\relax \@newglossary{main}{glg}{gls}{glo} \@newglossary{acronym}{alg}{acr}{acn} \@istfilename{Master.ist} \@glsorder{word} \select@language{english} \@writefile{toc}{\select@language{english}} \@writefile{lof}{\select@language{english}} \@writefile{lot}{\select@language{english}} \providecommand {\FN@pp@footnotehinttrue }{} \providecommand {\FN@pp@footnote@aux }[2]{} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \citation{GSM2009} \citation{GSM_history2011} \citation{GSM_stats2011} \citation{GSM2009} \citation{kommsys2006} \citation{GSM2009} \citation{fox} \citation{def_catcher} \citation{mueller} \citation{osmo_wiki_c123} \citation{protocols1999} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \citation{protocols1999} \citation{kommsys2006} \citation{GSM2009} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \citation{GSM2009} \citation{GSM_history2011} \citation{GSM_stats2011} \citation{dennis} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {1}Introduction}{1}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {1.1}Motivation}{1}} \@writefile{toc}{\contentsline {section}{\numberline {1.2}Structure}{2}} \@writefile{toc}{\contentsline {section}{\numberline {1.3}Disclaimer}{2}} \@writefile{toc}{\contentsline {section}{\numberline {1.4}On Typesetting}{3}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {2}GSM}{5}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \newlabel{ch:gsm}{{2}{5}} \@writefile{toc}{\contentsline {section}{\numberline {2.1}A Historical Perspective}{5}} \citation{GSM2009} \citation{protocols1999} \citation{GSM2009} \citation{GSM_history2011} \citation{GSM_stats2011} \citation{GSM2009} \citation{GSM_history2011} \citation{GSM_stats2011} \citation{3gpp_Proposal2000} \@writefile{lof}{\contentsline {figure}{\numberline {2.1}{\ignorespaces Growth of mobile GSM subscriptions. Compiled from \cite {GSM2009,GSM_history2011,GSM_stats2011}}}{6}} \newlabel{fig:gsm_growth}{{2.1}{6}} \citation{hsdpa} \citation{hsupa} \citation{kommsys2006} \citation{ITU1200} \FN@pp@footnote@aux{1}{7} \@writefile{toc}{\contentsline {section}{\numberline {2.2}The GSM Network}{7}} \newlabel{sec:network}{{2.2}{7}} \citation{GSM2009} \citation{overview1994} \citation{overview1996} \@writefile{lof}{\contentsline {figure}{\numberline {2.2}{\ignorespaces The main components of a GSM network.}}{8}} \newlabel{fig:gsm_network}{{2.2}{8}} \FN@pp@footnote@aux{2}{8} \@writefile{toc}{\contentsline {subsection}{\numberline {2.2.1}Mobile Station}{8}} \newlabel{sec:ms}{{2.2.1}{8}} \citation{GSM0207} \citation{protocols1999} \citation{ISO7810} \FN@pp@footnote@aux{3}{9} \FN@pp@footnote@aux{4}{9} \citation{protocols1999} \citation{protocols1999} \citation{kommsys2006} \citation{GSM23003} \citation{ITU212} \@writefile{lot}{\contentsline {table}{\numberline {2.1}{\ignorespaces Subset of data stored on a SIM card. Adopted from \cite {protocols1999}}}{10}} \newlabel{tab:simdata}{{2.1}{10}} \@writefile{lot}{\contentsline {table}{\numberline {2.2}{\ignorespaces Mobile Country and Network Codes. (R) denotes that the MCC is reserved but not operational as of yet, whereas (T) denotes a operational test network.}}{11}} \newlabel{tab:countrycodes}{{2.2}{11}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.2.2}Network Subsystem}{11}} \newlabel{sec:nss}{{2.2.2}{11}} \@writefile{toc}{\contentsline {subsubsection}{Mobile Switching Center}{11}} \@writefile{toc}{\contentsline {subsubsection}{Home Location Register}{12}} \@writefile{lof}{\contentsline {figure}{\numberline {2.3}{\ignorespaces Authentication procedure.