GSM security testing: where the action is [LWN.net]

GSM security testing: where the action is

Posted Sep 27, 2010 6:58 UTC (Mon) by Cyberax (✭ supporter ✭, #52523)
In reply to: GSM security testing: where the action is by rahvin
Parent article: GSM security testing: where the action is

While I'm awed by Harald Welte, I don't think this project makes a lot of difference.

Cell phone towers are mass-produced and are pretty cheap. You probably can't make anything much cheaper as it is on large scale. On small scale it might be possible, but it'll still probably be cheaper to buy a nanocell.

And while GSM is nice, it's now clear that the 'path forward' is 4G which is going to use VoIP over an IP data network.

to post comments

GSM security testing: where the action is

Posted Sep 27, 2010 8:21 UTC (Mon) by freddyh (guest, #21133) [Link] (9 responses)

You might be surprised. If Harald succeeds, you might see increased competition (as mentioned in the original article: there are only few companies who make hardware and software). Increased competition is always good, not only for features but also for security and price.

GSM security testing: where the action is

Posted Sep 27, 2010 8:37 UTC (Mon) by Cyberax (✭ supporter ✭, #52523) [Link] (8 responses)

Cynically speaking, obscurity in this case is good for security. Because not much companies can afford to reverse-engineer the whole stack and create malicious GSM software/hardware.

As for competition, there's enough of it in the hardware cell-tower market. They are produced in millions, and basic GSM cell phone infrastructure (i.e. no GPRS, EVDO, etc.) is now VERY cheap on per-subscriber basis. Use of non-carrier-grade hardware is quite likely to _increase_ costs because of increased maintenance overhead.

No, the next battlefield will be 4G technologies. They have the potential to uproot established telecoms. 4G phones will be simple IPv6 nodes, and calls between them are going to be simple VoIP streams over data network which can be (by design) transmitted over the WiFi and public Internet.

PS: I worked as a network architect in a small cell-phone company.

Viability of open GSM stacks and equipment

Posted Sep 27, 2010 12:39 UTC (Mon) by sladen (guest, #27402) [Link] (6 responses)

Yes, going forward, the number of modems/radio interfaces available for backhaul on a device is seemingly always increasing (GSM/GPRS/EDGE, Bluetooth, W-CDMA/HSDPA, 802.11b/g, LTE...), but on a phone the GSM Um is going to be present for a very long time virtually anywhere in the world (except in Japan).

Instead of thinking about the costs of initial hardware certification, consider instead every business case that you may have encountered (in designing networks) where a mast had been planned but wasn't economically viable based on the threshold of subscribers in that area. Imagine re-evaluating those business cases with potentially 1/10th of the equipment running costs (power, cooling) and 1/10th of the capital equipment costs.

For a small telco such as Telecom Niue (or perhaps yourself) the turning-over-the-tables of current build-out viability is probably quite attractive, and potentially as disruptive as COTS/open-source has been in the rest of the electronics industry. There are people open to the possibility out there name a recent smartphone on the market that isn't now running a BSD/GPL Unixy kernel inside it and then project that same degree of confluence onto the infrastructure side.

Viability of open GSM stacks and equipment

Posted Sep 27, 2010 13:10 UTC (Mon) by Cyberax (✭ supporter ✭, #52523) [Link] (5 responses)

>Yes, going forward, the number of modems/radio interfaces available for backhaul on a device is seemingly always increasing (GSM/GPRS/EDGE, Bluetooth, W-CDMA/HSDPA, 802.11b/g, LTE...), but on a phone the GSM Um is going to be present for a very long time virtually anywhere in the world (except in Japan).

Not likely. AMPS/DAMPS died quickly with the advent of GSM/CDMA, for example (oh, sure there were few holdouts). Once we have viable 4G standards, they're going to spread quickly. There are just too many advantages: cheaper roaming, better data integration, more bandwidth, less power consumption, etc.

>Instead of thinking about the costs of initial hardware certification, consider instead every business case that you may have encountered (in designing networks) where a mast had been planned but wasn't economically viable based on the threshold of subscribers in that area.

Almost never happens. Even at $1 ARPU per month it's economically viable to install a tower even with 50 subscribers. You don't really get lower than that. And if you DO get lower, than most of your investment will be spent on getting uplink anyway (usually a microwave link, which requires, you guessed it, a tower for line-of-sight).

