summaryrefslogtreecommitdiffstats
path: root/Tex/Master/Master.aux
diff options
context:
space:
mode:
Diffstat (limited to 'Tex/Master/Master.aux')
-rw-r--r--Tex/Master/Master.aux392
1 files changed, 203 insertions, 189 deletions
diff --git a/Tex/Master/Master.aux b/Tex/Master/Master.aux
index 33b9104..2d4ca48 100644
--- a/Tex/Master/Master.aux
+++ b/Tex/Master/Master.aux
@@ -74,101 +74,101 @@
\citation{hsdpa}
\citation{hsupa}
\citation{kommsys2006}
+\citation{ITU1200}
\FN@pp@footnote@aux{1}{7}
\@writefile{toc}{\contentsline {section}{\numberline {2.2}The GSM Network}{7}}
\newlabel{sec:network}{{2.2}{7}}
-\citation{ITU1200}
\citation{GSM2009}
\citation{overview1994}
\citation{overview1996}
\@writefile{lof}{\contentsline {figure}{\numberline {2.2}{\ignorespaces The main components of a GSM network.}}{8}}
\newlabel{fig:gsm_network}{{2.2}{8}}
\FN@pp@footnote@aux{2}{8}
+\@writefile{toc}{\contentsline {subsection}{\numberline {2.2.1}Mobile Station}{8}}
+\newlabel{sec:ms}{{2.2.1}{8}}
\citation{GSM0207}
\citation{protocols1999}
\citation{ISO7810}
-\@writefile{toc}{\contentsline {subsection}{\numberline {2.2.1}Mobile Station}{9}}
-\newlabel{sec:ms}{{2.2.1}{9}}
-\FN@pp@footnote@aux{3}{9}
-\FN@pp@footnote@aux{4}{9}
\citation{protocols1999}
\citation{protocols1999}
+\FN@pp@footnote@aux{3}{9}
+\FN@pp@footnote@aux{4}{9}
\citation{kommsys2006}
\citation{GSM23003}
+\citation{ITU212}
\@writefile{lot}{\contentsline {table}{\numberline {2.1}{\ignorespaces Subset of data stored on a SIM card. Adopted from \cite {protocols1999}}}{10}}
\newlabel{tab:simdata}{{2.1}{10}}
-\citation{ITU212}
\@writefile{lot}{\contentsline {table}{\numberline {2.2}{\ignorespaces Mobile Country and Network Codes. (R) denotes that the MCC is reserved but not operational as of yet, whereas (T) denotes a operational test network.}}{11}}
\newlabel{tab:countrycodes}{{2.2}{11}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2.2}Network Subsystem}{11}}
\newlabel{sec:nss}{{2.2.2}{11}}
-\@writefile{toc}{\contentsline {subsubsection}{Mobile Switching Center}{12}}
+\@writefile{toc}{\contentsline {subsubsection}{Mobile Switching Center}{11}}
\@writefile{toc}{\contentsline {subsubsection}{Home Location Register}{12}}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.3}{\ignorespaces Authentication procedure.}}{13}}
+\newlabel{fig:authentication}{{2.3}{13}}
\@writefile{toc}{\contentsline {subsubsection}{Visitor Location Register}{13}}
-\@writefile{toc}{\contentsline {subsubsection}{Authentication Center}{13}}
-\newlabel{sec:authentication}{{2.2.2}{13}}
-\FN@pp@footnote@aux{5}{13}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.3}{\ignorespaces Authentication procedure.}}{14}}
-\newlabel{fig:authentication}{{2.3}{14}}
\citation{kommsys2006}
\citation{kommsys2006}
+\@writefile{toc}{\contentsline {subsubsection}{Authentication Center}{14}}
+\newlabel{sec:authentication}{{2.2.2}{14}}
+\FN@pp@footnote@aux{5}{14}
+\citation{kommsys2006}
+\citation{kommsys2006}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.4}{\ignorespaces Mapping of functional entities on the 900\tmspace +\thinmuskip {.1667em}MHz\ band.}}{15}}
+\newlabel{fig:frequency}{{2.4}{15}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2.3}Base Station Subsystem}{15}}
\newlabel{sec:bss}{{2.2.3}{15}}
\@writefile{toc}{\contentsline {subsubsection}{Frequencies and the Cellular Principle}{15}}
-\citation{kommsys2006}
-\citation{kommsys2006}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.4}{\ignorespaces Mapping of functional entities on the 900\tmspace +\thinmuskip {.1667em}MHz\ band.}}{16}}
-\newlabel{fig:frequency}{{2.4}{16}}
+\citation{GSM2009}
\@writefile{lot}{\contentsline {table}{\numberline {2.3}{\ignorespaces Frequencies in the different bands \cite {kommsys2006}.}}{16}}
\newlabel{tab:frequencies}{{2.3}{16}}
-\citation{GSM2009}
\citation{protocols1999}
\citation{GSM2009}
\citation{GSM2009}
\citation{kommsys2006}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.5}{\ignorespaces Theoretical arrangement of radio cells compared to a realistic alignment. Cells with the same number share the same frequency \cite {GSM2009}.}}{17}}
+\newlabel{fig:cells}{{2.5}{17}}
\@writefile{toc}{\contentsline {subsubsection}{Base Transceiver Station}{17}}
