free software gsm protocol stacks - openbsc, osmosgsn
TRANSCRIPT
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
Free Software GSM protocol stacksOpenBSC, OsmoSGSN, OpenGGSN, OsmocomBB
Harald Welte
gnumonks.orggpl-violations.org
OpenBSCairprobe.org
hmw-consulting.de
ELCE 2010, October 2010, Cambridge/UK
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
Outline1 GSM/3G security
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
2 OpenBSCOpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
3 OsmocomBB ProjectOsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
4 SummaryWhat we’ve learnedWhere we go from hereWhere we go from hereFurther Reading
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
About the speaker
Using + playing with Linux since 1994Kernel / bootloader / driver / firmware development since1999IT security expert, focus on network protocol securityCore developer of Linux packet filter netfilter/iptablesBoard-level Electrical EngineeringAlways looking for interesting protocols (RFID, DECT,GSM)
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
GSM/3G protocol security
ObservationBoth GSM/3G and TCP/IP protocol specs are publiclyavailableThe Internet protocol stack (Ethernet/Wifi/TCP/IP) receiveslots of scrutinyGSM networks are as widely deployed as the InternetYet, GSM/3G protocols receive no such scrutiny!
There are reasons for that:GSM industry is extremely closed (and closed-minded)Only about 4 closed-source protocol stack implementationsGSM chipset makers never release any hardwaredocumentation
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
The closed GSM industryHandset manufacturing side
Only very few companies build GSM/3.5G baseband chipstoday
Those companies buy the operating system kernel and theprotocol stack from third parties
Only very few handset makers are large enough tobecome a customer
Even they only get limited access to hardwaredocumentationEven they never really get access to the firmware source
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
The closed GSM industryNetwork manufacturing side
Only very few companies build GSM network equipmentBasically only Ericsson, Nokia-Siemens, Alcatel-Lucent andHuaweiException: Small equipment manufacturers for picocell /nanocell / femtocells / measurement devices and lawenforcement equipment
Only operators buy equipment from themSince the quantities are low, the prices are extremely high
e.g. for a BTS, easily 10-40k EUR
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
The closed GSM industryOperator side
Operators are mainly banks todayTypical operator outsources
Network planning / deployment / servicingEven Billing!
Operator just knows the closed equipment as shipped bymanufacturerVery few people at an operator have knowledge of theprotocol beyond what’s needed for operations andmaintenance
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
GSM is more than phone calls
Listening to phone calls is boring...Machine-to-Machine (M2M) communication
BMW can unlock/open your car via GSMAlarm systems often report via GSMSmart Metering (Utility companies)GSM-R / European Train Control SystemVending machines report that their cash box is fullControl if wind-mills supply power into the gridTransaction numbers for electronic banking
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
The closed GSM industrySecurity implications
The security implications of the closed GSM industry are:Almost no people who have detailed technical knowledgeoutside the protocol stack or GSM network equipmentmanufacturersNo independent research on protocol-level security
If there’s security research at all, then only theoretical (likethe A5/2 and A5/1 cryptanalysis)Or on application level (e.g. mobile malware)
No open source protocol implementationswhich are key for making more people learn about theprotocolswhich enable quick prototyping/testing by modifying existingcode
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
The closed GSM industryMy self-proclaimed mission
Mission: Bring TCP/IP/Internet security knowledge to GSMCreate tools to enable independent/public IT Securitycommunity to examine GSMTry to close the estimated 10 year gap between the state ofsecurity technology on the Internet vs. GSM networks
Industry thinks in terms of walled garden and phonesbehaving like specifiedNo proper incident response strategies!No packet filters, firewalls, intrusion detection on GSMprotocol levelGeneral public assumes GSM networks are safer thanInternet
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
The closed GSM industryAreas of interest for Security research
Specification problemsEncryption optional, weak and only on the Um interfaceLack of mutual authenticationSilent calls for pin-pointing a phoneRRLP and SUPL to obtain GPS coordinates of phone
Implementation problemsTMSI information leak on network changeTLV parsers that have never seen invalid packetsObscure options in spec lead to rarely-tested/used codepaths
Operation problemsVLR overflow leading to paging-by-IMSITMSI re-allocation too infrequentNetworks/Cells without frequency hopping
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
Security analysis of GSMHow would you get started?
