Git Product home page Git Product logo

mobile_sentinel's Introduction

Mobile Sentinel

Mobile Sentinel is an Android App that allows you to detect vulnerabilities in deployed LTE and (future) 5G networks. With the current release, Mobile Sentinel focuses on the detection of the ReVoLTE vulnerability (www.revolte-attack.net). Mobile Sentinel requires a Qualcomm based Android phone with root access as it builds upon the Qualcomm's mdlog tool.

The application includes:

  • An automized test run to detect the ReVoLTE vulnerability
  • A logging view to capture cellular traffic (currently RRC only) and view protocol messages in-app
  • Writing the captured traffic into PCAP files
  • Upload function of logs to an http server (under development)

Installation

Download the latest APK build from here and install it directly on the device.

adb install MobileSentinel.apk

Alternatively, the app can be installed directly from the device's file system.

Settings

  • Configure Log Upload Setting: This setting allows you to change the behavior for uploading the log files to the server. Options:
    • Ask for Upload: Will ask after each test run if you would upload the data (Default).
    • Never Upload: Will never upload the logs.
    • Always Upload: Will always upload the logs.
  • Change Call Number: This setting allows you to change the phone number that is called for testing. Important note: there may be a risk of expense. Default number is a german phone number.

Build instructions

You can build the application from source as well however, you will need a Chaquopy SDK license to be able to deploy the app outside of Android Studio.

Requirements

  • Rooted Android Phone with a Qualcomm Baseband
  • The phone AND the used SIM Card must support VoLTE
  • Currently requires minimum Android Pie (9.0)

Make sure to grant Superuser rights to the application and accept the requested permissions, as the application will not work without.

Tested Devices

  • Xiaomi Mi A3 (Android 9.0)
  • One Plus 6T (Android 9.0)
  • Xiaomi Mix 3 5G (Android 9.0)

Used Libraries

Mobile Sentinel uses the following libraries:

Known Bugs

  • Some phones with a Qualcomm baseband do not allow extracting cellular network traffic from the DIAG interface

mobile_sentinel's People

Contributors

bedrankara avatar davidrupprecht avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

mobile_sentinel's Issues

Xiaomi Mi A3 Android 10

For some reason captured .pcap files always empty. Is it so because of Android 10 instead of 9? I can drop my .qmdl log files if it will help to determine the issue.

Undefined name: 'write_buf' in python/iodevices/fileio.py

https://github.com/RUB-SysSec/mobile_sentinel/blob/master/app/src/main/python/iodevices/fileio.py#L37

flake8 testing of https://github.com/RUB-SysSec/mobile_sentinel on Python 3.6.10

$ flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics

./app/src/main/python/iodevices/fileio.py:37:31: F821 undefined name 'write_buf'
            buf = util.unwrap(write_buf)
                              ^
./app/src/main/python/parsers/qualcomm/qualcommparser.py:281:5: F722 syntax error in forward annotation 'DIAG_LOG_F data without trailing CRC'
    def parse_diag_log(self, pkt: "DIAG_LOG_F data without trailing CRC", radio_id = 0):
    ^
./app/src/main/python/parsers/qualcomm/pycrate/pycrate_core/utils_py2.py:61:27: F821 undefined name 'long'
    integer_types = (int, long, _MPZ_T)
                          ^
./app/src/main/python/parsers/qualcomm/pycrate/pycrate_core/utils_py2.py:63:27: F821 undefined name 'long'
    integer_types = (int, long)
                          ^
./app/src/main/python/parsers/qualcomm/pycrate/pycrate_core/utils_py2.py:67:19: F821 undefined name 'unicode'
str_types = (str, unicode)
                  ^
1     F722 syntax error in forward annotation 'DIAG_LOG_F data without trailing CRC'
4     F821 undefined name 'write_buf'
5

https://flake8.pycqa.org/en/latest/user/error-codes.html

On the flake8 test selection, this PR does not focus on "style violations" (the majority of flake8 error codes that psf/black can autocorrect). Instead, these tests are focus on runtime safety and correctness:

  • E9 tests are about Python syntax errors usually raised because flake8 can not build an Abstract Syntax Tree (AST). Often these issues are a sign of unused code or code that has not been ported to Python 3. These would be compile-time errors in a compiled language but in a dynamic language like Python, they result in the script halting/crashing on the user.
  • F63 tests are usually about the confusion between identity and equality in Python. Use ==/!= to compare str, bytes, and int literals is the classic case. These are areas where a == b is True but a is b is False (or vice versa). Python >= 3.8 will raise SyntaxWarnings on these instances.
  • F7 tests logic errors and syntax errors in type hints
  • F82 tests are almost always undefined names which are usually a sign of a typo, missing imports, or code that has not been ported to Python 3. These also would be compile-time errors in a compiled language but in Python, a NameError is raised which will halt/crash the script on the user.

