Base Jumping - Attacking the GSM BB and BTS - grugq,...
Transcript of Base Jumping - Attacking the GSM BB and BTS - grugq,...
![Page 1: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/1.jpg)
Base Jumping
Attacking the GSM baseband and base station
Thursday, 14 October 2010
![Page 2: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/2.jpg)
Overview
❖GSM❖Base Station❖Base Band❖Conclusion
2
Thursday, 14 October 2010
![Page 3: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/3.jpg)
GSM: The Protocol
3
Thursday, 14 October 2010
![Page 4: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/4.jpg)
Documents
4
❖Dozens of docs❖Thousands of pages❖Important one (defines L3)
❖GSM 04 08
Thursday, 14 October 2010
![Page 5: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/5.jpg)
5
Thursday, 14 October 2010
![Page 6: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/6.jpg)
6
Thursday, 14 October 2010
![Page 7: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/7.jpg)
7
Logical Channels
Broadcast Channels (BCH) Broadcast Control Channel (BCCH) Frequency Correction Channel (FCCH) Synchronization Channel (SCH) Cell Broadcast Channel (CBCH)
Thursday, 14 October 2010
![Page 8: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/8.jpg)
Logical Channels, cont.❖ Common Control Channels (CCCH) Paging Channel (PCH) Random Access Channel (RACH) Access Grant Channel (AGCH)
8
Thursday, 14 October 2010
![Page 9: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/9.jpg)
Logical Channels, cont.
Standalone Dedicated Control Channel (SDCCH) Associated Control Channel (ACCH) Fast Associated Control Channel (FACCH) Slow Associated Control Channel (SACCH)
9
Thursday, 14 October 2010
![Page 10: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/10.jpg)
GSM Channels
10
❖Opening a channel is slow❖Can take seconds
❖Specific channels for specific uses
Thursday, 14 October 2010
![Page 11: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/11.jpg)
Opening a channel
11
Thursday, 14 October 2010
![Page 12: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/12.jpg)
12
Thursday, 14 October 2010
![Page 13: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/13.jpg)
12
RACH
Thursday, 14 October 2010
![Page 14: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/14.jpg)
12
RACH
AGCH
Thursday, 14 October 2010
![Page 15: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/15.jpg)
12
RACH
AGCH
LCH
Thursday, 14 October 2010
![Page 16: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/16.jpg)
13
Thursday, 14 October 2010
![Page 17: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/17.jpg)
13
PCH
Thursday, 14 October 2010
![Page 18: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/18.jpg)
13
RACH
PCH
Thursday, 14 October 2010
![Page 19: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/19.jpg)
13
RACH
PCH
AGCH
Thursday, 14 October 2010
![Page 20: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/20.jpg)
13
RACH
PCH
AGCH
LCH
Thursday, 14 October 2010
![Page 21: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/21.jpg)
14
MS
BTS
BTSBSCMSC
ARFCN
Thursday, 14 October 2010
![Page 22: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/22.jpg)
15
Base Transceiver StationBTS
Base StationController
BSC
Mobile StationController
MSC
Mobile StationMS
Base Station Sub-SystemBSS
Thursday, 14 October 2010
![Page 23: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/23.jpg)
16
MSBSSMSCHLR
VLR
Thursday, 14 October 2010
![Page 24: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/24.jpg)
Mobile Identifiers
17
Thursday, 14 October 2010
![Page 25: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/25.jpg)
18
Thursday, 14 October 2010
![Page 26: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/26.jpg)
18
IMSI
Thursday, 14 October 2010
![Page 27: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/27.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 28: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/28.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 29: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/29.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 30: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/30.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 31: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/31.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 32: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/32.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 33: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/33.jpg)
GSM Attacks
19
Thursday, 14 October 2010
![Page 34: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/34.jpg)
20
Thursday, 14 October 2010
![Page 35: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/35.jpg)
RACHell
21
❖Request channel allocation❖Flood the BSS with requests❖First announced by Dieter Spaar at DeepSec
❖Prevent everyone from using that cell
Thursday, 14 October 2010
![Page 36: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/36.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 37: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/37.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 38: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/38.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 39: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/39.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 40: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/40.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 41: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/41.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 42: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/42.jpg)
22
?