}}{13}} \newlabel{fig:authentication}{{2.3}{13}} \@writefile{toc}{\contentsline {subsubsection}{Visitor Location Register}{13}} \citation{kommsys2006} \@writefile{toc}{\contentsline {subsubsection}{Authentication Center}{14}} \newlabel{sec:authentication}{{2.2.2}{14}} \FN@pp@footnote@aux{5}{14} \citation{kommsys2006} \citation{kommsys2006} \citation{kommsys2006} \@writefile{lof}{\contentsline {figure}{\numberline {2.4}{\ignorespaces Mapping of functional entities on the 900\tmspace +\thinmuskip {.1667em}MHz\ band.}}{15}} \newlabel{fig:frequency}{{2.4}{15}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.2.3}Base Station Subsystem}{15}} \newlabel{sec:bss}{{2.2.3}{15}} \@writefile{toc}{\contentsline {subsubsection}{Frequencies and the Cellular Principle}{15}} \citation{GSM2009} \@writefile{lot}{\contentsline {table}{\numberline {2.3}{\ignorespaces Frequencies in the different bands \cite {kommsys2006}.}}{16}} \newlabel{tab:frequencies}{{2.3}{16}} \citation{protocols1999} \citation{GSM2009} \citation{GSM2009} \citation{kommsys2006} \@writefile{lof}{\contentsline {figure}{\numberline {2.5}{\ignorespaces Theoretical arrangement of radio cells compared to a realistic alignment. Cells with the same number share the same frequency \cite {GSM2009}.}}{17}} \newlabel{fig:cells}{{2.5}{17}} \@writefile{toc}{\contentsline {subsubsection}{Base Transceiver Station}{17}} \citation{kommsys2006} \@writefile{toc}{\contentsline {subsubsection}{Base Station Controller}{18}} \citation{kommsys2006} \citation{kommsys2006} \@writefile{lof}{\contentsline {figure}{\numberline {2.6}{\ignorespaces Ciphering procedure for one frame of voice data. Adopted from \cite {kommsys2006}.}}{19}} \newlabel{fig:cypher}{{2.6}{19}} \citation{protocols1999} \@writefile{toc}{\contentsline {section}{\numberline {2.3}The $U_m$ Interface}{20}} \newlabel{sec:Um}{{2.3}{20}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.3.1}Radio Transmission}{20}} \newlabel{sec:radio}{{2.3.1}{20}} \citation{GSM2009} \citation{GSM2009} \citation{GSM2009} \@writefile{lof}{\contentsline {figure}{\numberline {2.7}{\ignorespaces The combination of FDMA and TDMA.}}{21}} \newlabel{fig:fdma_tdma}{{2.7}{21}} \@writefile{toc}{\contentsline {subsubsection}{Frame Numbering}{21}} \@writefile{lof}{\contentsline {figure}{\numberline {2.8}{\ignorespaces Hierarchical composition of the different frames.}}{22}} \newlabel{fig:frame_hierarchy}{{2.8}{22}} \@writefile{lof}{\contentsline {figure}{\numberline {2.9}{\ignorespaces Structural Comparison of different Burst types. After \cite {GSM2009}.}}{22}} \newlabel{fig:burst_types}{{2.9}{22}} \@writefile{toc}{\contentsline {subsubsection}{Burst Types}{23}} \citation{kommsys2006} \@writefile{lof}{\contentsline {figure}{\numberline {2.10}{\ignorespaces Mapping of virtual channels on time slots.}}{24}} \newlabel{fig:channels}{{2.10}{24}} \FN@pp@footnote@aux{6}{24} \@writefile{toc}{\contentsline {subsection}{\numberline {2.3.2}Logical Channels}{24}} \newlabel{sec:channels}{{2.3.2}{24}} \@writefile{toc}{\contentsline {subsubsection}{Dedicated Channels}{25}} \@writefile{toc}{\contentsline {subsubsection}{Common Channels}{25}} \newlabel{sec:common_channels}{{2.3.2}{25}} \citation{gsm0502} \citation{protocols1999} \citation{GSM0405} \citation{GSM0406} \@writefile{toc}{\contentsline {subsubsection}{Combinations}{26}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.3.3}Layers}{26}} \newlabel{sec:layers}{{2.3.3}{26}} \@writefile{toc}{\contentsline {paragraph}{Physical Layer (Layer 1):}{26}} \@writefile{toc}{\contentsline {paragraph}{Data Link (Layer 2):}{26}} \citation{protocols1999} \citation{fox} \citation{imsi_wiki} \citation{fox} \citation{dennis} \citation{def_catcher} \citation{fox} \citation{def_catcher} \citation{fox} \citation{def_catcher} \@writefile{toc}{\contentsline {paragraph}{Network (Layer 3):}{27}} \@writefile{toc}{\contentsline {section}{\numberline {2.4}IMSI-Catcher}{27}} \newlabel{sec:catcher}{{2.4}{27}} \citation{mueller} \citation{mueller} \citation{mueller} \citation{fox} \@writefile{lof}{\contentsline {figure}{\numberline {2.11}{\ignorespaces A commercial catcher by Rhode\tmspace +\thinmuskip {.1667em}\&\tmspace +\thinmuskip {.1667em}Schwarz \cite {fox} and a self built catcher introduced at Defcon 2010 \cite {def_catcher}.