TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123

Analyzing
Mobile/Cellular DNI in
XKEYSCORE
May 2009
mvm
m m m

* — DERIVED FROM:N$A/

TOP SECRET//COMINT//REL TO USA, AUS, CAN. GBR, NZLJ/20291123

 TOP SECRET/,'COMINT//REL TO USA, AUS, CAN, GBR, NZL

Mobile DNI
Mobile DNI can be described as people
using their Cell Phone or cellular
technology to access the Internet and
E-mail
There are essentially two "types" of
collection:
> Collection within the GPRS/3G network (i.e Abis
link)
• Collection within the public Internet
(FO R N S AT/F6/S SO/FIS A/etc)

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SECRET/,'COMINT//REL TO USA, AUS, CAN, GBR, NZL

Mobile DNI
Mobile DNI Collect comes in two main types:

Convergence of DNR & DNI selectors!

Mostly from l~6 collection

Most cases, needs to be "near" the infrastructure

Looks like regular DNI but with "hints1' that the

source is a cell phone

Collection could be F6, FORNSAT, SSO, FISA

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SÉCRET/.'COMINT/íREL TO USA, AUS, CAN, GBR, NZL

HTTP Activity
• HTTP activity comes in two types:
[Link] Server

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SECRET/,'COMINT//REL TO USA, AUS, CAN, GBR, NZL

Mobile DNI: HTTP Activity

HTTP activity comes in two types:
"Hints" of DNR origins
Public (proxy} IP addresses [Link] Server

Convergence of DNR & DNI selectors!

Usually private IP addresses

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SECRET/,'COMINT//REL TO USA, AUS, CAN, GBR, NZL

Mobile DNI: Converged collection

Y
Examples of "converged" collection:
• GPRS by F6 JUGGERNAUT'S
• WLL/CDMA by SCREAMIN (OTRS)
All "converged" collection is put into the
"Cellular DNI" plug-in of XKS which gives
you the ability to query for DNI traffic based
on DNR selectors (IMSI, IMEI, MSISDN,
etc) where applicable

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 Mobile DNI: Converged collection

DNR & DNI meta-data will be together:

USKR_A ACTIVITY USER_B COOKIE ACTIVEUSER ACTIVEjrSER_TP ACTTVx
| | server to DÜent: clbÜ9e4e<TLLI> | |<yahoo>
^yahoo> logged in (email) B BfSSBT^B | |cyahoo> XX
« clb09e4e<TLL>
a 418056101353054<IMSI>

seen with machine ED E Show (2) Values c1b09e4e<TLLI> X3C

iyahoo> seen with machie DD E Show (2) Values 0 2 possible kyahoo> ZCi

previous IE' clb09e4e<TLLI> kyahoo^ XX

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SECRET/,'COMINT//REL TO USA, AUS, CAN, GBR, NZL
/
Mobile DNI: Converged collection j
r
r
X-KEYSCORE's Cellular DNI plug-in allows
you to query on the DNR selectors for
Persona Analysis
3 «¿3 Classic A-M
¡3 ASF end WM"/ Metadata Query Name: dlstuaJM
! ^ Alert
F^jBleckBerry Justification:
| [-BCNE
Additional Tus'jfication:
LC3S
¡^Category DM Miranda Number:
jlsr ONI
^Ciaju Passwords Drtterimft: 1 Week V Start: 2009-06-06 R UJ:0Ü ~ Stop: 20»05-13 1 1 23:59 C
¡^Dixuriijrr. Metadata
^iDocumerr. Tagging Interface:
'^jErrail Adc'esses
¡^Ex7aded Files Hit Status:
1^|FUILCG C>JI
IMS!:
HTTP Activity
fellRC Cafa Geo nratim KI:
ClLoaina and Pasawurtfe
ElMlarop utjh Metadata TMSI;

IMEI:

MCC:

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 Als..
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

//20291123

Mobile DNI: Converged collection ;

K

By taking the IMSI we found in MARINA we can identify all

of the DNI traffic (webmail, web-surfing etc.) that originated
from that same mobile subscriber
Application Inin • Appir^fiti n n AppiD f+Fingfirprrits)

h t t p i c ^ i w n a c cellpl

* * * * * * « * * [Link]/Yrtml http:f«|>onse p t tV i

• • • • • • • • • l*t|>xes|>0iise.'lTtml bttp r e s | > o n s e ptt w

Yah oft! Front Page m ail . ' w e h m i i i - y a l i o ù mnilwfthmail^ìhiw)

