\relax \@newglossary{main}{glg}{gls}{glo} \@newglossary{acronym}{alg}{acr}{acn} \@istfilename{Master.ist} \@glsorder{word} \select@language{english} \@writefile{toc}{\select@language{english}} \@writefile{lof}{\select@language{english}} \@writefile{lot}{\select@language{english}} \providecommand {\FN@pp@footnotehinttrue }{} \providecommand {\FN@pp@footnote@aux }[2]{} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \citation{GSM2009} \citation{GSM_history2011} \citation{GSM_stats2011} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {1}Introduction}{1}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {1.1}Structure}{1}} \@writefile{toc}{\contentsline {section}{\numberline {1.2}Disclaimer}{1}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {2}GSM}{3}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \newlabel{ch:gsm}{{2}{3}} \@writefile{toc}{\contentsline {section}{\numberline {2.1}A Historical Perspective}{3}} \citation{GSM2009} \citation{protocols1999} \citation{GSM2009} \citation{GSM_history2011} \citation{GSM_stats2011} \citation{GSM2009} \citation{GSM_history2011} \citation{GSM_stats2011} \citation{3gpp_Proposal2000} \@writefile{lof}{\contentsline {figure}{\numberline {2.1}{\ignorespaces Growth of mobile GSM subscriptions. Compiled from \cite {GSM2009,GSM_history2011,GSM_stats2011}}}{4}} \newlabel{fig:gsm_growth}{{2.1}{4}} \citation{hsdpa} \citation{hsupa} \citation{kommsys2006} \FN@pp@footnote@aux{1}{5} \@writefile{toc}{\contentsline {section}{\numberline {2.2}The GSM Network}{5}} \newlabel{sec:network}{{2.2}{5}} \citation{ITU1200} \citation{GSM2009} \citation{overview1994} \citation{overview1996} \@writefile{lof}{\contentsline {figure}{\numberline {2.2}{\ignorespaces The main components of a GSM network.}}{6}} \newlabel{fig:gsm_network}{{2.2}{6}} \FN@pp@footnote@aux{2}{6} \@writefile{toc}{\contentsline {subsection}{\numberline {2.2.1}Mobile Station}{6}} \newlabel{sec:ms}{{2.2.1}{6}} \citation{GSM0207} \citation{protocols1999} \citation{GSM0505} \citation{ISO7810} \FN@pp@footnote@aux{3}{7} \FN@pp@footnote@aux{4}{7} \citation{protocols1999} \citation{protocols1999} \citation{kommsys2006} \citation{GSM23003} \@writefile{lot}{\contentsline {table}{\numberline {2.1}{\ignorespaces Subset of data stored on a SIM card. Adopted from \cite {protocols1999}}}{8}} \newlabel{tab:simdata}{{2.1}{8}} \citation{ITU212} \@writefile{lot}{\contentsline {table}{\numberline {2.2}{\ignorespaces Mobile Country and Network Codes. (R) denotes that the MCC is reserved but not operational as of yet, whereas (T) denotes a operational test network.}}{9}} \newlabel{tab:countrycodes}{{2.2}{9}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.2.2}Network Subsystem}{9}} \newlabel{sec:nss}{{2.2.2}{9}} \@writefile{toc}{\contentsline {subsubsection}{Mobile Switching Center}{10}} \@writefile{toc}{\contentsline {subsubsection}{Home Location Register}{10}} \@writefile{lot}{\contentsline {table}{\numberline {2.3}{\ignorespaces Interfaces inside the core network (upper part) and the radio network (lower part)}}{11}} \newlabel{tab:interfaces}{{2.3}{11}} \citation{blacklisting} \@writefile{toc}{\contentsline {subsubsection}{Visitor Location Register}{12}} \@writefile{toc}{\contentsline {subsubsection}{Equipment Identification Register}{12}} \FN@pp@footnote@aux{5}{12} \@writefile{toc}{\contentsline {subsubsection}{Authentication Center}{12}} \newlabel{sec:authentication}{{2.2.2}{12}} \FN@pp@footnote@aux{6}{12} \@writefile{lof}{\contentsline {figure}{\numberline {2.3}{\ignorespaces Authentication procedure.}}{13}} \newlabel{fig:authentication}{{2.3}{13}} \citation{kommsys2006} \@writefile{toc}{\contentsline {subsection}{\numberline {2.2.3}Intelligent Network}{14}} \citation{GSM23078} \citation{kommsys2006} \citation{kommsys2006} \citation{kommsys2006} \@writefile{toc}{\contentsline {subsection}{\numberline {2.2.4}Base Station Subsystem}{15}} \newlabel{sec:bss}{{2.2.4}{15}} \@writefile{toc}{\contentsline {subsubsection}{Frequencies and the Cellular Principle}{15}} \@writefile{lof}{\contentsline {figure}{\numberline {2.4}{\ignorespaces Mapping of functional entities on the 900\tmspace +\thinmuskip {.1667em}MHz\ band.