Database Info

identify if IMSI catchers were used with field test?

Hello all
I've been reading this forum for some months now and i like the windows'es and informations i've found here on my Hermes device
But now i have some questions on using the often integrated tool field test.
I've found out that with the IMSI-catcher (german wikipedia as one of the sources), that are more and more often used semi-legal by the police(here in europe there are a lot of 'GA-90' devices sold to the police and other institutions), it is possible to listen to phone calls(man in the middle attack), by just 'emulating' the strongest phone-cell in the area, to which the device connects instead of connecting to the provider's cell.
I also read that it would be possible to find out if there was an imsi-catcher device active in the area near you or not. The only thing needed is a special monitor software (field test?) that observes the MNC(Mobile Network Codes) behavior(appearently you need 2 handy's from the same provider with the monitoring software running).
But they didn't explain exactly on which behavior you should pay attention.
Since I could use 2 windows mobile devices to test this out, I am searching for more detailled information on this subject, and the first place that came in my mind was xda-developers
I allready did search this forum for the subject imsi catcher, and the only thing I've found is this.
google result
so one person who tries to change hies imei number, and another one who doesn't seem to know exactly what an imsi catcher can do.
Is here anyone who knows more?
I know that where I live, there are pple who make abuse with IMSI-catchers(catching calls without the permission from a judge or similar, or even one time someone listening to his girlfriends phone calls to see if she's cheating(and she did and that was the reason he left her))And yes this one was a young policeman who told that to his friends and even was proud of it.
I also dislike the fact that the handy, instead of the encrypted one with the provider's cell, has an non encrypted connection to the imsi catcher(if not there would be no possibility for a listening man in the middle attack).
I also read about the cellphones from http://www.cryptophone.de/
Appearently they do allways have encrypted conversations even through an Imsi-catcher. But if that would be true, the other side will need the same handy to decrypt it again. Because it has to encrypt, the allready encrypted data traffic with the provider's cell, if not it can't allow any protection against IMSI -Catcher devices. I also ask myself if, depending on where u want to use it, the 2nd encryption could produce a to huge phone traffic that could result p.ex. in a robot voice...
Anyone who could light me up?
Or is there any software able of reencrypting the encrypted transfer on windows mobile devices?technically it should be possible(2nd phone dialer installed so you choose the normal one for normal calls and 2nd one for calls with pple who also have this software installed on their phones)perhaps not with an 256 bit encryption but perhaps with a 128 or 64 bit encryption...
BTW, if there would be anyone able to programm such a hot piece of software for windows mobile devices I wouldn't have any problem to donate him with paypal, and i suppose other pple would do the sameAnd no I don't wanna replace that by Voip or skype via HTC...
Thanks in advance
Patrick

So no one who knows more about this?
I would be very happy if i could at least test if they're really used that often as they say they are(where i live).
And since i could try it in different major 'cities' over here, i suppose catching a imsi catcher soon or later
I'm quite curios if all the pple, telling that there is a lot of abuse with these machines, are right, or if that's all nonsens...

It would be nice if a warning icon could be integrated into Windows Mobile or the dialer to indicate that a call is not being encrypted. Read the Wikipedia entry for IMSI-catcher for more info. I'm guessing CDMA is largely unaffected since the hole seems to rely on the UMTS spec's backward-compatibility with GSM.
I'd also like to note that Skype is the way to go for true endpoint to endpoint call encryption. You know, if you're a gangster or something and need to brush off the popos. It would be interesting to investigate whether the WM6 integrated VOIP stack requires authentication/encryption.

Voopee - where social meets the next generation

Has anyone tried Voopee ?
would like to get more feedbacks from users on the existing application.
Practically it is using a voice over lte technology where you get a mobile number (malaysian based for now) and functions like a prepaid account without the need of a sim card.
We're connected to a malaysian telco right now, but imagine the infinite possibilities when we connect to other country telco's.
The capabilities also includes messaging,news and most multimedia features.
Would love to get feedbacks from you guys !
thanks !

What do manufacterers need to enable VOLTE on devices

Not having VOLTE is quiet an annoyance when you have been using it previously on other handsets.
what are the specifics regarding enabling volte by both carieer and manufacterer?
what information do they need to enable the service?

Manufacturers have to include the proper configuration for VoLTE/VoWifi in their devices, e.g. ISM, Gateways, etc.
VoLTE/VoWifi has to be configured a little different than the usual VoIP like e.g. SIP.
The GSM Association has a Device Settings Database (where telco's can provide the needed information for handset manufacturers/OEMs), into slides can be found here: www gsma com/futurenetworks/wp-content/uploads/2017/02/Device_Settings_Database.pdf (insert dots after www and before com)
Sadly, I guess the database is for registered vendors/telcos only..

