Base Jumping Attacking the GSM baseband and base station - - PowerPoint PPT Presentation

▶
base jumping
SMART_READER_LITE
LIVE PREVIEW

Base Jumping Attacking the GSM baseband and base station - - PowerPoint PPT Presentation

Sep 29, 2023 363 likes •1.08k views

Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday, 20 July 2010 GSM: The Protocol 3 Tuesday, 20 July 2010 Documents

slide-1
SLIDE 1

Base Jumping

Attacking the GSM baseband and base station grugq@coseinc.com

Tuesday, 20 July 2010

slide-2
SLIDE 2

Overview

❖GSM ❖Base Station ❖Base Band ❖Conclusion

2 Tuesday, 20 July 2010

slide-3
SLIDE 3

GSM: The Protocol

3 Tuesday, 20 July 2010

slide-4
SLIDE 4

Documents

4

❖Dozens of docs ❖Thousands of pages ❖Important one (defines L3)

❖GSM 04 08

Tuesday, 20 July 2010

slide-5
SLIDE 5

5 Tuesday, 20 July 2010

slide-6
SLIDE 6

6 Tuesday, 20 July 2010

slide-7
SLIDE 7

7

Logical Channels

Broadcast Channels (BCH) Broadcast Control Channel (BCCH) Frequency Correction Channel (FCCH) Synchronization Channel (SCH) Cell Broadcast Channel (CBCH)

Tuesday, 20 July 2010

slide-8
SLIDE 8

Logical Channels, cont.

❖ Common Control Channels (CCCH)

Paging Channel (PCH) Random Access Channel (RACH) Access Grant Channel (AGCH)

8 Tuesday, 20 July 2010

slide-9
SLIDE 9

Logical Channels, cont.

Standalone Dedicated Control Channel (SDCCH) Associated Control Channel (ACCH) Fast Associated Control Channel (FACCH) Slow Associated Control Channel (SACCH)

9 Tuesday, 20 July 2010

slide-10
SLIDE 10

GSM Channels

10

❖Opening a channel is slow

❖Can take seconds

❖Specific channels for specific uses

Tuesday, 20 July 2010

slide-11
SLIDE 11

Opening a channel

11 Tuesday, 20 July 2010

slide-12
SLIDE 12

12 Tuesday, 20 July 2010

slide-13
SLIDE 13

12

RACH

Tuesday, 20 July 2010

slide-14
SLIDE 14

12

RACH AGCH

Tuesday, 20 July 2010

slide-15
SLIDE 15

12

RACH AGCH LCH

Tuesday, 20 July 2010

slide-16
SLIDE 16

13 Tuesday, 20 July 2010

slide-17
SLIDE 17

13

PCH

Tuesday, 20 July 2010

slide-18
SLIDE 18

13

RACH PCH

Tuesday, 20 July 2010

slide-19
SLIDE 19

13

RACH PCH AGCH

Tuesday, 20 July 2010

slide-20
SLIDE 20

13

RACH PCH AGCH LCH

Tuesday, 20 July 2010

slide-21
SLIDE 21

14

MS BTS BTS BSC MSC ARFCN

Tuesday, 20 July 2010

slide-22
SLIDE 22

15

Base Transceiver Station BTS Base Station Controller BSC Mobile Station Controller MSC Mobile Station MS Base Station Sub-System BSS

Tuesday, 20 July 2010

slide-23
SLIDE 23

16

MS BSS MSC HLR VLR

Tuesday, 20 July 2010

slide-24
SLIDE 24

Mobile Identifiers

17 Tuesday, 20 July 2010

slide-25
SLIDE 25

18 Tuesday, 20 July 2010

slide-26
SLIDE 26

18

IMSI

Tuesday, 20 July 2010

slide-27
SLIDE 27

18

IMSI IMEI

Tuesday, 20 July 2010

slide-28
SLIDE 28

GSM Attacks

19 Tuesday, 20 July 2010

slide-29
SLIDE 29

20 Tuesday, 20 July 2010

slide-30
SLIDE 30

RACHell

21

❖Request channel allocation ❖Flood the BSS with requests ❖First announced by Dieter Spaar at

DeepSec

❖Prevent everyone from using that cell

Tuesday, 20 July 2010

slide-31
SLIDE 31

22

RACHell

Tuesday, 20 July 2010

slide-32
SLIDE 32

22

RACHell

Tuesday, 20 July 2010

slide-33
SLIDE 33

22

RACHell

Tuesday, 20 July 2010

slide-34
SLIDE 34

22

RACHell

Tuesday, 20 July 2010

slide-35
SLIDE 35

22

RACHell

Tuesday, 20 July 2010

slide-36
SLIDE 36

22

RACHell

Tuesday, 20 July 2010

slide-37
SLIDE 37

22

?

