An OpenBTS GSM Replication Jail for Mobile Malware · 2011-10-12 · An OpenBTS GSM Replication Jail for Mobile Malware Axelle Apvrille Virus Bulletin Conference, October 2011

An OpenBTS GSM Replication Jail for

Mobile Malware

Axelle Apvrille

Virus Bulletin Conference, October 2011

Malware Jail

Thou Shalt Not Spread (Nor Leak)

VirusBulletin Conference 2011 - A. Apvrille 2/11

Malware Jail



Malware Jail



Malware Jail



Malware Jail



Malware Jail



Malware Jail



Malware Jail



Malware Jail



Jail 1. Remove SIM/ O�ine/ Flight mode

I Secure... probably

I Behaviour: changed!

Malware Name Online O�ine

SymbOS/Album Sends 2 SMS -SymbOS/Acallno Trojan spyware Can't be activatedSymbOS/Feixiang Sends 2 SMS Sends 1 SMSJava/Konov, SymbOS/-ZoomSms

Sends SMS System lag


Jail 2. Use an emulator

I Good Android emulator, butother OS?

I Same behaviour change problem

I Hardware exploits/ VMdetection


Jail 3. Faraday cage

Courtesy of J. Danielshttp://www.jeddaniels.

com/2007/

faraday-cage-part-1/

Not that easy to build...

I How to see the screen?

I Access to keyboard?

Large Faraday cages

Expensive + Weight


http://www.jeddaniels.com/2007/faraday-cage-part-1/





com/2007/





Large Faraday cages

Expensive + Weight







com/2007/





Large Faraday cages

Expensive + Weight







com/2007/





Large Faraday cages

Expensive + Weight





Build your own operator network!










What's OpenBTS?

OpenBTS

I Open source project

I Local GSM operator = USRP + accurate clock + hostrunning OpenBTS / Asterix

I No GPRS, EDGE, UMTS...

OpenBTS is a registered trademark of Range Networks, Inc.

And nanoBTS-OpenBSC?

Good (perhaps better?)... but 6 times more expensive


Jail Architecture


Video: Using an OpenBTS Jail for Malware Analysis

What the analyst sees...

Part 1. ... when the phone is o�inePart 2. ... with an OpenBTS-based jail


Results

Blue: o�ine, Red: with GSM jail, Yellow: +GPRS jail.Full results: see paper.

Main Advantages

I Behaviour similar to realconditions

I See SMS contents and details

I No leak to real networks

I Low cost

Limitations

I Sample requires a WCDMAbearer

I MMS not handled

I Dynamic analysis limitations


Thank You !

Follow us on http://blog.fortinet.com

or twitter: @FortiGuardLabs

Axelle Apvrille

aka Crypto Girl

/mobile malware reverse engineering/[email protected]

Slides edited with LOBSTER


http://blog.fortinet.com

http://www.eurecom.fr/~apvrille/lobster.html

Documents

An OpenBTS GSM Replication Jail for Mobile Malware · 2011-10-12 · An OpenBTS GSM Replication Jail for Mobile Malware Axelle Apvrille Virus Bulletin Conference, October 2011