RipperFox said:
Manufacturers have to include the proper configuration for VoLTE/VoWifi in their devices, e.g. ISM, Gateways, etc.
VoLTE/VoWifi has to be configured a little different than the usual VoIP like e.g. SIP.
The GSM Association has a Device Settings Database (where telco's can provide the needed information for handset manufacturers/OEMs), into slides can be found here: www gsma com/futurenetworks/wp-content/uploads/2017/02/Device_Settings_Database.pdf (insert dots after www and before com)
Sadly, I guess the database is for registered vendors/telcos only..
Click to expand...
Click to collapse
is it the responsibility of the MNO to liaison with the phone manufacturer to provide the VOLTE / VOWIFI settings? (or atleast make available) and thus the manufacturer would update the settings via an update?
is it possible to get the settings manually via a device that already has volte?
what im trying to figure out is this
i have two phones. a huawei p20 and a oneplus 6
they both support the same bands so no issues there
volte works on my p20 and not my oneplus 6 - this is confusing.
my operator clearly favors huawei (as they sell it in store) so they provide the required information (or do they add configuration to the network) to get the volte working
my p20 was not purchased via my telco so there is no telco based firmware required to get it working.
if possible can we pull the information required from the phone / telco and make available for others to enable VOLTE?

From what I think I read: MNOs: At least the three big players here in Germany whitelisted tested handsets until about beginning of 2017 - then I guess they decided they tested their networks enough and now you can read on their pages that it's (solely?) the OEMs part of work to include the correct config tu support VoLTE/Wifi in their Firmware (e.g. Android release).
In principle, the MNOs should send the needed details how to configure for VoLTE/VoWifi to GSMAs database, where the phone manufacturers could access it to implement in their phones - so there's no contact between MNO and phone OEM necessary at all.
Of course, if a MNO sells a branded phone, they make sure that phone had that specific MNOs VoLTW/VoWifi settings embeded (and maybe ONLY for that MNO ) .
Maybe if we find a Qualcomm Snapdragon 845 based phone we'd be able to copy the configs for other providers. Seems the OP6 currently (5.1.8) has these configs included:
OnePlus6:/data/vendor/radio/modem_config/mcfg_sw # cat mbn_sw.txt
cat mbn_sw.txt
mcfg_sw/generic/apac/airtel/volte/mcfg_sw.mbn
mcfg_sw/generic/apac/idea/commerci/mcfg_sw.mbn
mcfg_sw/generic/apac/reliance/commerci/mcfg_sw.mbn
mcfg_sw/generic/apac/vodafone/volte/india/mcfg_sw.mbn
mcfg_sw/generic/china/cmcc/commerci/volte_op/mcfg_sw.mbn
mcfg_sw/generic/china/cmcc/lab/conf_vol/mcfg_sw.mbn
mcfg_sw/generic/china/cmcc/lab/nsiot_vo/mcfg_sw.mbn
mcfg_sw/generic/china/cmcc/lab/tgl_comb/mcfg_sw.mbn
mcfg_sw/generic/china/ct/commerci/hvolte_o/mcfg_sw.mbn
mcfg_sw/generic/china/ct/lab/cta/mcfg_sw.mbn
mcfg_sw/generic/china/ct/lab/volte_co/mcfg_sw.mbn
mcfg_sw/generic/china/cu/commerci/volte/mcfg_sw.mbn
mcfg_sw/generic/eu/ee/commerci/mcfg_sw.mbn
mcfg_sw/generic/eu/elisa/commerci/fi/mcfg_sw.mbn
mcfg_sw/generic/eu/h3g/commerci/denmark/mcfg_sw.mbn
mcfg_sw/generic/eu/h3g/commerci/uk/mcfg_sw.mbn
mcfg_sw/generic/eu/telefoni/commerci/uk/mcfg_sw.mbn
mcfg_sw/generic/eu/telia/commerci/norway/mcfg_sw.mbn
mcfg_sw/generic/eu/telia/commerci/sweden/mcfg_sw.mbn
mcfg_sw/generic/na/att/volte/mcfg_sw.mbn
mcfg_sw/generic/na/tmo/commerci/mcfg_sw.mbn
mcfg_sw/generic/oem/lab/volte_pt/mcfg_sw.mbn
mcfg_sw/generic/oem/lab/volte_te/mcfg_sw.mbn
mcfg_sw/generic/oem/oversea/commerci/mtnl_bsn/mcfg_sw.mbn
mcfg_sw/generic/oem/oversea/commerci/mcfg_sw.mbn
mcfg_sw/generic/sea/chunghwa/commerci/tw/mcfg_sw.mbn
mcfg_sw/generic/sea/fareasto/commerci/mcfg_sw.mbn
mcfg_sw/generic/sea/tm/commerci/mcfg_sw.mbn
mcfg_sw/generic/sea/ytl/commerci/mcfg_sw.mbn
Click to expand...
Click to collapse
The files seem to have a digital signature, so it's unlikely that we'd be able to edit them, even if we would just know the correct parameters. Also, not everything is for VoLTE/Wifi.