}}{16}} \newlabel{fig:frequency}{{2.4}{16}} \@writefile{lot}{\contentsline {table}{\numberline {2.4}{\ignorespaces Frequencies in the different bands \cite {kommsys2006}.}}{16}} \newlabel{tab:frequencies}{{2.4}{16}} \citation{GSM2009} \citation{protocols1999} \citation{GSM2009} \citation{GSM2009} \citation{kommsys2006} \citation{protocols1999} \citation{protocols1999} \citation{protocols1999} \@writefile{lof}{\contentsline {figure}{\numberline {2.5}{\ignorespaces Theoretical arrangement of radio cells compared to a realistic alignment. Cells with the same number share the same frequency \cite {GSM2009}.}}{18}} \newlabel{fig:cells}{{2.5}{18}} \@writefile{toc}{\contentsline {subsubsection}{Base Transceiver Station}{18}} \@writefile{lof}{\contentsline {figure}{\numberline {2.6}{\ignorespaces Common base station configurations. Compiled from \cite {protocols1999}.}}{19}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Stantard configuration.}}}{19}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Umbrella cell configuration.}}}{19}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Sectorised configuration.}}}{19}} \newlabel{fig:configurations}{{2.6}{19}} \citation{kommsys2006} \@writefile{toc}{\contentsline {subsubsection}{Base Station Controller}{20}} \citation{kommsys2006} \@writefile{toc}{\contentsline {subsubsection}{Transcoding rate and Adaption Unit}{21}} \citation{kommsys2006} \citation{kommsys2006} \citation{protocols1999} \@writefile{lof}{\contentsline {figure}{\numberline {2.7}{\ignorespaces Ciphering procedure for one frame of voice data. Adopted from \cite {kommsys2006}.}}{22}} \newlabel{fig:cypher}{{2.7}{22}} \@writefile{toc}{\contentsline {section}{\numberline {2.3}The $U_m$ Interface}{22}} \newlabel{sec:Um}{{2.3}{22}} \@writefile{lof}{\contentsline {figure}{\numberline {2.8}{\ignorespaces The combination of FDMA and TDMA.}}{23}} \newlabel{fig:fdma_tdma}{{2.8}{23}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.3.1}Radio Transmission}{23}} \newlabel{sec:radio}{{2.3.1}{23}} \@writefile{toc}{\contentsline {subsubsection}{Frame Numbering}{24}} \@writefile{lof}{\contentsline {figure}{\numberline {2.9}{\ignorespaces Hierarchical Composition of the different frames.}}{25}} \newlabel{fig:frame_hierarchy}{{2.9}{25}} \citation{GSM2009} \citation{GSM2009} \citation{GSM2009} \@writefile{lof}{\contentsline {figure}{\numberline {2.10}{\ignorespaces Structural Comparison of different Burst types. After \cite {GSM2009}.}}{26}} \newlabel{fig:burst_types}{{2.10}{26}} \@writefile{toc}{\contentsline {subsubsection}{Burst Types}{26}} \citation{kommsys2006} \@writefile{lof}{\contentsline {figure}{\numberline {2.11}{\ignorespaces Mapping of virtual channels on time slots.}}{27}} \newlabel{fig:channels}{{2.11}{27}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.3.2}Logical Channels}{27}} \newlabel{sec:channels}{{2.3.2}{27}} \@writefile{toc}{\contentsline {subsubsection}{Dedicated Channels}{28}} \@writefile{toc}{\contentsline {subsubsection}{Common Channels}{28}} \newlabel{sec:common_channels}{{2.3.2}{28}} \citation{gsm0502} \citation{GSM2009} \citation{GSM2009} \citation{kommsys2006} \citation{protocols1999} \citation{kommsys2006} \citation{kommsys2006} \@writefile{lot}{\contentsline {table}{\numberline {2.5}{\ignorespaces Possible combinations of logical channels for the base station. From \cite {GSM2009}.}}{29}} \newlabel{tab:channel_configurations}{{2.5}{29}} \@writefile{toc}{\contentsline {subsubsection}{Combinations}{29}} \citation{protocols1999} \citation{GSM0405} \citation{GSM0406} \citation{protocols1999} \@writefile{toc}{\contentsline {subsection}{\numberline {2.3.3}Layers}{30}} \newlabel{sec:layers}{{2.3.3}{30}} \@writefile{toc}{\contentsline {paragraph}{Physical Layer (Layer 1):}{30}} \@writefile{toc}{\contentsline {paragraph}{Data Link (Layer 2):}{30}} \@writefile{toc}{\contentsline {paragraph}{Network (Layer 3):}{30}} \@writefile{lof}{\contentsline {figure}{\numberline {2.12}{\ignorespaces Snippet of a Multiframe-configurations for a base station from \cite {kommsys2006}.