Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Cathal Mc Daid Profile picture
@mcdaidc
Mar 15, 2022 • 7 tweets • 5 min read • Read on X
1/5 Another significant capture in #Ukraine. Reported discovery today of a #SIMBox being used to relay Voice calls & SMS and other info to Russian forces (including top leadership of Russian army) & other individuals in #Ukraine. I will explain what this is and how it works.
2/5
First the system is comprised of 3 main parts,
1) the SIM Box server - in this case a Hypertone SMB-128 . This handles the control of up to 128 SIM Cards, cycles them when detected etc , and co-ordinates interaction with the #GSM Gateways
hybertone.com/en/pro_detail.… Image
3/5 Next the GSM Gateways, there are two Hypertone types being used here:
- There are 3x GoIP 8 - VoIP Gateway for 8 Channels being used,
- along with 1x GoIP-4 4 SIM VoIP GSM Gateway.
Both can be used for SMS or Voice ImageImage
4/5 Lastly the Software, unfortunately unable to make out the logo (anyone identify it?), but it would be used to co-ordinate the messages, call forwarding settings (in and out) etc. Whole system would look like the below.
There is also a Xiaomi Mi AIoT Router AX3600 present Image
5/5 A significant find as given their comms problems, this reportedly has been used to communicate with top leadership in the Russian forces. Ukrainian mobile opcos have made unprecedented defensive moves, this is '#cyberwar' impacting the battlefield
rusi.org/explore-our-re…
6/5 Extra point - expanding the above, you should never use systems like this for military comms. #SIMBoxes are unreliable and actively hunted by mobile opcos.The use (and detection) of this system is due to #Ukraine aggressively defending the mobile network #SS7/#Diameter space.
This image is from the Hypertone website btw. Manuals for the #Sim Bank and the GSM Gateways are also on the site. hybertone.com/uploadfile/dow…
hybertone.com/uploadfile/dow…

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Cathal Mc Daid

Cathal Mc Daid Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @mcdaidc

Cathal Mc Daid Profile picture
Mar 6
1/12
It has been confirmed that the #Taurus interception was done via “a non-secure line”. Below is my opinion of one way in which it *might* have been done, taking into account the situation and #Russia's previous history.

Essentially it involves using #SS7 interception.
🧵 Image
2/12
First step is that we assume the call intercepted was generated by a German mobile device, roaming into Singapore. In the press release we are not told for certain it was a mobile. So could have been a mobile or a hotel line (or wifi)

theguardian.com/world/2024/mar…
Image
3/12
But as @RidT also states, this person gets added by another, so its probably not wifi.

And if i'm a German general abroad, would i use my "handy" or a strange hotel phone? I think I would use my mobile.

Read 12 tweets
Cathal Mc Daid Profile picture
Feb 15
1/11
Today, we’re releasing details of a small but interesting mobile #vulnerability called MMS Fingerprint, reportedly used by #NSOGroup.

How this might work, and how we found it, is a bit unusual.

@EneaAB @josephfcox @rj_gallagher @campuscodi @lorenzofbenea.com/insights/dusti…
2/11
After a WhatsApp vulnerability exploited in 2019 #WhatsApp/#Facebook sued NSO Group. As part of its evidence there was a contract between a NSO Group reseller and a telecom regulator.

Within that contract was a list of features, including something called #MMSFingerprint Image
3/11
What is an MMS Fingerprint? NSO’s description says it can "reveal the target device and OS version by sending an MMS to the device".

Problem here is this attack wasn’t known in the industry. So I went to work trying to figure it out.
files.lbr.cloud/316009/whatsap…
Image
Read 11 tweets
Cathal Mc Daid Profile picture
Apr 25, 2022
1/10
3rd part of @adaptivemobile series on the mobile battlefield of #Ukraine

@RowlandCorr and I cover what may happen in the future. In particular we look at the little-known Russian separatist Mobile Operators Phoenix (Фенікс) and Lugacom (Лугаком)

blog.adaptivemobile.com/the-mobile-net…
2/10
The unlicensed Phoenix (Фенікс) & Lugacom (Лугаком) opcos were formed from the separatist seizure of Ukrainian Mobile Operator equipment after 2014 invasion of the #Donbas

They have been growing as the licensed Ukrainian Operators have pulled out

euobserver.com/investigations…
3/10
Since the new 2022 invasion started, there have been reports of them expanding into newly occupied areas of #Luhansk & #Donetsk

Plotting these reports against current frontlines shows this seems plausible. Credit to @nrg8000 for making the frontlines shapefiles available
Read 10 tweets
Cathal Mc Daid Profile picture
Mar 29, 2022
🧵A good recent example of #Ukraine contesting the Mobile Network / InfoSec battlespace.

Multiple #SIMBox seizures as part of an "enemy bot farm" network were announced yesterday by the Security Service of Ukraine. 1/6
ssu.gov.ua/novyny/z-pocha…
Technically this is a much bigger setup that the #SIMBox relay discovery from 2 weeks ago, (see my previous thread) which is not surprising as these are more traditional ‘bot farms’ used for signups for social media 2/6
According to the #SBU, the 5 enemy bot farms in the network used social media (including some banned in Ukraine) to “spread disinformation about a full-scale Russian invasion of our state and spread distorted news from the front”.

This network used 100,000 fake accounts 3/6
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(