RACHell
Thursday, 14 October 2010
![Page 43: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/43.jpg)
23
Thursday, 14 October 2010
![Page 44: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/44.jpg)
23
Our Target
Thursday, 14 October 2010
![Page 45: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/45.jpg)
Demo - RACHell
24
Thursday, 14 October 2010
![Page 46: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/46.jpg)
IMSI Flood
❖Send IMSI ATTACH messages❖pre-authentication❖Overload the HLR/VLR infrastructure❖Prevent everyone using the network
25
Thursday, 14 October 2010
![Page 47: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/47.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 48: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/48.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 49: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/49.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 50: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/50.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 51: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/51.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 52: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/52.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 53: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/53.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 54: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/54.jpg)
IMSI DETACH
❖Send multiple Location Update Requests including a spoofed IMSI❖Unauthenticated
❖Prevent SIM from receiving calls and SMS
❖Discovered by Sylvain Munaut
27
Thursday, 14 October 2010
![Page 55: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/55.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 56: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/56.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 57: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/57.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 58: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/58.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 59: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/59.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 60: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/60.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 61: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/61.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 62: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/62.jpg)
How hard to get an IMSI?
29
Thursday, 14 October 2010
![Page 63: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/63.jpg)
Baseband Fuzzing
30
Thursday, 14 October 2010
![Page 64: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/64.jpg)
31
=+
How to make a smartphone
Thursday, 14 October 2010
![Page 65: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/65.jpg)
32
Two separate computers
Thursday, 14 October 2010
![Page 66: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/66.jpg)
32
Two separate computers
Thursday, 14 October 2010
![Page 67: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/67.jpg)
33
Baseband
❖Controls the radio❖Separate CPU and code base❖RTOS❖Written in C❖Typically legacy code base (decades)
Thursday, 14 October 2010
![Page 68: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/68.jpg)
GSM Frame Delivery
❖OpenBTS + XML-RPC❖ lch_open(char * IMSI)❖ lch_send(int fd, char *buf, size_t len)❖ lch_recv(int fd, char *buf, size_t len)❖ lch_close(int fd)
34
Thursday, 14 October 2010
![Page 69: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/69.jpg)
GSM Fuzzing Framework
❖USRP + OpenBTS for delivery❖GSM900 band❖BugMine case generation & mutation❖No Instrumentation
❖Very bad visibility on bugs
35
Thursday, 14 October 2010
![Page 70: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/70.jpg)
Coseinc GSM FuzzFarm❖Targetting
❖ iPhone❖HTC (Android)❖Palm Pre❖Blackberry❖Nokia
36
Thursday, 14 October 2010
![Page 71: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/71.jpg)
37
Thursday, 14 October 2010
![Page 72: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/72.jpg)
38
Thursday, 14 October 2010
![Page 73: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/73.jpg)
Conclusion
39
Thursday, 14 October 2010
![Page 74: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/74.jpg)
GSM Trouble
40
❖GSM is no longer a walled garden❖GSM spec has security problems❖Expect many more issues as OSS reduces costs for entry
Thursday, 14 October 2010
![Page 75: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/75.jpg)
Future work
❖More GSM stack fuzzing❖Next gen protocol stacks
41
Thursday, 14 October 2010
![Page 76: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/76.jpg)
42
Thanks to
Harald Welte, Osmocom-bb & OpenBTS
Thursday, 14 October 2010
![Page 77: Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)](https://reader031.fdocuments.us/reader031/viewer/2022020315/5aa675f37f8b9a1d728e747b/html5/thumbnails/77.jpg)
Questions?
43
Thursday, 14 October 2010