 \\
LAC &21010 &793 &588 &50945 \\
Cell ID &1 &2 &3 &4 \\
-Neighbours &- &1,2,3 &695, 20 &10, 20, 30\\
+Neighbours &- &10,11,12 &695, 20 &1022, 1001 \\
\bottomrule
\end{tabular}
\caption{Erroneous configurations for the IMSI catcher.}
\label{tab:err_configs}
\end{table}
With each of these configurations the \gls{icds} detected the catcher for various reasons:
-%TODO: fill in the missing rules
\begin{itemize}
\item Config 1: For this configuration the \gls{icds} detected that \gls{arfcn} 50 is not in the range registered to the provider T-Mobile.
- Apart from that the \gls{lac} differed from the ones found in the Freiburg area.
- The neighbouring cell list was also empty which is a strong indication for an IMSI catcher.\\
- Rules triggered:
+ Apart from that the \gls{lac} differed from the ones found in the Freiburg area and thus different from the neighbouring \glspl{lac}.
+ The neighbouring cell list was also empty which is a strong indication for an IMSI catcher.
+ An interesting fact to be noted here is, when an empty neighbourhood list is given to OpenBTS it still transmits a neighbourhood list containing the element '0'.
+ The Neighbourhood Structure Rule triggered nevertheless since no other T-Mobile station in the area had \gls{arfcn} 0 as a neighbour, nor was it discovered during the scan.\\
+ Rules triggered: LAC/Provider Mapping, Neighbourhood Structure, ARFCN/Provider Mapping, LAC Median Deviation
\item Config 2: The detected errors within this configuration are that none of the neighbours mentioned was in range to be detected, which is very unlikely for a normal base station.\\
- Rules triggered:
+ Rules triggered: Neighbourhood Structure
\item Config 3: In this configuration one of the neighbours, namely 695 is not consistent with the set provider.
The base stations breaks up the isolated subgraph for E-Plus and is thus detected.\\
- Rules triggered:
- \item Config 4: The \gls{mcc} is not consistent with the chosen provider.
+ Rules triggered: Pure Neighbourhoods
+ \item Config 4: The chosen provider is not consistent with the country set.
Additionally another warning is thrown since the neighbourhood list only contained nodes that were only found indirectly.\\
- Rules triggered:
+ Rules triggered: Country/Provider Mapping, Neighbourhood Structure (warning)
\end{itemize}
The \emph{LAC Change} and the \emph{rx Change} rules remain to be tested.
For this purpose the procedure was as follows.
@@ -230,14 +233,14 @@ These times can vary however depending on the timing of the catcher being turned
\centering
\begin{tabular}{lrrcrrrllr}
\toprule
- & &\multicolumn{2}{c}{rx} &\phantom{a} &\multicolumn{2}{c}{LAC} & & & \\
- \cmidrule{3-4} \cmidrule{6-7}
-Config &Cell &Old &New & &Old &New &rx det. &LAC det. &Time\\
+ & &\multicolumn{2}{c}{rx} &\phantom{a} &\multicolumn{2}{c}{LAC} & & & \\
+ \cmidrule{3-4} \cmidrule{6-7}
+Config &Cell &Old &New & &Old &New &rx det. &LAC det. &Time\\
\midrule
-Conf1 &877 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
-Conf1 &877 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
-Conf1 &877 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
-Conf1 &877 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
+T-Mobile &17 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
+O2 &877 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
+E-Plus &877 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
+Vodafone &877 &-94 dB &-55dB & &138 &139 &Yes &Yes &42 s\\
\bottomrule
\end{tabular}
\caption{failzor}
@@ -250,7 +253,6 @@ This has been done to find out whether base stations in the surrounding area cha
This is essential for a Location Area Database to be usable over a longer period of time.
The database itself has been built over the course of one week in Freiburg, Thuner Weg.
-%TODO: flil in exact values here
During this period no parameter changes were detected and the reception of base stations only varied inside a very small interval.
After that each day for another week, two scans per day were done.
One of them while the IMSI catcher was operating, the other without the device present.