If you were to start with GSM protocol level security analysis,where and how would you start?
On the network side?Difficult since equipment is not easily available andnormally extremely expensiveHowever, network is very modular and has manystandardized/documented interfacesThus, if BTS equipment is available, much easier/fasterprogress
Result: Started project OpenBSC in 10/2008
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
Security analysis of GSMHow would you get started?
If you were to start with GSM protocol level security analysis,where and how would you start?
On the handset side?Difficult since GSM firmware and protocol stacks are closedand proprietaryEven if you want to write your own protocol stack, the layer1 hardware and signal processing is closed andundocumented, tooPublicly known attempts (12/2009)
The TSM30 project as part of the THC GSM projectmados, an alternative OS for Nokia DTC3 phones
none of those projects have been successfulResult: Started project OsmocomBB in 01/2010
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
Security analysis of GSMThe bootstrapping process
Start to read GSM specs (> 1000 PDF documents)Gradually grow knowledge about the protocolsObtain actual GSM network equipment (BTS)Try to get actual protocol traces as examplesStart a complete protocol stack implementation fromscratchFinally, go and play with GSM protocol security
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
The GSM network
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
GSM network components
The BSS (Base Station Subsystem)MS (Mobile Station): Your phoneBTS (Base Transceiver Station): The cell towerBSC (Base Station Controller): Controlling up to hundredsof BTS
The NSS (Network Sub System)MSC (Mobile Switching Center): The central switchHLR (Home Location Register): Database of subscribersAUC (Authentication Center): Database of authenticationkeysVLR (Visitor Location Register): For roaming usersEIR (Equipment Identity Register): To block stolen phones
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
GSM network interfaces
Um: Interface between MS and BTSthe only interface that is specified over radio
A-bis: Interface between BTS and BSCA: Interface between BSC and MSCB: Interface between MSC and other MSC
GSM networks are a prime example of an asymmetricdistributed network, very different from the end-to-endtransparent IP network.
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
GSM network protocolsOn the Um interface
Layer 1: Radio Layer, TS 04.04Layer 2: LAPDm, TS 04.06Layer 3: Radio Resource, Mobility Management, CallControl: TS 04.08Layer 4+: for USSD, SMS, LCS, ...
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
The closed GSM industrySecurity implicationsThe GSM networkThe GSM protocols
GSM network protocolsOn the A-bis interface
Layer 1: Typically E1 line, TS 08.54Layer 2: A variant of ISDN LAPD with fixed TEI’s, TS 08.56Layer 3: OML (Organization and Maintenance Layer, TS12.21)Layer 3: RSL (Radio Signalling Link, TS 08.58)Layer 4+: transparent messages that are sent to the MSvia Um
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC software
OpenBSC is a Open Source implementation of (not only) theBSC features of a GSM network.
Support A-bis interface over E1 and IPSupport for BTS vendor/model is modular, currentlySiemens BS-11 and ip.access nanoBTSMultiple BTS models/vendorrs can be mixed!Can work as a pure BSC or as a full network in a boxSupports mobility management, authentication, intra-BSChand-over, SMS, voice calls (FR/EFR/AMR)GPRS + EDGE support if combined with OsmoSGSN andOpenGGSN
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC
Supports Siemens BS-11 BTS (E1) and ip.accessnanoBTS (IP based)Has classic 2G signalling, voice and SMS supportImplements various GSM protocols like
A-bis RSL (TS 08.58) and OML (TS 12.21)TS 04.08 Radio Resource, Mobility Management, CallControlTS 04.11 Short Message Service
Telnet console with Cisco-style interface
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC software architecture
Implemented in pure C, similarities to Linux kernelLinked List handling, Timer API, coding style
Single-threaded event-loop / state machine designTelnet based command line interface Cisco-styleInput driver abstraction (mISDN, Abis-over-IP)
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC: GSM network protocolsThe A-bis interface
Layer 1 Typically E1 line, TS 08.54Layer 2 A variant of ISDN LAPD with fixed TEI’s, TS 08.56Layer 3 OML (Organization and Maintenance Layer, TS
12.21)Layer 3 RSL (Radio Signalling Link, TS 08.58)
Layer 4+ transparent messages that are sent to the MS via Um
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC: How it all started
In 2006, I bought a Siemens BS-11 microBTS on eBayThis is GSM900 BTS with 2 TRX at 2W output power (each)A 48kg monster with attached antenna200W power consumption, passive coolingE1 physical interface
I didn’t have much time at the time (day job at Openmoko)Started to read up on GSM specs whenever I couldBought a HFC-E1 based PCI E1 controller, has mISDNkernel supportFound somebody in the GSM industry who providedprotocol traces
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC: Timeline
November 2008: I started the development of OpenBSCDecember 2008: we did a first demo at 25C3January 2009: we had full voice call supportQ1/2009: Add support for ip.access nanoBTSJune 2009: I started with actual security related stuffAugust 2009: We had the first field test with 2BTS and >860 phonesQ1/2010: The first 25 OpenBSC instances running in acommercial network
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC: Field Test at HAR2009
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC in NITB modeNetwork In a Box Mode
The bsc_hack programimplements the A-bis interface towards any number of BTSprovides most typical features of a GSM network in onesoftwareno need for MSC, AuC, HLR, VLR, EIR, ...
