LTESniffer - An Open-source LTE Downlink/Uplink Eavesdropper

LTESniffer is An Open-source LTE Downlink/Uplink Eavesdropper

It first decodes the Physical Downlink Control Channel (PDCCH) to obtain the Downlink Control Informations (DCIs) and Radio Network Temporary Identifiers (RNTIs) of all active users. Using decoded DCIs and RNTIs, LTESniffer further decodes the Physical Downlink Shared Channel (PDSCH) and Physical Uplink Shared Channel (PUSCH) to retrieve uplink and downlink data traffic.

LTESniffer supports an API with three functions for security applications and research. Many LTE security research assumes a passive sniffer that can capture privacy-related packets on the air. However, non of the current open-source sniffers satisfy their requirements as they cannot decode protocol packets in PDSCH and PUSCH. We developed a proof-of-concept security API that supports three tasks that were proposed by previous works: 1) Identity mapping, 2) IMSI collecting, and 3) Capability profiling.

Please refer to our [paper][paper] for more details.

LTESniffer in layman's terms

LTESniffer is a tool that can capture the LTE wireless messages that are sent between a cell tower and smartphones connected to it. LTESniffer supports capturing the messages in both directions, from the tower to the smartphones, and from the smartphones back to the cell tower.

LTESniffer CANNOT DECRYPT encrypted messages between the cell tower and smartphones. It can be used for analyzing unencrypted parts of the communication between the cell tower and smartphones. For example, for encrypted messages, it can allow the user to analyze unencrypted parts, such as headers in MAC and physical layers. However, those messages sent in plaintext can be completely analyzable. For example, the broadcast messages sent by the cell tower, or the messages at the beginning of the connection are completely visible.

Ethical Consideration

The main purpose of LTESniffer is to support security and analysis research on the cellular network. Due to the collection of uplink-downlink user data, any use of LTESniffer must follow the local regulations on sniffing the LTE traffic. We are not responsible for any illegal purposes such as intentionally collecting user privacy-related information.

Features

New Update v2.1.0

• Supports recording IQ raw data of subframes to file. Please refer to LTESniffer-record-subframe branch and its [README][capture-readme] for more details.
• Supports offline decoding using recorded files ([README][capture-readme]).
• Enable API in the downlink mode (only apply for identity collecting and mapping API)

New Update v2.0.0

• Supports two USRP B-series for uplink sniffing mode. Please refer to LTESniffer-multi-usrp branch and its [README][multi-readme] for more details.
• Fixed some bugs.

LTESniffer is implemented on top of [FALCON][falcon] with the help of [srsRAN][srsran] library. LTESniffer supports:

• Real-time decoding LTE uplink-downlink control-data channels: PDCCH, PDSCH, PUSCH
• LTE Advanced and LTE Advanced Pro, up to 256QAM in both uplink and downlink
• DCI formats: 0, 1A, 1, 1B, 1C, 2, 2A, 2B
• Transmission modes: 1, 2, 3, 4
• FDD only
• Maximum 20 MHz base station.
• Automatically detect maximum UL/DL modulation schemes of smartphones (64QAM/256QAM on DL and 16QAM/64QAM/256QAM on UL)
• Automatically detect physical layer configuration per UE.
• LTE Security API: RNTI-TMSI mapping, IMSI collecting, UECapability Profiling.

Hardware and Software Requirement

OS Requirement

Currently, LTESniffer works stably on Ubuntu 18.04/20.04/22.04.

Hardware Requirement

Achieving real-time decoding of LTE traffic requires a high-performance CPU with multiple physical cores, especially during peak hours when the base station has many active users. LTESniffer successfully achieved real-time decoding when deployed on an Intel i7-9700K PC, decoding traffic from a base station with 150 active users.

The following hardware is recommended

• Intel i7 CPU with at least 8 physical cores
• At least 16Gb RAM
• 256 Gb SSD storage

SDR

LTESniffer requires different SDR for its uplink and downlink sniffing modes.

To sniff only downlink traffic from the base station, LTESniffer is compatible with most SDRs that are supported by the srsRAN library (for example, USRP or BladeRF). The SDR should be connected to the PC via a USB 3.0 port. Additionally, it should be equipped with two RX antennas to decode downlink messages in transmission modes 3 and 4. If your SDR only has one RX antenna, LTESniffer will only decode downlink messages in transmission mode 1. Note that GPSDO is optional for downlink sniffing; it will help improve synchronization but is not mandatory.

On the other hand, to sniff uplink traffic from smartphones to base stations, LTESniffer needs to listen to two different frequencies (Uplink and Downlink) concurrently. To solve this problem, LTESniffer supports two options:

• Using a single USRP X310. USRP X310 has two Local Oscillators (LOs) for 2 RX channels, which can turn each RX channel to a distinct Uplink/Downlink frequency. Similar to Downlink Sniffing, GPSDO is optional for this option. To use this option, please refer to the main branch of LTESniffer.
• Using 2 USRP B-Series. LTESniffer utilizes 2 USRP B-series (B210/B200) for uplink and downlink separately. It achieves synchronization between 2 USRPs by using GPSDO for clock source and time reference. GPSDO is mandatory for this option. To use this option, please refer to the LTESniffer-multi-usrp branch of LTESniffer and its [README][multi-readme].

Installation

Important note: To avoid unexpected errors, please follow the following steps on Ubuntu 18.04/20.04/22.04.

Dependencies

• Important dependency: [UHD][uhd] library version >= 4.0 must be installed in advance (recommend building from source). The following steps can be used on Ubuntu 18.04. Refer to UHD Manual for full installation guidance.

UHD dependencies:

sudo apt update
sudo apt-get install autoconf automake build-essential ccache cmake cpufrequtils doxygen ethtool \
g++ git inetutils-tools libboost-all-dev libncurses5 libncurses5-dev libusb-1.0-0 libusb-1.0-0-dev \
libusb-dev python3-dev python3-mako python3-numpy python3-requests python3-scipy python3-setuptools \
python3-ruamel.yaml

Clone and build UHD from source (make sure that the current branch is higher than 4.0)

git clone https://github.com/EttusResearch/uhd.git
cd <uhd-repo-path>/host
mkdir build
cd build
cmake ../
make -j 4
make test
sudo make install
sudo ldconfig

Download firmwares for USRPs:

sudo uhd_images_downloader

We use a 10Gb card to connect USRP X310 to PC, refer to UHD Manual [1], [2] to configure USRP X310 and 10Gb card interface. For USRP B210, it should be connected to PC via a USB 3.0 port.

Test the connection and firmware (for USRP X310 only):

sudo sysctl -w net.core.rmem_max=33554432
sudo sysctl -w net.core.wmem_max=33554432
sudo ifconfig <10Gb card interface> mtu 9000
sudo uhd_usrp_probe

• srsRAN dependencies:

sudo apt-get install build-essential git cmake libfftw3-dev libmbedtls-dev libboost-program-options-dev libconfig++-dev libsctp-dev

• LTESniffer dependencies:

sudo apt-get install libglib2.0-dev libudev-dev libcurl4-gnutls-dev libboost-all-dev qtdeclarative5-dev libqt5charts5-dev

Build LTESniffer from source:

git clone https://github.com/SysSec-KAIST/LTESniffer.git
cd LTESniffer
mkdir build
cd build
cmake ../
make -j 4 (use 4 threads)

Usage

LTESniffer has 3 main functions:

• Sniffing LTE downlink traffic from the base station
• Sniffing LTE uplink traffic from smartphones
• Security API