Viability of open GSM stacks and equipment

Posted Sep 30, 2010 7:13 UTC (Thu) by Cato (guest, #7643) [Link] (4 responses)

I doubt GSM is going to go away on the handset for at least 10 years, simply because there is so much GSM deployed world-wide and it will be convenient to be able to make voice calls even when visiting the most rural parts of the developing world. Given software radio and DSP technologies, there is very little extra cost to supporting GSM alongside UMTS and LTE.

GSM also has good coverage for rural areas, as a GSM cell can reach up to 35 km (http://en.wikipedia.org/wiki/GSM#Cellular_radio_network ) vs. "over 10km" in theory for UMTS (http://books.google.co.uk/books?id=7m-MnwW_o7AC&lpg=P... ). Even today in a Western European country, the only way I can get UMTS 3G coverage at home is via femtocell, and I'm only 5 km from the nearest 3G base station. The economics of deploying a UMTS or LTE base station closer to me will only stack up if there's a very cheap wireless backhaul technology that can handle the required throughput for multiple 3G/4G subscribers.

Viability of open GSM stacks and equipment

Posted Sep 30, 2010 12:54 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

Range of coverage can actually be better in 4G technologies. First, they are going to use more robust and efficient radio modulation technologies. I know that it's being specifically worked on.

For GSM maximum distance is limited to about 40km (by lightspeed so you can't do anything about it). It's quite feasible that 4G technologies will allow 50-70km maximum distance to tower.

UMTS is quite far from ideal here. We've learned a lot since it was first designed.

Viability of open GSM stacks and equipment

Posted Sep 30, 2010 19:42 UTC (Thu) by Jan_Zerebecki (guest, #70319) [Link] (1 responses)

> For GSM maximum distance is limited to about 40km (by lightspeed so you can't do anything about it).

Usually the range is limited to the distance the signal can travel in one timeslot, but it seems you can do something about it if your BTS is modified to allow the signal to arrive in the next timeslot.

Viability of open GSM stacks and equipment

Posted Sep 30, 2010 19:50 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link]

Yes, it's sometimes used. But not all devices will work in this case, and GSM you can get issues with interference.

Viability of open GSM stacks and equipment

Posted Oct 4, 2010 2:24 UTC (Mon) by showell (guest, #2929) [Link]

We have had our GSM cells working out to 121 kms using an Ericsson feature called extended range.

GSM will be with us for along time because the GSM chipsets are still 1/2 the price of the 3G / 4G ones (due mainly to IP payments). GSM handsets sell in poorer markets in massive quantities over 3G.

LTE and VoIP

Posted Sep 30, 2010 6:57 UTC (Thu) by Cato (guest, #7643) [Link]

It's not quite true to say that all 4G calls will be VoIP - true for WiMAX if you count that as 4G, but with LTE (successor to UMTS/GSM), it's still not clear exactly how voice will be handled. Some LTE operators will use "circuit switch fall back" to 3G for voice, some will use VoLGA ( http://findarticles.com/p/articles/mi_m0FGI/is_6_20/ai_n3... ), and others will go IMS (VoLTE), implying VoIP calls - http://www.pcworld.com/businesscenter/article/189339/mobi... and http://www.networkworld.com/news/2010/021510-gsma-one-voi... have some discussion, but IMS is notoriously complex to deploy (it's been the "next thing" for about 10 years now).

Basically, 3G voice fallback has issues with the time to switch networks, while VoLTE is the long term solution (but has had to add SMS support to IMS), while VoLGA is the interim solution using GAN (Generic Access Network, aka UMA) - essentially circuit switch calls over an IP infrastructure, also used today by mobile phones that switch between GSM/3G and WiFi while on the same call (e.g. Blackberry and some Nokias), bypassing the need for femtocells in some cases.

Ultimately it looks like everyone will use VoIP with LTE, but it will take a few years given that some of the VoLTE standards aren't yet finalised.

