FROM CHINA WITH LOVE by Oleg Kupreev & Nikita Tarakanov WHO IS - - PowerPoint PPT Presentation

▶
from china with love
SMART_READER_LITE
LIVE PREVIEW

FROM CHINA WITH LOVE by Oleg Kupreev & Nikita Tarakanov WHO IS - - PowerPoint PPT Presentation

Feb 04, 2023 11 likes •535 views

FROM CHINA WITH LOVE by Oleg Kupreev & Nikita Tarakanov WHO IS OLEG KUPREEV? v Russian Security Researcher v Hardware researching v Software researching v Reverse engineering v Exploit development WHO IS NIKITA TARAKANOV? v

slide-1
SLIDE 1

FROM CHINA WITH LOVE

by Oleg Kupreev & Nikita Tarakanov

slide-2
SLIDE 2

WHO IS OLEG KUPREEV?

v Russian Security Researcher v Hardware researching v Software researching v Reverse engineering v Exploit development

slide-3
SLIDE 3

WHO IS NIKITA TARAKANOV?

v Independent Russian Security Researcher v Aka Vulnerability Assassin v Aka Crazy Wild Russian v Aka Stars Alinger v Nice dude J

slide-4
SLIDE 4

AGENDA

v Hardware overview v Software overview v Infection ideas v Pwning ideas v Conclusion v Q&A

slide-5
SLIDE 5

HARDWARE

v Many Mobile Partners (Beeline, Megafon, MTS, T-Mobile, Vodafone) ¡users in different countries v One modem vendor - HUAWEI v One SOC vendor – Qualcomm

slide-6
SLIDE 6

3G MODEMS

slide-7
SLIDE 7

MORE 3G MODEMS

slide-8
SLIDE 8

4G LTE MODEMS

slide-9
SLIDE 9

VENDOR SOFTWARE

v Huawei Dashboard Tool for ISO dumping and executable dashboard generation v Qualcomm QPST,QXDM,QMAT are used for all kind of baseband reverse engineering

slide-10
SLIDE 10

HUAWEI TOOL

slide-11
SLIDE 11

HUAWEI_TOOL.AU3

slide-12
SLIDE 12

DASHBOARD UPDATABLE!

slide-13
SLIDE 13

UNLOCK LOG

slide-14
SLIDE 14

QUALCOMM INFO

slide-15
SLIDE 15

HARDWARE SUMMARY

Modem Network Qualcomm SOC CD-ROM capacity E1550 2G/3G MSM6246 64MB E171 2G/3G MSM6290 128MB E173 2G/3G MSM6290 128MB E352 2G/3G MSM6290 128MB E392 2G/3G/4G LTE MDM9600 256MB E3276 (M150) 2G/3G/4G LTE MDM9225 128MB

slide-16
SLIDE 16

HOMEBREW SOFT

v Different Unlockers (DC-Unlocker, Huawei Modem Unlocker 5.8.1 by Bojs, Huawei Calculator, Huawei NCK Calc) v QcomInfoReader v Custom dashboards v Custom baseband firmwares

slide-17
SLIDE 17

MOBILE PARTNER CD

Dialing software and modem drivers are stored at hybrid CD image (ISO9660/HFS+) and contains: v Mobile Partner (lots of misc stuff) and drivers for Windows v Mobile Partner installation script for Linux v Mobile Partner app for OS X v Windows + Linux + OS X – sweet targets to rootkit

slide-18
SLIDE 18

WINDOWS PART 1

slide-19
SLIDE 19

WINDOWS PART 2

slide-20
SLIDE 20

SYSCONFIG.DAT

slide-21
SLIDE 21

LINUX

slide-22
SLIDE 22

LINUX INSTALL PART1

slide-23
SLIDE 23

LINUX INSTALL PART 2

slide-24
SLIDE 24

MAC OSX

slide-25
SLIDE 25

WTF IS DASHBOARD?

Mobile Partner application stored on Huawei modem CD image ¡in modem flash memory: v Modem drivers v Dialing application with voice calling features v Mobile Partner additional applications (multifon, trava) v And some CONFIG FILES

slide-26
SLIDE 26

BUNCH OF DRIVERS

slide-27
SLIDE 27

BUNCH OF PLUGINS

slide-28
SLIDE 28

PLUGINS

slide-29
SLIDE 29

MOBILE PROFILE

slide-30
SLIDE 30

NICE PROFILE TO INFECT

slide-31
SLIDE 31

CUSTOM MOBILE PROFILE

slide-32
SLIDE 32

PROCESSES

slide-33
SLIDE 33

MODEM SERVICES

slide-34
SLIDE 34

OUC.EXE OUCH!!!

slide-35
SLIDE 35

KERNEL PART

v No need in live debugging v There are lot of code that helps you v Debug prints in production code v That Rulezzz

slide-36
SLIDE 36

MAY BE DEBUG?

slide-37
SLIDE 37

DEBUGLEVEL++

slide-38
SLIDE 38

VENDOR SOURCE CODE

v Driver source code leaked http://en.pudn.com/downloads181/sourcecode/comm/usb/ detail844652_en.html

slide-39
SLIDE 39

MAIN RESEARCH IDEAS

INFECT AS MUCH AS POSSIBLE!

slide-40
SLIDE 40

INFECTION VECTORS

v BOOTKIT for USB-CD & USB-SD boot via MBR v CD autorun v DNS poisoning via dashboard config infection v Auto update by infecting XML configuration v WiFi autoconnect with presets v Voice calling spyware $$$ v GPS & P2P in future releases?

slide-41
SLIDE 41

BOOTKIT

v SD card MBR infection is standard and simple v CD image updated by dashboard flasher v Force BSOD/kernel panic/reboot v Profit!

slide-42
SLIDE 42

DNS POISONING

slide-43
SLIDE 43

DNS POISONING RAW XML

slide-44
SLIDE 44

ANTIVIRUS

slide-45
SLIDE 45

VIRUS_INSTALL=1

slide-46
SLIDE 46

AND EVEN WI-FI PROFILE

slide-47
SLIDE 47

BASEBAND RESEARCH

v Qualcomm Baseband fuzzing for vulnerabilities v EEPROM patching v JTAG RVERSE KIT (Medusa Box)

slide-48
SLIDE 48

NVRAM ¡(EEPROM)

slide-49
SLIDE 49

FUZZING = KILLING

slide-50
SLIDE 50

CENTRALIZED UPDATES

slide-51
SLIDE 51

CONCLUSION

v Software part is very insecure v Hardware part is also insecure(research is in progress) v All security of 3G/4G Huawei modems hangs on security of one Web-site, that works on IIS 6.0. Call/Ask Charlie for 0day exploit ;)

slide-52
SLIDE 52

THE END?