Ericsson W25 and W35 Support Settings to prevent recently published attacks on GSM

Ericsson W35 Cellular Terminal, also known as Ericsson W35 Mobile Broadband Router - supports settings that can be used to prevent the recently published “Fake GSM Tower” attacks demonstrated by Chris Paget.

The Ericsson W35 has settings to limit the frequency bands on which the Ericsson W35 will operate. It can also modify the “Region”, in other words the PRL or Preferred Roaming List, as follows:

Preferred Roaming List:

Global

Europe/Rest of the World

North America

Australia

Japan

H3G, W2100, G900/1800

Note: A restart of the unit is required if changing this setting.

* If the PRL setting was set for North America - when operating in North America (or compatible countries such as the Bahamas) - then Chris Pagets attack would not be possible. Chris’s attack uses the 900 Mhz band because he could legally operate a tranceiver in that band because some GSM 900 Mhz channels coincide with US Amateur Band frequencies. That’s how Chris stays under the radar as far as an FCC violation for transmitting on frequencies for which he is not authorized. Anyway a Global Setting (the default, and also probably what most GSM hand phones have set) would allow the attack because the Ericsson would not favor any particular Regions frequency bands. And it would allow all of the bands.

Also you can individually set check boxes for the following:

3G Settings - Select the frequency bands to be used for a 3G mobile connection: 850, 1900, 2100.

2G Settings - Select the frequency bands to be used for a 2G mobile connection: 850, 900, 1800, 1900.

* The attack is a 2G GSM attack. It doesn’t work against a 3G system. So if you were to ensure that only the US bands for 2G were selected (and save that setting and restart the unit) then no attack using non-US GSM bands could be performed. If you disabled 900 Mhz and 1800 Mhz by unchecking the check boxes under 2G Settings then your W35 would ignore 900 and 1800 Mhz towers. Alternatively you could uncheck everything 2G. But that could put you out of service - should you travel into a 2G only area in the U.S. or elsewhere.

* * * * Forcing any potential attacker willing to spend $1500+ on hardware to break FCC rules (in US Territories) by transmitting on US Cellular Bands (unlicensed and potentially interfering with real cell carriers) - would probably eliminate most of them. Removing 2G altogether would remove any of them that are remaining.

Then we’re back on a level playing field where they have to spend 10’s of thousands of $$$ on equipment and try to perform a MUCH MUCH more difficult 3G attack.

Additional Note: These settings can also be performed from a command line (telnet) interface. The W30 and W35 support disabling and enabling 2g or 3g (all bands from either technology) - the W35 also supports setting which frequency bands per each of the two technologies can be used.

The configuration can be saved, as a file, and restored later at any time, from any computer on the local area (computer network) network of the Ericsson unit. **** You could have, for example, two different configurations - one for US locations - and one for European/Other locations. (Or Australia, or whereever of the available PRL settings is your *other* location.)

It should be also noted that the W2x (Ericsson W25) also have these same capabilities as long as you have a recent firmware installed in your unit.

—
Alan Spicer

DBA Alan Spicer Telcom / Alan Spicer Marine Telecom
Computer Services, Wired/Wireless Networking,
Cell/Sat/Landline Communications, General Consulting…
Marine, Business, Small Office and Home Office (SOHO)

* Cost Savings and Integration of Multiple Internet Technologies
on board Sail and Motor Yachts * Documentation, Operating
Instructions, and Support after the Sale *

* http://www.marinetelecom.net/
* http://www.internetforyachts.net/
* http://www.wifiyacht.net/
* 954-683-3426

Mobile Internet! Step up to the HSPA 3G Fast Internet!

Ericsson W35 released in the USA. This you’ve gotta SEE!!
Better looking presentation than W25 (you might not want to
hide this one in the Doghouse!) + High Speed Upload which
the W25 did not have.
http://www.marinetelecom.net/Ericsson_W35/

This entry was posted on 2. August 2010 at 08:48 and is filed under Cellular Voice and Internet. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response or trackback from your own site.