\relax \@newglossary{main}{glg}{gls}{glo} \@newglossary{acronym}{alg}{acr}{acn} \@istfilename{Master.ist} \@glsorder{word} \select@language{english} \@writefile{toc}{\select@language{english}} \@writefile{lof}{\select@language{english}} \@writefile{lot}{\select@language{english}} \providecommand {\FN@pp@footnotehinttrue }{} \providecommand {\FN@pp@footnote@aux }[2]{} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \citation{GSM2009} \citation{GSM_history2011} \citation{GSM_stats2011} \citation{GSM2009} \citation{kommsys2006} \citation{GSM2009} \citation{fox} \citation{def_catcher} \citation{mueller} \citation{osmo_wiki_c123} \citation{protocols1999} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \citation{protocols1999} \citation{kommsys2006} \citation{GSM2009} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \citation{GSM2009} \citation{GSM_history2011} \citation{GSM_stats2011} \citation{dennis} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {1}Introduction}{1}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {1.1}Motivation}{1}} \@writefile{toc}{\contentsline {section}{\numberline {1.2}Structure}{2}} \@writefile{toc}{\contentsline {section}{\numberline {1.3}Disclaimer}{2}} \@writefile{toc}{\contentsline {section}{\numberline {1.4}On Typesetting}{3}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {2}GSM}{5}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \newlabel{ch:gsm}{{2}{5}} \@writefile{toc}{\contentsline {section}{\numberline {2.1}A Historical Perspective}{5}} \citation{GSM2009} \citation{protocols1999} \citation{GSM2009} \citation{GSM_history2011} \citation{GSM_stats2011} \citation{GSM2009} \citation{GSM_history2011} \citation{GSM_stats2011} \citation{3gpp_Proposal2000} \@writefile{lof}{\contentsline {figure}{\numberline {2.1}{\ignorespaces Growth of mobile GSM subscriptions. Compiled from \cite {GSM2009,GSM_history2011,GSM_stats2011}}}{6}} \newlabel{fig:gsm_growth}{{2.1}{6}} \citation{hsdpa} \citation{hsupa} \citation{kommsys2006} \FN@pp@footnote@aux{1}{7} \@writefile{toc}{\contentsline {section}{\numberline {2.2}The GSM Network}{7}} \newlabel{sec:network}{{2.2}{7}} \citation{ITU1200} \citation{GSM2009} \citation{overview1994} \citation{overview1996} \@writefile{lof}{\contentsline {figure}{\numberline {2.2}{\ignorespaces The main components of a GSM network.}}{8}} \newlabel{fig:gsm_network}{{2.2}{8}} \FN@pp@footnote@aux{2}{8} \citation{GSM0207} \citation{protocols1999} \citation{ISO7810} \@writefile{toc}{\contentsline {subsection}{\numberline {2.2.1}Mobile Station}{9}} \newlabel{sec:ms}{{2.2.1}{9}} \FN@pp@footnote@aux{3}{9} \FN@pp@footnote@aux{4}{9} \citation{protocols1999} \citation{protocols1999} \citation{kommsys2006} \citation{GSM23003} \@writefile{lot}{\contentsline {table}{\numberline {2.1}{\ignorespaces Subset of data stored on a SIM card. Adopted from \cite {protocols1999}}}{10}} \newlabel{tab:simdata}{{2.1}{10}} \citation{ITU212} \@writefile{lot}{\contentsline {table}{\numberline {2.2}{\ignorespaces Mobile Country and Network Codes. (R) denotes that the MCC is reserved but not operational as of yet, whereas (T) denotes a operational test network.}}{11}} \newlabel{tab:countrycodes}{{2.2}{11}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.2.2}Network Subsystem}{11}} \newlabel{sec:nss}{{2.2.2}{11}} \@writefile{toc}{\contentsline {subsubsection}{Mobile Switching Center}{12}} \@writefile{toc}{\contentsline {subsubsection}{Home Location Register}{12}} \@writefile{lot}{\contentsline {table}{\numberline {2.3}{\ignorespaces Interfaces inside the core network (upper part) and the radio network (lower part)}}{13}} \newlabel{tab:interfaces}{{2.3}{13}} \@writefile{toc}{\contentsline {subsubsection}{Visitor Location Register}{14}} \@writefile{toc}{\contentsline {subsubsection}{Authentication Center}{14}} \newlabel{sec:authentication}{{2.2.2}{14}} \FN@pp@footnote@aux{5}{14} \@writefile{lof}{\contentsline {figure}{\numberline {2.3}{\ignorespaces Authentication procedure.