cdma2000 CSA radio test measurements

Recording the test results from CSA radio test measurements, whether the transmission technology be e.g. GSM, CDMA, WCDMA and/or LTE, it is perhaps a common thought that the data can be output and presented in a uniform format irrespective of the transmission technology. That would be all well and good were it the case that there had been set down an agreement for CSA regarding the components that only need to be provided. However, there is no such formal forensic best practice, evidential regulation or legislative directive that prescribes this. The fact that there is lack of agreement isn't such a problem and is probably a good thing because the components acquired for CSA are constantly evolving and changing and therein, for anyone conducting CSA, is the requirement to constantly and continuously identify:

a0 - The relevant transmission technology(ies) under investigation (MS may use several cellular technologies)

a1 - The relevant transmission capability of the mobile terminal and the profiling of any (U)SIM/R-UIM

a2 - The relevant technical capability of BSS/BTS and arrangements defined at a particular mast/tower

a3 - The relevance of any legacy technology/influences operating at the material time

a4 - How the above impacts on the information that is recorded in the call records/cell site details

Where cdma2000 1x, cdma2000 1x EV-DO or cdma2000 1x EV-DV might be in use it may be that cross-referencing the radio test measurement results to corroborate the information recorded in the call records might nor always be possible. Moreover, depending upon the information dissemenation, it can be a law enforcement officer, private investigator or court/attorney the person to whom their enquiries are made for information that person may have no clue what information is available or have a limited understanding.

For those conducting cell site analysis, the identification of cell coverage and each cell's parameters detected at a particular point within a surveyed land-parcel is an important procedure. Commonly, a person conducting CSA within a cdma2000 radio demesne might seek network operator identity, radio area network identity, base station identity and cell/sector. There are various cdma standards, but for the purposes of this discussion the combination of detail that can be preferred is the combination of SID/NID/base_id/Ref_PN. I use the reference cdma2000 standard adopted for this discussion:

3GPP2 C.S0022-A v1.0 Date: March 2004
Position Determination Service for cdma2000 Spread Spectrum Systems

Provide Pilot Phase Measurement Page 2-552.2.4.2.6 Provide Pilot Phase Measurement (‘0101’)
If RESP_TYPE is equal to ‘0101’ (Provide Pilot Phase Measurement), RESP_PAR_RECORD shall include the following variable-length record:

Table Page 2-56



This standard defines an MS to capture and compile the SID/NID/base_id/Ref_PN along with other details but the standard does not specify how this information may be translated so that a CSA examiner can illustrate the uniqueness of a particular cell/sector. It is known that an important component for CSA that the examiner endeavours to report the cell and sector upon which MS mobile communications may be/have been routed from a particular location within a land-parcel.

Balancing the issues of the material time technology vis-a-vis legacy technology; a useful starting point appears to be June 2004 when the CDMA mobile industry focus groups discussed and reached a consensus that the inclusion of SID/NID/base_id/Ref_PN would provide the broadcast parameters for identifying a unique cell/sector. That is in relation to Position Determination Services. From my research library of historical reports and papers I note:

Terry Jacobson (Lucent Technologies) comments in X.P0024 (June 8th 2004) ".....this contribution recommends that the Pilot PN information be used (in addition to the SID, NID and BASE_ID) to uniquely identify a cell/sector. Specifically, that the REF_PN parameter be added (see C.S0022-A v1.0 page 2-53) to the SID, NID and BASE_ID as the parameters that identify the serving cell/sector. The REF_PN is a 9-bit information element indicates the “PN sequence offset of the pilot used by the mobile station to derive its time reference, relative to the zero offset pilot PN sequence in units of 64 PN chips”." 

Ref-PN as stated in 3GPP2 C.S0022-A v1.0 Date: March 2004



 So at what point would an MS communicate the measurements to the network? The standard set outs:

 
CSA examiners should read the relevant paragraphs of 3.2.2 as it reminds examiners of issues associated with 'not supported' in legacy technology.  Moreover, take care when considering what information is being measured in Idle Mode, Mobile Originated Call (send call) and Mobile Terminated Call (received call).