\citation{kommsys2006}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.5}{\ignorespaces Theoretical arrangement of radio cells compared to a realistic alignment. Cells with the same number share the same frequency \cite {GSM2009}.}}{18}}
-\newlabel{fig:cells}{{2.5}{18}}
\@writefile{toc}{\contentsline {subsubsection}{Base Station Controller}{18}}
\citation{kommsys2006}
\citation{kommsys2006}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.6}{\ignorespaces Ciphering procedure for one frame of voice data. Adopted from \cite {kommsys2006}.}}{19}}
+\newlabel{fig:cypher}{{2.6}{19}}
\citation{protocols1999}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.6}{\ignorespaces Ciphering procedure for one frame of voice data. Adopted from \cite {kommsys2006}.}}{20}}
-\newlabel{fig:cypher}{{2.6}{20}}
\@writefile{toc}{\contentsline {section}{\numberline {2.3}The $U_m$ Interface}{20}}
\newlabel{sec:Um}{{2.3}{20}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3.1}Radio Transmission}{20}}
\newlabel{sec:radio}{{2.3.1}{20}}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.7}{\ignorespaces The combination of FDMA and TDMA.}}{21}}
-\newlabel{fig:fdma_tdma}{{2.7}{21}}
-\@writefile{toc}{\contentsline {subsubsection}{Frame Numbering}{21}}
\citation{GSM2009}
\citation{GSM2009}
\citation{GSM2009}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.7}{\ignorespaces The combination of FDMA and TDMA.}}{21}}
+\newlabel{fig:fdma_tdma}{{2.7}{21}}
+\@writefile{toc}{\contentsline {subsubsection}{Frame Numbering}{21}}
+\@writefile{toc}{\contentsline {subsubsection}{Burst Types}{21}}
\@writefile{lof}{\contentsline {figure}{\numberline {2.8}{\ignorespaces Hierarchical composition of the different frames.}}{22}}
\newlabel{fig:frame_hierarchy}{{2.8}{22}}
-\@writefile{toc}{\contentsline {subsubsection}{Burst Types}{22}}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.9}{\ignorespaces Structural Comparison of different Burst types. After \cite {GSM2009}.}}{23}}
-\newlabel{fig:burst_types}{{2.9}{23}}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.9}{\ignorespaces Structural Comparison of different Burst types. After \cite {GSM2009}.}}{22}}
+\newlabel{fig:burst_types}{{2.9}{22}}
\citation{kommsys2006}
\@writefile{lof}{\contentsline {figure}{\numberline {2.10}{\ignorespaces Mapping of virtual channels on time slots.}}{24}}
\newlabel{fig:channels}{{2.10}{24}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3.2}Logical Channels}{24}}
\newlabel{sec:channels}{{2.3.2}{24}}
-\@writefile{toc}{\contentsline {subsubsection}{Dedicated Channels}{25}}
+\@writefile{toc}{\contentsline {subsubsection}{Dedicated Channels}{24}}
+\citation{gsm0502}
\@writefile{toc}{\contentsline {subsubsection}{Common Channels}{25}}
\newlabel{sec:common_channels}{{2.3.2}{25}}
-\citation{gsm0502}
\citation{protocols1999}
\citation{GSM0405}
\citation{GSM0406}
+\citation{protocols1999}
\@writefile{toc}{\contentsline {subsubsection}{Combinations}{26}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3.3}Layers}{26}}
\newlabel{sec:layers}{{2.3.3}{26}}
\@writefile{toc}{\contentsline {paragraph}{Physical Layer (Layer 1):}{26}}
\@writefile{toc}{\contentsline {paragraph}{Data Link (Layer 2):}{26}}
-\citation{protocols1999}
\citation{fox}
\citation{imsi_wiki}
\citation{fox}
@@ -178,11 +178,13 @@
\citation{def_catcher}
\citation{fox}
\citation{def_catcher}
+\citation{mueller}
\@writefile{toc}{\contentsline {paragraph}{Network (Layer 3):}{27}}
\@writefile{toc}{\contentsline {section}{\numberline {2.4}IMSI-Catcher}{27}}
\newlabel{sec:catcher}{{2.4}{27}}
\citation{mueller}
\citation{mueller}
+\citation{fox}
\citation{mueller}
\citation{fox}
\@writefile{lof}{\contentsline {figure}{\numberline {2.11}{\ignorespaces A commercial catcher by Rhode \& Schwarz \cite {fox} and a self built catcher introduced at Defcon 2010 \cite {def_catcher}.}}{28}}
@@ -191,26 +193,24 @@
\newlabel{sec:catcher_operation}{{2.4.1}{28}}
\@writefile{lof}{\contentsline {figure}{\numberline {2.12}{\ignorespaces IMSI catching procedure. Adopted and simplified from \cite {mueller}.}}{29}}
\newlabel{fig:catcher_catch}{{2.12}{29}}
-\citation{mueller}
-\citation{fox}
\citation{dennis}
\citation{imsi_wiki}
+\citation{fox}