}}{15}} \newlabel{fig:authentication}{{2.3}{15}} \citation{kommsys2006} \citation{kommsys2006} \@writefile{toc}{\contentsline {subsection}{\numberline {2.2.3}Base Station Subsystem}{16}} \newlabel{sec:bss}{{2.2.3}{16}} \@writefile{toc}{\contentsline {subsubsection}{Frequencies and the Cellular Principle}{16}} \citation{kommsys2006} \citation{kommsys2006} \@writefile{lof}{\contentsline {figure}{\numberline {2.4}{\ignorespaces Mapping of functional entities on the 900\tmspace +\thinmuskip {.1667em}MHz\ band.}}{17}} \newlabel{fig:frequency}{{2.4}{17}} \@writefile{lot}{\contentsline {table}{\numberline {2.4}{\ignorespaces Frequencies in the different bands \cite {kommsys2006}.}}{17}} \newlabel{tab:frequencies}{{2.4}{17}} \citation{GSM2009} \citation{protocols1999} \citation{GSM2009} \citation{GSM2009} \citation{kommsys2006} \@writefile{toc}{\contentsline {subsubsection}{Base Transceiver Station}{18}} \citation{kommsys2006} \@writefile{lof}{\contentsline {figure}{\numberline {2.5}{\ignorespaces Theoretical arrangement of radio cells compared to a realistic alignment. Cells with the same number share the same frequency \cite {GSM2009}.}}{19}} \newlabel{fig:cells}{{2.5}{19}} \@writefile{toc}{\contentsline {subsubsection}{Base Station Controller}{19}} \citation{kommsys2006} \citation{kommsys2006} \citation{protocols1999} \@writefile{lof}{\contentsline {figure}{\numberline {2.6}{\ignorespaces Ciphering procedure for one frame of voice data. Adopted from \cite {kommsys2006}.}}{21}} \newlabel{fig:cypher}{{2.6}{21}} \@writefile{toc}{\contentsline {section}{\numberline {2.3}The $U_m$ Interface}{21}} \newlabel{sec:Um}{{2.3}{21}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.3.1}Radio Transmission}{21}} \newlabel{sec:radio}{{2.3.1}{21}} \@writefile{lof}{\contentsline {figure}{\numberline {2.7}{\ignorespaces The combination of FDMA and TDMA.}}{22}} \newlabel{fig:fdma_tdma}{{2.7}{22}} \@writefile{toc}{\contentsline {subsubsection}{Frame Numbering}{22}} \@writefile{lof}{\contentsline {figure}{\numberline {2.8}{\ignorespaces Hierarchical Composition of the different frames.}}{23}} \newlabel{fig:frame_hierarchy}{{2.8}{23}} \citation{GSM2009} \citation{GSM2009} \citation{GSM2009} \@writefile{lof}{\contentsline {figure}{\numberline {2.9}{\ignorespaces Structural Comparison of different Burst types. After \cite {GSM2009}.}}{24}} \newlabel{fig:burst_types}{{2.9}{24}} \@writefile{toc}{\contentsline {subsubsection}{Burst Types}{24}} \citation{kommsys2006} \@writefile{toc}{\contentsline {subsection}{\numberline {2.3.2}Logical Channels}{25}} \newlabel{sec:channels}{{2.3.2}{25}} \@writefile{toc}{\contentsline {subsubsection}{Dedicated Channels}{25}} \@writefile{lof}{\contentsline {figure}{\numberline {2.10}{\ignorespaces Mapping of virtual channels on time slots.}}{26}} \newlabel{fig:channels}{{2.10}{26}} \@writefile{toc}{\contentsline {subsubsection}{Common Channels}{26}} \newlabel{sec:common_channels}{{2.3.2}{26}} \citation{gsm0502} \citation{protocols1999} \@writefile{toc}{\contentsline {subsubsection}{Combinations}{27}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.3.3}Layers}{27}} \newlabel{sec:layers}{{2.3.3}{27}} \@writefile{toc}{\contentsline {paragraph}{Physical Layer (Layer 1):}{27}} \citation{GSM0405} \citation{GSM0406} \citation{protocols1999} \citation{fox} \citation{imsi_wiki} \@writefile{toc}{\contentsline {paragraph}{Data Link (Layer 2):}{28}} \@writefile{toc}{\contentsline {paragraph}{Network (Layer 3):}{28}} \@writefile{toc}{\contentsline {section}{\numberline {2.4}IMSI-Catcher}{28}} \newlabel{sec:catcher}{{2.4}{28}} \citation{fox} \citation{dennis} \citation{def_catcher} \citation{fox} \citation{def_catcher} \citation{fox} \citation{def_catcher} \citation{mueller} \citation{mueller} \citation{mueller} \@writefile{lof}{\contentsline {figure}{\numberline {2.11}{\ignorespaces A commercial catcher by Rhode \& Schwarz \cite {fox} and a self built catcher introduced at Defcon 2010 \cite {def_catcher}.}}{29}} \newlabel{fig:catchers}{{2.11}{29}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.4.1}Mode of Operation}{29}} \newlabel{sec:catcher_operation}{{2.4.1}{29}} \citation{fox} \@writefile{lof}{\contentsline {figure}{\numberline {2.12}{\ignorespaces IMSI catching procedure. Adopted and simplified from \cite {mueller}.