Subject to the collection of location components identified in this discussion actually being supported by the various technologies highlighted above, it is clear that it is possible for MS to collate the measurement results in order to send those measurements to the network. This suggests the test handset used for any radio test measurements should be able to display the combination of SID/NID/base_id/Ref_PN that should assist the examiner identify a unique cell/sector of a particular mast/tower.

The above discussion is not definitive and does not cover every aspect of cdma2000 cell site analysis. The discussion highlights one area of knowledge that may be helpful to a possible investigation by a CSA examiner.

Examples of Cell Site Details

Here, too, it is possible to echo the discussion about passing on information: see Range of radio test measurement results - http://cellsiteanalysis.blogspot.co.uk/2014/03/range-of-radio-test-measurement-results.html

Range of radio test measurement results

I ridiculous as this may read, until I started publishing at my various blogspot I didn't realise that hoarding information is actually NOT a very good idea. Mark Twain once said (my paraphrase) 'the best thing to so with information is pass it on'. A reference to the fact that the older the information becomes the less useful it can be. I have equally found that during disucssion and debate it quite often occurs the other party will deny something not because they have knowledge and/or experience but rather the lack of them. Maybe the ruse is get research without doing any work or alternatively the person genuinely lack knowledge and experience thus didn't believe certain information existed.

Whilst it is useful to compile test results and keep them to yourself it is equally more important to the peer group to circulate such information at a point in time and space. This is important relevant to the analogies often quoted in life about (a) living on one's laurels and (b) the grass growing under one's feet.

Some good examples where sharing information is far better than keeping it yourself.

1. In a court of law the chance to present alternatives is lost in a one-chance-presentation if prior disclosure has not been made.

2. The chance to form common ground with one's peer's is yet another example

3. As a third example, what about actually knowing what type of information is available. Do remember some love the idea of psychological smoke and mirrors. However, forensics, the law of evidence, universities and education are poor for it for those the system that indulges "bluff". Also, bluff has no place in forensics and evidential standards. 

 

Test your USIM knowledge

Below is UST (USIM Service Table) 3GPP 31.102 that may be found in a UST elementary file.

QUESTION 1
There are at minimum 1,900 items for examination discovery, investigatory leads and evidence that can be obtained from these UST entries.  Can you identify just 50 items for examination discovery, investigatory leads and evidence? If so, what are they?