\@writefile{toc}{\contentsline {subsubsection}{Attacks}{30}}
\newlabel{sec:attacks}{{2.4.1}{30}}
\@writefile{toc}{\contentsline {paragraph}{MS is in normal cell selection mode:}{30}}
\@writefile{toc}{\contentsline {paragraph}{MS is already connected to a network:}{30}}
\citation{fox}
-\citation{fox}
\citation{imsi_wiki}
+\citation{criminal_justice}
\@writefile{toc}{\contentsline {subsubsection}{Risks and Irregularities}{31}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.4.2}Law Situation in Germany}{31}}
\newlabel{sec:catcher_law}{{2.4.2}{31}}
-\citation{criminal_justice}
\FN@pp@footnotehinttrue
\citation{dennis}
\citation{osmo_rationale}
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {3}IMSI Catcher Detection}{33}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {3}IMSI Catcher Detection System}{33}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
@@ -235,8 +235,6 @@
\@writefile{lof}{\contentsline {figure}{\numberline {3.2}{\ignorespaces Interaction of the OsmocomBB components with the ICDS software.}}{37}}
\newlabel{fig:osmo_setup}{{3.2}{37}}
\@writefile{toc}{\contentsline {section}{\numberline {3.2}Procedure}{37}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{37}}
-\newlabel{sec:info_gathering}{{3.2.1}{37}}
\citation{GSM2009}
\citation{GSM2009}
\citation{protocols1999}
@@ -244,128 +242,144 @@
\citation{protocols1999}
\@writefile{lot}{\contentsline {table}{\numberline {3.2}{\ignorespaces Type Codes and the corresponding System Information Types \cite {GSM2009}.}}{38}}
\newlabel{tab:tc_mapping}{{3.2}{38}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 1 Message \cite {protocols1999}.}}{39}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{38}}
+\newlabel{sec:info_gathering}{{3.2.1}{38}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 2 Message \cite {protocols1999}.}}{39}}
\newlabel{fig:si1}{{3.3}{39}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{40}}
-\newlabel{sec:info_evaluation}{{3.2.2}{40}}
-\@writefile{lot}{\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{41}}
-\newlabel{tab:config_rules}{{3.3}{41}}
-\@writefile{lot}{\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{42}}
-\newlabel{tab:context_rules}{{3.4}{42}}
-\FN@pp@footnote@aux{10}{42}
-\@writefile{toc}{\contentsline {subsubsection}{Neighbourhood Structure}{42}}
-\FN@pp@footnote@aux{11}{43}
-\@writefile{toc}{\contentsline {subsubsection}{Base Station Evaluation}{43}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.4}{\ignorespaces Base stations and their neighbourhood connections at the Technische Fakult\"at.}}{44}}
-\newlabel{fig:neighbourhood_example}{{3.4}{44}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.5}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{44}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Normal neighbourhood}}}{44}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Tainted neighbourhood}}}{44}}
-\newlabel{fig:structure_comparison}{{3.5}{44}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.3}Forged Parameters}{45}}
-\newlabel{sec:fake_parameters}{{3.2.3}{45}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.4}{\ignorespaces Procedure taken when the network has a call/text waiting for a passive subscriber.}}{41}}
+\newlabel{fig:paging}{{3.4}{41}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{41}}
+\newlabel{sec:info_evaluation}{{3.2.2}{41}}
+\@writefile{lot}{\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{42}}
+\newlabel{tab:config_rules}{{3.3}{42}}
+\@writefile{toc}{\contentsline {subsubsection}{Configuration Rules}{42}}
+\@writefile{lot}{\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{43}}
+\newlabel{tab:context_rules}{{3.4}{43}}
+\FN@pp@footnote@aux{10}{43}
+\@writefile{toc}{\contentsline {subsubsection}{Context Rules}{43}}
+\@writefile{toc}{\contentsline {paragraph}{Neighbourhood Structure}{44}}
+\FN@pp@footnote@aux{11}{44}
+\FN@pp@footnote@aux{12}{44}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.5}{\ignorespaces Base stations and their neighbourhood connections at the Faculty of Engineering.}}{45}}
+\newlabel{fig:neighbourhood_example}{{3.5}{45}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.6}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{45}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Normal neighbourhood}}}{45}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Tainted neighbourhood}}}{45}}