GSM security testing: where the action is

Posted Sep 27, 2010 8:40 UTC (Mon) by rahvin (guest, #16953) [Link] (4 responses)

Depends on your definition of cheap. Where the average yearly income is less than $2000 a year the build out costs of a tower network can be so astronomical that it's not possible to recoup the investment and at the same time offer affordable service at the rates the average citizen can afford. The major costs in this equation are the equipment and what makes that equipment expensive is the software IP behind it all and the astronomic amounts charged for the back-end equipment that runs the network. Costs that are almost entirely software as the physical hardware is quite cheap.

The kicker is that even when the patents expire, or in countries where they aren't valid the closed ecosystem prevents operators from offering service at locally affordable rates without paying the IP tax. The ultimate goal (at least from my perspective) of all these FOSS GSM projects is to break open the closed ecosystem and crack the security that enforces it so that software isn't an expense in the equation. This relegates the costs to construction, towers, power and general purpose equipment with FOSS on top. Without the "software" costs the systems can be erected cheaper, maybe even to the point where people making less than $2000 a year can afford service. At the least it's definitely going to lower the break point where more people can afford cellular service. Even if it takes 5 years or more to crack open, GSM is going to have a long lifespan in areas with low average incomes.

Most people in the west don't realize it, but cellular phones are the primary means of access to information in large areas of the world. Not just voice, but the primary internet access as well. These efforts to crack this closed ecosystem and the security that enforces it are vital to free access to information.

Harold's role in this is critical as the security is a key component to building a cellular service. Not only that but the benefits to those of us in the west as he could find security holes that right now only the government and criminals are aware of.

GSM security testing: where the action is

Posted Sep 27, 2010 8:50 UTC (Mon) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

I live in a country with $2500-$3000 nominal GDP per capita (Ukraine, if anyone is interested).

We have like 80% of coverage for the whole country, with many competing independent cell networks. I can literally travel everywhere and get a good phone signal (even in Chernobyl).

GSM security testing: where the action is

Posted Sep 29, 2010 8:31 UTC (Wed) by mfedyk (guest, #55303) [Link]

I imagine it's different in many parts of africa and some parts of asia and south america.

GSM security testing: where the action is

Posted Oct 7, 2010 7:46 UTC (Thu) by gat3way (guest, #47864) [Link]

Same here (Bulgaria, nominal GDP/capita ~ $6000). Our three operators have >95% coverage since at least 6-7 years ago. Also, the bills are not at all expensive for the average person (Bulgaria is EU's poorest member). They were in the end of the 90s but that was mostly due to the fact that we had just one operator then.

3G did develop practically in the last 3-4 years and it was incredibly expensive in the beginning, now you can get postpaid plans with unlimited traffic for about $15-$20/month. Lots of people switched off from ADSL to the mobile telcos in the rural areas as it costs almost the same (and the national ADSL provider is notorious for its poor support).

Yet as the nice new Android smartphones and the iphones are quite expensive here, GSM is here to stay for at least a couple of years.

GSM security testing: where the action is

Posted Sep 27, 2010 11:28 UTC (Mon) by marcH (subscriber, #57642) [Link]

I visited Niger, one of the poorest countries in the world; its GDP has never been above $500 per capita. There are three different GSM operators and decent coverage. Every working person has a GSM phone.

They can easily transfer credit from one account to another, sometimes using phone credit as mere pocket money.

Price of GSM/3G base stations

Posted Sep 30, 2010 6:44 UTC (Thu) by Cato (guest, #7643) [Link] (1 responses)

You may be right - the main costs probably can't be avoided, such as amplifiers, power supply, etc. According to this research a few years ago, a UMTS 3G base station (presumably a macrocell, i.e. a normal "cell phone tower" for GSM-family 3G) costs $24,000: http://mobilesociety.typepad.com/mobile_life/2007/02/the_...

The test would be whether WiMAX base stations are cheaper, as they are built in a more "commodity" way - if GSM becomes more open it would be possible to build GSM base stations like that.

UMTS femtocells are very cheap (there are few if any GSM femtocells) with a consumer price of $70-$150 - I bought mine for $70 new off eBay.

Price of GSM/3G base stations

Posted Sep 30, 2010 12:26 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link]

Let's say, that $24000 is way too high for a small cell phone tower (to provide coverage in a small village) somewhere in Niger. Especially, if you are willing to trade some reliability for price.