}}{28}} \newlabel{fig:catchers}{{2.11}{28}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.4.1}Mode of Operation}{28}} \newlabel{sec:catcher_operation}{{2.4.1}{28}} \@writefile{lof}{\contentsline {figure}{\numberline {2.12}{\ignorespaces IMSI catching procedure. Adopted and simplified from \cite {mueller}.}}{29}} \newlabel{fig:catcher_catch}{{2.12}{29}} \citation{mueller} \citation{fox} \citation{dennis} \citation{imsi_wiki} \@writefile{toc}{\contentsline {subsubsection}{Attacks}{30}} \newlabel{sec:attacks}{{2.4.1}{30}} \@writefile{toc}{\contentsline {paragraph}{MS is in normal cell selection mode:}{30}} \@writefile{toc}{\contentsline {paragraph}{MS is already connected to a network:}{30}} \citation{fox} \@writefile{lof}{\contentsline {figure}{\numberline {2.13}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{31}} \newlabel{fig:takeover_attack}{{2.13}{31}} \citation{fox} \citation{imsi_wiki} \citation{criminal_justice} \@writefile{toc}{\contentsline {subsubsection}{Risks and Irregularities}{32}} \@writefile{toc}{\contentsline {subsection}{\numberline {2.4.2}Law Situation in Germany}{32}} \newlabel{sec:catcher_law}{{2.4.2}{32}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \citation{dennis} \citation{osmo_rationale} \@writefile{toc}{\contentsline {chapter}{\numberline {3}IMSI Catcher Detection System}{35}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {3.1}Framework and Hardware}{35}} \FN@pp@footnote@aux{7}{35} \@writefile{toc}{\contentsline {subsection}{\numberline {3.1.1}OsmocomBB}{35}} \citation{osmo_slides} \citation{osmo_wiki_c123} \citation{osmo_wiki_c123} \FN@pp@footnote@aux{8}{36} \@writefile{toc}{\contentsline {subsubsection}{Project Status}{36}} \FN@pp@footnote@aux{9}{36} \@writefile{lot}{\contentsline {table}{\numberline {3.1}{\ignorespaces Technical specifications for the Motorola C123.}}{37}} \newlabel{tab:c123_specs}{{3.1}{37}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.1.2}Motorola C123}{37}} \newlabel{sec:osmo_phones}{{3.1.2}{37}} \FN@pp@footnote@aux{10}{37} \@writefile{lof}{\contentsline {figure}{\numberline {3.1}{\ignorespaces Circuit board of the Motorola C123 with its components \cite {osmo_wiki_c123}.}}{38}} \newlabel{fig:osmo_c123}{{3.1}{38}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.1.3}OsmocomBB and ICDS}{38}} \FN@pp@footnote@aux{11}{38} \citation{GSM2009} \@writefile{lof}{\contentsline {figure}{\numberline {3.2}{\ignorespaces Interaction of the OsmocomBB components with the ICDS software.}}{39}} \newlabel{fig:osmo_setup}{{3.2}{39}} \@writefile{toc}{\contentsline {section}{\numberline {3.2}Procedure}{39}} \citation{GSM2009} \citation{GSM2009} \citation{protocols1999} \citation{protocols1999} \citation{protocols1999} \@writefile{lot}{\contentsline {table}{\numberline {3.2}{\ignorespaces Type Codes and the corresponding System Information Types \cite {GSM2009}.}}{40}} \newlabel{tab:tc_mapping}{{3.2}{40}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{40}} \newlabel{sec:info_gathering}{{3.2.1}{40}} \@writefile{lof}{\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 2 Message \cite {protocols1999}.