@@ -306,12 +308,25 @@ MNC &01 &02 &03 &07\\
Note that the Cell ID can be a arbitrary value as long as it is unique in the area of reception.
Cell IDs measured from different base stations do not follow any particular schema.
The scenarios are built after the attacks described in Section \ref{sec:attacks}.
+Local information in terms of a Local Area Database was available.
+\subsubsection{IMSI Catcher as a new Cell}
The first scenario will simulate the case where the catcher opened up a new cell with a good reception and forced the \gls{ms} into normal cell selection mode by disconnecting it from the current base station via a jammer.
+First the IMSI catcher was turned on, faking a legitimate T-Mobile cell with a new cell ID.
+Afterwards the \gls{icds} was started and a sweep scan was performed.
+As soon as the cell was scanned which occurred very early since the reception was very good (-45) it was detected that this cell was not in the Local Area Database.
+After the sweep scan cell IDs from Google were also fetched.
+Both the Local Area Database Rule and the Cell ID Database Rule indicated a Critical status.
-The second scenario simulates the attack where the IMSI catcher replaces a base station with a bad reception in the neighbourhood of the cell the \gls{ms} is connected to.
-This way the reception drastically improves on that particular frequency suggesting to the \gls{ms} that the subscriber moved to the close perimeter of that \gls{bts} and initiating a handover.
+As a further step to simulate the case where no local information is available, the Local Area Database and Cell ID Rules were turned off.
+The \gls{icds} then yielded an Ok evaluation since the configuration of the catcher cell was consistent.
+The next step was to put the \gls{icds} into User Mode with T-Mobile as its fixed provider.
+It selected the IMSI catcher cell as its target cell because of the good reception level and since it's evaluation was 'Ok' an additional PCH scan was started.
+No paging messages or Immediate Assignments were caught so the end result was a 'Critical' status for the IMSI catcher cell.
+\subsubsection{IMSI Catcher replacing an old Cell}
+The second scenario simulated the attack where the IMSI catcher replaces a base station with a bad reception in the neighbourhood of the cell the \gls{ms} is connected to.
+This way the reception drastically improves on that particular frequency suggesting to the \gls{ms} that the subscriber moved to the close perimeter of that \gls{bts} and initiating a handover.
Figure \ref{fig:takeover_attack} illustrates this particular attack.
The station with the \gls{arfcn} 42 has the lowest reception with its signal to noise ratio of -95\,dB.
In this particular scenario the \gls{ms} would first connect to the station on 23 because of its good reception.
@@ -326,4 +341,7 @@ Since the catcher sends a different \gls{lac} the \gls{ms} will send a location
\includegraphics{../Images/replace_attack}
\caption{Takeover attack of an IMSI catcher on a base station.}
\label{fig:takeover_attack}
-\end{figure} \ No newline at end of file
+\end{figure}
+
+Due to its strong increase in reception and the change in the \gls{lac} the IMSI catcher cell obtained a 'Critical' status immediately after it had been scanned a second time.