Service n°1: Local Phone Book
Service n°2: Fixed Dialling Numbers (FDN)
Service n°3: Extension 2
Service n°4: Service Dialling Numbers (SDN)
Service n°5: Extension3
Service n°6: Barred Dialling Numbers (BDN)
Service n°7: Extension4
Service n°8: Outgoing Call Information (OCI and OCT)
Service n°9: Incoming Call Information (ICI and ICT)
Service n°10: Short Message Storage (SMS)
Service n°11: Short Message Status Reports (SMSR)
Service n°12: Short Message Service Parameters (SMSP)
Service n°13: Advice of Charge (AoC)
Service n°14: Capability Configuration Parameters 2 (CCP2)
Service n°15: Cell Broadcast Message Identifier
Service n°16: Cell Broadcast Message Identifier Ranges
Service n°17: Group Identifier Level 1
Service n°18: Group Identifier Level 2
Service n°19: Service Provider Name
Service n°20: User controlled PLMN selector with Access Technology
Service n°21: MSISDN
Service n°22: Image (IMG)
Service n°23: Support of Localised Service Areas (SoLSA)
Service n°24: Enhanced Multi Level Precedence and Pre emption Service
Service n°25: Automatic Answer for eMLPP
Service n°26: RFU
Service n°27: GSM Access
Service n°28: Data download via SMS-PP
Service n°29: Data download via SMS CB
Service n°30: Call Control by USIM
Service n°31: MO-SMS Control by USIM
Service n°32: RUN AT COMMAND command
Service n°33: shall be set to '1'
Service n°34: Enabled Services Table
Service n°35: APN Control List (ACL)
Service n°36: Depersonalisation Control Keys
Service n°37: Co-operative Network List
Service n°38: GSM security context
Service n°39: CPBCCH Information
Service n°40: Investigation Scan
Service n°41: MexE
Service n°42: Operator controlled PLMN selector with Access Technology
Service n°43: HPLMN selector with Access Technology
Service n°44: Extension 5
Service n°45: PLMN Network Name
Service n°46: Operator PLMN List
Service n°47: Mailbox Dialling Numbers
Service n°48: Message Waiting Indication Status
Service n°49: Call Forwarding Indication Status
Service n°50: Reserved and shall be ignored
Service n°51: Service Provider Display Information
Service n°52 Multimedia Messaging Service (MMS)
Service n°53 Extension 8
Service n°54 Call control on GPRS by USIM
Service n°55 MMS User Connectivity Parameters
Service n°56 Network's indication of alerting in the MS (NIA)
Service n°57 VGCS Group Identifier List (EFVGCS and EFVGCSS)
Service n°58 VBS Group Identifier List (EFVBS and EFVBSS)
Service n°59 Pseudonym
Service n°60 User Controlled PLMN selector for I-WLAN access
Service n°61 Operator Controlled PLMN selector for I-WLAN access
Service n°62 User controlled WSID list
Service n°63 Operator controlled WSID list
Service n°64 VGCS security
Service n°65 VBS security
Service n°66 WLAN Reauthentication Identity
Service n°67 Multimedia Messages Storage
Service n°68 Generic Bootstrapping Architecture (GBA)
Service n°69 MBMS security
Service n°70 Data download via USSD and USSD application mode
Service n°71 Equivalent HPLMN
Service n°72 Additional TERMINAL PROFILE after UICC activation
Service n°73 Equivalent HPLMN Presentation Indication
Service n°74 Last RPLMN Selection Indication
Service n°75 OMA BCAST Smart Card Profile
Service n°76 GBA-based Local Key Establishment Mechanism
Service n°77 Terminal Applications
Service n°78 Service Provider Name Icon
Service n°79 PLMN Network Name Icon
Service n°80 Connectivity Parameters for USIM IP connections
Service n°81 Home I-WLAN Specific Identifier List
Service n°82 I-WLAN Equivalent HPLMN Presentation Indication
Service n°83 I-WLAN HPLMN Priority Indication
Service n°84 I-WLAN Last Registered PLMN
Service n°85 EPS Mobility Management Information
Service n°86 Allowed CSG Lists and corresponding indications
Service n°87 Call control on EPS PDN connection by USIM
Service n°88 HPLMN Direct Access
Service n°89 eCall Data
Service n°90 Operator CSG Lists and corresponding indications
Service n°91 Support for SM-over-IP
Service n°92 Support of CSG Display Control
Service n°93 Communication Control for IMS by USIM
Service n°94 Extended Terminal Applications
Service n°95 Support of UICC access to IMS
Service n°96 Non-Access Stratum configuration by USIM
Service n°97 PWS configuration by USIM 

QUESTION 2
An officer approaches you as the expert to investigate comminucations on an iPhone. There is known comms that have taken place but the twist is the comms at the distance end are being received by a Satellite phone. The user of the SatPhone is known to be trafficking in young children snatched from parents whilst on holiday. Your job is to provide evidence to help the police officer regarding which elementary files in the USIM would be used to permit mobile network usage (home and roaming) and any network artefacts that maybe connected to Satellite comms? To help you, a link below leads you to a piece of equipment that links iPhone to satellite:

www.thuraya.com/

SIM Test Card Hardware Layouts

15/11/97
Interface for ASIM

README       This file.
EMUSIM.BMP   Artwork of Smart Card sized PCB
MAX232.BMP   Artwork of Smart Card sized PCB whith MAX232
MAX232LY.GIF Parts placement guide of max232 pcb.
CIRCLAY.GIF  Parts placement guide.

The bitmap file can be loaded into Windows Paintbrush then printed. They
are drawn 1:1 at 300 dpi so make sure you click "Use printer resolution" and
the Laser printer is set to 300 dpi before you print. The artwork is drawn as
seen from the copper side. It can be printed on a transparency as is and used
directly in a positive photo etch. The copper side of PCB not touches the
toner side of transparency.