}}{30}} \newlabel{fig:catcher_catch}{{2.12}{30}} \citation{mueller} \citation{fox} \citation{dennis} \citation{imsi_wiki} \@writefile{toc}{\contentsline {subsubsection}{Attacks}{31}} \newlabel{sec:attacks}{{2.4.1}{31}} \@writefile{toc}{\contentsline {paragraph}{MS is in normal cell selection mode:}{31}} \@writefile{toc}{\contentsline {paragraph}{MS is already connected to a network:}{31}} \citation{fox} \citation{fox} \citation{imsi_wiki} \citation{criminal_justice} \@writefile{toc}{\contentsline {subsubsection}{Risks and Irregularities}{32}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.4.2}Law Situation in Germany}{32}} \newlabel{sec:catcher_law}{{2.4.2}{32}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \citation{dennis} \citation{osmo_rationale} \@writefile{toc}{\contentsline {chapter}{\numberline {3}IMSI Catcher Detection}{35}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {3.1}Framework and Hardware}{35}} \FN@pp@footnote@aux{6}{35} \@writefile{toc}{\contentsline {subsection}{\numberline {3.1.1}OsmocomBB}{35}} \citation{osmo_slides} \citation{osmo_wiki_c123} \citation{osmo_wiki_c123} \@writefile{toc}{\contentsline {subsubsection}{Project Status}{36}} \FN@pp@footnote@aux{7}{36} \@writefile{lot}{\contentsline {table}{\numberline {3.1}{\ignorespaces Technical specifications for the Motorola C123.}}{37}} \newlabel{tab:c123_specs}{{3.1}{37}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.1.2}Motorola C123}{37}} \newlabel{sec:osmo_phones}{{3.1.2}{37}} \FN@pp@footnote@aux{8}{37} \@writefile{lof}{\contentsline {figure}{\numberline {3.1}{\ignorespaces Circuit board of the Motorola C123 with its components \cite {osmo_wiki_c123}.}}{38}} \newlabel{fig:osmo_c123}{{3.1}{38}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.1.3}OsmocomBB and ICDS}{38}} \FN@pp@footnote@aux{9}{38} \citation{GSM2009} \@writefile{lof}{\contentsline {figure}{\numberline {3.2}{\ignorespaces Interaction of the OsmocomBB components with the ICDS software.}}{39}} \newlabel{fig:osmo_setup}{{3.2}{39}} \@writefile{toc}{\contentsline {section}{\numberline {3.2}Procedure}{39}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{39}} \newlabel{sec:info_gathering}{{3.2.1}{39}} \citation{GSM2009} \citation{GSM2009} \citation{protocols1999} \citation{protocols1999} \citation{protocols1999} \@writefile{lot}{\contentsline {table}{\numberline {3.2}{\ignorespaces Type Codes and the corresponding System Information Types \cite {GSM2009}.}}{40}} \newlabel{tab:tc_mapping}{{3.2}{40}} \@writefile{lof}{\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 1 Message \cite {protocols1999}.}}{41}} \newlabel{fig:si1}{{3.3}{41}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{42}} \newlabel{sec:info_evaluation}{{3.2.2}{42}} \@writefile{lot}{\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{43}} \newlabel{tab:config_rules}{{3.3}{43}} \@writefile{lot}{\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{44}} \newlabel{tab:context_rules}{{3.4}{44}} \FN@pp@footnote@aux{10}{44} \@writefile{toc}{\contentsline {subsubsection}{Neighbourhood Structure}{44}} \FN@pp@footnote@aux{11}{45} \@writefile{toc}{\contentsline {subsubsection}{Base Station Evaluation}{45}} \@writefile{lof}{\contentsline {figure}{\numberline {3.4}{\ignorespaces Base stations and their neighbourhood connections at the Technische Fakult\"at.}}{46}} \newlabel{fig:neighbourhood_example}{{3.4}{46}} \@writefile{lof}{\contentsline {figure}{\numberline {3.5}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{46}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Normal neighbourhood}}}{46}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Tainted neighbourhood}}}{46}} \newlabel{fig:structure_comparison}{{3.5}{46}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.2.3}Forged Parameters}{47}} \newlabel{sec:fake_parameters}{{3.2.3}{47}} \citation{wiki_cells} \@writefile{toc}{\contentsline {subsubsection}{Database Rules}{48}} \FN@pp@footnote@aux{12}{48} \FN@pp@footnote@aux{13}{48} \FN@pp@footnote@aux{14}{48} \@writefile{lof}{\contentsline {figure}{\numberline {3.6}{\ignorespaces Procedure taken when the network has a call/text waiting for a passive subscriber.