Tools of the Trade Cellular Pentesting · 2017-01-15 · 1 Tools of the Trade –Cellular...
14
1 Tools of the Trade – Cellular Pentesting Hendrik Schmidt <[email protected]> Brian Butterly <[email protected]>
Transcript of Tools of the Trade Cellular Pentesting · 2017-01-15 · 1 Tools of the Trade –Cellular...
1
Tools of the Trade – Cellular Pentesting
Hendrik Schmidt <[email protected]>
Brian Butterly <[email protected]>
2
Cellular Networks
o Connecting $mobile_devices which each othero Internet of Things (EGSM, LTM-M)
o Automotive Systems
o Industry 4.0
o Using Services aso Voice
o Data
o Messaging
o OTA Updates
3
The Goal?
o Simulating a real world environment / a provider
o Interception of mobile data
o Raw Data Access Open Source?
o Portable
o Monitoring Capabilitieso Wireshark?
What, we are building our own Stingray?
4
Toolso GSM
¬ phone: osmocomBB
¬ network: openBSC, osmoBTS, openBTS, gr-gsm
o UMTS¬ phone: xgoldmon
¬ network: openBTS-UMTS
o LTE¬ phone: Samsung Kalmia, SnoopSnitch
¬ network: Amarisoft, openLTE, srsLTE, OpenAirInterface
5
OsmoBTS OpenBSC
HLR
SimpleHLR
SMPP
Asterisk
SIP-GW
Osmo-SIP
SMS
Voice
Dizzy
OpenSGSN OpenGGSN
Internet
6
Why is this Working?
o Mobile Connection depends ono MCC / MNC (Roaming SIM?)
o Encryption Keys
Can be ignored when using A5/0
o APN
o SMSC-Number
o Limitationso GPRS/EDGE (UMTS available soon)
o Restricted APNs
7
(Brief) Cell Selection
1. Build Cell Selection Table
2. Read Last Cell from SIM
3. Select Home Network (best/loudest)
4. Select Roaming Network (best/loudest)
Challenges:
o Cell Fixation
o Higher privileged networks (LTE)
Jamming
8
Data Interception
(eliminating the magic)
o GPRS Data Access
o “Common” Pentest Methodology
o Identification of running services
o Eavesdropping & Encryption Tests
o Man-in-the-Middle of Communication
o Ever used a M2M SIM for free Internet?
9
Voice Interception
o Intercepting Calls like a Full-MitM-IMSI-Catcher
o Testing implemented Security Measures (Authentication/Encryption)
o Emergency Calls
o SIP based Uplink to PSTN
o Ever used a M2M SIM for free calls?
10
Short Messaging Service
o SMS PDU Attacks
o SMS UDH Attacks
o Application access via SMS
o OTA Updates via (8-bit) binary Datao Depends on PID/DCS
o Data Forward to SIM
o Ever used a M2M SIM for free SMS?
11
o TP-DCS:o GSM 7-Bito 8-Bit Datao UCS-2o Message Class
o TP-PIDo Forward SMo Data Download (125)o U(SIM) Data Download (127)o … and more
o Furthermore o UDHIo Status-Reportso Tracing
The Python Codedef send_message(destaddr, dcs, pid, message):
print 'Sending SMS "%s" to %s' % (string,dest) pdu = client.send_message(
source_addr_ton=smpplib.consts.SMPP_TON_INTL,source_addr_npi=smpplib.consts.SMPP_NPI_ISDN, source_addr='1001', dest_addr_ton=smpplib.consts.SMPP_TON_INTL,dest_addr_npi=smpplib.consts.SMPP_NPI_ISDN,destination_addr=destaddr, data_coding=dcs, protocol_id=pid, esm_class=smpplib.consts.SMPP_GSMFEAT_UDHI, short_message=message, registered_delivery=False,
) print(pdu.sequence)
12
Radio Layer Access
o Testing Security of BaseBand & Configuration
o Authentication/Encryption
o RAW PDU Access enables us to do targeted Fuzzing
13
Demo!
14
Conclusion
o Build an Full-MitM IMSI Catcher with (mostly) Open Source Tools
o Whitehat vs. Blackhat
o Code Access and Interfaces to send Raw Data
o What can you do to avoid connecting to my fake cell?
o Quite nothing, watch out for signs on your phone. It’s up to the standards and their implementations
![Reflections - ernw.de€¦ · Reflections on Vulnerability Disclosure Case Studies & Ethical Dilemmas by Enno Rey [erey@ernw.de] at ACM SigComm2015 Workshop on Ethics in Networked](https://static.fdocuments.us/doc/165x107/5f6dc208a35d7a661c40e5fd/reflections-ernwde-reflections-on-vulnerability-disclosure-case-studies-.jpg)