+User Mode did not start a PCH scan since the evaluation had already been 'Critical'. \ No newline at end of file
diff --git a/Tex/Master/Master.acn b/Tex/Master/Master.acn
index 112ae19..50efbcf 100644
--- a/Tex/Master/Master.acn
+++ b/Tex/Master/Master.acn
@@ -519,12 +519,12 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{49}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{49}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{50}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{50}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{50}
-\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{50}
-\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{51}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{51}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
@@ -537,27 +537,27 @@
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{54}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{54}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{54}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{55}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{55}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{55}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{55}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{55}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{55}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{55}
-\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{55}
+\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{58}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{58}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{58}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{58}
\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{58}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{59}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
@@ -589,20 +589,25 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{66}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{66}
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{66}
-\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{67}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{66}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{66}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{67}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{67}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{68}
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{69}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{69}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{69}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{69}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{69}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{70}
diff --git a/Tex/Master/Master.aux b/Tex/Master/Master.aux
index c26495a..17d530d 100644
--- a/Tex/Master/Master.aux
+++ b/Tex/Master/Master.aux
@@ -279,16 +279,15 @@
\@writefile{toc}{\contentsline {section}{\numberline {3.3}IMSI Catcher Detection System}{50}}
\newlabel{sec:icds}{{3.3}{50}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Implemetation}{50}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{51}}
-\newlabel{fig:python_dict}{{3.8}{51}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{51}}
\newlabel{sec:configuration}{{3.3.2}{51}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{52}}
+\newlabel{fig:python_dict}{{3.8}{52}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Operation}{52}}
\newlabel{sec:icds_operation}{{3.3.3}{52}}
\@writefile{lof}{\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{53}}
\newlabel{fig:icds}{{3.9}{53}}
\@writefile{toc}{\contentsline {paragraph}{Sweep scans:}{55}}
-\@writefile{toc}{\contentsline {paragraph}{CellID Information:}{55}}
\newlabel{fig:filters_window}{{3.10(a)}{56}}
\newlabel{sub@fig:filters_window}{{(a)}{56}}
\newlabel{fig:rules_window}{{3.10(b)}{56}}
@@ -302,10 +301,11 @@
\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Rules window.}}}{56}}
\@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Databases window.}}}{56}}
\@writefile{lof}{\contentsline {subfigure}{\numberline{(d)}{\ignorespaces {Encryption window (not yet implemented).}}}{56}}
+\@writefile{toc}{\contentsline {paragraph}{CellID Information:}{57}}
\@writefile{toc}{\contentsline {paragraph}{Location Area Database:}{57}}
\@writefile{toc}{\contentsline {paragraph}{PCH Scan:}{57}}
-\@writefile{toc}{\contentsline {paragraph}{User Mode:}{57}}
\citation{catcher_catcher}
+\@writefile{toc}{\contentsline {paragraph}{User Mode:}{58}}
\@writefile{toc}{\contentsline {section}{\numberline {3.4}Related Projects}{58}}
\FN@pp@footnote@aux{15}{58}
\FN@pp@footnotehinttrue
@@ -351,8 +351,10 @@
\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{68}}
\@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{69}}
\newlabel{tab:consistent_parameters}{{4.6}{69}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{69}}
-\newlabel{fig:takeover_attack}{{4.5}{69}}
+\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher as a new Cell}{69}}
+\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{69}}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{70}}
+\newlabel{fig:takeover_attack}{{4.5}{70}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{71}}
@@ -439,8 +441,10 @@
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {D.1}IMSI Catcher Configurations}{91}}
-\newlabel{sec:config_data}{{D.1}{91}}
+\@writefile{toc}{\contentsline {section}{\numberline {D.1}Rx and LAC Change Test}{91}}
+\newlabel{sec_lac_change_test}{{D.1}{91}}
+\@writefile{toc}{\contentsline {section}{\numberline {D.2}Long Term Test}{91}}
+\newlabel{sec:long_term_test}{{D.2}{91}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\@writefile{toc}{\contentsline {chapter}{Acronyms}{93}}
diff --git a/Tex/Master/Master.ist b/Tex/Master/Master.ist
index a5794c7..f4b7626 100644
--- a/Tex/Master/Master.ist
+++ b/Tex/Master/Master.ist
@@ -1,5 +1,5 @@
% makeindex style file created by the glossaries package
-% for document 'Master' on 2012-5-21
+% for document 'Master' on 2012-5-28
actual '?'
encap '|'
level '!'
