Base Jumping - Attacking the GSM BB and BTS - grugq, 2010conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1 - The... · Base Jumping Attacking the GSM baseband ... (CCCH)

Base Jumping

Attacking the GSM baseband and base station

[email protected]

Thursday, 14 October 2010

mailto:[email protected]

mailto:[email protected]

Overview

❖GSM❖Base Station❖Base Band❖Conclusion

2


GSM: The Protocol

3


Documents

4

❖Dozens of docs❖Thousands of pages❖Important one (defines L3)

❖GSM 04 08


5


6


7

Logical Channels

Broadcast Channels (BCH) Broadcast Control Channel (BCCH) Frequency Correction Channel (FCCH) Synchronization Channel (SCH) Cell Broadcast Channel (CBCH)


Logical Channels, cont.❖ Common Control Channels (CCCH) Paging Channel (PCH) Random Access Channel (RACH) Access Grant Channel (AGCH)

8


Logical Channels, cont.

Standalone Dedicated Control Channel (SDCCH) Associated Control Channel (ACCH) Fast Associated Control Channel (FACCH) Slow Associated Control Channel (SACCH)

9


GSM Channels

10

❖Opening a channel is slow❖Can take seconds

❖Specific channels for specific uses


Opening a channel

11


12


12

RACH


12

RACH

AGCH


12

RACH

AGCH

LCH


13


13

PCH


13

RACH

PCH


13

RACH

PCH

AGCH


13

RACH

PCH

AGCH

LCH


14

MS

BTS

BTSBSCMSC

ARFCN


15

Base Transceiver StationBTS

Base StationController

BSC

Mobile StationController

MSC

Mobile StationMS

Base Station Sub-SystemBSS


16

MSBSSMSCHLR

VLR


Mobile Identifiers

17


18


18

IMSI


18

IMSI

IMEI


18

IMSI

IMEI


18

IMSI

IMEI


18

IMSI

IMEI


18

IMSI

IMEI


18

IMSI

IMEI


GSM Attacks

19


20


RACHell

21

❖Request channel allocation❖Flood the BSS with requests❖First announced by Dieter Spaar at DeepSec

❖Prevent everyone from using that cell


22

RACHell


22

RACHell


22

RACHell


22

RACHell


22

RACHell


22

RACHell


22

?

RACHell


23


23

Our Target


Demo - RACHell

24


IMSI Flood

❖Send IMSI ATTACH messages❖pre-authentication❖Overload the HLR/VLR infrastructure❖Prevent everyone using the network

25


26

IMSI Flood


26

IMSI Flood


26

IMSI Flood


26

IMSI Flood


26

IMSI Flood


26

IMSI Flood


26

IMSI Flood


IMSI DETACH

❖Send multiple Location Update Requests including a spoofed IMSI❖Unauthenticated

❖Prevent SIM from receiving calls and SMS

❖Discovered by Sylvain Munaut

27


28

IMSI DETACH


28

IMSI DETACH


28

IMSI DETACH


28

IMSI DETACH


28

IMSI DETACH


28

IMSI DETACH


28

IMSI DETACH


How hard to get an IMSI?

29


Baseband Fuzzing

30


31

=+

How to make a smartphone


32

Two separate computers


32

Two separate computers


33

Baseband

❖Controls the radio❖Separate CPU and code base❖RTOS❖Written in C❖Typically legacy code base (decades)


GSM Frame Delivery

❖OpenBTS + XML-RPC❖ lch_open(char * IMSI)❖ lch_send(int fd, char *buf, size_t len)❖ lch_recv(int fd, char *buf, size_t len)❖ lch_close(int fd)

34


GSM Fuzzing Framework

❖USRP + OpenBTS for delivery❖GSM900 band❖BugMine case generation & mutation❖No Instrumentation

❖Very bad visibility on bugs

35


Coseinc GSM FuzzFarm❖Targetting

❖ iPhone❖HTC (Android)❖Palm Pre❖Blackberry❖Nokia

36


37


38


Conclusion

39


GSM Trouble

40

❖GSM is no longer a walled garden❖GSM spec has security problems❖Expect many more issues as OSS reduces costs for entry


Future work

❖More GSM stack fuzzing❖Next gen protocol stacks

41


42

Thanks to

Harald Welte, Osmocom-bb & OpenBTS


Questions?

43