RipperFox said:
From what I think I read: MNOs: At least the three big players here in Germany whitelisted tested handsets until about beginning of 2017 - then I guess they decided they tested their networks enough and now you can read on their pages that it's (solely?) the OEMs part of work to include the correct config tu support VoLTE/Wifi in their Firmware (e.g. Android release).
In principle, the MNOs should send the needed details how to configure for VoLTE/VoWifi to GSMAs database, where the phone manufacturers could access it to implement in their phones - so there's no contact between MNO and phone OEM necessary at all.
Of course, if a MNO sells a branded phone, they make sure that phone had that specific MNOs VoLTW/VoWifi settings embeded (and maybe ONLY for that MNO ) .
Maybe if we find a Qualcomm Snapdragon 845 based phone we'd be able to copy the configs for other providers. Seems the OP6 currently (5.1.8) has these configs included:
The files seem to have a digital signature, so it's unlikely that we'd be able to edit them, even if we would just know the correct parameters. Also, not everything is for VoLTE/Wifi.
Click to expand...
Click to collapse
mcfg_sw/generic/eu/h3g/commerci/uk/mcfg_sw.mbn
It seems my network three uk is included, however VOLTE doesn't work for me.

See my last sentence in my last post
Those modem configs seem to include seperate config files for selecting the correct bands, etc.
I'd guess that mostly the directory entries with "volte" contain VoLTE settings

virtyx said:
is it the responsibility of the MNO to liaison with the phone manufacturer to provide the VOLTE / VOWIFI settings? (or atleast make available) and thus the manufacturer would update the settings via an update?
is it possible to get the settings manually via a device that already has volte?
what im trying to figure out is this
i have two phones. a huawei p20 and a oneplus 6
they both support the same bands so no issues there
volte works on my p20 and not my oneplus 6 - this is confusing.
my operator clearly favors huawei (as they sell it in store) so they provide the required information (or do they add configuration to the network) to get the volte working
my p20 was not purchased via my telco so there is no telco based firmware required to get it working.
if possible can we pull the information required from the phone / telco and make available for others to enable VOLTE?
Click to expand...
Click to collapse
Hey mate, can you upload your p20 mbn files?
I need specifcally bouygues .
If you guys need, I have pixel 3(snapdragon 845 as well) and i can upload all my mbn files for reference?

Many websites not working on Smarty/Three network

Hello,
I recently signed up to the SMARTY UK phone network, which is owned by and operates on Three. Great value, but for some reason I'm having issues connecting to many sites and apps - half the internet works, half doesn't! Their customer service haven't been able to help. So if you're up for a challenge, I've listed below the details and everything I've tried so far. Hopefully someone with the technical understanding will be able to advise what is happening here.
Issue: Many websites return the following error...
This page isn’t working
yahoo.com didn’t send any data.
ERR_EMPTY_RESPONSE
Click to expand...
Click to collapse
Note: This is a generic error meaning it can't connect to the website.
My phone: Samsung Galaxy S9 - from Australia, where I recently returned from, but is the G960F "Global/Europe, single SIM" model (specs here). Android 10.
Network: SMARTY. They use frequency bands 1 (2100MHz), 3 (1800MHz) and 20 (800MHz) according to 4g.co.uk. All these are supported by my phone if I'm not mistaken.
Network status: I have a strong, 4G connection in London E10 with the recommended APN settings. The default APN is three.co.uk but their site says to use mob.asm.net. I've tried both, restarting phone each time. Also tried the APN Type as both 'Default' and '*'. The networks adult filter is turned OFF.
What about other UK SIMs?
Asda Mobile (EE) and Giffgaff (O2) both work fine in the phone.
What about when you try it in a different phone?
When the SIM is in my partners iPhone, all websites work.
Running through a list of most popular websites, as well as others I've tested, here's some websites that do and do not work, to see if anyone can identify some trends:
Examples of websites that load successfully:
Google.com, Google.co.uk
Wikipedia.org
Duckduckgo.com
Reddit.com
Qq.com (China)
Microsoft.com
Bing.com
Ebay.com, ebay.co.uk
Indeed.co.uk (not dot com)
Examples of websites that fail to load:
Yahoo.com
Amazon.com
Google.com.hk (Hong Kong)
Baidu.com (China)
Vk.com (Russia)
Indeed.com
Example.com
Avforums.com
xda-developers.com
Androidforums.com
DNS
I've tried using different DNS servers - Google Public DNS (8.8.8.8), OpenDNS, 1.1.1.1, etc. and restarting to no avail.
Tor
When I connect through Tor (e.g. Orbot app), as I am now to post this, all sites work.
Many thanks,
Chris