diff --git a/Tex/Master/Master.lof b/Tex/Master/Master.lof
index 08a06fc..4de561e 100644
--- a/Tex/Master/Master.lof
+++ b/Tex/Master/Master.lof
@@ -23,7 +23,7 @@
\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Tainted neighbourhood}}}{46}
\contentsline {figure}{\numberline {3.6}{\ignorespaces Procedure taken when the network has a call/text waiting for a passive subscriber.}}{49}
\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{50}
-\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{51}
+\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{52}
\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{53}
\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{56}
\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Filters window.}}}{56}
@@ -37,7 +37,7 @@
\contentsline {figure}{\numberline {4.4}{\ignorespaces Nokia 3310 NetMonitor screenshots.}}{66}
\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Connected cell information.}}}{66}
\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Neighbouring cell measurements.}}}{66}
-\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{69}
+\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{70}
\addvspace {10\p@ }
\addvspace {10\p@ }
\addvspace {10\p@ }
diff --git a/Tex/Master/Master.log b/Tex/Master/Master.log
index fdd6f93..341c5de 100644
--- a/Tex/Master/Master.log
+++ b/Tex/Master/Master.log
@@ -1,4 +1,4 @@
-This is pdfTeX, Version 3.1415926-1.40.10 (TeX Live 2009/Debian) (format=pdflatex 2012.1.7) 21 MAY 2012 18:37
+This is pdfTeX, Version 3.1415926-1.40.10 (TeX Live 2009/Debian) (format=pdflatex 2012.1.7) 28 MAY 2012 19:10
entering extended mode
%&-line parsing enabled.
**Master.tex
@@ -1084,25 +1084,25 @@ Class scrbook Info: You've told me to use the font selection of the element
(scrbook) on input line 63.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 74.
-Class scrbook Info: You've told me to use the font selection of the element
-(scrbook) `sectioning' that is an alias of element `disposition'
(scrbook) on input line 76.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 77.
+(scrbook) on input line 78.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 81.
+(scrbook) on input line 79.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 84.
+(scrbook) on input line 83.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 85.
+(scrbook) on input line 86.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
(scrbook) on input line 87.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 90.
)
\tf@toc=\write10
\openout10 = `Master.toc'.
@@ -1244,61 +1244,61 @@ LaTeX Font Info: Font shape `T1/phv/bx/n' in size <14.4> not available
LaTeX Warning: Reference `sec:log_channels' on page 49 undefined on input line
436.
+<../Images/Paging.png, id=234, 167.95547pt x 144.61227pt>
+File: ../Images/Paging.png Graphic file (type png)
-Underfull \vbox (badness 10000) has occurred while \output is active []
-
- [49]
-<../Images/Architecture_software.png, id=238, 341.8371pt x 183.78261pt>
+<use ../Images/Paging.png> [49 <../Images/Paging.png (PNG copy)>]
+<../Images/Architecture_software.png, id=239, 341.8371pt x 183.78261pt>
File: ../Images/Architecture_software.png Graphic file (type png)
<use ../Images/Architecture_software.png> [50 <../Images/Architecture_software.
png (PNG copy)>]
LaTeX Font Info: Font shape `T1/pcr/m/it' in size <10.95> not available
-(Font) Font shape `T1/pcr/m/sl' tried instead on input line 510.
+(Font) Font shape `T1/pcr/m/sl' tried instead on input line 511.
[51] <../Images/ICDS.png, id=246, 1287.81125pt x 881.2925pt>
File: ../Images/ICDS.png Graphic file (type png)
<use ../Images/ICDS.png> [52] [53 <../Images/ICDS.png>] [54]
-<../Images/filter_window.png, id=257, 311.1625pt x 218.8175pt>
+<../Images/filter_window.png, id=258, 311.1625pt x 218.8175pt>
File: ../Images/filter_window.png Graphic file (type png)
<use ../Images/filter_window.png>
-<../Images/rules_window.png, id=258, 278.03876pt x 358.33875pt>
+<../Images/rules_window.png, id=259, 278.03876pt x 358.33875pt>
File: ../Images/rules_window.png Graphic file (type png)
<use ../Images/rules_window.png>
-<../Images/databases.png, id=259, 358.33875pt x 373.395pt>
+<../Images/databases.png, id=260, 358.33875pt x 373.395pt>
File: ../Images/databases.png Graphic file (type png)
<use ../Images/databases.png>
File: ../Images/databases.png Graphic file (type png)
<use ../Images/databases.png>
-Underfull \hbox (badness 1297) in paragraph at lines 617--617
+Underfull \hbox (badness 1297) in paragraph at lines 618--618
[]\T1/ptm/m/n/9 (d) En-cryp-tion win-dow (not yet im-ple-
[]
-Overfull \hbox (10.40205pt too wide) in paragraph at lines 632--647
+Overfull \hbox (10.40205pt too wide) in paragraph at lines 633--648
[] \T1/ptm/b/n/10.95 Cel-lID In-for-ma-tion:[][] \T1/ptm/m/n/10.95 Cel-lID in-f
or-ma-tion can be ob-tained through sev-eral dif-fer-ent means.