}}{49}} \newlabel{fig:paging}{{3.6}{49}} \@writefile{toc}{\contentsline {subsubsection}{Remaining Issues and Paging}{49}} \newlabel{sec:paging}{{3.2.3}{49}} \@writefile{lof}{\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{50}} \newlabel{fig:architecture}{{3.7}{50}} \@writefile{toc}{\contentsline {section}{\numberline {3.3}IMSI Catcher Detection System}{50}} \newlabel{sec:icds}{{3.3}{50}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Implemetation}{50}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{51}} \newlabel{sec:configuration}{{3.3.2}{51}} \@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{52}} \newlabel{fig:python_dict}{{3.8}{52}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Operation}{52}} \newlabel{sec:icds_operation}{{3.3.3}{52}} \@writefile{lof}{\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{53}} \newlabel{fig:icds}{{3.9}{53}} \@writefile{toc}{\contentsline {paragraph}{Sweep scans:}{55}} \newlabel{fig:filters_window}{{3.10(a)}{56}} \newlabel{sub@fig:filters_window}{{(a)}{56}} \newlabel{fig:rules_window}{{3.10(b)}{56}} \newlabel{sub@fig:rules_window}{{(b)}{56}} \newlabel{fig:databases}{{3.10(c)}{56}} \newlabel{sub@fig:databases}{{(c)}{56}} \newlabel{fig:encryption_window}{{3.10(d)}{56}} \newlabel{sub@fig:encryption_window}{{(d)}{56}} \@writefile{lof}{\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{56}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Filters window.}}}{56}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Rules window.}}}{56}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Databases window.}}}{56}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(d)}{\ignorespaces {Encryption window (not yet implemented).}}}{56}} \@writefile{toc}{\contentsline {paragraph}{CellID Information:}{57}} \@writefile{toc}{\contentsline {paragraph}{Location Area Database:}{57}} \@writefile{toc}{\contentsline {paragraph}{PCH Scan:}{57}} \citation{catcher_catcher} \@writefile{toc}{\contentsline {paragraph}{User Mode:}{58}} \@writefile{toc}{\contentsline {section}{\numberline {3.4}Related Projects}{58}} \FN@pp@footnote@aux{15}{58} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{61}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {4.1}Performance Evaluation}{61}} \@writefile{lot}{\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{61}} \newlabel{tab:key_data}{{4.1}{61}} \@writefile{lof}{\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{62}} \newlabel{fig:durations}{{4.1}{62}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{62}} \@writefile{lot}{\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in s for fetching the information.}}{63}} \newlabel{tab:coverage}{{4.2}{63}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{63}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{63}} \citation{dennis} \@writefile{lot}{\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Pagings and Immediate Assignments (per 10\tmspace +\thickmuskip {.2777em}s) for the four German providers at different locations.}}{64}} \newlabel{tab:pagings}{{4.3}{64}} \@writefile{toc}{\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{64}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{64}} \@writefile{lof}{\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{65}} \newlabel{fig:setup}{{4.2}{65}} \FN@pp@footnote@aux{16}{65} \FN@pp@footnote@aux{17}{65} \FN@pp@footnote@aux{18}{65} \@writefile{toc}{\contentsline {subsubsection}{Nokia 3310}{65}} \FN@pp@footnote@aux{19}{65} \@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{66}} \newlabel{fig:openbts_parameters}{{4.3}{66}} \@writefile{lof}{\contentsline {figure}{\numberline {4.4}{\ignorespaces Nokia 3310 NetMonitor screenshots.}}{66}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Connected cell information.}}}{66}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Neighbouring cell measurements.