Explicitly clarify that test number is in DE in UI

The app warned that there might be costs, but I didn't expect the call to Germany. It would be useful to state where the test number is so the user can make an informed decision about the costs before starting the test.

App for Android 10

Hi,

When do you plan to release App for Android 10?

OnePlus 8 with Android 10 (rooted) does not detect device supports VoLTE.

Thanks

How the vulnerability is determined [Question]

Hello! I'm wondering about the determination of vulnerable eNodeB. Not quite sure that got that part right from the source code... So, the app makes short dials, records traffic, parses it... and what parameters point to the vulnerability? Is it if we recieve the same DRB ID twice?

Python syntax error in qualcommparser.py

https://github.com/RUB-SysSec/mobile_sentinel/blob/master/app/src/main/python/parsers/qualcomm/qualcommparser.py#L281

flake8 testing of https://github.com/RUB-SysSec/mobile_sentinel on Python 3.6.10

$ flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics

./app/src/main/python/iodevices/fileio.py:37:31: F821 undefined name 'write_buf'
            buf = util.unwrap(write_buf)
                              ^
./app/src/main/python/parsers/qualcomm/qualcommparser.py:281:5: F722 syntax error in forward annotation 'DIAG_LOG_F data without trailing CRC'
    def parse_diag_log(self, pkt: "DIAG_LOG_F data without trailing CRC", radio_id = 0):
    ^
./app/src/main/python/parsers/qualcomm/pycrate/pycrate_core/utils_py2.py:61:27: F821 undefined name 'long'
    integer_types = (int, long, _MPZ_T)
                          ^
./app/src/main/python/parsers/qualcomm/pycrate/pycrate_core/utils_py2.py:63:27: F821 undefined name 'long'
    integer_types = (int, long)
                          ^
./app/src/main/python/parsers/qualcomm/pycrate/pycrate_core/utils_py2.py:67:19: F821 undefined name 'unicode'
str_types = (str, unicode)
                  ^
1     F722 syntax error in forward annotation 'DIAG_LOG_F data without trailing CRC'
4     F821 undefined name 'write_buf'
5

https://flake8.pycqa.org/en/latest/user/error-codes.html

On the flake8 test selection, this PR does not focus on "style violations" (the majority of flake8 error codes that psf/black can autocorrect). Instead, these tests are focus on runtime safety and correctness:

  • E9 tests are about Python syntax errors usually raised because flake8 can not build an Abstract Syntax Tree (AST). Often these issues are a sign of unused code or code that has not been ported to Python 3. These would be compile-time errors in a compiled language but in a dynamic language like Python, they result in the script halting/crashing on the user.
  • F63 tests are usually about the confusion between identity and equality in Python. Use ==/!= to compare str, bytes, and int literals is the classic case. These are areas where a == b is True but a is b is False (or vice versa). Python >= 3.8 will raise SyntaxWarnings on these instances.
  • F7 tests logic errors and syntax errors in type hints
  • F82 tests are almost always undefined names which are usually a sign of a typo, missing imports, or code that has not been ported to Python 3. These also would be compile-time errors in a compiled language but in Python, a NameError is raised which will halt/crash the script on the user.

Xiaomi Mi Mix 5G - App Crash

I have rooted the phone and installed the App. When I run the test, it gets 4 calls in to testing and the App crashes out. I have tried uninstalling and reinstalling again but same .

App fails on Pixel 3a XL

Pixel 3a XL (Qualcomm Snapdragon 670 chip)
Android 10 in developer mode
VoLTE network
SIM card: LTE voice and data
MobileSentinel 1.0

App doesn't detect IMSI (ICCID on this phone) and shows isVolteEnabled: False.
Changed Call Number to this phone.
Starting detection makes 4 calls and then gives up without logging anything.

App crashes

The app crashes %10 thru the test

Android version 10

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.