IP security with GPRS handsets

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

JF Mezei - 14 Jan 2004 11:41 GMT

From what I have read, the GSM networks generally NAT all GPRS handsets who
then appear to have all the same IP address from the internet side of things.
This means that a server on the internet cannot know whether requests are
comming from different users or all the same user etc.

Does anyone know if the GSM network operators have logs of which customer
connected to which internet IP address at what time ? Or is it impossible
(even with warrant) to trace fraudulent use back to a handset ?

Would a web/wap server for instance need to also log the client's port number
so that the GSM network could then associate the specific call to a handset ?

Reply to this Message

Will Spencer - 09 Feb 2004 05:03 GMT

> From what I have read, the GSM networks generally NAT all GPRS handsets who
> then appear to have all the same IP address from the internet side of things.
[quoted text clipped - 7 lines]
> Would a web/wap server for instance need to also log the client's port number
> so that the GSM network could then associate the specific call to a handset ?

The GSM network operators, for legal reasons, should maintain logfile data.

When I browse the web from my AT&T GSM BlackBerry, the web server log file
shows:

209.183.48.49 - - [08/Feb/2004:22:04:39 -0700] "GET / HTTP/1.1" 200
3144 "-" "BlackBerry6710/3.6.0 UP.Link/5.1.1.1a"

nslookup of 209.183.48.49 shows:

Name: pnupagt08.attwireless.net
Address: 209.183.48.49

The web server won't be able to identify the user by the incoming port
number.

Tracing fraud back to an individual subscriber would require cooperation
from the carrier.

Will
Webmaster: http://www.gsmsecurity.com

Reply to this Message

JF Mezei - 09 Feb 2004 06:58 GMT

> When I browse the web from my AT&T GSM BlackBerry, the web server log file
> shows:
>
> 209.183.48.49 - - [08/Feb/2004:22:04:39 -0700] "GET / HTTP/1.1" 200
> 3144 "-" "BlackBerry6710/3.6.0 UP.Link/5.1.1.1a"

And when I access from my Fido phone, I get an entry such as:
204.92.15.224 - - [04/Feb/2004:21:32:33 +0000] "GET /index.wml HTTP/1.0" 200 107
1 "" "SIE-M55/09 UP.Browser/6.1.0.5.c.6 (GUI) MMP/1.0"

with 204.92.15.224 being aegis.fido.ca

However, looking at http headers, I also get
HTTP_VIA 1.1 squid.fido.ca:3128 (Squid/2.3.STABLE5)
HTTP_X_FORWARDED_FOR 205.151.11.27

According to some of the documentation I have read, the forwarded_for should
be the address of the phone with the WAP apn. But I can't reverse nslookup
that IP.

Since I posted the message, I have found that many WAP gateway (but
Microcell's doesn't) provide a X_SUBNO header which has a unique number
associated with the subscriber.But if Fido doesn't provide it, I guess it
isn't all that standard.

Reply to this Message

Mark E. Daniel - 10 Feb 2004 07:47 GMT

In alt.cellular.gsm Will Spencer <will.spencer@gsmsecurity.com> wrote:

>> From what I have read, the GSM networks generally NAT all GPRS handsets who
>> then appear to have all the same IP address from the internet side of things.
>> This means that a server on the internet cannot know whether requests are

Is that to say that GSM handsets using GPRS don't have any incoming
ports? People won't be able to ssh into my connected laptop?

Reply to this Message

Jer - 10 Feb 2004 14:26 GMT

> In alt.cellular.gsm Will Spencer <will.spencer@gsmsecurity.com> wrote:
>
[quoted text clipped - 4 lines]
> Is that to say that GSM handsets using GPRS don't have any incoming
> ports? People won't be able to ssh into my connected laptop?

If you don't want anyone accessing your crummy laptop, put a firewall on
it. If it's connected, it's vulnerable.

Signature

jer email reply - I am not a 'ten' ICQ = 35253273
"All that we do is touched with ocean, yet we remain on the shore of
what we know." -- Richard Wilbur

Reply to this Message

JF Mezei - 12 Feb 2004 07:33 GMT

Jer wrote:> If you don't want anyone accessing your crummy laptop, put a
firewall on

> it. If it's connected, it's vulnerable.

From what I have read, it depends on the network. If the network uses NAT,
there may be no way to connect from the internet to the phone since the NAT
router has no idea to which phone an incoming call should be routed.

If a network provides dynamic routable IP adresses without using NAT, then
yes, you could connect remotely to the handset. But from what I read, most
networks use NAT.

Some implementations may have smart enough NAT to allow some UDP packets to
get back to the phone (for instance to allow a traceroute/ping).

Reply to this Message

Jer - 12 Feb 2004 14:12 GMT

> Jer wrote:> If you don't want anyone accessing your crummy laptop, put a
> firewall on
[quoted text clipped - 11 lines]
> Some implementations may have smart enough NAT to allow some UDP packets to
> get back to the phone (for instance to allow a traceroute/ping).

Yes, what you say is all true, but don't ignore the network
administrators, you don't know whether they're angels either. It's your
computer, and it's your responsibility to allow or deny what connects to
it, not theirs.

You don't make risk assessments in terms of what someone says they want
to do, nor what you think they want to do. You consider what they CAN
do, given opportunity. Any lesser assessment is begging for abuse.

A firewall is your friend, not theirs.

Signature

jer email reply - I am not a 'ten' ICQ = 35253273
"All that we do is touched with ocean, yet we remain on the shore of
what we know." -- Richard Wilbur

Reply to this Message