Open Source Mobile Communications

Harald Welte will deliver workshop on Running your own cellular network using OpenBSC & Co at the Electromagnetic Field Camp.

The workshop is currently scheduled at Saturday August 6th at 10:00 AM in Workshop 2

More information can be found at https://www.emfcamp.org/line-up/2016/183

Harald Welte will deliver workshop on Tracing (U)SIM card communication using Osmocom SIMtrace at the Electromagnetic Field Camp.

The workshop is currently scheduled at Saturday August 6th at 3:40 PM in Workshop 2

More information can be found at https://www.emfcamp.org/line-up/2016/184

libgtpnl, the library for Linux GTP netlink support, has been re-licensed under LGPLv2.1-or-later, instead of the existing GPLv2-or-later in order to facilitate its use from GPL-incompatible free software projects.

The release is tagged as 1.0.1 at http://git.osmocom.org/libgtpnl/tag/?h=1.0.1

Back in May, Osmocom developer Max Suraev has been working on implementing both uplink and downlink DTX support in the Osmocom GSM stack, most notably OsmoBTS and the OpenbSC libbsc (OsmoBSC and OsmoNITB).

• reduce uplink interference with other (remote) cells on the same ARFCNs
• conserve battery power in the mobile station (lower transmit duty cycle)

• reduce power consumption and heat dissipation on the BTS
• reduce downlink interference with other (remote) cells on the same ARFCNs

Downlink DTX is only permitted on secondary trnansceivers, i.e. on those TRX that do not carry the FCCH/SCH/BCCH beacon.

All related patches to OsmoBTS and OpenBSC have meanwhile been merged. You can use the dtx uplink [force] and dtx downlink VTY commands at the BTS node to enable the features.

The classic ETSI/3GPP specifications about GSM, particularly those related to A-bis, assume a fairly static allocation of the timeslots of a TRX inside a BTS. This means that the administrator configures each timeslot in the BSC to be one of the permitted channel combinations, for user traffic that's either SDCCH, TCH/F, TCH/H or PDCH.

The Osmocom project software, including OsmoBSC, OsmoNITB, OsmoBTS and OsmoPCU followed this static timeslot allocation when first implementing the related standards and systems.

This static allocation, particularly between circuit-switched calls and packet data leads to sub-optimal use of available (scarce) resources. What if there are no voice calls, but a high demand for packet data? Or why not (as an operator policy) provide more voice channels on demand, at the expense of packet data?

In 2013 years, Osmocom developer Andreas Eversberg did a BSC-side implementation of dynamic PDCH switching in OsmoNITB. However, related code unfortunately never made it to Osmocom master and it exposed some bit-rot over the years.

Neels Hofmeyr has recently picked up those patches, extended, fixed and forward-ported them to current master. They were subsequently merged. Corresponding changes inside OsmoBTS have been made with osmo-bts-sysmo and osmo-bts-litecell15, and have also been merged. Implementation for osmo-bts-trx is still ongoing (but difficult due to the desolate state of osmo-bts-trx with lack of a current maintainer).

With this first series of changes, only switching between TCH/F and PDCH is possible. Neels is currently working on making TCH/F, TCH/H and PDCH dynamic, resulting in even more flexibility even among full-rate and half-rate voice channels.

All the years since OsmoSGSN came first into existance, it never had gained GPRS encryption support. While the original code had been written with encryption in mind, and libosmocore even contained a plugin infrastructure for GPRS encryption plugins, nobody had so far connected the dots, figured out the bugs in the existing code and made it fully work.

Thanks to analysis by Dieter Spaar and Max Suraev, we now have a functional implementation of GPRS encryption in OsmoSGSN. The SGSN contains the core infrastructure for it, while encyption is handled via libosmocore. A GEA3 implementation has just been merged to libosmocore - we also have experimentally verified operation with GEA1 + GEA2, but unfortunately no public documentation / implementation of those security by obscurity algorithms is available yet.

In terms of the SGSN changes required: Most have been merged, while some are still in the gerrit review process, see https://gerrit.osmocom.org/#/q/topic:gea

Over the past weeks, Osmocom developer Daniel Willmann has been working on various improvements/extensions of the popular wireshark dissector in the context of using it with (Osmocom) GSM networks.

• support for playback of AMR from captured RTP streams (using libopencore-amrnb)
• extend RTP jitter/delay statistics for AMR-RTP as used in A-bis/IP and A/IP
• a new dissector for the Osmux (Osmocom Multiplex) protocol
• statistics support for the Osmux protocol.

The above features allow for much better analysis of any voice plane related issues in Osmocom GSM networks.

All related changes can be found in https://gitea.osmocom.org/osmocom/wireshark/src/branch/daniel/osmux and we are actively submitting them to mainline wireshark at this point.

According to some news report, including this report at softpedia, a 26 year old student at the Faculty of Criminal Justice and Security in Maribor, Slovenia has received a suspended prison sentence for finding flaws in Slovenian police and army TETRA network using OsmocomTETRA.

If a TETRA network (like any other network) is configured with broken security, then the people responsible for configuring and operating that network are to be blamed, and not the researcher who invests his personal time and effort into demonstrating that police radio communications safety is broken. On the outside, the court sentence really sounds like "shoot the messenger". They should instead have jailed the people responsible for deploying such an insecure network in the first place, as well as those responsible for not doing the most basic air-interface interception tests before putting such a network into production.

According to all reports, the student had shared the results of his research with the authorities and there are public detailed reports from 2015, like the report (in Slovenian) at https://podcrto.si/vdor-v-komunikacijo-policije-razkril-hude-varnostne-ranljivosti-sistema-tetra/.

The Osmocom project has migrated from an aging infrastructure consisting of multiple trac instances to a new environment using redmine.

Using redmine allows us to create a comprehensive hierarchy of nested projects, and allows projects to be shifted around in that hierarchy after the fact, as well as cross-project issue (=ticket) relationships. This fits our development much better than what we had before.

Over the past five weeks, the content of the affected was imported and manually reviewed/edited/migrated. You may still find some pages with erroneous formatting or other issues. If you do, please consider registering an account and fixing it yourself, or notifying the respective project mailing list (openbsc@lists.osmocom.org in case of doubt) about the issue you've encountered.

• http://bb.osmocom.org/ (OsmocomBB)
• http://openbsc.osmocom.org/ (OpenBSC, OsmoBTS, OsmoBSC, OsmoNITB, OsmoSGSN, ...)
• http://tetra.osmocom.org/ (OsmocomTETRA)
• http://simtrace.osmocom.org/ (Osmocom SIMtrace)
• http://security.osmocom.org/
• http://gmr.osmocom.org/ (OsmocomGMR)
• http://sdr.osmocom.org/ (OsmoSDR, rtl-sdr, ...)

More details can be found in Harald's blog post at http://laforge.gnumonks.org/blog/20160221-osmocom-redmine/

Yesterday the Osmocom project founder Harald Welte presented about Open Source Network Elements for Security Analysis of Mobile Networks at the Troopers 2016 TelcoSecDay.

The main topics addressed by this presentation are:

• Importance of Free and Open Source Software implementations of cellular network protocol stacks / interfaces / network elements for applied telecom security research
• The progress we've made at Osmocom over the last eight years.
• An overview about our current efforts to implement at 3G Network similar to the existing 2G/2.5G/2.75G implementations.

There are no audio or video recordings of this session.

Slides are available at http://git.gnumonks.org/index.html/laforge-slides/plain/2016/telcosecday/foss-gsm.html