D2T1 - The Grugq - Attacking GSM Basestations
-
Upload
hlias-alafogiannis -
Category
Documents
-
view
61 -
download
2
Transcript of D2T1 - The Grugq - Attacking GSM Basestations
![Page 1: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/1.jpg)
Base Jumping
Attacking the GSM baseband and base station
Thursday, 14 October 2010
![Page 2: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/2.jpg)
Overview
❖GSM❖Base Station❖Base Band❖Conclusion
2
Thursday, 14 October 2010
![Page 3: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/3.jpg)
GSM: The Protocol
3
Thursday, 14 October 2010
![Page 4: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/4.jpg)
Documents
4
❖Dozens of docs❖Thousands of pages❖Important one (defines L3)
❖GSM 04 08
Thursday, 14 October 2010
![Page 5: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/5.jpg)
5
Thursday, 14 October 2010
![Page 6: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/6.jpg)
6
Thursday, 14 October 2010
![Page 7: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/7.jpg)
7
Logical Channels
Broadcast Channels (BCH) Broadcast Control Channel (BCCH) Frequency Correction Channel (FCCH) Synchronization Channel (SCH) Cell Broadcast Channel (CBCH)
Thursday, 14 October 2010
![Page 8: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/8.jpg)
Logical Channels, cont.❖ Common Control Channels (CCCH) Paging Channel (PCH) Random Access Channel (RACH) Access Grant Channel (AGCH)
8
Thursday, 14 October 2010
![Page 9: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/9.jpg)
Logical Channels, cont.
Standalone Dedicated Control Channel (SDCCH) Associated Control Channel (ACCH) Fast Associated Control Channel (FACCH) Slow Associated Control Channel (SACCH)
9
Thursday, 14 October 2010
![Page 10: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/10.jpg)
GSM Channels
10
❖Opening a channel is slow❖Can take seconds
❖Specific channels for specific uses
Thursday, 14 October 2010
![Page 11: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/11.jpg)
Opening a channel
11
Thursday, 14 October 2010
![Page 12: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/12.jpg)
12
Thursday, 14 October 2010
![Page 13: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/13.jpg)
12
RACH
Thursday, 14 October 2010
![Page 14: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/14.jpg)
12
RACH
AGCH
Thursday, 14 October 2010
![Page 15: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/15.jpg)
12
RACH
AGCH
LCH
Thursday, 14 October 2010
![Page 16: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/16.jpg)
13
Thursday, 14 October 2010
![Page 17: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/17.jpg)
13
PCH
Thursday, 14 October 2010
![Page 18: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/18.jpg)
13
RACH
PCH
Thursday, 14 October 2010
![Page 19: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/19.jpg)
13
RACH
PCH
AGCH
Thursday, 14 October 2010
![Page 20: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/20.jpg)
13
RACH
PCH
AGCH
LCH
Thursday, 14 October 2010
![Page 21: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/21.jpg)
14
MS
BTS
BTSBSCMSC
ARFCN
Thursday, 14 October 2010
![Page 22: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/22.jpg)
15
Base Transceiver StationBTS
Base StationController
BSC
Mobile StationController
MSC
Mobile StationMS
Base Station Sub-SystemBSS
Thursday, 14 October 2010
![Page 23: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/23.jpg)
16
MSBSSMSCHLR
VLR
Thursday, 14 October 2010
![Page 24: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/24.jpg)
Mobile Identifiers
17
Thursday, 14 October 2010
![Page 25: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/25.jpg)
18
Thursday, 14 October 2010
![Page 26: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/26.jpg)
18
IMSI
Thursday, 14 October 2010
![Page 27: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/27.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 28: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/28.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 29: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/29.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 30: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/30.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 31: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/31.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 32: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/32.jpg)
18
IMSI
IMEI
Thursday, 14 October 2010
![Page 33: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/33.jpg)
GSM Attacks
19
Thursday, 14 October 2010
![Page 34: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/34.jpg)
20
Thursday, 14 October 2010
![Page 35: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/35.jpg)
RACHell
21
❖Request channel allocation❖Flood the BSS with requests❖First announced by Dieter Spaar at DeepSec
❖Prevent everyone from using that cell
Thursday, 14 October 2010
![Page 36: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/36.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 37: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/37.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 38: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/38.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 39: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/39.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 40: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/40.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 41: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/41.jpg)
22
RACHell
Thursday, 14 October 2010
![Page 42: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/42.jpg)
22
?
