Seguridad en Comunicaciones

COMPRA NUESTROSPRODUCTOS AHORA!!

ARROWARROW - GSM Interception System

• Real time interception of GSM traffic• Supports both A5.1 and A5.2 deciphering • Totally transparent and undetectable by the Mobile Operator and the subscriber• Support for all frequency bands• Gathering intelligence information even when target is not using the mobile

phone• User-friendly operation


The ARROW is designed for off-air interception for cellular communication in GSM networks. It provides the interception of 4/6/8 ( or more) simultaneously subscribers that are operating close to the system. The system intercepts and records all outgoing and incoming calls, voice and SMS, to and from the target. The ARROW is using an active system that captures the IMSI and IMEI of the targets but as it is an active system it is proved fully non detectable modes of operation.The ARROW operates in Random mode as well as in Target mode. It can filter, track and record only the target operation.

Advantages:•Totally undetectable by the operator and by the user•Intercepts and records all outgoing and incoming calls, voice and SMS•All target calls are registered in the Mobile Operator billing systems•Pass the caller ID to the target mobile phone.•All traffic (voice and data) is fully encrypted in the air.•Multi Mobile Operators functionality •Easy change of Mobile Operator by changing a parameter only•Interception distance up to 1Km, •Interception operation starts in less than 15 seconds •Correlation tools to detect targets•Analysis tools to search for events•VPN configuration allows operation in different locations and common control center.•Operate with GSM DF system – remote silent activation of a target

Options and extra features•Optional- interception of 3G cell phones.•Optional – target Direction Finder – Homing system•Optional- ARROW - Split operation: controlling remote interception points via wireless communication•Standard operation – controlling of interception mission via Internet•Standard target communication manipulation. Block, redirect or change information to or from the target. Change SMS content, Voice call manipulation

ARROWARROW OverviewThe ARROW Purpose

• Detecting GSM-standard mobile stations, located within the zone controlled by the System,• Registering traffic (incoming and outgoing communications) from these mobile stations,• Manipulating the state of mobile stations, which have been registered by the system.

The System operates in stealth mode in GSM networks, which use various encoding types (А5.2, А5.1)

The ARROW system supports• Defining mobile station key parameters - IMSI, IMEI, Kc, etc, which are required for System operation;• Full control over mobile station incoming and outgoing traffic within the System’s reach zone;• Manipulating the state of mobile stations, including the possibility of identifying the location of a mobile station (target) by activating its transmitter.


The ARROW rangeThe ARROW is the only system in the world that can operate in a range between 1-2 Km (with

long range option).The system default configuration supports up to 1 Km. The actual system range will be depending on

the environment where it is being used. Typically in a heavily built-up urban area the range will be about 150 meters that is because BTS in an urban area covers small area influence on the real capture area of the ARROW. In more open areas where the cell coverage area is larger the actual interception distances.

Optional models can be provided for increased range.

The ARROW special featuresThe ARROW can perform several manipulations to provide more information about the targets.

• The system can force the activation and the transmission of the target phone to feed the Direction Finder (DF) system• Early Kc evaluation is performed by the MS unit. It helps to shorten the authentication call process. It helps only if Mobile Operator change the Kc every few calls.• The system force the target mobile phone to a certain ARFCN traffic channel to correlate with the operation of a DF system• The system shows constant indications of the reception level from the Mobile subscriber as well as constant level display of the BTS.• PLMN detection – The ARROW includes a very important function that called "Get Public number". It detects the Mobile Subscriber telephone number (PLMN number) by capture its number when sending the callerId over hidden incoming call. • Tracking and analysis tools by saving subscribers lists that include fade out subscribers, rejected subscribers and " target presence " subscriber lists,• Target history tracking list - to view the information stored in the database on a subscriber with IMSI identification


•Backup utilities - Convert Voice recording to standard .WAV files to be recorded on removable storage media. Database can be exported due to Microsoft Access MDB format.•Intelligence Analysis functions helps the operator to search for specific conversation or SMS. The operator can apply many filters to search for an event. SQL query language also provide means to search for events•Easy way to detect if Target replaces SIM cards. Each HLR list displays the IMSI (SIM Id number) and the IMEI (Equipment Id number). Using the correlation function the operator finds the changes of new IMSI/IMEI combinations.•The system applies transmission level control to determine the Tx level of the BTS. •Intelligence gathering when the target does not participate in incoming/outgoing calls (call standby). •Quick Mobile Operator change. The operator may change to a new operator by changing the LAI ( MCC + MNC) in the system BTS parameters setup.

