Hacking Connected Cars : Tactics, Techniques, and Procedures (9781119491736) by Knight Alissa

Author:Knight, Alissa [Knight, Alissa]
Language: eng
Format: epub
ISBN: 9781119491736
Publisher: John Wiley & Sons Inc
Published: 2020-03-10T00:00:00+00:00

When You Don't Know the IMSI or MSISDN of the TCU

When you find yourself in the precarious position of a black box or gray box penetration test, or even a white box penetration test, and the client doesn't know the telephone number or IMSI of the TCU, it doesn't prevent you from finding it. While a laborious and uneventful process, you can actually go hunting for it yourself. To do so, you'll need the help of either Kalibrate or grgsm to get a list of the local towers and then Wireshark to passively sniff the packets to find your TCU.

Let's do that now. But before doing this, you need to install a few things, if they aren't yet installed.

First, install gqrx:

$ sudo apt install gqrx-sdr

Next, install grgsm:

$ sudo apt install pybombs $ sudo pybombs install gr-gsm

Finally, use grgsm_scanner to list local base stations and their channels:

$ sudo grgsm_scanner -g 35

In addition to listing local base stations and their channels, grgsm will output the associated channel's frequency, cell ID (CID), location area code (LAC), country code, and network code. To switch to a listed frequency and listen for traffic, use grgsm_livemon.

My recommendation is to start with the ARFCN with the highest power, because that will be the BTS with the strongest signal that our TCU will be camped on.

Once you've identified the ARFCN you want to camp on, use grgsm_livemon to easily switch to that channel and begin monitoring:

$ sudo grgsm_livemon

Alternatively, you can also use a tool called Kalibrate to find local base stations as well. Start Kalibrate and hunt for channels in the local area to find the TCU, as shown in Figure 5-6:

$ kal -s GSM900

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.