4G LTE Man In The Middle Attacks With A Hacked Small Cells

Here is an interesting talk from recent HITBSecConf by Xiaodong Zou. HITBSecConf or the Hack In The Box Security Conference is an annual must attend event in the calendars of security researchers and professionals around the world. Held annually in Kuala Lumpur, Malaysia and Amsterdam in The Netherlands, HITBSecConf is a platform for the discussion and dissemination of next generation computer security issues.

From the talk narrative:

Femtocells offer a user the ability to have a small base station located within their house or other area. These small base stations provide access to the core telecom network where poor reception from an eNodeB would normally prevent consistent coverage. Femtocells has been standardized in LTE since release 8, and is referred as Home eNodeB, or HeNB. HeNBs are mandated to have an IPsec connection back to a security gateway (SeGW) to protect traffic flowing into and out of a Mobile Network Operator (MNO)’s core network.

If the HeNB is within the physical possession of an attacker, this provides unlimited time to identify a flaw on the HeNB. A compromised HeNB can be used in a manner similar to a rogue base station, but will also provide the attacker access to clear text traffic before it is sent back to the core network. There are more than ten different types of HeNBs deployed in China. Ericsson ENC-nRBS01B40 is one of them – a TD-LTE base station working on band B40.

In this talk, we will cover:

1.) How to root a 4G LTE femtocell.
2.) How to make the femtocell portable.
3.) How to perform man-in-the-middle attack with the femtocell.
4.) Show the prototype of Hacking Box of S1 Interface (HBoS)

Slides and video embedded below:

4G LTE Man in the Middle Attack with a Hacked Femtocell from 3G4G

Related Posts:

• Macrocells, Small Cells & Hetnets Tutorial
• Introduction to 3GPP Security in Mobile Cellular Networks

China Telecom's PON based Small Cells backhaul to reduce CapEX and OpEX

GSMA has a network economics case study from China Telecom on their future networks website. This case study focuses on the challenges of CapEX and OpEX of small cell backhaul. For coverage and/or capacity enhancement purpose, small cells will be deployed widely in the future. As the number of small cells deployed increases, larger bandwidth and higher flexibility are required for the backhaul transportation, which consequentially leads to higher CapEX and OpEX. Therefore an economic and practical approach has to be put forwarded and verified.

China Telecommunications (CT) is one of the largest state-owned telecommunication companies in China. With the world’s largest broadband Internet network, Frequency Division Duplex – Long Term Evolution (FDD – LTE) mobile network, China Telecom is capable of providing cross-region, fully integrated information services to global customers through its sound customer service channel system.

In this case study, CT proposes a small cell backhaul based on Passive Optical Network (PON) system, which can reduce at least 80% of the trunk fibre and 50% of associated fibre. As a result making facility room and air-conditioning unnecessary. Therefore the CapEX and OpEx of small cell deployment could be reduced effectively and remarkably.

As networks evolve through 4.5G to 5G with more complexity, network densification and intelligence at the edge, the need will be even greater to optimise transport network architecture within mobile Radio Access Network (RAN) to resolve the challenges of backhaul/fronthaul demand and the corresponding increase in costs (CapEX and OpEX).

Key highlights of the case study:

• Small cell backhaul based on Passive Optical Network (PON) system is proposed, which can reduce at least 80% of the trunk fibre and 50% of associated fibre and facility room and airconditioner are no longer required.
• China Telecom has conducted laboratory and field test in Hubei City and Shanghai with Huawei and ZTE. The test results proved the feasibility with equipment and performance KPI’s satisfied.
• Backhaul based PON could be one of the preferred choices for small cell backhaul transport. 

CT selected seven outdoor sites and one indoor site in Hubei, and eight outdoor sites in Shanghai. All the small cells were linked to EPON (Ethernet Passive Optical Network) equipment, which had been updated (software and hardware) to support frequency and time synchronisation. Detailed information about CBUs (Cellular Backhaul Units) and small cells in CT laboratory can be seen in the picture above and more details are provided in the case study.