[]
[55] [56 <../Images/filter_window.png> <../Images/rules_window.png> <../Images/
-databases.png>]
+databases.png>] [57]
-LaTeX Warning: Reference `fig:user_mode' on page 57 undefined on input line 663
+LaTeX Warning: Reference `fig:user_mode' on page 58 undefined on input line 664
.
-[57]
LaTeX Warning: Citation `catcher_catcher' on page 58 undefined on input line 68
-6.
+7.
+[58]
-LaTeX Warning: Reference `sec:catcher_features' on page 58 undefined on input l
-ine 698.
+LaTeX Warning: Reference `sec:catcher_features' on page 59 undefined on input l
+ine 699.
-[58]) (../Content/Evaluation.tex [59] [60
+) (../Content/Evaluation.tex [59] [60
]
@@ -1309,99 +1309,110 @@ Overfull \hbox (3.33815pt too wide) in paragraph at lines 16--30
[]
[61] [62] [63] [64]
-Overfull \hbox (9.98987pt too wide) in paragraph at lines 170--170
+Overfull \hbox (9.98987pt too wide) in paragraph at lines 172--172
[]\T1/ptm/m/n/9 (a)
[]
-Overfull \hbox (17.9999pt too wide) in paragraph at lines 170--170
+Overfull \hbox (17.9999pt too wide) in paragraph at lines 172--172
\T1/ptm/m/n/9 Con-
[]
-Overfull \hbox (23.48973pt too wide) in paragraph at lines 170--170
+Overfull \hbox (23.48973pt too wide) in paragraph at lines 172--172
\T1/ptm/m/n/9 nected
[]
-Overfull \hbox (12.9957pt too wide) in paragraph at lines 170--170
+Overfull \hbox (12.9957pt too wide) in paragraph at lines 172--172
\T1/ptm/m/n/9 cell
[]
-Overfull \hbox (9.99887pt too wide) in paragraph at lines 170--170
+Overfull \hbox (9.99887pt too wide) in paragraph at lines 172--172
\T1/ptm/m/n/9 in-
[]
-Overfull \hbox (13.31093pt too wide) in paragraph at lines 170--170
+Overfull \hbox (13.31093pt too wide) in paragraph at lines 172--172
\T1/ptm/m/n/9 for-
[]
-Overfull \hbox (13.99481pt too wide) in paragraph at lines 170--170
+Overfull \hbox (13.99481pt too wide) in paragraph at lines 172--172
\T1/ptm/m/n/9 ma-
[]
-Overfull \hbox (16.25381pt too wide) in paragraph at lines 170--170
+Overfull \hbox (16.25381pt too wide) in paragraph at lines 172--172
\T1/ptm/m/n/9 tion.
[]
-Overfull \hbox (10.49393pt too wide) in paragraph at lines 171--171
+Overfull \hbox (10.49393pt too wide) in paragraph at lines 173--173
[]\T1/ptm/m/n/9 (b)
[]
-Overfull \hbox (24.99278pt too wide) in paragraph at lines 171--171
+Overfull \hbox (24.99278pt too wide) in paragraph at lines 173--173
\T1/ptm/m/n/9 Neigh-
[]
-Overfull \hbox (19.31396pt too wide) in paragraph at lines 171--171
+Overfull \hbox (19.31396pt too wide) in paragraph at lines 173--173
\T1/ptm/m/n/9 bour-
[]
-Overfull \hbox (11.5019pt too wide) in paragraph at lines 171--171
+Overfull \hbox (11.5019pt too wide) in paragraph at lines 173--173
\T1/ptm/m/n/9 ing
[]
-Overfull \hbox (12.9957pt too wide) in paragraph at lines 171--171
+Overfull \hbox (12.9957pt too wide) in paragraph at lines 173--173
\T1/ptm/m/n/9 cell
[]
-Overfull \hbox (17.99075pt too wide) in paragraph at lines 171--171
+Overfull \hbox (17.99075pt too wide) in paragraph at lines 173--173
\T1/ptm/m/n/9 mea-
[]
-Overfull \hbox (17.99077pt too wide) in paragraph at lines 171--171
+Overfull \hbox (17.99077pt too wide) in paragraph at lines 173--173
\T1/ptm/m/n/9 sure-
[]
-Overfull \hbox (23.75066pt too wide) in paragraph at lines 171--171
+Overfull \hbox (23.75066pt too wide) in paragraph at lines 173--173
\T1/ptm/m/n/9 ments.