RACHell

Tuesday, 20 July 2010

slide-38
SLIDE 38

23 Tuesday, 20 July 2010

slide-39
SLIDE 39

23

Our Target

Tuesday, 20 July 2010

slide-40
SLIDE 40

Demo - RACHell

24 Tuesday, 20 July 2010

slide-41
SLIDE 41

IMSI Flood

❖Send IMSI ATTACH messages ❖pre-authentication ❖Overload the HLR/VLR infrastructure ❖Prevent everyone using the network

25 Tuesday, 20 July 2010

slide-42
SLIDE 42

26

IMSI Flood

Tuesday, 20 July 2010

slide-43
SLIDE 43

26

IMSI Flood

Tuesday, 20 July 2010

slide-44
SLIDE 44

26

IMSI Flood

Tuesday, 20 July 2010

slide-45
SLIDE 45

26

IMSI Flood

Tuesday, 20 July 2010

slide-46
SLIDE 46

26

IMSI Flood

Tuesday, 20 July 2010

slide-47
SLIDE 47

26

IMSI Flood

Tuesday, 20 July 2010

slide-48
SLIDE 48

26

IMSI Flood

Tuesday, 20 July 2010

slide-49
SLIDE 49

How hard to get an IMSI?

27 Tuesday, 20 July 2010

slide-50
SLIDE 50

IMSI DETACH

❖Send multiple Location Update

Requests including a spoofed IMSI

❖Unauthenticated

❖Prevent SIM from receiving calls and

SMS

❖Discovered by Sylvain Munaut

28 Tuesday, 20 July 2010

slide-51
SLIDE 51

29

IMSI DETACH

Tuesday, 20 July 2010

slide-52
SLIDE 52

29

IMSI DETACH

Tuesday, 20 July 2010

slide-53
SLIDE 53

29

IMSI DETACH

Tuesday, 20 July 2010

slide-54
SLIDE 54

29

IMSI DETACH

Tuesday, 20 July 2010

slide-55
SLIDE 55

29

IMSI DETACH

Tuesday, 20 July 2010

slide-56
SLIDE 56

29

IMSI DETACH

Tuesday, 20 July 2010

slide-57
SLIDE 57

29

IMSI DETACH

Tuesday, 20 July 2010

slide-58
SLIDE 58

Baseband Fuzzing

30 Tuesday, 20 July 2010

slide-59
SLIDE 59

31

= +

How to make a smartphone

Tuesday, 20 July 2010

slide-60
SLIDE 60

32

Two separate computers

Tuesday, 20 July 2010

slide-61
SLIDE 61

32

Two separate computers

Tuesday, 20 July 2010

slide-62
SLIDE 62

33

Baseband

❖Controls the radio ❖Separate CPU and code base ❖RTOS ❖Written in C ❖Typically legacy code base (decades)

Tuesday, 20 July 2010

slide-63
SLIDE 63

Coseinc GSM FuzzFarm

❖OpenBTS based fuzzer delivery

engine

❖Targetting

❖iPhone ❖HTC (Android) ❖Palm Pre ❖Blackberry ❖Nokia

34 Tuesday, 20 July 2010

slide-64
SLIDE 64

35 Tuesday, 20 July 2010

slide-65
SLIDE 65

Conclusion

36 Tuesday, 20 July 2010

slide-66
SLIDE 66

GSM Trouble

37

❖GSM is no longer a walled garden ❖GSM spec has security problems ❖Expect many more issues as OSS

reduces costs for entry

Tuesday, 20 July 2010

slide-67
SLIDE 67

Future work

❖More GSM stack fuzzing ❖Next gen protocol stacks

38 Tuesday, 20 July 2010

slide-68
SLIDE 68

39

Thanks to

Harald Walte, Osmocom-bb & OpenBTS

Tuesday, 20 July 2010

slide-69
SLIDE 69

Questions?

40 Tuesday, 20 July 2010