Showing posts with label call record analysis. Show all posts
Showing posts with label call record analysis. Show all posts

Monday, June 04, 2012

CSA - R&TTE Directive

R&TTE Directive applies to telecommunications and radio equipment and therefore is applicable to examiners and advisors involved with forensics and evidence:

Directive 1999/5/EC of the European Parliament and of the Council of 9 March 1999 on radio equipment and telecommunications terminal equipment and the mutual recognition of their conformity....
[Official Journal L 091 , 07/04/1999 P. 0010 - 0028]
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31999L0005:EN:HTML

In fact it is inescapable, thus unavoidable, that an examiner / advsior could not at some stage make reference to R&TTE given the scope of the work involved in CSA (cell site analysis).


The Directive sets out the Essential Requirements, which members states should follow and in turns places obligations incumbent on network operators and manufacturers placing or using equipment in a member state governed by the principles in [the] Directive.  

Article 3
Essential requirements
1. The following essential requirements are applicable to all apparatus:
(a) the protection of the health and the safety of the user and any other person, including the objectives with respect to safety requirements contained in Directive 73/23/EEC, but with no voltage limit applying;
(b) the protection requirements with respect to electromagnetic compatibility contained in Directive 89/336/EEC.
2. In addition, radio equipment shall be so constructed that it effectively uses the spectrum allocated to terrestrial/space radio communication and orbital resources so as to avoid harmful interference.
3. In accordance with the procedure laid down in Article 15, the Commission may decide that apparatus within certain equipment classes or apparatus of particular types shall be so constructed that:
(a) it interworks via networks with other apparatus and that it can be connected to interfaces of the appropriate type throughout the Community; and/or that
(b) it does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service; and/or that
(c) it incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected; and/or that
(d) it supports certain features ensuring avoidance of fraud; and/or that
(e) it supports certain features ensuring access to emergency services; and/or that
(f) it supports certain features in order to facilitate its use by users with a disability.

The connection to CSA initially comes by way of harmonised standards (ENs) defining the radio requirements that are required to conform across EEC (EU) members states. That is conformance is intended to act as an enabler to ensure EEC (EU) principles to be achieved and succeed relating to the free movement of goods and the reduction and removal of trade barriers brought about by mandatory regulation.

Such an example can be immediately demonstrated by reference to:
*The Radio Equipment and Telecommunications Terminal Equipment Regulations 2000 No. 730 PART II
http://www.legislation.gov.uk/uksi/2000/730/part/II/made
http://www.legislation.gov.uk/uksi/2000/730/pdfs/uksi_20000730_en.pdf

*It should be noted that this UK Regulation applies a different numbering sequence when referencing the Essential Requirements

The European Telecommunication Standards Institute (ETSI) has translated the Essential Requirements in the Directive and modularised them in order to assist and enable standards to be produced that create a level playing field for conformance but, at the same time, allowing for innovation and variation in function and technqiue in achievement of the conformance.



In practice the modularised structure (c) ETSI 2000-2003 defines those modules against which standards have been produced. Clearly 3.2 is immediately discernable as having relevance to CSA, thus applicable to examiners to have awareness about the module when performing CSA. Of course the other modules play an important part in varying aspects of CSA and mobile phone investigations, too. The focus though of this discussion is on CSA and making use of the illustration without being verbose on every subject that the illustration refers. The relevance, then, to CSA is that is were device conformance to the standards not to be achieved and not pass technical scrutiny and assessment wireless devices would be unlikely to be allowed to make and receive mobile communications (V/D/F).

To this extent, the spectrum module and its standards associated with it directly relates to defining the use of aspects of the laws of physics, in radio terms, and through setting requirements for radio signalling allow real world realisation of the commodities that that can bring, such as voice and data communications. The standards, underpinned by conformance tests, actually define voice and data communications and the expectation of their performance. If that wasn't possible translating activity in the ether to the physical world would not allow interconnecion; the use of SS7; mobile SCCP; and a very primary form of evidence noted by the mobile academic author (Heine, G), illustrates (c) 1998 in his illustrated model realting to CaPD and CdPD (calling party address and called party address) as seen in the image below. That interconnecion record of a call or, at minimum, an attempt of a call (0-second duration etc) is vitally important for CSA and mobile investigations.


Finally, the above merely discusses a grain of sand relating to technical realisation and end-point evidence and applying the same focus above to other aspects that can (for forensics, evidence and mobile phone investigation) uncover a rich seam of material that can equally be applied to discernng how events may have occurred such as (unlawful) interception, in the course of transmission, signal jamming, voicemail hacking, fake and bogus mobile communications, mobile location tracing etc etc etc, that could be profiled and traced due to having an understanding of what is happening when making use of radio signals in mobile communications and its impact on the sending/receiving device.

Sunday, October 02, 2011

EF-FPLMN

EF-FPLMN

There are many ways you may wish to approach examining a SIM Card elementary file (EF) and to the university students that wrote and asked for some ideas here are some observations. I would recommend, assuming you have access to SIM reading tools, that it is useful to target a particular EF in the GSM standard GSM11.11. Importantly, as there have been numerous versions and revisions of GSM11.11 it is an essential task to check the various versions and revisions taking account of any changes to the technical requirements for the EF: for instance

a) access conditions
b) content
c) coding
d) etc

To illustrate some of the points raised by this blog discussion I have selected the SIM forbidden list found in elementary file (EF) FPLMN (Forbidden PLMNs) 7F20:6F7B (7F21:6F7B). PLMNs MCC/MNC populated in this EF are those that the MS shall not camp on and provide a location update. 

ETS GSM11.11 v4.21.1 December 1999
GSM 11.11 v8.14.0 June 2007

Of course, when reading the conditions laid out in the standards it is also essential to appreciate the conditions under which a PLMN (MCC/MNC) may be updated into this EF. Trial test conditions should relate to 'automatic' update and update caused by 'manual' selection of a Forbidden PLMN. These are not simple tasks as one might imagine. There is the radio environment to consider? Which PLMNs are forbidden? Is roaming required? The coding of the data? ....and so on. So for an elementary file that largely gets overlooked during examination and ignored in evidence, an analysis of exactly the tasks this EF performs in the SIM module is quite surprising when considering its impact on the MS. That is from the perspective that its evidence could be considered when placing an MS within an PLMN's radio coverage and the follow on potential inference of a geographical location. EF-FPLMN adds an intriguing prospects to be considered, beyond handset and SIM analysis, and that is it can be used in cell site analysis and call record analysis, too.

Extracted and Harvested Data
It is inescapable, thus unavoidable, that validating data that has been extracted and harvested cannot be performed based upon using one tool. Moreover, tools vary in the way they present harvested data and will require the examiner to pay particular attention to ensure the output data (although presented in various arrangements) should be identical. If parity isn't possible then analysis of the tools should be undertaken. It is worth mentioning at this juncture, so as to avoid unduly raising concerns, many tools once released into the marketplace do not allow users to update the product. Changes to SIM techncial specifications or new services or new/change to operators may simply not be included in a tool. 

SIMSpy Trace file Output (Text file)


Other tools present data in varying layouts within the program:

SIM Explorer


SIMCON


SIMCOM


USIM Detective




In conclusion, students asked for some observations and I hope the above may help. Care should be taken when reading the binary not to corrupt content in the EF; to consider the use of reverse-nibble; writing scripts; APDU/PDU and so on, in addition to the automatic and manual tests to be conducted. Moreover, any discovery could also extend to the use of EF-FPLMN to cell site analysis and call record analysis.