}}{41}} \newlabel{fig:si1}{{3.3}{41}} \@writefile{lof}{\contentsline {figure}{\numberline {3.4}{\ignorespaces Procedure taken when the network has a call/text waiting for a passive subscriber.}}{43}} \newlabel{fig:paging}{{3.4}{43}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{43}} \newlabel{sec:info_evaluation}{{3.2.2}{43}} \@writefile{lot}{\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{44}} \newlabel{tab:config_rules}{{3.3}{44}} \@writefile{toc}{\contentsline {subsubsection}{Configuration Rules}{44}} \@writefile{lot}{\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{45}} \newlabel{tab:context_rules}{{3.4}{45}} \FN@pp@footnote@aux{12}{45} \@writefile{toc}{\contentsline {subsubsection}{Context Rules}{45}} \@writefile{toc}{\contentsline {paragraph}{Neighbourhood Structure}{46}} \FN@pp@footnote@aux{13}{46} \FN@pp@footnote@aux{14}{46} \@writefile{lof}{\contentsline {figure}{\numberline {3.5}{\ignorespaces Some base stations and their neighbourhood connections at the Faculty of Engineering.}}{47}} \newlabel{fig:neighbourhood_example}{{3.5}{47}} \@writefile{lof}{\contentsline {figure}{\numberline {3.6}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{48}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Normal neighbourhood}}}{48}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Tainted neighbourhood}}}{48}} \newlabel{fig:structure_comparison}{{3.6}{48}} \@writefile{lot}{\contentsline {table}{\numberline {3.5}{\ignorespaces Database Rules implemented inside the ICDS.}}{48}} \newlabel{tab:database_rules}{{3.5}{48}} \@writefile{toc}{\contentsline {subsubsection}{Database Rules}{48}} \citation{wiki_cells} \@writefile{lot}{\contentsline {table}{\numberline {3.6}{\ignorespaces Scan Rules implemented inside the ICDS.}}{49}} \newlabel{tab:scan_rules}{{3.6}{49}} \FN@pp@footnote@aux{15}{49} \FN@pp@footnote@aux{16}{49} \FN@pp@footnote@aux{17}{49} \@writefile{toc}{\contentsline {subsubsection}{Scan Rules}{49}} \@writefile{toc}{\contentsline {subsubsection}{Remaining Issues and Paging}{50}} \newlabel{sec:paging}{{3.2.2}{50}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.2.3}Base Station Evaluation}{51}} \newlabel{sec:evaluators}{{3.2.3}{51}} \@writefile{toc}{\contentsline {section}{\numberline {3.3}Implementation}{51}} \newlabel{sec:icds}{{3.3}{51}} \@writefile{lof}{\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{52}} \newlabel{fig:architecture}{{3.7}{52}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Architecture}{52}} \@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{53}} \newlabel{fig:python_dict}{{3.8}{53}} \FN@pp@footnote@aux{18}{53} \FN@pp@footnote@aux{19}{53} \@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{53}} \newlabel{sec:configuration}{{3.3.2}{53}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Graphical User Interface}{54}} \newlabel{sec:icds_operation}{{3.3.3}{54}} \@writefile{lof}{\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{55}} \newlabel{fig:icds}{{3.9}{55}} \@writefile{toc}{\contentsline {subsection}{\numberline {3.3.4}Usage}{57}} \newlabel{sec:user_mode}{{3.3.4}{57}} \@writefile{toc}{\contentsline {paragraph}{Conducting sweep scans:}{57}} \newlabel{fig:databases_window}{{3.10(a)}{58}} \newlabel{sub@fig:databases_window}{{(a)}{58}} \newlabel{fig:rules_window}{{3.10(b)}{58}} \newlabel{sub@fig:rules_window}{{(b)}{58}} \newlabel{fig:filters_window}{{3.10(c)}{58}} \newlabel{sub@fig:filters_window}{{(c)}{58}} \newlabel{fig:pch_window}{{3.10(d)}{58}} \newlabel{sub@fig:pch_window}{{(d)}{58}} \@writefile{lof}{\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{58}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Databases window.}}}{58}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Rules window.