Y«Hi66! r r ó l ì t P4iJt mairwehmalLyalio* m a il / w e b m a i i y a h o o

Y! Mail m ail [Link] m a 11 w e b m a i l v a l i oo

Y! Mail m ail ' w e h n v a i l . y a l i o r t m a i l > W e b m a i l «ysili o o

Y! Mail m a l l "wvebmaiLy ali o o m a 11 . W e b u u i i v a h o o

Y! Mail mail w e b m a d yaiioo m a 11/web mail v a l i o o

Y! Mail mail w e h m a i l y a h o o m a i l / w e b m a i l <yah o o

Y! Mall m ail \ v t b m a i l y alio* [Link]/y*hoo

Y!Mail mail [Link] m a il/Web mail vali oo

Y! Mail mail w e h m a i l yalioo m a iI -w e b m a i l y i h oo

Y! Mail mairwchmaiLyaliOò moilWebmail/yahoo

Y! Mail mail w ^ b m a i i y ali o o m a il . w e b m a n c a l i o o

Y! Mail m ail w e b m a i l yalioo m a iI « w e b m a i l / p a h o o

Y! Mail m a i l W c b m a i . y a h o o mnil.W£bmaU/>tthoo

Y! Mall mail w t b m a i i y a l i o * m a Il . w e b [Link] oo

mail [Link] y a h o o m a i I / w e b m a i l v a li o o
Y! Mail

m ail w e h m o l - y a h o o [Link]/yohoo
Y! Mail

m a i r w e b m a l L y a h o * m a Il . w e b mall/yah o o
Y! Mall

m ail [Link] m a 11 W e b m a i l . y . i h o o
Y! Mail
 TOP SECRET/,'COMINT/iREL TO USA, AUS, CAN, GBR, NZL

Mobile DNI: Traditional Collection

• After the DNI traffic exits the

GPRS/WLL/CDMA Gateway, it will travel
over the public Internet and can be
collected through "traditional" DNI accesses
like FORNSAT, F6, SSO, FISA etc.

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SECRET7/COMINT//RELTO USA, AUS, CAN, GBR, NZL

Mobile DNI: Traditional Collection

Sometimes its difficult to tell if your target is using

a cell phone to access his E-mail
MARINA currently provides little or no "hints"
TS A USER TD PHONF TTSE"R A ACTTVTTY T TSKT? TI COOTCTF ACTTVF TÍSTlTi A C. TÍVETÍSTIR TP AH TT VF

20090:05 192943Z client to server -Vcilio o > AP

20090505 192943Z logged ir. (email) - y ai io o > AI

20090505 194642Z logged ir. (email) -yahoo^ AP
¿ÜÜ9ÜÍÜ6 19ÜÜÜ6Z logged ir. (email) -yaho o > AJK

20090506 190622Z logged ir. (email) 'yaho o > AP

20090506 190622Z cLcntto 5 citci" kyalEo> AI7

20090506 192654Z seen with machine ED 9rvueuh4;lr97<jahooEcookie> 9rvueuh4slr97<yahcoBcookie> iyahoo> AP

20090506 192654Z [-yahoo- seen with machine EE' 9rvueuh4 ;lr 97 ^yahooE cookie^ 9rvueuh4 sir 97 <^yahc oBc o okie> AP
¿ÜU9ÜÍ06 1926MZ previous IF 9rvueuh4 sir 9' / <yahc oBc o okie> AP
20090506 192654Z client to server 9rvueuh4 sir 97 < yahc oBcookie> AI
20090506 192654Z -yahoo> logged ir. (email) 9ryueuh4 sir 97 <y ahc oBc o okic> AP
20090506 192805Z seen with machine ED 9rvueuh4;lr97<vahooEcookie> 9rvueuh4 sir 97 <yahc oBc ookie> AP
/0090506 192R05Z nl-fint to iftrvp.r 9n?i iei ]h4 sir 97 <yah o oBr o [Link] e> AP
20090506 192305Z previous EP 9rvueuh4 sir 97 <yahc oBc o okie> AI
20090506 192S05Z -yahoo- logged ir. (email) 9rvueuh4 sir 97 <yahc oBc ookie> AI