[]
+[65]
+Overfull \hbox (13.2843pt too wide) in paragraph at lines 208--214
+\T1/ptm/m/n/10.95 Rules trig-gered: LAC/Provider Map-ping, Neigh-bour-hood Stru
+c-ture, AR-FC-N/Provider
+ []
-Underfull \vbox (badness 1117) has occurred while \output is active []
+[66]
- [65]
-[66] [67] <../Images/replace_attack.png, id=305, 356.94153pt x 162.67976pt>
-File: ../Images/replace_attack.png Graphic file (type png)
+LaTeX Warning: Reference `sec:config_data' on page 67 undefined on input line 2
+29.
-<use ../Images/replace_attack.png>) (../Content/Conclusion.tex [68] [69 <../Ima
-ges/replace_attack.png (PNG copy)>] [70
+[67]
+Underfull \vbox (badness 10000) has occurred while \output is active []
+ [68]
+<../Images/replace_attack.png, id=309, 356.94153pt x 162.67976pt>
+File: ../Images/replace_attack.png Graphic file (type png)
-]
+<use ../Images/replace_attack.png> [69]) (../Content/Conclusion.tex [70 <../Ima
+ges/replace_attack.png (PNG copy)>]
Chapter 5.
-) [71] [72
+) [71
+
+
+] [72
@@ -1508,7 +1519,7 @@ Overfull \hbox (5.82301pt too wide) in paragraph at lines 47--48
[][][][][][][][][][][][][][][][][][]
[]
-[78] <../Images/t191cable.jpg, id=340, 702.625pt x 609.27625pt>
+[78] <../Images/t191cable.jpg, id=341, 702.625pt x 609.27625pt>
File: ../Images/t191cable.jpg Graphic file (type jpg)
<use ../Images/t191cable.jpg> [79 <../Images/t191cable.jpg>] [80
@@ -1527,18 +1538,18 @@ File: ../Images/sysinfo1.png Graphic file (type png)
LaTeX Warning: Float too large for page by 0.9002pt on input line 206.
-<../Images/sysinfo2.png, id=360, 261.32832pt x 440.55792pt>
+<../Images/sysinfo2.png, id=361, 261.32832pt x 440.55792pt>
File: ../Images/sysinfo2.png Graphic file (type png)
<use ../Images/sysinfo2.png>
LaTeX Warning: Float too large for page by 61.98238pt on input line 211.
-<../Images/sysinfo3.png, id=361, 284.45473pt x 373.49136pt>
+<../Images/sysinfo3.png, id=362, 284.45473pt x 373.49136pt>
File: ../Images/sysinfo3.png Graphic file (type png)
<use ../Images/sysinfo3.png>
-<../Images/sysinfo4.png, id=362, 252.07776pt x 370.0224pt>
+<../Images/sysinfo4.png, id=363, 252.07776pt x 370.0224pt>
File: ../Images/sysinfo4.png Graphic file (type png)
<use ../Images/sysinfo4.png> [85
@@ -1550,11 +1561,7 @@ G copy)>] [89 <../Images/sysinfo4.png (PNG copy)>] [90
]
Appendix D.
-
-Underfull \vbox (badness 10000) has occurred while \output is active []
-
- [91])
-(./Master.acr [92]
+[91]) (./Master.acr [92]
Underfull \hbox (badness 2626) in paragraph at lines 24--24
[]|\T1/ptm/m/n/10.95 Conférence Eu-ropéenne des Ad-min-is-tra-tions des
[]
@@ -1575,10 +1582,10 @@ LaTeX Warning: There were undefined references.