}}}{58}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Filters window.}}}{58}} \@writefile{lof}{\contentsline {subfigure}{\numberline{(d)}{\ignorespaces {PCH scan window.}}}{58}} \newlabel{fig:dialogs}{{3.10}{58}} \@writefile{toc}{\contentsline {paragraph}{Using and obtaining Cell ID Information:}{59}} \@writefile{toc}{\contentsline {paragraph}{Building or using a Local Area Database:}{59}} \@writefile{lof}{\contentsline {figure}{\numberline {3.11}{\ignorespaces The User Mode window.}}{60}} \newlabel{fig:user_mode}{{3.11}{60}} \@writefile{toc}{\contentsline {paragraph}{Conducting a PCH Scan:}{60}} \@writefile{toc}{\contentsline {paragraph}{Utilising User Mode:}{60}} \citation{catcher_catcher} \@writefile{toc}{\contentsline {section}{\numberline {3.4}Related Projects}{61}} \FN@pp@footnote@aux{20}{61} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{63}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {4.1}Performance Evaluation}{63}} \@writefile{lot}{\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{63}} \newlabel{tab:key_data}{{4.1}{63}} \@writefile{lof}{\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{64}} \newlabel{fig:durations}{{4.1}{64}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{64}} \@writefile{lot}{\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in s for fetching the information.}}{65}} \newlabel{tab:coverage}{{4.2}{65}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{65}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{65}} \citation{dennis} \@writefile{lot}{\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Pagings and Immediate Assignments (per 10\tmspace +\thickmuskip {.2777em}s) for the four German providers at different locations.}}{66}} \newlabel{tab:pagings}{{4.3}{66}} \@writefile{toc}{\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{66}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{66}} \@writefile{lof}{\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{67}} \newlabel{fig:setup}{{4.2}{67}} \FN@pp@footnote@aux{21}{67} \FN@pp@footnote@aux{22}{67} \FN@pp@footnote@aux{23}{67} \@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{68}} \newlabel{fig:openbts_parameters}{{4.3}{68}} \@writefile{toc}{\contentsline {subsubsection}{Modifications to the ICDS Configuration}{68}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{68}} \@writefile{lot}{\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{69}} \newlabel{tab:err_configs}{{4.4}{69}} \@writefile{lot}{\contentsline {table}{\numberline {4.5}{\ignorespaces Results obtained testing the \emph {rx} and \emph {LAC Change rules}.}}{70}} \newlabel{tab:par_change}{{4.5}{70}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Long-Term Test}{70}} \@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{70}} \@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long-term evaluation.}}{71}} \newlabel{tab:longterm_test}{{4.6}{71}} \@writefile{lot}{\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{71}} \newlabel{tab:consistent_parameters}{{4.7}{71}} \@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher as a new Cell}{72}} \@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{72}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{73}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {5.1}Summary}{73}} \@writefile{lof}{\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{74}} \newlabel{fig:decision_process}{{5.1}{74}} \@writefile{toc}{\contentsline {section}{\numberline {5.2}Future