TOP SECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SECRET/,'COMINT//REL TO USA, AUS, CAN, GBR, NZL

Mobile DNI: Traditional Collection •[Link] I

I
X-KEYSCORE "User Activity" provides
some hints
Note the fingerprint of
browser/cellphone/nokia
Search For Se src h Value Applic atior AppID (4-Fingerprints)
username
• • w w • ww www ^w 1 ^gyahoo mailwelnriailyaltoo m ai 1 rwebmail Amhoo b r o w s e r sell>[Link] c^lli>hoi^/wai>fiiia&riuin1'Phon^.iioHia. , '(i^n^iic m o b i k

username } y a , l 0 ° nini 1 film mi 1 y.i Inn m a l l / w e b m a l l / y a h o o [Link] c e l l p h o n f t t o a p f i i i g e r p r ^ mobi

username • • • • • . v y o h o o mallWelMDillyalioo

uocrnamc I "B'S yahoo moll wcbivial I yahoo [Link] browi>tr-<tll|>l>onc.ii0kla ccllphoiKvwap fingerprint phonc/hokla/gcncrfc m o b i k

uocrnamc I "B'Syahoo molliWcbm ai lyal 100 m«ul-wcbmoilyohoo b r o w : m * t l l | > l K H r c . i i o k i a ccllphoi^c.\va|>fliigcr|[Link]<ia/ijcncric m o b i k

uocrnamc I ~Bayahoo mail iWebm ai lyal ioo mail w c b m a i l y a h o o b r o w s e r -{cllHionc/iiokia collphonc/[Link]/iicncrio m o b i k

username I ~^5yahoo nrail webiriail yahoo ni<iil'wel>[Link] browser^ell|:4>oi>[Link] collphono:wa|>fiiigcr|irint ; [Link]/gcnorio m o b i k

username | ~^yahoo mail wel>nTailyal 100 [Link] browser*:ell|)lK>i>[Link] ceHphoiie/wapfiiigerprint [Link]/.yenerio m o b i k

username | ~^yahoo mailwelMviailyalioo mail'[Link] browser•»:ell|>lvc>i)[Link] cellphoiie/wa|>fiiiger|»rii^ [Link]/generic m o b i k

username | ""Jgyahoo mail W e l m i ai l y a l i o o niail'webniailyahoo browser-:ell|>l>[Link] cellphone/wapfiiigerprint«phonejiokia/generic m o b i k

username Bgyahoo m a il •wel>ni ai l yal too mail'Wdbniailyahoo browser*<*ll|>lK>[Link] cellphoiw/wapfiiigdrprint'phond.'iiokia.'iidnorio m o b i k

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SECRET/,'COMINT//REL TO USA, AUS, CAN, GBR, NZL
/ y

Mobile DNI: Traditional Collection •TO*«

T X-KEYSCORE "HTTP Activity" also provides some hintsf
• Note the hostname of [Link] and user agent of:
NokiaN72/5.0706.4.0.1 Series60/2.8 Profile/MIDP-2.0
Configuration/CLDC-1.1

HTTP Type Ho si - ÜRL^at. URL Args

get [Link] ^Ariesseriqer c=Na2nvYzHyTUâtsrc=YahtMâr=2B4440433

Cookie Browser
SP«v»- âa-1, Y-vUn»d8k"Sflii1 !38c5ÂI=I |MokieN72«.07D6.AJ0.1 "Ser =560.2.8 Profited DP-2.0 Configurationj^LDC-l.1

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SECRET/,'COMINT//REL TO USA, AUS, CAN, GBR, NZL

Mobile DNI: Traditional Collection U ^ I W Z .

The content also provides some "hints"
ID: orio proc
Type H P GET ^ P r i n t s Friendly Version

ONI Display 1 Rav/Dala | DNI Format

Services ^

Cffir/ptocss:agci?c=lTa2avYiHynj ^src^i.c5i»urcc-Scnict?aaißc=7ahoo &i=28444Q43? HTiTA.l

