base jumping - github pages...base jumping attacking the gsm baseband and base station...

Base Jumping

Attacking the GSM baseband and base station

[email protected]

Tuesday, 20 July 2010

mailto:[email protected]

mailto:[email protected]

Overview

❖GSM❖Base Station❖Base Band❖Conclusion

2


GSM: The Protocol

3


Documents

4

❖Dozens of docs❖Thousands of pages❖Important one (defines L3)

❖GSM 04 08


5


6


7

Logical Channels

Broadcast Channels (BCH) Broadcast Control Channel (BCCH) Frequency Correction Channel (FCCH) Synchronization Channel (SCH) Cell Broadcast Channel (CBCH)


Logical Channels, cont.❖ Common Control Channels (CCCH) Paging Channel (PCH) Random Access Channel (RACH) Access Grant Channel (AGCH)

8


Logical Channels, cont.

Standalone Dedicated Control Channel (SDCCH) Associated Control Channel (ACCH) Fast Associated Control Channel (FACCH) Slow Associated Control Channel (SACCH)

9


GSM Channels

10

❖Opening a channel is slow❖Can take seconds

❖Specific channels for specific uses


Opening a channel

11


12


12

RACH


12

RACH

AGCH


12

RACH

AGCH

LCH


13


13

PCH


13

RACH

PCH


13

RACH

PCH

AGCH


13

RACH

PCH

AGCH

LCH


14

MS

BTS

BTSBSCMSC

ARFCN


15

Base Transceiver StationBTS

Base StationController

BSC

Mobile StationController

MSC

Mobile StationMS

Base Station Sub-SystemBSS


16

MSBSSMSCHLR

VLR


Mobile Identifiers

17


18


18

IMSI


18

IMSI

IMEI


GSM Attacks

19


20


RACHell

21

❖Request channel allocation❖Flood the BSS with requests❖First announced by Dieter Spaar at DeepSec

❖Prevent everyone from using that cell


22

RACHell


22

?

RACHell


23


23

Our Target


Demo - RACHell

24


IMSI Flood

❖Send IMSI ATTACH messages❖pre-authentication❖Overload the HLR/VLR infrastructure❖Prevent everyone using the network

25


26

IMSI Flood


How hard to get an IMSI?

27


IMSI DETACH

❖Send multiple Location Update Requests including a spoofed IMSI❖Unauthenticated

❖Prevent SIM from receiving calls and SMS

❖Discovered by Sylvain Munaut

28


29

IMSI DETACH


Baseband Fuzzing

30


31

=+

How to make a smartphone


32

Two separate computers


33

Baseband

❖Controls the radio❖Separate CPU and code base❖RTOS❖Written in C❖Typically legacy code base (decades)


Coseinc GSM FuzzFarm❖OpenBTS based fuzzer delivery engine

❖Targetting❖ iPhone❖HTC (Android)❖Palm Pre❖Blackberry❖Nokia

34


35


Conclusion

36


GSM Trouble

37

❖GSM is no longer a walled garden❖GSM spec has security problems❖Expect many more issues as OSS reduces costs for entry


Future work

❖More GSM stack fuzzing❖Next gen protocol stacks

38


39

Thanks to

Harald Walte, Osmocom-bb & OpenBTS


Questions?

40