+\newlabel{fig:structure_comparison}{{3.6}{45}}
\citation{wiki_cells}
+\@writefile{lot}{\contentsline {table}{\numberline {3.5}{\ignorespaces Database Rules implemented inside the ICDS.}}{46}}
+\newlabel{tab:database_rules}{{3.5}{46}}
\@writefile{toc}{\contentsline {subsubsection}{Database Rules}{46}}
-\FN@pp@footnote@aux{12}{46}
\FN@pp@footnote@aux{13}{46}
-\FN@pp@footnote@aux{14}{46}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.6}{\ignorespaces Procedure taken when the network has a call/text waiting for a passive subscriber.}}{47}}
-\newlabel{fig:paging}{{3.6}{47}}
-\@writefile{toc}{\contentsline {subsubsection}{Remaining Issues and Paging}{47}}
-\newlabel{sec:paging}{{3.2.3}{47}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{48}}
-\newlabel{fig:architecture}{{3.7}{48}}
-\@writefile{toc}{\contentsline {section}{\numberline {3.3}IMSI Catcher Detection System}{48}}
-\newlabel{sec:icds}{{3.3}{48}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Implemetation}{48}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{49}}
-\newlabel{sec:configuration}{{3.3.2}{49}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{50}}
-\newlabel{fig:python_dict}{{3.8}{50}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Operation}{50}}
-\newlabel{sec:icds_operation}{{3.3.3}{50}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{51}}
-\newlabel{fig:icds}{{3.9}{51}}
-\@writefile{toc}{\contentsline {paragraph}{Sweep scans:}{53}}
-\newlabel{fig:databases_window}{{3.10(a)}{54}}
-\newlabel{sub@fig:databases_window}{{(a)}{54}}
-\newlabel{fig:rules_window}{{3.10(b)}{54}}
-\newlabel{sub@fig:rules_window}{{(b)}{54}}
-\newlabel{fig:filters_window}{{3.10(c)}{54}}
-\newlabel{sub@fig:filters_window}{{(c)}{54}}
-\newlabel{fig:pch_window}{{3.10(d)}{54}}
-\newlabel{sub@fig:pch_window}{{(d)}{54}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{54}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Databases window.}}}{54}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Rules window.}}}{54}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Filters window.}}}{54}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(d)}{\ignorespaces {PCH scan window.}}}{54}}
-\@writefile{toc}{\contentsline {paragraph}{CellID Information:}{55}}
-\@writefile{toc}{\contentsline {paragraph}{Location Area Database:}{55}}
-\@writefile{toc}{\contentsline {paragraph}{PCH Scan:}{55}}
+\@writefile{lot}{\contentsline {table}{\numberline {3.6}{\ignorespaces Scan Rules implemented inside the ICDS.}}{47}}
+\newlabel{tab:scan_rules}{{3.6}{47}}
+\FN@pp@footnote@aux{14}{47}
+\FN@pp@footnote@aux{15}{47}
+\@writefile{toc}{\contentsline {subsubsection}{Scan Rules}{47}}
+\@writefile{toc}{\contentsline {subsubsection}{Remaining Issues and Paging}{48}}
+\newlabel{sec:paging}{{3.2.2}{48}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.3}Base Station Evaluation}{49}}
+\newlabel{sec:evaluators}{{3.2.3}{49}}
+\@writefile{toc}{\contentsline {section}{\numberline {3.3}Implementation}{49}}
+\newlabel{sec:icds}{{3.3}{49}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Architecture}{49}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{50}}
+\newlabel{fig:architecture}{{3.7}{50}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{51}}
+\newlabel{fig:python_dict}{{3.8}{51}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{51}}
+\newlabel{sec:configuration}{{3.3.2}{51}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{52}}
+\newlabel{fig:icds}{{3.9}{52}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Graphical User Interface}{52}}
+\newlabel{sec:icds_operation}{{3.3.3}{52}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.4}Usage}{54}}
+\newlabel{sec:user_mode}{{3.3.4}{54}}
+\newlabel{fig:databases_window}{{3.10(a)}{55}}
+\newlabel{sub@fig:databases_window}{{(a)}{55}}
+\newlabel{fig:rules_window}{{3.10(b)}{55}}
+\newlabel{sub@fig:rules_window}{{(b)}{55}}
+\newlabel{fig:filters_window}{{3.10(c)}{55}}
+\newlabel{sub@fig:filters_window}{{(c)}{55}}
+\newlabel{fig:pch_window}{{3.10(d)}{55}}