}}{31}} \newlabel{fig:channel_example}{{2.12}{31}} \citation{fox} \citation{imsi_wiki} \citation{fox} \citation{dennis} \citation{def_catcher} \citation{fox} \citation{def_catcher} \citation{fox} \citation{def_catcher} \citation{mueller} \@writefile{toc}{\contentsline {section}{\numberline {2.4}IMSI-Catcher}{32}} \newlabel{sec:catcher}{{2.4}{32}} \citation{mueller} \citation{mueller} \citation{fox} \citation{mueller} \citation{fox} \@writefile{lof}{\contentsline {figure}{\numberline {2.13}{\ignorespaces A commercial catcher by Rhode \& Schwarz \cite {fox} and a self built catcher introduced at Defcon 2010 \cite {def_catcher}.}}{33}} \newlabel{fig:catchers}{{2.13}{33}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.4.1}Mode of Operation}{33}} \newlabel{sec:catcher_operation}{{2.4.1}{33}} \@writefile{lof}{\contentsline {figure}{\numberline {2.14}{\ignorespaces IMSI catching procedure. Adopted and simplified from \cite {mueller}.}}{34}} \newlabel{fig:catcher_catch}{{2.14}{34}} \citation{dennis} \citation{imsi_wiki} \citation{fox} \@writefile{toc}{\contentsline {subsubsection}{Attacks}{35}} \newlabel{sec:attacks}{{2.4.1}{35}} \@writefile{toc}{\contentsline {paragraph}{MS is in normal cell selection mode:}{35}} \@writefile{toc}{\contentsline {paragraph}{MS is already connected to a network:}{35}} \citation{fox} \citation{imsi_wiki} \citation{criminal_justice} \@writefile{toc}{\contentsline {subsubsection}{Risks and Irregularities}{36}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.4.2}Law Situation in Germany}{36}} \newlabel{sec:catcher_law}{{2.4.2}{36}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \citation{dennis} \citation{osmo_rationale} \@writefile{toc}{\contentsline {chapter}{\numberline {3}IMSI Catcher Detection}{39}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {3.1}Framework and Hardware}{39}} \FN@pp@footnote@aux{7}{39} \@writefile{toc}{\contentsline {subsection}{\numberline {3.1.1}OsmocomBB}{39}} \citation{osmo_slides} \citation{osmo_wiki_c123} \citation{osmo_wiki_c123} \@writefile{toc}{\contentsline {subsubsection}{Project Status}{40}} \FN@pp@footnote@aux{8}{40} \@writefile{lot}{\contentsline {table}{\numberline {3.1}{\ignorespaces Technical specifications for the Motorola C123.}}{41}} \newlabel{tab:c123_specs}{{3.1}{41}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.1.2}Motorola C123}{41}} \newlabel{sec:osmo_phones}{{3.1.2}{41}} \FN@pp@footnote@aux{9}{41} \@writefile{lof}{\contentsline {figure}{\numberline {3.1}{\ignorespaces Circuit board of the Motorola C123 with its components \cite {osmo_wiki_c123}.}}{42}} \newlabel{fig:osmo_c123}{{3.1}{42}} \@writefile{toc}{\contentsline {subsubsection}{OsmocomBB and ICDS}{42}} \FN@pp@footnote@aux{10}{42} \citation{GSM2009} \@writefile{lof}{\contentsline {figure}{\numberline {3.2}{\ignorespaces Interaction of the OsmocomBB components with the ICDS software.}}{43}} \newlabel{fig:osmo_setup}{{3.2}{43}} \@writefile{toc}{\contentsline {section}{\numberline {3.2}Procedure}{43}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{43}} \newlabel{sec:info_gathering}{{3.2.1}{43}} \citation{GSM2009} \citation{GSM2009} \citation{protocols1999} \citation{protocols1999} \citation{protocols1999} \@writefile{lot}{\contentsline {table}{\numberline {3.2}{\ignorespaces Type Codes and the corresponding System Information Types \cite {GSM2009}.}}{44}} \newlabel{tab:tc_mapping}{{3.2}{44}} \@writefile{lof}{\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 1 Message \cite {protocols1999}.