Home
Reference Guides
Reference material for alerts and incidents, discovery and Smart Polling strategies, and Federal Information Processing Standards.
Alerts and Incidents
Reference guide for alerts and incidents.
Alerts
A description of alerts in the Nozomi Networks software.
Learned behavior (virtual image)
Virtual image represents a set of information by which Guardian represents the monitored network. This includes for example node properties, links, protocols, function codes, variables, variable values. Such information is collected via learning, smart polling, or external contents, such as Asset Intelligence. Alerts in this group represent deviations from expected behaviors, according to the learned or fed information. When an alert of this category is raised, if the related event is not considered a malicious attack or an anomaly, it can be learned.
SIGN:WIRELESS:CELLULAR-ROGUE
Rogue Cell Tower Detected

Reference Guides
Reference material for alerts and incidents, discovery and Smart Polling strategies, and Federal Information Processing Standards.
- Alerts and Incidents
  Reference guide for alerts and incidents.
  - Alerts
    A description of alerts in the Nozomi Networks software.
    - Built-in checks
      Built-in checks are based on specific signatures or hard-coded logics with reference to: known ICS threats (by signatures provided by Threat Intelligence), known malicious operations, system weaknesses, or protocol-compliant operations that can impact the network/ICS functionality. They might also leverage the Learning process to be more accurate.
    - Custom checks
      These are checks set in place by the user. Typically the nature of an event related to a custom check cannot generally be referred to a problem per se, if not contextualized to the specific network and installation.
    - Protocol validations
      An undesired protocol behavior has been detected. This can refer to a wrong single message, to a correct single message not supposed to be transmitted or transmitted at the wrong time (state machines violation) or to a malicious message sequence. Protocol specific error messages indicating misconfigurations also trigger alerts that fall into this category.
    - Learned behavior (virtual image)
      Virtual image represents a set of information by which Guardian represents the monitored network. This includes for example node properties, links, protocols, function codes, variables, variable values. Such information is collected via learning, smart polling, or external contents, such as Asset Intelligence. Alerts in this group represent deviations from expected behaviors, according to the learned or fed information. When an alert of this category is raised, if the related event is not considered a malicious attack or an anomaly, it can be learned.
      - SIGN:WIRELESS:CELLULAR-ROGUE
        Rogue Cell Tower Detected
      - VI:CONF-MISMATCH
        Configuration Mismatch
      - VI:GLOBAL:NEW-FUNC-CODE
        New global function code
      - VI:GLOBAL:NEW-MAC-VENDOR
        New global MAC vendor
      - VI:GLOBAL:NEW-VAR-PRODUCER
        New global variable producer
      - VI:KB:UNKNOWN-FUNC-CODE
        Unknown asset function code
      - VI:KB:UNKNOWN-PROTOCOL
        Unknown asset's protocol
      - VI:NEW-ARP
        New ARP
      - VI:NEW-FUNC-CODE
        New function code
      - VI:NEW-LINK
        New link
      - VI:NEW-LINK-CONFIRMED
        New confirmed link
      - VI:NEW-LINK-GROUP
        New link group
      - VI:NEW-MAC
        New MAC address
      - VI:NEW-NET-DEV
        New network device
      - VI:NEW-NODE
        New node
      - VI:NEW-NODE:DUALUSE-IP
        DUALUSE IP (new node)
      - VI:NEW-NODE:MALICIOUS-IP
        Bad IP reputation (new node)
      - VI:NEW-NODE:PUA-IP
        PUA IP (new node)
      - VI:NEW-NODE:TARGET
        New target node
      - VI:PROC:NEW-VALUE
        New OT variable value
      - VI:PROC:NEW-VAR
        New OT variable
      - VI:PROC:PROTOCOL-FLOW-ANOMALY
        Protocol flow anomaly
      - VI:PROC:VARIABLE-FLOW-ANOMALY
        Variable flow anomaly
      - VI:WIRELESS:GEOFENCE
        Geofencing event
      - VI:WIRELESS:PROTECTED_NETWORK
        Protected network event
      - VI:WIRELESS:ROGUE-AP
        Rogue Access Point
  - Incidents
    Incidents are a set of alerts that are related to each other. You can use them to streamline alerts analysis. The user interface (UI) lets you group alerts into incidents. You can toggle the view between Alerts or Incidents.
- Discovery
  Reference guide for discovery strategies.
- Smart Polling
  Reference guide for Smart Polling strategies.
- Federal Information Processing Standards
  Reference guide for Federal Information Processing Standards.
- N2OS Configuration Reference
  Reference guide for the current N2OS configuration settings (versioned publication).

SIGN:WIRELESS:CELLULAR-ROGUE

Rogue Cell Tower Detected

Type ID

SIGN:WIRELESS:CELLULAR-ROGUE

Security profile

Alerts of this type are visible in the following security profiles:

LOW
MEDIUM
HIGH
PARANOID

Risk

The base risk for this alert is 7.

Cause

Rogue Cell Towers are false base stations that hijack nearby mobile device connections, performing active or passive attacks against devices. They trick the mobile device into thinking it is connected to an authorized cell tower, leaving it vulnerable to man-in-the-middle attacks and increasing threats to privacy. In this way, an attacker can collect private information about you indirectly through metadata, as well as tracing users' location and capturing the content of messages or calls.

Solution

To date, the detection of Rogue Cell Towers can't be done by the mobile device's operating system. Usually, the attacker is not very far from the targeted devices: if possible, start an investigation to find suspicious antennas. Also, if supported, it is advisable to use your mobile device's full 5G connection, less vulnerable than 3G (UMTS) and 4G (LTE) connections.

Product versions

Guardian Air 1.0.1

Trace

Alerts of this type are expected to generate traces.

Deduplication key

Attribute TYPE_ID
Attribute TRIGGER_ID
Property cell_context