Bye
by Giulio Cesare

SIM/USIM Research Materials

Research Materials
I shall be posting material (example below) I have gathered from my research over the last 20 years that students, examiners and experts may find of use. Some of the materials to be posted I couldn't find when I searched the Internet recently. Whether that is down to me not searching enough or information held in web-based wall-gardens or the information is no longer available, it would be a pity to let that research fade into obscurity. Where I can identify authors of materials posted I shall do so. But if I cannot do that then by posting I am not declaring someone elses work or their material are my creation. I am just sharing what is and in some case what was freely distributed over the years. 

Trial and Error
When considering historical material it can provide a useful background insight, whilst at the same time nuture the interest to experiment and offers a knowledge base that may be needed or useful to know when approaching trial and error tests/experimentation.

Past Solutions Future Answers
One last point. A re-occuring theme, when considering digital evidence or forensic methodology or, even, how to apply examination techniques, is that solutions to problems, conundrums or perceived diametrically opposing facts can often be found by studying early developments in particular technologies. The approach that the manufacturer applied to the technology or how research and application found another way through may provide the solution for students, examiners and experts.

TEST SIM Script
(NOTE: The only details I have for the Author "brka". The email and website are no longer active. It is possible that the test materials are compiled from different sources and brought together in one source file. Some of the materials seemed to be have recognisable or at least similar designs to that created by the known programmer/developer "Dejan"). 

Once when you make TEST SIM using test_sim.hex you can:

          Entering into TEST mode
        ***********************

Insert TEST SIM in your phone.
Power ON phone.
When phone ask for PIN, type 5555
Then, the phone displays "CHECK CARD",
and then Power-Off the phone and Power-Up
The phone will enter into the TEST mode ....
(it can Register on ANY network ... but no Phone calls
can be done)

          Entering into CLONE mode (SP Unlocking)
          ***************************************

Insert TEST SIM in your phone.
Power ON phone.
When phone ask for PIN, type 1111
Phone will display "CHECK CARD"
Wait for few seconds and turn OFF phone!!!
Now turn phone ON and phone will be in CLONE Mode!

Clone Mode works on all Motorola phones!


          SP Unlocking
         ************

Once you are in Clone Mode, type  03# and phone will be unlocked.
NOTE!  SP unlocking work on all Motorola phones made before Sep.98!!!
It even works on some of CD920 and CD930 ....

Try it and please write me the results ....
(I found that the phones that IMEI ends with 0 can be unlocked !)

TEST SIM can be made with PIC 16F84 (16C84) wafer card.

***************************************
test_sim.hex
***************************************
This test file is still available on the internet

Tools
PICkit - http://www.microchip.com/Developmenttools/ProductDetails.aspx?PartNO=PG164130

Propic2 Clone - http://cuteminds.com/index.php/en/propic2

BYOD risks and minefields

I read the article in CIO Think_Deleted_Text_Messages_Are_Gone_Forever_Think_Again and the discussion that rumbles on about BYOD.

Firstly, a bit surprising the article suggests a "wow" factor associated with recovering deleted text messages. I would have thought it was common knowledge by now in business, generally, and particularly at CIO level.

Secondly, the notion and practice of companies getting employees to use their own devices (BYOD) to access company networks and company information seems to be an open invitation to allow a security breach (intentional or by accident) to happen. The corporate body and individual (at senior level) duty of care place encumbent obligations on both to conduct risk assessments, identify company assets, control dissemenation of company information in order to protect. It might be there are legal risks for companies demanding access to employees phones to go through their personal data.

There appears no persuasive technical/technological evidence to support BYOD propagation on the basis without it a company could not operate. Moreover, why require BYOD policies, practices and procedures that in essence generate further and continuing costs to maintain them anyway whereas in-house company devices (properly controlled) also means retention of company assets, devices have an asset value, depreciation allows for write down and tax relief etc.

BTW the points about assets and finance came from a specialist corporate accountant in this area where as accounting is not my forte. Mind you, brain surgery is not my forte either as I could not get any practice in the subject matter due to the patients; there was a shortage of volunteers.