+\newlabel{sub@fig:pch_window}{{(d)}{55}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{55}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Databases window.}}}{55}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Rules window.}}}{55}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Filters window.}}}{55}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(d)}{\ignorespaces {PCH scan window.}}}{55}}
+\newlabel{fig:dialogs}{{3.10}{55}}
+\@writefile{toc}{\contentsline {paragraph}{Conducting sweep scans:}{56}}
+\@writefile{toc}{\contentsline {paragraph}{Using and obtaining Cell ID Information:}{56}}
+\@writefile{toc}{\contentsline {paragraph}{Building or using a Local Area Database:}{56}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.11}{\ignorespaces The User Mode window.}}{57}}
+\newlabel{fig:user_mode}{{3.11}{57}}
+\@writefile{toc}{\contentsline {paragraph}{Conducting a PCH Scan:}{57}}
+\@writefile{toc}{\contentsline {paragraph}{Utilising User Mode:}{57}}
\citation{catcher_catcher}
-\@writefile{toc}{\contentsline {paragraph}{User Mode:}{56}}
-\@writefile{toc}{\contentsline {section}{\numberline {3.4}Related Projects}{56}}
-\FN@pp@footnote@aux{15}{56}
+\@writefile{toc}{\contentsline {section}{\numberline {3.4}Related Projects}{58}}
+\FN@pp@footnote@aux{16}{58}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{59}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{61}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {4.1}Performance Evaluation}{59}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{59}}
-\newlabel{tab:key_data}{{4.1}{59}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{60}}
-\newlabel{fig:durations}{{4.1}{60}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{60}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in s for fetching the information.}}{61}}
-\newlabel{tab:coverage}{{4.2}{61}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{61}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{61}}
+\@writefile{toc}{\contentsline {section}{\numberline {4.1}Performance Evaluation}{61}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{61}}
+\newlabel{tab:key_data}{{4.1}{61}}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{62}}
+\newlabel{fig:durations}{{4.1}{62}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{62}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in s for fetching the information.}}{63}}
+\newlabel{tab:coverage}{{4.2}{63}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{63}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{63}}
\citation{dennis}
-\@writefile{lot}{\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Pagings and Immediate Assignments (per 10\tmspace +\thickmuskip {.2777em}s) for the four German providers at different locations.}}{62}}
-\newlabel{tab:pagings}{{4.3}{62}}
-\@writefile{toc}{\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{62}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{62}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{63}}
-\newlabel{fig:setup}{{4.2}{63}}
-\FN@pp@footnote@aux{16}{63}
-\FN@pp@footnote@aux{17}{63}
-\FN@pp@footnote@aux{18}{63}
-\@writefile{toc}{\contentsline {subsubsection}{Nokia 3310}{63}}
-\FN@pp@footnote@aux{19}{63}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{64}}
-\newlabel{fig:openbts_parameters}{{4.3}{64}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.4}{\ignorespaces Nokia 3310 NetMonitor screenshots.}}{64}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Connected cell information.}}}{64}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Neighbouring cell measurements.}}}{64}}
-\newlabel{fig:netmonitor}{{4.4}{64}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{65}}
-\newlabel{tab:err_configs}{{4.4}{65}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{65}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.5}{\ignorespaces failzor}}{66}}
-\newlabel{tab:par_change}{{4.5}{66}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Long Term Test}{66}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long term evaluation.}}{67}}
-\newlabel{tab:longterm_test}{{4.6}{67}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{67}}
-\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher as a new Cell}{67}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{68}}