RACHell
Thursday, 14 October 2010
![Page 43: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/43.jpg)
23
Thursday, 14 October 2010
![Page 44: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/44.jpg)
23
Our Target
Thursday, 14 October 2010
![Page 45: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/45.jpg)
Demo - RACHell
24
Thursday, 14 October 2010
![Page 46: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/46.jpg)
IMSI Flood
❖Send IMSI ATTACH messages❖pre-authentication❖Overload the HLR/VLR infrastructure❖Prevent everyone using the network
25
Thursday, 14 October 2010
![Page 47: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/47.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 48: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/48.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 49: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/49.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 50: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/50.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 51: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/51.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 52: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/52.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 53: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/53.jpg)
26
IMSI Flood
Thursday, 14 October 2010
![Page 54: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/54.jpg)
IMSI DETACH
❖Send multiple Location Update Requests including a spoofed IMSI❖Unauthenticated
❖Prevent SIM from receiving calls and SMS
❖Discovered by Sylvain Munaut
27
Thursday, 14 October 2010
![Page 55: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/55.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 56: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/56.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 57: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/57.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 58: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/58.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 59: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/59.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 60: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/60.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 61: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/61.jpg)
28
IMSI DETACH
Thursday, 14 October 2010
![Page 62: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/62.jpg)
How hard to get an IMSI?
29
Thursday, 14 October 2010
![Page 63: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/63.jpg)
Baseband Fuzzing
30
Thursday, 14 October 2010
![Page 64: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/64.jpg)
31
=+
How to make a smartphone
Thursday, 14 October 2010
![Page 65: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/65.jpg)
32
Two separate computers
Thursday, 14 October 2010
![Page 66: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/66.jpg)
32
Two separate computers
Thursday, 14 October 2010
![Page 67: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/67.jpg)
33
Baseband
❖Controls the radio❖Separate CPU and code base❖RTOS❖Written in C❖Typically legacy code base (decades)
Thursday, 14 October 2010
![Page 68: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/68.jpg)
GSM Frame Delivery
❖OpenBTS + XML-RPC❖ lch_open(char * IMSI)❖ lch_send(int fd, char *buf, size_t len)❖ lch_recv(int fd, char *buf, size_t len)❖ lch_close(int fd)
34
Thursday, 14 October 2010
![Page 69: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/69.jpg)
GSM Fuzzing Framework
❖USRP + OpenBTS for delivery❖GSM900 band❖BugMine case generation & mutation❖No Instrumentation
❖Very bad visibility on bugs
35
Thursday, 14 October 2010
![Page 70: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/70.jpg)
Coseinc GSM FuzzFarm❖Targetting
❖ iPhone❖HTC (Android)❖Palm Pre❖Blackberry❖Nokia
36
Thursday, 14 October 2010
![Page 71: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/71.jpg)
37
Thursday, 14 October 2010
![Page 72: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/72.jpg)
38
Thursday, 14 October 2010
![Page 73: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/73.jpg)
Conclusion
39
Thursday, 14 October 2010
![Page 74: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/74.jpg)
GSM Trouble
40
❖GSM is no longer a walled garden❖GSM spec has security problems❖Expect many more issues as OSS reduces costs for entry
Thursday, 14 October 2010
![Page 75: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/75.jpg)
Future work
❖More GSM stack fuzzing❖Next gen protocol stacks
41
Thursday, 14 October 2010
![Page 76: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/76.jpg)
42
Thanks to
Harald Welte, Osmocom-bb & OpenBTS
Thursday, 14 October 2010
![Page 77: D2T1 - The Grugq - Attacking GSM Basestations](https://reader033.fdocuments.us/reader033/viewer/2022051413/554009a74a795919088b4921/html5/thumbnails/77.jpg)
Questions?
43
Thursday, 14 October 2010