}}{45}} \newlabel{fig:si1}{{3.3}{45}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{46}} \newlabel{sec:info_evaluation}{{3.2.2}{46}} \@writefile{lot}{\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{47}} \newlabel{tab:config_rules}{{3.3}{47}} \@writefile{lot}{\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{48}} \newlabel{tab:context_rules}{{3.4}{48}} \FN@pp@footnote@aux{11}{48} \@writefile{toc}{\contentsline {subsubsection}{Neighbourhood Structure}{48}} \FN@pp@footnote@aux{12}{49} \@writefile{toc}{\contentsline {subsubsection}{Base Station Evaluation}{49}} \@writefile{lof}{\contentsline {figure}{\numberline {3.4}{\ignorespaces Base stations and their neighbourhood connections at the Technische Fakult\"at.}}{50}} \newlabel{fig:neighbourhood_example}{{3.4}{50}} \@writefile{lof}{\contentsline {figure}{\numberline {3.5}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{50}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Normal neighbourhood}}}{50}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Tainted neighbourhood}}}{50}} \newlabel{fig:structure_comparison}{{3.5}{50}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.2.3}Forged Parameters}{51}} \newlabel{sec:fake_parameters}{{3.2.3}{51}} \citation{wiki_cells} \@writefile{toc}{\contentsline {subsubsection}{Database Rules}{52}} \FN@pp@footnote@aux{13}{52} \FN@pp@footnote@aux{14}{52} \FN@pp@footnote@aux{15}{52} \@writefile{lof}{\contentsline {figure}{\numberline {3.6}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{53}} \newlabel{fig:architecture}{{3.6}{53}} \@writefile{toc}{\contentsline {section}{\numberline {3.3}IMSI Catcher Detection System}{53}} \newlabel{sec:icds}{{3.3}{53}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Implemetation}{53}} \@writefile{lof}{\contentsline {figure}{\numberline {3.7}{\ignorespaces Configuration Dictionary in the settings file.}}{54}} \newlabel{fig:python_dict}{{3.7}{54}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{54}} \newlabel{sec:configuration}{{3.3.2}{54}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Operation}{55}} \newlabel{sec:icds_operation}{{3.3.3}{55}} \@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces The ICDS main window.}}{56}} \newlabel{fig:icds}{{3.8}{56}} \@writefile{toc}{\contentsline {paragraph}{Sweep scans:}{58}} \@writefile{toc}{\contentsline {paragraph}{CellID Information:}{58}} \newlabel{fig:filters_window}{{3.9(a)}{59}} \newlabel{sub@fig:filters_window}{{(a)}{59}} \newlabel{fig:rules_window}{{3.9(b)}{59}} \newlabel{sub@fig:rules_window}{{(b)}{59}} \newlabel{fig:databases}{{3.9(c)}{59}} \newlabel{sub@fig:databases}{{(c)}{59}} \newlabel{fig:encryption_window}{{3.9(d)}{59}} \newlabel{sub@fig:encryption_window}{{(d)}{59}} \@writefile{lof}{\contentsline {figure}{\numberline {3.9}{\ignorespaces Dialogs for different settings.}}{59}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Filters window.}}}{59}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Rules window.}}}{59}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Databases window.}}}{59}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(d)}{\ignorespaces {Encryption window (not yet implemented).}}}{59}} \@writefile{toc}{\contentsline {paragraph}{Location Area Database:}{60}} \@writefile{toc}{\contentsline {paragraph}{Scan Encryption:}{60}} \@writefile{toc}{\contentsline {paragraph}{User Mode:}{60}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{61}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {4.1}Performance Evaluation}{61}} \@writefile{lot}{\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{61}} \newlabel{tab:key_data}{{4.1}{61}} \@writefile{lof}{\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{62}} \newlabel{fig:durations}{{4.1}{62}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{62}} \@writefile{lot}{\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in s for fetching the information.