}}}{66}} \newlabel{fig:netmonitor}{{4.4}{66}} \@writefile{lot}{\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{67}} \newlabel{tab:err_configs}{{4.4}{67}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{67}} \@writefile{lot}{\contentsline {table}{\numberline {4.5}{\ignorespaces failzor}}{68}} \newlabel{tab:par_change}{{4.5}{68}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Long Term Test}{68}} \@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long term evaluation.}}{69}} \newlabel{tab:longterm_test}{{4.6}{69}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{69}} \@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher as a new Cell}{69}} \@writefile{lot}{\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{70}} \newlabel{tab:consistent_parameters}{{4.7}{70}} \@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{70}} \@writefile{lof}{\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{71}} \newlabel{fig:takeover_attack}{{4.5}{71}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{73}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {5.1}Summary}{73}} \@writefile{toc}{\contentsline {section}{\numberline {5.2}Future Work}{73}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \bibstyle{acm} \citation{*} \bibdata{../Content/Bibliography} \bibcite{GSM0405}{1} \bibcite{GSM0406}{2} \bibcite{GSM0505}{3} \bibcite{GSM0207}{4} \bibcite{ISO7810}{5} \bibcite{gsm0502}{6} \bibcite{GSM23078}{7} \bibcite{GSM23003}{8} \bibcite{3gpp_Proposal2000}{9} \bibcite{GSM2009}{10} \bibcite{mueller}{11} \bibcite{fox}{12} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{Bibliography}{75}} \bibcite{GSM_stats2011}{13} \bibcite{GSM_history2011}{14} \bibcite{osmo_slides}{15} \bibcite{overview1994}{16} \bibcite{protocols1999}{17} \bibcite{hsdpa}{18} \bibcite{hsupa}{19} \bibcite{osmo_rationale}{20} \bibcite{osmo_wiki_c123}{21} \bibcite{criminal_justice}{22} \bibcite{kommsys2006}{23} \bibcite{overview1996}{24} \bibcite{def_catcher}{25} \bibcite{ITU1200}{26} \bibcite{ITU212}{27} \bibcite{dennis}{28} \bibcite{wiki_cells}{29} \bibcite{blacklisting}{30} \bibcite{imsi_wiki}{31} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {A}OsmocomBB}{79}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {A.1}Installation}{79}} \newlabel{sec:osmo_install}{{A.1}{79}} \@writefile{toc}{\contentsline {section}{\numberline {A.2}Usage}{80}} \newlabel{sec:osmo_usage}{{A.2}{80}} \@writefile{toc}{\contentsline {section}{\numberline {A.3}Serial Cable Schematics}{81}} \newlabel{sec:osmo_serial_schematics}{{A.3}{81}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {B}IMSI Catcher Detection System}{83}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {B.1}Extextions}{83}} \newlabel{sec:extensions}{{B.1}{83}} \@writefile{toc}{\contentsline {section}{\numberline {B.2}Example Configuration}{84}} \newlabel{sec:example_config}{{B.2}{84}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {C}System Information}{87}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \newlabel{sec:system_infos}{{C}{87}} \FN@pp@footnotehinttrue \@writefile{lof}{\contentsline {figure}{\numberline {C.1}{\ignorespaces System Information 1 Message}}{88}} \@writefile{lof}{\contentsline {figure}{\numberline {C.2}{\ignorespaces System Information 2 Message}}{89}} \@writefile{lof}{\contentsline {figure}{\numberline {C.3}{\ignorespaces System Information 3 Message}}{90}} \@writefile{lof}{\contentsline {figure}{\numberline {C.4}{\ignorespaces System Information 4 Message}}{91}} \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {D}Evaluation Data}{93}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {D.1}Rx and LAC Change Test}{93}} \newlabel{sec_lac_change_test}{{D.1}{93}} \@writefile{toc}{\contentsline {section}{\numberline {D.2}Long Term Test}{93}} \newlabel{sec:long_term_test}{{D.2}{93}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{Acronyms}{95}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \gdef \LT@i {\LT@entry {4}{63.42068pt}\LT@entry {1}{245.03047pt}} \FN@pp@footnotehinttrue \global\@altsecnumformattrue