-\newlabel{tab:consistent_parameters}{{4.7}{68}}
-\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{68}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{69}}
-\newlabel{fig:takeover_attack}{{4.5}{69}}
-\FN@pp@footnotehinttrue
-\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{71}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Pagings and Immediate Assignments (per 10\tmspace +\thickmuskip {.2777em}s) for the four German providers at different locations.}}{64}}
+\newlabel{tab:pagings}{{4.3}{64}}
+\@writefile{toc}{\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{64}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{64}}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{65}}
+\newlabel{fig:setup}{{4.2}{65}}
+\FN@pp@footnote@aux{17}{65}
+\FN@pp@footnote@aux{18}{65}
+\FN@pp@footnote@aux{19}{65}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{66}}
+\newlabel{fig:openbts_parameters}{{4.3}{66}}
+\@writefile{toc}{\contentsline {subsubsection}{Nokia 3310}{66}}
+\FN@pp@footnote@aux{20}{66}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.4}{\ignorespaces Nokia 3310 NetMonitor screenshots.}}{67}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Connected cell information.}}}{67}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Neighbouring cell measurements.}}}{67}}
+\newlabel{fig:netmonitor}{{4.4}{67}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{67}}
+\newlabel{tab:err_configs}{{4.4}{67}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{67}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.5}{\ignorespaces failzor}}{68}}
+\newlabel{tab:par_change}{{4.5}{68}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Long Term Test}{68}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long term evaluation.}}{69}}
+\newlabel{tab:longterm_test}{{4.6}{69}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{69}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{70}}
+\newlabel{tab:consistent_parameters}{{4.7}{70}}
+\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher as a new Cell}{70}}
+\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{70}}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{71}}
+\newlabel{fig:takeover_attack}{{4.5}{71}}
+\FN@pp@footnotehinttrue
+\FN@pp@footnotehinttrue
+\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{73}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {5.1}Summary}{71}}
-\@writefile{lof}{\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{72}}
-\newlabel{fig:decision_process}{{5.1}{72}}
-\@writefile{toc}{\contentsline {section}{\numberline {5.2}Future Work}{73}}
+\@writefile{toc}{\contentsline {section}{\numberline {5.1}Summary}{73}}
+\@writefile{lof}{\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{74}}
+\newlabel{fig:decision_process}{{5.1}{74}}
+\@writefile{toc}{\contentsline {section}{\numberline {5.2}Future Work}{75}}
+\FN@pp@footnotehinttrue
+\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\bibstyle{acm}
\citation{*}
@@ -384,9 +398,7 @@
\bibcite{fox}{12}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\FN@pp@footnotehinttrue
-\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{Bibliography}{75}}
+\@writefile{toc}{\contentsline {chapter}{Bibliography}{77}}
\bibcite{GSM_stats2011}{13}
\bibcite{GSM_history2011}{14}
\bibcite{osmo_slides}{15}
@@ -394,76 +406,78 @@
\bibcite{protocols1999}{17}
\bibcite{hsdpa}{18}
\bibcite{hsupa}{19}
-\bibcite{osmo_rationale}{20}
+\bibcite{osmo_c123}{20}
\bibcite{osmo_wiki_c123}{21}
-\bibcite{criminal_justice}{22}
-\bibcite{kommsys2006}{23}
-\bibcite{overview1996}{24}
-\bibcite{def_catcher}{25}
-\bibcite{ITU1200}{26}
-\bibcite{ITU212}{27}
-\bibcite{dennis}{28}
-\bibcite{wiki_cells}{29}
-\bibcite{blacklisting}{30}
+\bibcite{osmo_rationale}{22}
+\bibcite{criminal_justice}{23}
+\bibcite{kommsys2006}{24}
+\bibcite{overview1996}{25}
+\bibcite{def_catcher}{26}
+\bibcite{ITU1200}{27}
+\bibcite{ITU212}{28}
+\bibcite{dennis}{29}
+\bibcite{wiki_cells}{30}
\bibcite{imsi_wiki}{31}
+\bibcite{blacklisting}{32}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {A}GSM}{79}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {A}GSM}{81}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {A.1}Interfaces}{79}}