Ec st. nülm y al \oo. coca
Accept text/javascript,tóxt/ecmascripl,appKcaùonfe-javascnpt, text/ldml, appKcatior^vrjd [Link] a
mi^ajtfmized, tetrad [Link] applicaüoa/widwap wmlc, appbcafcoctfvnd\vap ranlscnptt
application^^. appHczkoitfx-java- archive, cent/^nd. suo.j 2me. app - des criptor, appkadcrMd
app-Hcation'vnd orna cm content [Link] tarns-message, appicaior/vndwap. sic
applicafcctftfvnd orna dd \Trìl. :extfjavascriptv
Accept-Chars et: i30-8SÌ5--l. utf-3. :$o-IG64.6->jcs-2; q=0 6
Acccpt-2jiccdiag; 2^.clc£atc.:dcrjti;y.q=0.9
Acccpt-LiU^gy^p en
iookic v=1
SP
a=1
v=1
ii=dSksi?iilf3Si
(Yahoo l o g i n i c l i ^ H i ^ H )
t> B ( Gindel': male, Biith yean 1964, Postili corto: |
Y 17Ü0
r=i4
Ig=co-US ( Language-conteufc Fnjrfiisli )

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SECRET/,'COMINT//REL TO USA, AUS, CAN, GBR, NZL

HTTP Activity Examples

r
The content also provides some "hints"

Host [Link]
A:cept: [Link], text/ecmascript, appHcation/x-javascnpt, text/html, [Link]/[Link] z
multipart/mixed, t e x t / v n d w a p . w m l , appHcation/[Link], application/[Link]
application/java, application/x-java-archive, text/[Link]-descriptor, application/vnd
applic ation/vnd. oma. dm;, content, appLcation/vnd. [Link] -me s s age. application/vnd. wap. sic,
application/vnd. [Link] xml, text/javascript, * / *

U s er-Agent: N o k i a N 7 2 / 5 . 0 7 0 6 . 4 . 0 . 1 Series6Q/2.S P r o f i l e / M I D P - 2 . 0 Coofiguratìon/CLDC-1.1

2: w a p profile: "[Link] 1 . n d s . n o k i a . c o m / u a p r o f / N t T 7 2 r 1 OC. xml"

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SECRET/,'COMINT//REL TO USA, AUS, CAN, GBR, NZL

/
Mobile DNI: Traditional Collection
mm

Sometimes there are even more "hints"

21Ea8h50fljl
B
Yahoo B Cookie s=71
:p-a<5drcss
Ä-MSP-APN wap
MSISDN X-MSP-MSISDN 93707982562
X-MSP-MSISDN-HEX 3933373037393832353632
User-A^ent Moalla/5 0 (SymbianOS^ U; Senes60/3 1 NokiaE63-1/100 21 •.10; Profile/MIDP-2 0 Configurat
like Gccko) Safan/413
x-wap-profile: "http-y/ndsl nd£ nokia cojn/[Link]"
X-Nolua-Mus:c Shop-Version: 1 0.0
X-Noba-Mus:c Sh op-Bearer GPK.S/3G
Reltrer hßp//[Link] yahoo, convw/bp rnessetigeri'messenger''c-Ow<>NoDÄlcNKcfa—6& tsrc =hpr
X-MSP-AG: DEFAULT AG
X MSP APN wap
X-MSP-CAI,IJNG-IP
X MSP MSISDN. 93707982562
X-MSP-MSISDN HEX 3933373037393832353632
X-MSP -NODE-NAME [Link]
X-MSP - SESSION-ID. 10. i o n I 6 8 _ 2 3 2 0
X-MSP-UG. DEFAÜLTUG
X-MSP - WAP-CUENT-ID: ¿927C7932562
Via. Siemens

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL

 TOP SECRET/,'COMINT//REL TO USA, AUS, CAN, GBR, NZL

HTTP Activity Examples

Host Browser
IPhone Users! [Link] •Phone Mail (5H11)

Cookie: V=1

Y a h o o l o g i n i l l : )
Gender: female, Birth year: 1977. [Link] co<le:|
jb=34|32|9 (Industry: Telecommunications, Job: Network Administrator, Spe
r=ga
lg=ei.-TJS ( Language/content:English )
ind=us I Country: United States )
np=l
ptdil /
domain
2F=CSICKBC YdCKBItdVgYO Y*85MjJ?Bj YyMDczTzQ2TzA-
a=QAE
sk=DAACWI24ft844j7
ks=EAApZl STMfoCuSrWedATmlg—C
d=c SwBTIRYNEFURTFO ekEwT0RNeE9E YyOB YQFRQUTJBZwF UTEZVQ1TTV
F ocgFDTTOlD $ 0 JtVOEÈ 4 GJwATBkVXVF Q v?- -
pgih /
domain [Link]
TJser-A^ent: iPhone M a i (5H11)

TOPSECRET//COMINT//RELTO USA, AUS, CAN, GBR, NZL