ARROWARROW operating modes“Catcher” mode

• IMSI and IMEI catching. (Secretly obtaining mobile station main identification parameters (IMSI, IMEI, TMSI, Kc etc).• Detection, controlling of mobile stations entering and leaving, turning the power on and off in the System's coverage zone.• Preventing operation of a certain mobile station (Target) or of station groups, which are in the System's coverage zone.

The System initializes the operation of the base station. Thus, one cell is formed (further - internal network) for which the MCC, MNC and ARFCN values will correspond to the parameters of a cellular communication operator, operating in a given district (further - external network), and the LAC is set to a different value from what is used in the real network. The mobile phones, which are within its operation radius (further - subscribers), will acknowledge activation of a strong channel and will start the registration procedure. They will transmit to the System their IMSI, IMEI, TMSI (received in real GSM networks), classmark, KCN. The program’s “BTS control” window will display a list of registered subscribers (called inthe system - HLR). For the subscribers, registration in the internal network does not differ from registration in the external network.


“Interceptor”

Maintaining full control over mobile station incoming and outgoing traffic within the System’s coverage zone;

Two control modes:Random mode Interception (all mobile stations)- Capture and record all incoming and outgoing traffic

within the System’s coverage zone;Tracking mode Interception – IMSI and/or IMEI (only targets)The System supports subscriber (target) selection by the known IMSI and/or IMEI identifiers and also has

the given identifiers search tools based on the registered subscribers’ statistical list processing results.

The System operates in stealth mode and it cannot be detected by the mobile stations’ users. The system does not create interference for external mobile GSM networks.

“Target correlation” mode.

The “Target Correlation” function helps to identify the Targets specific parameters from a list of all subscribers that were registered in the system.

This function is intended to search for the target’s IMSI/IMEI identifiers with the purpose of their subsequent use as selection parameters. This technique is based on comparing the lists of subscribers, registered in the internal network, obtained from various sources (at different addresses) during various time periods



“Local network” modeThe System supports mobile station operation (restoring the radio coverage zone) in critical situations

(natural or technogenic disasters);Hostage situations - search, detection and possible contact with the GSM mobile station owners in

disaster areas, accidents (supporting exclusive System’s operator’s contact with pre-determined mobile stations).

It can be used as a local area network for a small office.

“Detection”Supports detection by the usual (standard) radio control resources of the location of a given mobile

station, located within the System's coverage zone, by concealed activation of the mobile station’s transmitter.

ARROWARROW structureThe following units are included with the System:

• Paging channel stations - to receive from one external network’s LAC incoming subscribers’ call messages, registered in the internal network;• Mobile stations - to support authentication procedure, initiated by the external network, during incoming and outgoing subscribers’ calls, registered in the internal network. The mobile stations are automatically tuned to the internal network base station’s arfcn channel;• Active stations - to interact with the external GSM network on behalf of the subscriber, registered in the internal network.• Notebook PC to perform the control, storage, information production and analysis tools. The Notebook Pc is handling the real time deciphering function.


•BTS cloning system includes: A base station (BTS), tuned to one of the GSM -850, GSM-900 or GSM-1800 frequency bands (with preliminary agreement);Multi BTS (multi bands and multi Mobile operators support) connection could be ordered A base station transmitting channel amplifier (AMP)Two (or more) channels of mobile stations (MS) for Kc calculation.