-\newlabel{sec:interfaces}{{A.1}{79}}
-\@writefile{lot}{\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{79}}
-\@writefile{toc}{\contentsline {section}{\numberline {A.2}Channel Combinations}{80}}
-\newlabel{sec:combinations}{{A.2}{80}}
-\@writefile{lot}{\contentsline {table}{\numberline {A.2}{\ignorespaces Possible mappings of channels onto Multiframes}}{80}}
+\@writefile{toc}{\contentsline {section}{\numberline {A.1}Interfaces}{81}}
+\newlabel{sec:interfaces}{{A.1}{81}}
+\@writefile{lot}{\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{81}}
+\@writefile{toc}{\contentsline {section}{\numberline {A.2}Channel Combinations}{82}}
+\newlabel{sec:combinations}{{A.2}{82}}
+\@writefile{lot}{\contentsline {table}{\numberline {A.2}{\ignorespaces Possible mappings of channels onto Multiframes}}{82}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {B}OsmocomBB}{81}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {B}OsmocomBB}{83}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {B.1}Installation}{81}}
-\newlabel{sec:osmo_install}{{B.1}{81}}
-\@writefile{toc}{\contentsline {section}{\numberline {B.2}Usage}{82}}
-\newlabel{sec:osmo_usage}{{B.2}{82}}
-\@writefile{toc}{\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{83}}
-\newlabel{sec:osmo_serial_schematics}{{B.3}{83}}
+\@writefile{toc}{\contentsline {section}{\numberline {B.1}Installation}{83}}
+\newlabel{sec:osmo_install}{{B.1}{83}}
+\@writefile{toc}{\contentsline {section}{\numberline {B.2}Usage}{84}}
+\newlabel{sec:osmo_usage}{{B.2}{84}}
+\@writefile{toc}{\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{85}}
+\newlabel{sec:osmo_serial_schematics}{{B.3}{85}}
+\FN@pp@footnote@aux{21}{85}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{85}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{87}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {C.1}Extextions}{85}}
-\newlabel{sec:extensions}{{C.1}{85}}
-\@writefile{toc}{\contentsline {section}{\numberline {C.2}Example Configuration}{86}}
-\newlabel{sec:example_config}{{C.2}{86}}
+\@writefile{toc}{\contentsline {section}{\numberline {C.1}Extextions}{87}}
+\newlabel{sec:extensions}{{C.1}{87}}
+\@writefile{toc}{\contentsline {section}{\numberline {C.2}Example Configuration}{89}}
+\newlabel{sec:example_config}{{C.2}{89}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {D}System Information}{89}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {D}System Information}{93}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\newlabel{sec:system_infos}{{D}{89}}
+\newlabel{sec:system_infos}{{D}{93}}
\FN@pp@footnotehinttrue
-\@writefile{lof}{\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{90}}
-\@writefile{lof}{\contentsline {figure}{\numberline {D.2}{\ignorespaces System Information 2 Message}}{91}}
-\@writefile{lof}{\contentsline {figure}{\numberline {D.3}{\ignorespaces System Information 3 Message}}{92}}
-\@writefile{lof}{\contentsline {figure}{\numberline {D.4}{\ignorespaces System Information 4 Message}}{93}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{94}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.2}{\ignorespaces System Information 2 Message}}{95}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.3}{\ignorespaces System Information 3 Message}}{96}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.4}{\ignorespaces System Information 4 Message}}{97}}
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {E}Evaluation Data}{95}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {E}Evaluation Data}{99}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{95}}
-\newlabel{sec_lac_change_test}{{E.1}{95}}
-\@writefile{toc}{\contentsline {section}{\numberline {E.2}Long Term Test}{95}}
-\newlabel{sec:long_term_test}{{E.2}{95}}
+\@writefile{toc}{\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{99}}
+\newlabel{sec_lac_change_test}{{E.1}{99}}
+\@writefile{toc}{\contentsline {section}{\numberline {E.2}Long Term Test}{99}}
+\newlabel{sec:long_term_test}{{E.2}{99}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{Acronyms}{97}}
+\@writefile{toc}{\contentsline {chapter}{Acronyms}{101}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\gdef \LT@i {\LT@entry