Work}{75}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \bibstyle{acm} \citation{*} \bibdata{../Content/Bibliography} \bibcite{GSM0405}{1} \bibcite{GSM0406}{2} \bibcite{GSM0505}{3} \bibcite{GSM0207}{4} \bibcite{ISO7810}{5} \bibcite{gsm0502}{6} \bibcite{GSM23078}{7} \bibcite{GSM23003}{8} \bibcite{3gpp_Proposal2000}{9} \bibcite{GSM2009}{10} \bibcite{mueller}{11} \bibcite{fox}{12} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{Bibliography}{77}} \bibcite{GSM_stats2011}{13} \bibcite{GSM_history2011}{14} \bibcite{osmo_slides}{15} \bibcite{overview1994}{16} \bibcite{protocols1999}{17} \bibcite{hsdpa}{18} \bibcite{hsupa}{19} \bibcite{catcher_catcher}{20} \bibcite{osmo_c123}{21} \bibcite{osmo_wiki_c123}{22} \bibcite{osmo_rationale}{23} \bibcite{criminal_justice}{24} \bibcite{kommsys2006}{25} \bibcite{overview1996}{26} \bibcite{def_catcher}{27} \bibcite{ITU1200}{28} \bibcite{ITU212}{29} \bibcite{dennis}{30} \bibcite{wiki_cells}{31} \bibcite{imsi_wiki}{32} \bibcite{blacklisting}{33} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {A}GSM}{81}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {A.1}Interfaces}{81}} \newlabel{sec:interfaces}{{A.1}{81}} \@writefile{lot}{\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{81}} \@writefile{toc}{\contentsline {section}{\numberline {A.2}Channel Combinations}{82}} \newlabel{sec:combinations}{{A.2}{82}} \@writefile{lot}{\contentsline {table}{\numberline {A.2}{\ignorespaces Possible mappings of channels onto Multiframes}}{82}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {B}OsmocomBB}{83}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {B.1}Installation}{83}} \newlabel{sec:osmo_install}{{B.1}{83}} \@writefile{toc}{\contentsline {section}{\numberline {B.2}Usage}{84}} \newlabel{sec:osmo_usage}{{B.2}{84}} \@writefile{toc}{\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{85}} \newlabel{sec:osmo_serial_schematics}{{B.3}{85}} \FN@pp@footnote@aux{24}{85} \@writefile{lof}{\contentsline {figure}{\numberline {B.1}{\ignorespaces Serial cable schematics.}}{85}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{87}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {C.1}Extextions}{87}} \newlabel{sec:extensions}{{C.1}{87}} \@writefile{toc}{\contentsline {section}{\numberline {C.2}Example Configuration}{89}} \newlabel{sec:example_config}{{C.2}{89}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {D}System Information}{93}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \newlabel{sec:system_infos}{{D}{93}} \FN@pp@footnotehinttrue \@writefile{lof}{\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{94}} \@writefile{lof}{\contentsline {figure}{\numberline {D.2}{\ignorespaces System Information 2 Message}}{95}} \@writefile{lof}{\contentsline {figure}{\numberline {D.3}{\ignorespaces System Information 3 Message}}{96}} \@writefile{lof}{\contentsline {figure}{\numberline {D.4}{\ignorespaces System Information 4 Message}}{97}} \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{\numberline {E}Evaluation Data}{99}} \@writefile{lof}{\addvspace {10\p@ }} \@writefile{lot}{\addvspace {10\p@ }} \@writefile{lol}{\addvspace {10\p@ }} \@writefile{toc}{\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{99}} \newlabel{sec:lac_change_test}{{E.1}{99}} \@writefile{lot}{\contentsline {table}{\numberline {E.1}{\ignorespaces Configurations used for the rx\tmspace +\thinmuskip {.1667em}/\tmspace +\thinmuskip {.1667em}LAC Change Rules test.}}{99}} \@writefile{toc}{\contentsline {section}{\numberline {E.2}Long Term Test}{99}} \newlabel{sec:long_term_test}{{E.2}{99}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \@writefile{toc}{\contentsline {chapter}{Acronyms}{101}} \FN@pp@footnotehinttrue \FN@pp@footnotehinttrue \gdef \LT@i {\LT@entry {4}{63.42068pt}\LT@entry {1}{245.03047pt}} \FN@pp@footnotehinttrue \global\@altsecnumformattrue