Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010
Overview ❖ GSM ❖ Base Station ❖ Base Band ❖ Conclusion 2 Tuesday, 20 July 2010
GSM: The Protocol 3 Tuesday, 20 July 2010
Documents ❖ Dozens of docs ❖ Thousands of pages ❖ Important one (defines L3) ❖ GSM 04 08 4 Tuesday, 20 July 2010
5 Tuesday, 20 July 2010
6 Tuesday, 20 July 2010
Logical Channels Broadcast Channels ( BCH ) Broadcast Control Channel ( BCCH ) Frequency Correction Channel ( FCCH ) Synchronization Channel ( SCH ) Cell Broadcast Channel ( CBCH ) 7 Tuesday, 20 July 2010
Logical Channels, cont. ❖ Common Control Channels ( CCCH ) Paging Channel ( PCH ) Random Access Channel ( RACH ) Access Grant Channel ( AGCH ) 8 Tuesday, 20 July 2010
Logical Channels, cont. Standalone Dedicated Control Channel ( SDCCH ) Associated Control Channel ( ACCH ) Fast Associated Control Channel ( FACCH ) Slow Associated Control Channel ( SACCH ) 9 Tuesday, 20 July 2010
GSM Channels ❖ Opening a channel is slow ❖ Can take seconds ❖ Specific channels for specific uses 10 Tuesday, 20 July 2010
Opening a channel 11 Tuesday, 20 July 2010
12 Tuesday, 20 July 2010
RACH 12 Tuesday, 20 July 2010
RACH AGCH 12 Tuesday, 20 July 2010
RACH AGCH LCH 12 Tuesday, 20 July 2010
13 Tuesday, 20 July 2010
PCH 13 Tuesday, 20 July 2010
PCH RACH 13 Tuesday, 20 July 2010
PCH RACH AGCH 13 Tuesday, 20 July 2010
PCH RACH AGCH LCH 13 Tuesday, 20 July 2010
ARFCN MSC MS BSC BTS BTS 14 Tuesday, 20 July 2010
Mobile Station MS Mobile Station Base Transceiver Base Station Controller Station Controller MSC BTS BSC Base Station Sub-System BSS 15 Tuesday, 20 July 2010
VLR HLR MSC MS BSS 16 Tuesday, 20 July 2010
Mobile Identifiers 17 Tuesday, 20 July 2010
18 Tuesday, 20 July 2010
IMSI 18 Tuesday, 20 July 2010
IMSI IMEI 18 Tuesday, 20 July 2010
GSM Attacks 19 Tuesday, 20 July 2010
20 Tuesday, 20 July 2010
RACHell ❖ Request channel allocation ❖ Flood the BSS with requests ❖ First announced by Dieter Spaar at DeepSec ❖ Prevent everyone from using that cell 21 Tuesday, 20 July 2010
RACHell 22 Tuesday, 20 July 2010
RACHell 22 Tuesday, 20 July 2010
RACHell 22 Tuesday, 20 July 2010
RACHell 22 Tuesday, 20 July 2010
RACHell 22 Tuesday, 20 July 2010
RACHell 22 Tuesday, 20 July 2010
RACHell ? 22 Tuesday, 20 July 2010
23 Tuesday, 20 July 2010
Our Target 23 Tuesday, 20 July 2010
Demo - RACHell 24 Tuesday, 20 July 2010
IMSI Flood ❖ Send IMSI ATTACH messages ❖ pre-authentication ❖ Overload the HLR/VLR infrastructure ❖ Prevent everyone using the network 25 Tuesday, 20 July 2010
IMSI Flood 26 Tuesday, 20 July 2010
IMSI Flood 26 Tuesday, 20 July 2010
IMSI Flood 26 Tuesday, 20 July 2010
IMSI Flood 26 Tuesday, 20 July 2010
IMSI Flood 26 Tuesday, 20 July 2010
IMSI Flood 26 Tuesday, 20 July 2010
IMSI Flood 26 Tuesday, 20 July 2010
How hard to get an IMSI? 27 Tuesday, 20 July 2010
IMSI DETACH ❖ Send multiple Location Update Requests including a spoofed IMSI ❖ Unauthenticated ❖ Prevent SIM from receiving calls and SMS ❖ Discovered by Sylvain Munaut 28 Tuesday, 20 July 2010
IMSI DETACH 29 Tuesday, 20 July 2010
IMSI DETACH 29 Tuesday, 20 July 2010
IMSI DETACH 29 Tuesday, 20 July 2010
IMSI DETACH 29 Tuesday, 20 July 2010
IMSI DETACH 29 Tuesday, 20 July 2010
IMSI DETACH 29 Tuesday, 20 July 2010
IMSI DETACH 29 Tuesday, 20 July 2010
Baseband Fuzzing 30 Tuesday, 20 July 2010
How to make a smartphone + = 31 Tuesday, 20 July 2010
Two separate computers 32 Tuesday, 20 July 2010
Two separate computers 32 Tuesday, 20 July 2010
Baseband ❖ Controls the radio ❖ Separate CPU and code base ❖ RTOS ❖ Written in C ❖ Typically legacy code base (decades) 33 Tuesday, 20 July 2010
Coseinc GSM FuzzFarm ❖ OpenBTS based fuzzer delivery engine ❖ Targetting ❖ iPhone ❖ HTC (Android) ❖ Palm Pre ❖ Blackberry ❖ Nokia 34 Tuesday, 20 July 2010
35 Tuesday, 20 July 2010
Conclusion 36 Tuesday, 20 July 2010
GSM Trouble ❖ GSM is no longer a walled garden ❖ GSM spec has security problems ❖ Expect many more issues as OSS reduces costs for entry 37 Tuesday, 20 July 2010
Future work ❖ More GSM stack fuzzing ❖ Next gen protocol stacks 38 Tuesday, 20 July 2010
Thanks to Harald Walte, Osmocom-bb & OpenBTS 39 Tuesday, 20 July 2010
Questions? 40 Tuesday, 20 July 2010
Recommend
More recommend