•Target cloning unit includes: A complete set of up to 6 active stations (AS). A paging channel station (PGS) 1 unit;

•A notebook with the corresponding software (PC)IBM ThinkPad T60 or betterProcessor 1.86GHz 80Gbyte hard disk2.048 Gbyte RAM;



•A set of power supply units (PS1-PS3) (3 units);•Directional antenna (A1) for the GSM frequency multi band size 154X134X46 mm;•Directional antenna (A2) for the GSM frequency multi band size 154X134X46 mm;•A set of connection cables.•Long distance optional components

Yagi antennasLong distance amplifiers units

ARROWARROW GUIThe ARROW Graphic User Interface (GUI) is composed of main window and some sub programs that enables the process of the information that was captured during the interception process:The main windows enable the full and easy control of the field interception mission. It provides an easy setup of the system parameters and a full automatic capture and presentation of the communication protocols of the subscribers.

The ARROW main windows


The main window presents the status of the 4 channels receivers and voice recorders. Via the main windows the system operator manages the target list parameters and controls the modes of operations. The target correlation window enables to isolate the target IMSI/IMEI parameters by correlating of subscribers lists with or without the target presence. The targets correlation window enables also to detect the replacing of SIM cards in mobile handsets by correlating the IMSI and IMEI data.


ARROWARROW SpecificationsNumber of channels 4 full duplex optional 6 channels

Kc calculation 2 separate channels for prior calculation.Interception direction Incoming and outgoing calls

Interception content Voice, ,

SMSSS-message

Frequency bands 850MHz/900 MHz /1800 MHz /1900MHz

Optional - Dual band

Operation modes IMSI/IMEI catching

Random interception mode

Tracking Target modeTarget PLMN (phone number) detection

"Local Network"

Target correlation mode

Early Kc evaluationInterception setup time Within 10-20 seconds

BTS information LACARFCNRx levelMCC MNC

Interception method Fully transparent active

Tones interception DTMF

Real time decipher A5.1 and A5.2

Voice and data recording 80 Gbyte hard disk

Target filter IMSI, IMEI

PLMN number detection YesEvent real time status Incoming/Outgoing call

Emergency callIncoming/Outgoing SMSSS operationIMSI attachPower offRegistration period timer Periodic /Normal Location Update

HLR display Local subscriberFade out SubscribersRejected subscribers

Display design Color change for each message typeProtocol filter Yes

Processing software Correlation target lists Detecting SIM replacements

Database Microsoft Access DB

Query method SQL queries

Search parameters by date, time, IMSI, IMEI,TMSI, Target namelocation LACDTMFSMS word content, partial number using * and ?

Voice features Target detection Alarm

Automatic voice activation

Possible to listen to one speaker side

Replacing Operator Change MCC +MNC parameters

Connectivity to DF system Yes

CO

MPR

A N

UES

TRO

SPR

OD

UC

TOS

AH

OR

A!!

Transmission Power 10 Watt

high power (optional)

control Yes

Notebook PC IBM ThinkPad T43 or equivalentProcessor 1.86GHz 80Gbyte hard disk2.048 Gbyte RAM;

Power supply 115/230V AC 47 Hz to 63 Hz

or 12V DC

Power Consumption AS - 72watts (14v -16v 3a)

MS+BT -120watts (24-27v 3a)

LPT - 72watts (14-16v 3a)

Unit connections LAN cable

Unit 1 Dimensions (W x H x D) 290 x 260 x

Unit 2 Dimensions (W x H x D) 290 x 280 x

Small Directional Antenna GSM Multi Band

9.4 dBi in 900MHz

49° Horizontal plane

154 x 134 x

Directional high gain or Yagi Antenna optional

External power amplifier optional

Total Weight (2 units) 5.6Kg

More details:

CO

MPR

A N

UES

TRO

SPR

OD

UC

TOS

AH

OR

A!!

CO

MPR

A N

UES

TRO

SPR

OD

UC

TOS

AH

OR

A!!

Seguridad en Comunicaciones

Documents

Transcript of Seguridad en Comunicaciones