❖Dozens of docs❖Thousands of pages❖Important one (defines L3)
❖GSM 04 08
Thursday, 14 October 2010
5
Thursday, 14 October 2010
6
Thursday, 14 October 2010
7
Logical Channels
Broadcast Channels (BCH) Broadcast Control Channel (BCCH) Frequency Correction Channel (FCCH) Synchronization Channel (SCH) Cell Broadcast Channel (CBCH)
Thursday, 14 October 2010
Logical Channels, cont.❖ Common Control Channels (CCCH) Paging Channel (PCH) Random Access Channel (RACH) Access Grant Channel (AGCH)
8
Thursday, 14 October 2010
Logical Channels, cont.
Standalone Dedicated Control Channel (SDCCH) Associated Control Channel (ACCH) Fast Associated Control Channel (FACCH) Slow Associated Control Channel (SACCH)
9
Thursday, 14 October 2010
GSM Channels
10
❖Opening a channel is slow❖Can take seconds
❖Specific channels for specific uses
Thursday, 14 October 2010
Opening a channel
11
Thursday, 14 October 2010
12
Thursday, 14 October 2010
12
RACH
Thursday, 14 October 2010
12
RACH
AGCH
Thursday, 14 October 2010
12
RACH
AGCH
LCH
Thursday, 14 October 2010
13
Thursday, 14 October 2010
13
PCH
Thursday, 14 October 2010
13
RACH
PCH
Thursday, 14 October 2010
13
RACH
PCH
AGCH
Thursday, 14 October 2010
13
RACH
PCH
AGCH
LCH
Thursday, 14 October 2010
14
MS
BTS
BTSBSCMSC
ARFCN
Thursday, 14 October 2010
15
Base Transceiver StationBTS
Base StationController
BSC
Mobile StationController
MSC
Mobile StationMS
Base Station Sub-SystemBSS
Thursday, 14 October 2010
16
MSBSSMSCHLR
VLR
Thursday, 14 October 2010
Mobile Identifiers
17
Thursday, 14 October 2010
18
Thursday, 14 October 2010
18
IMSI
Thursday, 14 October 2010
18
IMSI
IMEI
Thursday, 14 October 2010
18
IMSI
IMEI
Thursday, 14 October 2010
18
IMSI
IMEI
Thursday, 14 October 2010
18
IMSI
IMEI
Thursday, 14 October 2010
18
IMSI
IMEI
Thursday, 14 October 2010
18
IMSI
IMEI
Thursday, 14 October 2010
GSM Attacks
19
Thursday, 14 October 2010
20
Thursday, 14 October 2010
RACHell
21
❖Request channel allocation❖Flood the BSS with requests❖First announced by Dieter Spaar at DeepSec
❖Prevent everyone from using that cell
Thursday, 14 October 2010
22
RACHell
Thursday, 14 October 2010
22
RACHell
Thursday, 14 October 2010
22
RACHell
Thursday, 14 October 2010
22
RACHell
Thursday, 14 October 2010
22
RACHell
Thursday, 14 October 2010
22
RACHell
Thursday, 14 October 2010
22
?
RACHell
Thursday, 14 October 2010
23
Thursday, 14 October 2010
23
Our Target
Thursday, 14 October 2010
Demo - RACHell
24
Thursday, 14 October 2010
IMSI Flood
❖Send IMSI ATTACH messages❖pre-authentication❖Overload the HLR/VLR infrastructure❖Prevent everyone using the network
25
Thursday, 14 October 2010
26
IMSI Flood
Thursday, 14 October 2010
26
IMSI Flood
Thursday, 14 October 2010
26
IMSI Flood
Thursday, 14 October 2010
26
IMSI Flood
Thursday, 14 October 2010
26
IMSI Flood
Thursday, 14 October 2010
26
IMSI Flood
Thursday, 14 October 2010
26
IMSI Flood
Thursday, 14 October 2010
IMSI DETACH
❖Send multiple Location Update Requests including a spoofed IMSI❖Unauthenticated
❖Prevent SIM from receiving calls and SMS
❖Discovered by Sylvain Munaut
27
Thursday, 14 October 2010
28
IMSI DETACH
Thursday, 14 October 2010
28
IMSI DETACH
Thursday, 14 October 2010
28
IMSI DETACH
Thursday, 14 October 2010
28
IMSI DETACH
Thursday, 14 October 2010
28
IMSI DETACH
Thursday, 14 October 2010
28
IMSI DETACH
Thursday, 14 October 2010
28
IMSI DETACH
Thursday, 14 October 2010
How hard to get an IMSI?
29
Thursday, 14 October 2010
Baseband Fuzzing
30
Thursday, 14 October 2010
31
=+
How to make a smartphone
Thursday, 14 October 2010
32
Two separate computers
Thursday, 14 October 2010
32
Two separate computers
Thursday, 14 October 2010
33
Baseband
❖Controls the radio❖Separate CPU and code base❖RTOS❖Written in C❖Typically legacy code base (decades)