Rogue Cell Tower

Balint Seeber of Bastille shows how a rogue cell tower, in this demo hidden inside an ordinary office printer, masquerades as a legitimate tower so nearby phones associate with its stronger signal. From there an attacker runs a man-in-the-middle attack and downgrades security to reveal sensitive data. Bastille continuously monitors for new towers and alerts when one appears on an illegal band or unexpected operator, even just outside the perimeter.

Key Takeaways

• A rogue cell tower can be hidden in innocuous office equipment, like a printer, and imitate a legitimate tower
• Phones associate with its stronger signal, letting the attacker run a man-in-the-middle attack and downgrade security
• Bastille continuously monitors and localizes new towers, flagging illegal bands or unexpected operators
• The solution detects rogue towers on the premises and even those placed just outside the office perimeter

Video Transcript

Hello, my name is Balint Seeber, and I'm the director of vulnerability research at Bastille. I'd like to show you how an attacker can use a rogue cell tower to listen to sensitive information, and how you can use the Bastille solution to actually detect these rogue cell towers. In this case, we have the floor of an office, a floor plan, and we have an employee here that's using their mobile phone. And their mobile phone would usually, in normal circumstances, communicate with a legitimate tower that is nearby the office.

If an attacker wanted to gain more intelligence about the employees within an organization, it's possible and very cheap nowadays to set up one's own rogue cell tower. And in this case, we have what appears to be an innocuous, legitimate piece of office equipment here, a printer. But what's actually contained inside the printer is a small rogue cell tower that looks like it's masquerading as a legitimate cell tower.

And what will happen then is cell phones in the area that are looking for that particular network will see that there's a stronger signal being emitted nearby. And instead of associating with the outside cell tower, phones may decide to associate with this rogue tower. And because it's under attack and control, they can then perform a man-in-the-middle attack and look at any data they may wish to send to the cloud.

It's possible to do various sorts of attacks to downgrade any security protocols that may be in use there, and to reveal any sort of sensitive information that pertains to the employee or to the organization. Now, if you have the Bastille solution deployed, these sensors are continually monitoring.

And if a new cell tower appears and it's actually within the vicinity and perhaps able to be localized within the map, an alert can actually be thrown indicating that there is a rogue cell tower, perhaps one that's transmitting on an illegal band or as an operator that's not expected within that particular area. This alert will be then sent to users of the Bastille solution, and then personnel can come and try to actually find that rogue tower. If it's on the premises, it can be removed.

But the solution will also detect rogue towers that may be placed slightly outside the office perimeter. For more information, please visit our website.