HLR/VLR as SQLite3 tableAuthentication + Ciphering supportGSM voice calls, MO/MT SMSHand-over between all BTSMultiple Location Areas within one BSC
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC NITB features
OpenBSC NITB featuresRun a small GSM network with 1-n BTS and OpenBSCNo need for MSC/HLR/AUC/...No need for your own SIM cards (unless crypto/auth rqd)Establish signalling and voice channelsMake incoming and outgoing voice calls between phonesSend/receive SMS between phonesConnect to ISDN PBX or public ISDN via Linux Call Router
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC in NITB modeNetwork In a Box Mode
The bsc_hack programdoes not implement any other GSM interfaces apart fromA-bisno SS7 / TCAP / MAP based protocolsno integration (roaming) with existing traditional GSMnetworkswired telephony interfacing with ISDN PBX lcr (Linux CallRouter)Has been tested with up to 800 subscribers on 5 BTSIntended for R&D use or private PBX systems
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC LCR integrationInterfacing with wired telephony
OpenBSC (NITB mode) can be linked into Linux Call Router(lcr)
OpenBSC is compiled as libbsc.alibbsc.a includes full OpenBSC NITB mod codelinking the library into lcr results in GSM line interfaces tobecome available inside lcr
OpenBSC no longer takes care of call control, but simplyhands everything off to lcr
Dialling plan, etc. is now configure in lcr like for any otherwired phones
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenBSC in BSC-only mode
The osmo-bsc programbehaves like a classic GSM BSCuses SCCP-Lite (ip.access multipex) to any SoftMSC likeADCused in production/commercial deployments ( 75 BSCs)mainly intended to replace proprietary BSC in traditionalGSM networks
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
GPRS and OpenBSC
The BSC doesn’t really do anything related to GPRSGPRS implemented in separate SGSN and GGSN nodesGPRS uses its own Gb interface to RAN, independent ofA-bisOpenBSC can configure the nanoBTS for GPRS+EDGEsupport via OMLActual SGSN and GGSN implemented as OsmoSGSN andOpenGGSN programs
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OsmoSGSN
The Osmocom SGSN program implementsbasic/minimal SGSN functionalitythe Gb interface (NS/BSSGP/LLC/SNDCP)mobility management, session management
It’s a work in progress, many missing featuresno HLR integration yetno paging coordination with MSC/BSCno encryption support yet
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OpenBSC IntroductionOpenBSC Network In The BoxOpenBSC BSC-only modeOpenBSC GPRS support
OpenGGSN
GPL licensed Linux program implementing GGSN nodeImplements GTP-U protocol between SGSN and GGSNUser-configurable range/pool of IPv4 addresses for MSUses tun device for terminating IP tunnel from MSprovides GTP implementation as libgtpExperimental patches for IPv6 support
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
A GSM phone baseband processor
GSM protocol stack always runs in a so-called basebandprocessor (BP)What is the baseband processor
Typically ARM7 (2G/2.5G phones) or ARM9 (3G/3.5Gphones)
Runs some RTOS (often Nucleus, sometimes L4)No memory protection between tasks
Some kind of DSP, model depends on vendorRuns the digital signal processing for the RF Layer 1Has hardware peripherals for A5 encryption
The software stack on the baseband processoris written in C and assemblylacks any modern security features (stack protection,non-executable pages, address space randomization, ..)
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
A GSM Baseband Chipset
CALYPSODigital Baseband
DSPMCUSRAMMask ROMUART, SPI, I2C
TWL3025ABB
BSP
USP
TSP
BULBDL
AntennaSwitch
ASM4532
TRF6151
TransceiverMixersVCOPLL
RF3166
RF PA
TSP
GSM
DCS/PCS
GSM
DCS
PCS
RFCLK
I/Q Analog
CLK13M
AFC Analog
TSP Parallel
TSP Serial
CLK32K
GS
M
DC
S/PC
S
APC Analog
I/Q Digital
SPI
http://laforge.gnumonks.org/papers/gsm_phone-anatomy-latest.pdf
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
Requirements for GSM security analysis
What do we need for protocol-level security analysis?A GSM MS-side baseband chipset under our controlA Layer1 that we can use to generate arbitrary L1 framesA Layer2 protocol implementation that we can use + modifyA Layer3 protocol implementation that we can use + modify
None of those components existed, so we need to create them!
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
A GSM baseband under our control
The two different DIY approachesBuild something using generic components (DSP, CPU,ADC, FPGA)
No reverse engineering requiredA lot of work in hardware design + debuggingHardware will be low-quantity and thus expensive
Build something using existing baseband chipsetReverse engineering or leaked documents requiredLess work on the ’Layer 0’Still, custom hardware in low quantity
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
A GSM baseband under our control
Alternative ’lazy’ approachRe-purpose existing mobile phone
Hardware is known to be workingNo prototyping, hardware revisions, etc.Reverse engineering requiredHardware drivers need to be writtenBut: More time to focus on the actual job: Protocol software
Searching for suitable phonesAs cheap as possibleReadily available: Many people can play with itAs old/simple as possible to keep complexity lowBaseband chipset with lots of leaked information
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
Baseband chips with leaked information
Texas Instruments CalypsoDBB Documentation on cryptome.org and other sitesABB Documentation on Chinese phone developer websitesSource code of GSM stack / drivers was on sf.net (tsm30project)End of life, no new phones with Calypso since about 2008No cryptographic checks in bootloader
Mediatek MT622x chipsetsLots of Documentation on Chinese sitesSDK with binary-only GSM stack libraries on Chinese sites95 million produced/sold in Q1/2010
Initial choice: TI Calypso (GSM stack source available)
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
OsmocomBB Introduction
Project was started only in January 2010 (9 months ago!)Implementing a GSM baseband software from scratchThis includes
GSM MS-side protocol stack from Layer 1 through Layer 3Hardware drivers for GSM Baseband chipsetSimple User Interface on the phone itselfVerbose User Interface on the PC
Note about the strange project nameOsmocom = Open Source MObile COMmunicationBB = Base Band
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
OsmocomBB Software Architecture
Reuse code from OpenBSC where possible (libosmocore)We build libosmocore both for phone firmware and PC
Initially run as little software in the phoneDebugging code on your host PC is so much easierYou have much more screen real-estateHardware drivers and Layer1 run in the phoneLayer2, 3 and actual phone application / MMI on PCLater, L2 and L3 can me moved to the phone
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
OsmocomBB Software Interfaces
Interface between Layer1 and Layer2 called L1CTLFully custom protocol as there is no standardImplemented as message based protocol overSercomm/HDLC/RS232
Interface between Layer2 and Layer3 called RSLmsIn the GSM network, Um Layer2 terminates at the BTS butis controlled by the BSCReuse this GSM 08.58 Radio Signalling LinkExtend it where needed for the MS case
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
OsmocomBB Target Firmware
Firmware includes software likeDrivers for the Ti Calypso Digital Baseband (DBB)Drivers for the Ti Iota TWL3025 Analog Baseband (ABB)Drivers for the Ti Rita TRF6151 RF TransceiverDrivers for the LCD/LCM of a number of phonesCFI flash driver for NOR flashGSM Layer1 synchronous/asynchronous partSercomm - A HDLC based multiplexer for the RS232 tohost PC
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
OsmocomBB Host Software
Current working name: layer23Includes
Layer 1 Control (L1CTL) protocol APIGSM Layer2 implementation (LAPDm)GSM Layer3 implementation (RR/MM/CC)GSM Cell (re)selectionSIM Card emulationSupports various ’apps’ depending on purpose
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
OsmocomBB Supported Hardware
Baseband ChipsetsTI Calypso/Iota/RitaSome early research being done on Mediatek (MTK)MT622x
Actual PhonesCompal/Motorola C11x, C12x, C13x, C14x and C15xmodelsMost development/testing on C123 and C155GSM modem part of Openmoko Neo1973 and Freerunner
All those phones are simple feature phones built on aARM7TDMI based DBB
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
The Motorola/Compal C123
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
OsmocomBB Project Status: Working
Hardware Drivers for Calypso/Iota/Rita very completeDrivers for Audio/Voice signal pathLayer1
Power measurementsCarrier/bit/TDMA synchronizationReceive and transmit of normal bursts on SDCCHTransmit of RACH burstsAutomatic Rx gain control (AGC)Frequency Hopping
Layer2 UI/SABM/UA frames and ABM modeLayer3 Messages for RR / MM / CCCell (re)selection according GSM 03.22
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
OsmocomBB Project Status: Working (2/2)
OsmocomBB can now do GSM Voice calls (08/2010)Very Early Assignment + Late AssignmentA3/A8 Authentication of SIMA5/1 + A5/2 EncryptionFull Rate (FR) and Enhanced Full Rate (EFR) codec
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
OsmocomBB Project Status: Not working
Fully-fledged SIM card reader inside phone (WIP)Layer1
Automatic Tx power control (APC)Neighbor Cell MeasurementsIn-call hand-over to other cells
Actual UI on the phoneCircuit Switched Data (CSD) callsGPRS (packet data)No Type Approval for the stack!
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
OsmocomBB IntroductionOsmocomBB SoftwareOsmocomBB Hardware SupportOsmocomBB Project Status
OsmocomBB Project Status: Executive Summary
We can establish control/signalling channels to bothhopping and non-hopping GSM cells
Control over synthesizer means we can even go to GSM-Rband
We can send arbitrary data on those control channelsRR messages to BSCMM/CC messages to MSCSMS messages to MSC/SMSC
TCH (Traffic Channel) support for voice callsDieter Spaar and Andreas Eversberg have made multiple20 minute call with current master branchSome people have tried alpha code on real networks forreal 30+ minute calls!
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
What we’ve learnedWhere we go from hereWhere we go from hereFurther Reading
SummaryWhat we’ve learned
The GSM industry is making security analysis very difficultIt is well-known that the security level of the GSM stacks isvery lowWe now have multiple solutions for sending arbitraryprotocol data
From a rogue network to phones (OpenBSC, OpenBTS)Frem a FOSS controlled phone to the network(OsmocomBB)From an A-bis proxy to the network or the phones
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
What we’ve learnedWhere we go from hereWhere we go from hereFurther Reading
TODOWhere we go from here
The tools for fuzzing mobile phone protocol stacks areavailableIt is up to the security community to make use of thosetools (!)Don’t you too think that TCP/IP security is boring?Join the GSM protocol security research projectsBoldly go where no man has gone before
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
What we’ve learnedWhere we go from hereWhere we go from hereFurther Reading
Current Areas of Work / Future plans
UMTS(3G) support for NodeB and femtocellsSS7 / MAP integrationPlaying with SIM Toolkit from the operator sidePlaying with MMSMore exploration of RRLP + SUPL
Harald Welte Free Software GSM protocol stacks
GSM/3G securityOpenBSC
OsmocomBB ProjectSummary
What we’ve learnedWhere we go from hereWhere we go from hereFurther Reading
Further Reading
http://laforge.gnumonks.org/papers/gsm_phone-anatomy-latest.pdf
http://bb.osmocom.org/
http://openbsc.gnumonks.org/
http://openbts.sourceforge.net/
http://airprobe.org/
Harald Welte Free Software GSM protocol stacks