The case study is available here.


Chengliang Zhang, Vice President of China Telecom Beijing Research Institute, China talked about "Optical Networking in the Cloud and 5G Era" which is embedded below.

ZTE's 4G / 5G Street Lights

While we are on the subject of street lights and lamp posts, I thought it may be worth mentioning about ZTE's BluePillar Streetlamp solution that it announced back in 2016:

An integrated streetlamp, charging pillar, base transceiver station (BTS) and smart city information solution, BluePillar enables a traditional streetlamp pillar to double as a 4G/5G BTS, or a charging point for electric vehicles. The solution can also collect local data on weather, environment, transportation and security while its large outdoor LED screen can be used to display information and advertising.

The BluePillar solution consists of ZTE’s BlueBox charging pillar, 4G iMacro base station, intelligent controller and intelligent streetlamp, all fully integrated into one product. It makes full use of a streetlamp pillar and integrates seamlessly into the surrounding environment, which could not only solve the difficulty in siting 4G networks, but also assure Wi-Fi construction, environment monitoring, security management and data collection in hotspots. It also offers direct outdoor advertising opportunities, as well as the display of municipal information and other value-added services at the same time. This solution could reduce the unit cost and promote the business density of each site, which could help operators acquire sites whilst saving land, electricity and other resources. Local governments, operators, everyday citizens and electric car owners all stand to benefit from this solution. For example operators could expand their business scope, and make the transition from traditional telecoms operation to the comprehensive operation of data services in cities.

The innovative integration of the solution, including the BTS, streetlamp and charging pillar, coupled with its ability to charge electric vehicles makes this a convenient solution for telecoms tower companies. ZTE's BluePillar solution could solve the challenges of Internet access on roads and in communities, as well as making streetlamps intelligently connected via information exchanged through its BTS.

Additionally:

Besides street lighting ZTE BluePillar is an integrated part of smart city. The system supports security surveillance, real-time information collection on the environment, real-time monitoring of the assets/special crowd with RFID .Through the LCD, important information and advertisement can be displayed which will bring benefit to the citizens as well as operators. RRU and WIFI equipment can be installed with BluePillar, citizen will be facilitated with WIFI services. Nowadays people have concern about air pollution and prefer clean transportation, such as Electrical Vehicles .However, due to limited space, lack of charging piles becomes an vital factor hinders the popularity of EV. Integrated with AC charging piles, BulePillar solution can save space and be an ideal method for municipal department to spread EV.


According to the ZTE magazine:

ZTE has deployed its IoT solutions in over 140 cities in 40 countries globally. She stated that a wide variety of solutions using smart meters have helped optimise city infrastructure with smart street lighting, parking as well as water and air monitoring Some examples include the deployment of 20 thousand smart street lamps in Paris’ smart city project: the City of Light. These smart street lamps are outfitted with sensors that help manage its energy consumption and maintenance optimisation.

To help alleviate traffic jams in congested cities, ZTE has smart parking solutions that notify users where they can park their vehicle without having to search for hours on end for parking spots. With its smart building and environmental monitoring, building managers would be able to better manage power distribution within the building.

I could not find any information about the 4G / 5G solution being trialed anywhere but I am sure it probably is.

Also, it seems that this Streetlight is developed by another Chinese company called Shanghai Sansi Technology Co.,Ltd. See here. More info also on their Youtube channel here.

Related Posts:

• KDDI to test 5G with base stations built in Street Lights
• Small Cells at Mobile World Congress 2017 (#MWC17)
• Small Cells in the Lamp posts
• Small Cells on the Lamp posts and other street furniture

Interference in 3G Hetnets in case of shared carrier

We had a discussion earlier on 'dedicated v/s shared' carrier here. This post is just re-iterating the fact that while in case of LTE, there are advanced techniques like eICIC to manage interference (see 3G4G blog here), in case of 3G there are no standard techniques to manage the interference in case of shared carrier.

A recent presentation from ZTE in one of the conferences explains this point further that has been reproduced below for reference: