2g downgrade update

bin/Cargo.toml

@@ -32,3 +32,4 @@ clap = { version = "4.5.2", features = ["derive"] }
 serde_json = "1.0.114"
 image = "0.25.1"
 tempfile = "3.10.1"
+simple_logger = "5.0.0"

bin/src/check.rs

@@ -1,5 +1,6 @@
 use std::{collections::HashMap, future, path::PathBuf, pin::pin};
-use rayhunter::{analysis::analyzer::Harness, diag::DataType, gsmtap_parser, pcap::GsmtapPcapWriter, qmdl::QmdlReader};
+use log::{info, warn};
+use rayhunter::{analysis::analyzer::{EventType, Harness}, diag::DataType, gsmtap_parser, pcap::GsmtapPcapWriter, qmdl::QmdlReader};
 use tokio::fs::{metadata, read_dir, File};
 use clap::Parser;
 use futures::TryStreamExt;
@@ -9,7 +10,7 @@ mod dummy_analyzer;
 #[derive(Parser, Debug)]
 #[command(version, about)]
 struct Args {
-    #[arg(short, long)]
+    #[arg(short = 'p', long)]
     qmdl_path: PathBuf,
 
     #[arg(short, long)]
@@ -20,6 +21,9 @@ struct Args {
 
     #[arg(long)]
     enable_dummy_analyzer: bool,
+
+    #[arg(short, long)]
+    quiet: bool,
 }
 
 async fn analyze_file(harness: &mut Harness, qmdl_path: &str, show_skipped: bool) {
@@ -41,20 +45,37 @@ async fn analyze_file(harness: &mut Harness, qmdl_path: &str, show_skipped: bool
         }
         for analysis in row.analysis {
             for maybe_event in analysis.events {
-                if let Some(event) = maybe_event {
-                    warnings += 1;
-                    println!("{}: {:?}", analysis.timestamp, event);
+                let Some(event) = maybe_event else { continue };
+                match event.event_type {
+                    EventType::Informational => {
+                        info!(
+                            "{}: INFO - {} {}",
+                            qmdl_path,
+                            analysis.timestamp,
+                            event.message,
+                        );
+                    }
+                    EventType::QualitativeWarning { severity } => {
+                        warn!(
+                            "{}: WARNING (Severity: {:?}) - {} {}",
+                            qmdl_path,
+                            severity,
+                            analysis.timestamp,
+                            event.message,
+                        );
+                        warnings += 1;
+                    }
                 }
             }
         }
     }
     if show_skipped && skipped > 0 {
-        println!("{}: messages skipped:", qmdl_path);
+        info!("{}: messages skipped:", qmdl_path);
         for (reason, count) in skipped_reasons.iter() {
-            println!("    - {}: \"{}\"", count, reason);
+            info!("    - {}: \"{}\"", count, reason);
         }
     }
-    println!("{}: {} messages analyzed, {} warnings, {} messages skipped", qmdl_path, total_messages, warnings, skipped);
+    info!("{}: {} messages analyzed, {} warnings, {} messages skipped", qmdl_path, total_messages, warnings, skipped);
 }
 
 async fn pcapify(qmdl_path: &PathBuf) {
@@ -75,21 +96,30 @@ async fn pcapify(qmdl_path: &PathBuf) {
             }
         }
     }
-    println!("wrote pcap to {:?}", &pcap_path);
+    info!("wrote pcap to {:?}", &pcap_path);
 }
 
 #[tokio::main]
 async fn main() {
-    env_logger::init();
     let args = Args::parse();
+    let level = if args.quiet {
+        log::LevelFilter::Warn
+    } else {
+        log::LevelFilter::Trace
+    };
+    simple_logger::SimpleLogger::new()
+        .with_colors(true)
+        .without_timestamps()
+        .with_level(level)
+        .init().unwrap();
 
     let mut harness = Harness::new_with_all_analyzers();
     if args.enable_dummy_analyzer {
         harness.add_analyzer(Box::new(dummy_analyzer::TestAnalyzer { count: 0 }));
     }
-    println!("Analyzers:");
+    info!("Analyzers:");
     for analyzer in harness.get_metadata().analyzers {
-        println!("    - {}: {}", analyzer.name, analyzer.description);
+        info!("    - {}: {}", analyzer.name, analyzer.description);
     }
 
     let metadata = metadata(&args.qmdl_path).await.expect("failed to get metadata");

lib/src/analysis/analyzer.rs

@@ -7,7 +7,8 @@ use crate::{diag::MessagesContainer, gsmtap_parser};
 use super::{
     imsi_requested::ImsiRequestedAnalyzer,
     information_element::InformationElement,
-    lte_downgrade::LteSib6And7DowngradeAnalyzer,
+    connection_redirect_downgrade::ConnectionRedirect2GDowngradeAnalyzer,
+    priority_2g_downgrade::LteSib6And7DowngradeAnalyzer,
     null_cipher::NullCipherAnalyzer,
 };
 
@@ -117,8 +118,9 @@ impl Harness {
 
     pub fn new_with_all_analyzers() -> Self {
         let mut harness = Harness::new();
-        harness.add_analyzer(Box::new(LteSib6And7DowngradeAnalyzer{}));
         harness.add_analyzer(Box::new(ImsiRequestedAnalyzer::new()));
+        harness.add_analyzer(Box::new(ConnectionRedirect2GDowngradeAnalyzer{}));
+        harness.add_analyzer(Box::new(LteSib6And7DowngradeAnalyzer{}));
         harness.add_analyzer(Box::new(NullCipherAnalyzer{}));
 
         harness

lib/src/analysis/connection_redirect_downgrade.rs

@@ -0,0 +1,42 @@
+use std::borrow::Cow;
+
+use super::analyzer::{Analyzer, Event, EventType, Severity};
+use super::information_element::{InformationElement, LteInformationElement};
+use telcom_parser::lte_rrc::{DL_DCCH_Message, DL_DCCH_MessageType, DL_DCCH_MessageType_c1, RRCConnectionReleaseCriticalExtensions, RRCConnectionReleaseCriticalExtensions_c1, RedirectedCarrierInfo};
+use super::util::unpack;
+
+// Based on HITBSecConf presentation "Forcing a targeted LTE cellphone into an
+// eavesdropping network" by Lin Huang
+pub struct ConnectionRedirect2GDowngradeAnalyzer {
+}
+
+// TODO: keep track of SIB state to compare LTE reselection blocks w/ 2g/3g ones
+impl Analyzer for ConnectionRedirect2GDowngradeAnalyzer {
+    fn get_name(&self) -> Cow<str> {
+        Cow::from("Connection Release/Redirected Carrier 2G Downgrade")
+    }
+
+    fn get_description(&self) -> Cow<str> {
+        Cow::from("Tests if a cell releases our connection and redirects us to a 2G cell.")
+    }
+
+    fn analyze_information_element(&mut self, ie: &InformationElement) -> Option<Event> {
+        unpack!(InformationElement::LTE(lte_ie) = ie);
+        unpack!(LteInformationElement::DlDcch(DL_DCCH_Message { message }) = lte_ie);
+        unpack!(DL_DCCH_MessageType::C1(c1) = message);
+        unpack!(DL_DCCH_MessageType_c1::RrcConnectionRelease(release) = c1);
+        unpack!(RRCConnectionReleaseCriticalExtensions::C1(c1) = &release.critical_extensions);
+        unpack!(RRCConnectionReleaseCriticalExtensions_c1::RrcConnectionRelease_r8(r8_ies) = c1);
+        unpack!(Some(carrier_info) = &r8_ies.redirected_carrier_info);
+        match carrier_info {
+            RedirectedCarrierInfo::Geran(_carrier_freqs_geran) => Some(Event {
+                event_type: EventType::QualitativeWarning { severity: Severity::High },
+                message: format!("Detected 2G downgrade"),
+            }),
+            _ => Some(Event {
+                event_type: EventType::Informational,
+                message: format!("RRCConnectionRelease CarrierInfo: {:?}", carrier_info),
+            }),
+        }
+    }
+}

lib/src/analysis/imsi_requested.rs

@@ -30,15 +30,15 @@ impl Analyzer for ImsiRequestedAnalyzer {
             return None;
         };
 
-        // NAS identity request
+        // NAS identity request, ID type IMSI
         if payload == &[0x07, 0x55, 0x01] {
             if self.packet_num < PACKET_THRESHHOLD {
                 return Some(Event {
                     event_type: EventType::QualitativeWarning {
                         severity: Severity::Medium
                     },
                     message: format!(
-                        "NAS IMSI request detected, however it was within \
+                        "NAS IMSI identity request detected, however it was within \
                         the first {} packets of this analysis. If you just \
                         turned your device on, this is likely a \
                         false-positive.",
@@ -50,7 +50,7 @@ impl Analyzer for ImsiRequestedAnalyzer {
                     event_type: EventType::QualitativeWarning {
                         severity: Severity::High
                     },
-                    message: format!("NAS IMSI request detected"),
+                    message: format!("NAS IMSI identity request detected"),
                 })
             }
         }

lib/src/analysis/mod.rs

@@ -1,6 +1,8 @@
 pub mod analyzer;
 pub mod information_element;
-pub mod lte_downgrade;
+pub mod priority_2g_downgrade;
+pub mod connection_redirect_downgrade;
 pub mod imsi_provided;
 pub mod imsi_requested;
 pub mod null_cipher;
+pub mod util;

lib/src/analysis/util.rs

@@ -0,0 +1,32 @@
+
+// Unpacks a pattern, or returns None.
+//
+// # Examples
+// You can use `unpack!` to unroll highly nested enums like this:
+// ```
+// enum Foo {
+//     A(Bar),
+//     B,
+// }
+//
+// enum Bar {
+//     C(Baz)
+// }
+//
+// struct Baz;
+//
+// fn get_bang(foo: Foo) -> Option<Baz> {
+//     unpack!(Foo::A(bar) = foo);
+//     unpack!(Bar::C(baz) = bar);
+//     baz
+// }
+// ```
+//
+macro_rules! unpack {
+    ($pat:pat = $val:expr) => {
+        let $pat = $val else { return None; };
+    };
+}
+
+// this is apparently how you make a macro publicly usable from this module
+pub(crate) use unpack;