CellBroadcast and Emergency Warnings on Android - is it a mess?

Hey,
Germany is implementing EU-Alert (ETSI TS 102 900 [1]) at the moment and referring to the local News, it is a huge mess [2].
But let's start at the beginning.
CellBroadcast is a core component of each mobile network generation (2G,3G,4G,5G,...) and part of the 3GPP spec. CellBroadcast basically allows the network to send a simple SMS to all mobile phones connected to a specific base station. Thes SMS-CB are sent with a Message Identifier (aka Channel, aka Topic) which gives them a special purpose by convention. e.g. ID / Channel 50 is often used for area related information [3], while channel 207 might broadcast local weather information. Since not all Channels are standardized, there is also the option to broadcast an Index that lists all channels with a description. And since users probably don't want any message broadcasted, users have to subscribe to these channels.
Since decades now, CellBroadcast is also used for public Emergency Warnings. This means that, by definition of a country, a specific channel is used to broadcast Emergency Warnings. Long time ago, in many countries it looks like Channel 919 was used for this purpose. For this to work properly, mobile phones were instructed to subscribe to channel 919 by default and also use a special ringtone (even if muted) to alert such a message.
Later - over 12 years ago - additional channels from 4370-4399 were standardized in ETSI TS 123 041 [4] for public warning systems like CMAS, EU-Alert, KPAS. All using the same channels which is beneficial for global roaming.
Android of course supports these public warning systems specified in ETSI TS 123 041 [4] since at least Android 4.2.2 [5]. And nations that use these systems already, like CMAS in the US, report very high and reliable coverage.
However, referring to German news [2] and government, not many phones that are currently on the market will actually support EU-Alert in Germany, despite already supporting EU-Alert in Netherlands or CMAS in the US.
How is this possible when exactly the same SMS-CB is broadcasted, just in a different country?
Golem [2] says that Samsung and Google already confirmed that EU-Alert is currently not supported in Germany, but updates will be rolled out to recent devices.
This strongly suggests to me that OEMs like Samsung and Google actually added country specific filters/configurations for these public warning systems to their phones without deploying a reasonable fallback. Public warning systems based on ETSI TS 123 041 [4] thus may only work in countries that were known to use these systems when the phone was released.
Isn't this an obvious issue?
Google said, starting with Android 11+ it will be possible to update the CellBroadcastReceiver App via Google Play. So devices with Android 11+ will likely receive an update to support EU-Alert in Germany. For Android 10 and older, OEMs will have to supply updates.
What also confuses me is the fact that all Android Phones I own (Nexus 4 with Android 5, Nexus 5X with Android 8, Pixel 3a with Android 12) here in Germany do actually offer the setting for Emergency Warnings and they are already enabled by default. So I assume they would work? Did Google actually deploy a sane default configuration here already?
But if they did - why isn't it working on ALL Android 11+ Phones already? I'm pretty sure my Pixel 3a uses Googles CellBroadcastReceiver App which is provided through the Play Store. So all Android 11+ phones should already use the exact same App?! Or am I wrong here? So what is this update Google actually needs to provide?
And does this also mean that with Android 11+ OEMs are not allowed / cannot implement their own Emergency Warning CellBroadcastReceiver?
This topic is really confusing to me
Shouldn't it be really simple?
All phones, regardless of the OEM, should have a proper SMS-CB Application which allows you to subscribe to custom channels, view the index, and manage your SMS-CB Messages.
Phones should also be aware of special channels to apply special ringtones etc if needed, but they should have a sane fallbacks!
A phone that knows about NL-Alert and CMAS may call messages on Channel 4370 received in the Netherlands "NL-Alert". But when it receives the same message in Germany, it shouldn't just drop it! It should display it as warning and call it whatever it wants. And if it doesn't know about CMAS / EU-Alert, it should just receive it as regular SMS-CB.
Can't be that hard?
Interestingly enough, Samsung phones allow you to subscribe to custom channels. Google phones do not :/
Should there be a better / more enforced standard, so that a country that wants to implement CMAS/EU-Alert in the future doesn't have to rely on OEMs help?
And finally some technical Questions:
I found zero Apps for Android that would allow me to subscribe to custom CellBroadcast Channels on my Google Android phones. Is this even possible?
Also, is it possible to test these CellBroadcasts somehow? Is it possible to write an App that can inject SMS-CB into the system?
Sorry for the long post, but I think this an important Topic.
Let me know what you think
Do you have experience with these Emergency Warnings already?
[1] https://www.etsi.org/deliver/etsi_ts/102900_102999/102900/
[2] https://www.golem.de/news/cell-broadcast-warum-es-am-warntag-ruhig-bleiben-koennte-2206-165822.html
[3] https://source.android.com/devices/architecture/modular-system/cellbroadcast#channel-50
[4] https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/11.04.00_60/ts_123041v110400p.pdf
[5] https://cs.android.com/android/plat...ternal/telephony/gsm/SmsCbConstants.java;l=58