)
Here is how much of TeX's memory you used:
- 24980 strings out of 493848
- 467231 string characters out of 1152824
- 689952 words of memory out of 3000000
- 27598 multiletter control sequences out of 15000+50000
+ 24987 strings out of 493848
+ 467381 string characters out of 1152824
+ 689963 words of memory out of 3000000
+ 27604 multiletter control sequences out of 15000+50000
82699 words of font info for 109 fonts, out of 3000000 for 9000
714 hyphenation exceptions out of 8191
69i,13n,72p,1076b,1689s stack positions out of 5000i,500n,10000p,200000b,50000s
@@ -1598,9 +1605,9 @@ nts/type1/urw/helvetic/uhvb8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/tim
es/utmb8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/
share/texmf-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/share/texmf-texlive/
fonts/type1/urw/times/utmri8a.pfb>
-Output written on Master.pdf (107 pages, 13163027 bytes).
+Output written on Master.pdf (107 pages, 13383627 bytes).
PDF statistics:
- 458 PDF objects out of 1000 (max. 8388607)
+ 459 PDF objects out of 1000 (max. 8388607)
0 named destinations out of 1000 (max. 500000)
- 153 words of extra memory for PDF output out of 10000 (max. 10000000)
+ 158 words of extra memory for PDF output out of 10000 (max. 10000000)
diff --git a/Tex/Master/Master.pdf b/Tex/Master/Master.pdf
index 2c8b7c5..144952d 100644
--- a/Tex/Master/Master.pdf
+++ b/Tex/Master/Master.pdf
Binary files differ
diff --git a/Tex/Master/Master.synctex.gz b/Tex/Master/Master.synctex.gz
index ce62dc4..9b548a1 100644
--- a/Tex/Master/Master.synctex.gz
+++ b/Tex/Master/Master.synctex.gz
Binary files differ
diff --git a/Tex/Master/Master.toc b/Tex/Master/Master.toc
index 5c19a96..c4e67b9 100644
--- a/Tex/Master/Master.toc
+++ b/Tex/Master/Master.toc
@@ -55,10 +55,10 @@
\contentsline {subsection}{\numberline {3.3.2}Configuration}{51}
\contentsline {subsection}{\numberline {3.3.3}Operation}{52}
\contentsline {paragraph}{Sweep scans:}{55}
-\contentsline {paragraph}{CellID Information:}{55}
+\contentsline {paragraph}{CellID Information:}{57}
\contentsline {paragraph}{Location Area Database:}{57}
\contentsline {paragraph}{PCH Scan:}{57}
-\contentsline {paragraph}{User Mode:}{57}
+\contentsline {paragraph}{User Mode:}{58}
\contentsline {section}{\numberline {3.4}Related Projects}{58}
\contentsline {chapter}{\numberline {4}Evaluation}{61}
\contentsline {section}{\numberline {4.1}Performance Evaluation}{61}
@@ -71,6 +71,8 @@
\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{66}
\contentsline {subsection}{\numberline {4.2.3}Long Term Test}{67}
\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{68}
+\contentsline {subsubsection}{IMSI Catcher as a new Cell}{69}
+\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{69}
\contentsline {chapter}{\numberline {5}Conclusion}{71}
\contentsline {section}{\numberline {5.1}Future Work}{71}
\contentsline {chapter}{Bibliography}{73}
@@ -83,5 +85,6 @@
\contentsline {section}{\numberline {B.2}Example Configuration}{82}
\contentsline {chapter}{\numberline {C}System Information}{85}
\contentsline {chapter}{\numberline {D}Evaluation Data}{91}
-\contentsline {section}{\numberline {D.1}IMSI Catcher Configurations}{91}
+\contentsline {section}{\numberline {D.1}Rx and LAC Change Test}{91}
+\contentsline {section}{\numberline {D.2}Long Term Test}{91}
\contentsline {chapter}{Acronyms}{93}