}}{63}} \newlabel{tab:coverage}{{4.2}{63}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{63}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.1.3}Encryption Detection Speed}{63}} \@writefile{toc}{\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{63}} \citation{dennis} \@writefile{lof}{\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{64}} \newlabel{fig:setup}{{4.2}{64}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{64}} \FN@pp@footnote@aux{16}{64} \FN@pp@footnote@aux{17}{64} \FN@pp@footnote@aux{18}{64} \@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{65}} \newlabel{fig:openbts_parameters}{{4.3}{65}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{65}} \@writefile{lot}{\contentsline {table}{\numberline {4.3}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{66}} \newlabel{tab:err_configs}{{4.3}{66}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Long Term Test}{66}} \@writefile{lot}{\contentsline {table}{\numberline {4.4}{\ignorespaces failzor}}{67}} \newlabel{tab:par_change}{{4.4}{67}} \@writefile{lof}{\contentsline {figure}{\numberline {4.4}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{67}} \newlabel{fig:takeover_attack}{{4.4}{67}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{67}} \FN@pp@footnotehinttrue \@writefile{lot}{\contentsline {table}{\numberline {4.5}{\ignorespaces Results of the long term evaluation.}}{68}} \newlabel{tab:longterm_test}{{4.5}{68}} \@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{68}} \newlabel{tab:consistent_parameters}{{4.6}{68}} \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{69}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {5.1}Future Work}{69}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \bibstyle{acm} \citation{*} \bibdata{../Content/Bibliography} \bibcite{GSM0405}{1} \bibcite{GSM0406}{2} \bibcite{GSM0505}{3} \bibcite{GSM0207}{4} \bibcite{ISO7810}{5} \bibcite{gsm0502}{6} \bibcite{GSM23078}{7} \bibcite{GSM23003}{8} \bibcite{3gpp_Proposal2000}{9} \bibcite{GSM2009}{10} \bibcite{mueller}{11} \bibcite{fox}{12} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{Bibliography}{71}} \bibcite{GSM_stats2011}{13} \bibcite{GSM_history2011}{14} \bibcite{osmo_slides}{15} \bibcite{overview1994}{16} \bibcite{protocols1999}{17} \bibcite{hsdpa}{18} \bibcite{hsupa}{19} \bibcite{osmo_rationale}{20} \bibcite{osmo_wiki_c123}{21} \bibcite{criminal_justice}{22} \bibcite{kommsys2006}{23} \bibcite{overview1996}{24} \bibcite{def_catcher}{25} \bibcite{ITU1200}{26} \bibcite{ITU212}{27} \bibcite{dennis}{28} \bibcite{wiki_cells}{29} \bibcite{blacklisting}{30} \bibcite{imsi_wiki}{31} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {A}OsmocomBB}{75}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {A.1}Installation}{75}} \newlabel{sec:osmo_install}{{A.1}{75}} \@writefile{toc}{\contentsline {section}{\numberline {A.2}Usage}{76}} \newlabel{sec:osmo_usage}{{A.2}{76}} \@writefile{toc}{\contentsline {section}{\numberline {A.3}Serial Cable Schematics}{77}} \newlabel{sec:osmo_serial_schematics}{{A.3}{77}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {B}IMSI Catcher Detection System}{79}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {B.1}Extextions}{79}} \newlabel{sec:extensions}{{B.1}{79}} \@writefile{toc}{\contentsline {section}{\numberline {B.2}Example Configuration}{80}} \newlabel{sec:example_config}{{B.2}{80}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {C}System Information}{83}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \newlabel{sec:system_infos}{{C}{83}} \FN@pp@footnotehinttrue \@writefile{lof}{\contentsline {figure}{\numberline {C.1}{\ignorespaces System Information 1 Message}}{84}} \@writefile{lof}{\contentsline {figure}{\numberline {C.2}{\ignorespaces System Information 2 Message}}{85}} \@writefile{lof}{\contentsline {figure}{\numberline {C.3}{\ignorespaces System Information 3 Message}}{86}} \@writefile{lof}{\contentsline {figure}{\numberline {C.4}{\ignorespaces System Information 4 Message}}{87}} \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {D}Evaluation Data}{89}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {D.1}IMSI Catcher Configurations}{89}} \newlabel{sec:config_data}{{D.1}{89}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{Acronyms}{91}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \gdef \LT@i {\LT@entry {1}{55.97493pt}\LT@entry {1}{245.03047pt}} \FN@pp@footnotehinttrue \global\@altsecnumformattrue