Hey! I was just researching something about this. Thanks for your detailed post.
I am from Chile and, in my case, my operator had subscriptions to two channels: 919 and 920.
In order to see the Cell Broadcast menu in the Messages app, I had to override a CSC setting (I use a Samsung device), particularly "CarrierFeature_Message_DisableMenuCBMessage") because it seems some Chilean operators ordered Samsung to hide it.
Even then, the Google Cell Broadcast app would not let me modify settings other than test alerts.
In my country these emergency alerts are quite unreliable and are often sent by mistake or to the wrong place (i.e. sending a tsunami alert to an area more than 100 km away from the coast).

Shooting Star Max said:
Hey! I was just researching something about this. Thanks for your detailed post.
I am from Chile and, in my case, my operator had subscriptions to two channels: 919 and 920.
In order to see the Cell Broadcast menu in the Messages app, I had to override a CSC setting (I use a Samsung device), particularly "CarrierFeature_Message_DisableMenuCBMessage") because it seems some Chilean operators ordered Samsung to hide it.
Even then, the Google Cell Broadcast app would not let me modify settings other than test alerts.
In my country these emergency alerts are quite unreliable and are often sent by mistake or to the wrong place (i.e. sending a tsunami alert to an area more than 100 km away from the coast).
Click to expand...
Click to collapse
Can you explain how you disabled this CSC setting and on what samsung phone/os?
You can see Googles/Androids latest default configuration for Chile (MCC 730) here:
https://cs.android.com/android/plat...apps/CellBroadcastReceiver/res/values-mcc730/
The config.xml really has some restrictive features enabled :/

Thanks for your reply!
Please note that all the following information assumes you have rooted your device. It's impossible to override this configuration otherwise.
My device is a Galaxy Note20 Ultra (Exynos version, SM‑N985F) running Android 12, One UI 4.1.
As you might know, Samsung devices include several packages named “CSC”, which define settings according to a sales code matching with a region. For example, a device sold in Chile without a carrier uses the sales code CHO, while one sold by operator Movistar uses the sales code CHT.
In the Galaxy Note20 Ultra, the CSC packages are stored in /optics/config/carriers/single (older Samsung devices might use /omc/).
Once you find the sales code matching with your current configuration, you can grab two files: cscfeature.xml and customer_carrier_feature.json. Taking CHO again as an example, the files would be /optics/config/carriers/single/CHO/conf/system/cscfeature.xml and/optics/config/carriers/single/CHO/conf/system/customer_carrier_feature.json.
These files are encoded, but OmcTextDecoder can take care of that.
In the case of CHO, customer_carrier_feature.json has the value "CarrierFeature_Message_DisableMenuCBMessage":"TRUE", which hides the cell broadcast menu in the stock Messages application. Just replace “TRUE” with “FALSE”, save the file and push it to its location. The next time you reboot your system, it will be applied.
Regarding the link you sent, I think we could get around that configuration by decompiling the GoogleCellBroadcastApp.apk through Apktool, modifying the restrictive values, and then pushing the APK to the device, replacing the original version.

Thank you!
Let me know if you managed to patch your original CellBroadcastReceiver.apk!
I actually tried using Runtime Resource Overlays (RROs) which is described on the official docu about CellBroadcast in Android.
You can find the result here: https://github.com/xsrf/android-de-alert
However, I didn't quite get these RROs. It looked like in Oreo you can use RROs to overlay any resource of any app without any permissions or matching signatures, which is quite a surprise to me?!
On my phones with more recent OS, I get signature mismatch errors and also it looks like apps now have to define what resources can be overlayed ...