Empfohlen
Empfohlen
Weitere Àhnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ăhnlich wie Root via SMS: 4G access level security assessment, Sergey Gordeychik, Alexander Zaytsev
Ăhnlich wie Root via SMS: 4G access level security assessment, Sergey Gordeychik, Alexander Zaytsev (20)
Mehr von Sergey Gordeychik
Mehr von Sergey Gordeychik (11)
KĂŒrzlich hochgeladen
KĂŒrzlich hochgeladen (20)
Root via SMS: 4G access level security assessment, Sergey Gordeychik, Alexander Zaytsev
- 6. the EvilÂ
- 7. 4G access level ï⯠Branded mobile equipment security checks ï⯠3G/4G USB Modems ï⯠Routers / Wireless Access Point ï⯠Smartphones/Femtocell/Branded applications ï⯠(U)SIM cards ï⯠Radio/IP access network ï⯠Radio access network ï⯠IP access (GGSN, Routers, GRX) ï⯠Related Infrastructure ï⯠Additional services/VAS (TV, Games, etc)
- 8. why?Â
- 9. why? ï⯠we use it every day ï⯠Internet ï⯠social network ï⯠to hack stuff ï⯠IT use it everyday ï⯠ATM ï⯠IoT ï⯠SCADA
- 10. Plain Line Station C omputer Based Interlocking to peripherals: signals, point machines, etc. R BC F ixed E urobalise R BC  MMI F ixed E urobalise GS MâR GS MâR Onboard ETCS Onboard Data GSM-R bullet train interlocking hQp://en.wikipedia.org/wiki/European_Rail_TraïŹc_Management_SystemÂ
- 11. Plain Line Station C omputer Based Interlocking to peripherals: signals, point machines, etc. R BC F ixed E urobalise R BC  MMI F ixed E urobalise GSM-R GSM-R Onboard ETCS Onboard Data GSM-R GSMâRÂ
- 12. radio access network âąâŻ Well researched by community â⯠hQp://security.osmocom.org/trac/  âąâŻ Special thanks to â⯠ Sylvain Munaut/Alexander Chemeris/Karsten Nohl/et. al. hQp://security.osmocom.org/trac/Â
- 13. bingo!Â
- 14. not so quick ï⯠RBC-RBC Safe Communication Interface Subset-098 ï⯠EN 50159:2010 ï⯠VPN over GSM ï⯠âŠ
- 16. the NETÂ
- 17. the NETÂ
- 19. by devices Â
- 20. the NET   Â
- 21. GPRS Tunnelling Protocol   ï⯠Subset of protocols for GPRS communica]ons ï⯠SGSN <â> GGSN signaling (PDP context, QoS, etc) ï⯠IP tunneling ï⯠Roaming (GRX) ï⯠Charging data exchange ï⯠GTPâC UDP/2123  ï⯠GTPâU UDP/2152 ï⯠GTP' TCP/UDP/3386   hQp://en.wikipedia.org/wiki/GPRS_Tunnelling_ProtocolÂ
- 23. GPRS Tunnelling Protocol    ï⯠GTPâecho responses ï⯠207401  ï⯠No answer for PDP context request ï⯠199544   ï⯠U  r welcome  ï⯠548  ï⯠Management ports ï⯠DNS (.gprs .3gppnetwork.org)Â
- 24. Brazil   228 China   162 India   34 Colombia  14 USA   13 Japan   13 Malaysia  10 Kuwait   9 Germany  9 UAE    7Â
- 25. so what?Â
- 26. AQacks   ï⯠GGSN PWN ï⯠GPRS aQacks ï⯠DoS ï⯠Informa]on leakage ï⯠Fraud ï⯠APN guessing   Â
- 29. Iâm insideÂ
- 30. Guter Weg um ist nie krumm ï⯠All old IP stuff ï⯠traces 1.1.1.1/10.1.1.1 ï⯠IP source routing ï⯠Management ports ï⯠All new IP stuff ï⯠IPv6 ï⯠MPTCP ï⯠Telco specific (GTP, SCTP M3UA, DIAMETER etc) hQp://ubm.io/11K3yLT        hQps://www.thc.org/thcâipv6/ Â
- 31. Here There Be Tygers
- 32. DNS ï⯠In most cases it internal DNS server ï⯠Sometimes it uses companyâs FQDN and address space ï⯠Bruteforce/Zone Transfer and other information leakage ï⯠.gprs .3gppnetwork.org ï⯠APIPA IP address reuse ï⯠local.COMPANY.com have A-record to 10.X.X.X ï⯠Attacker publishes link to local.COMPANY.com on same address ï⯠Victims form 10.Đ„ network will transfer cookies to attacker hQp://lab.onsec.ru/2013/07/insecureâdnsârecordsâinâtopâwebâprojects.htmlÂ
- 33. 1990th ï⯠Your balance is insufficient ï⯠Connect to your favorite UDP VPN
- 34. Resume ï⯠For telcos ï⯠Please scan all your Internets! ï⯠Your subscribers network is not your internal network ï⯠For auditors ï⯠Check all states ï⯠online/blocked/roaming ï⯠Check all subscribers ï⯠APNâs, subscribers plans ï⯠Donât hack other subscribers hQp://www.slideshare.net/phdays/howâtoâhackâaâtelecommunica]onâcompanyâandâstayâaliveâgordeychik/32Â
- 35. The Device
- 36. Who is mister USB-modem? ï⯠Rebranded hardware platform ï⯠Linux/Android/BusyBox onboard ï⯠Multifunctional ï⯠Storage ï⯠CWID USB SCSI CD-ROM USB Device ï⯠MMC Storage USB Device (MicroSD Card Reader) ï⯠Local management ï⯠COM-Port (UI, AT commands) ï⯠Network ï⯠Remote NDIS based Internet Sharing Device ï⯠WiFi
- 37. Cet animal est trĂšs mĂ©chant ï⯠Well researched ï⯠«Unlock» ï⯠«Firmware customization» ï⯠«Dashboard customization» ï⯠Some security researches ï⯠http://threatpost.com/using-usb-modems-to-phish-and-send-malicious-sms-messages ï⯠http://www.slideshare.net/RahulSasi2/fuzzing-usb-modems-rahusasi ï⯠http://2014.phdays.com/program/business/37688/ ï⯠https://media.blackhat.com/eu-13/briefings/Tarakanov/bh-eu-13-from-china-with-love- tarakanov-slides.pdf
- 38. Quand on l'attaque il se dĂ©fend ï⯠Developers answer ï⯠Device «Hardening» ï⯠Disabling of local interfaces (COM) ï⯠Web-dashboards
- 39. Identification
- 40. Identification ï⯠Documentation ï⯠Google ï⯠Box ï⯠Google again ï⯠Internals
- 42. Scan it
- 43. Sometimes you get luckyâŠ
- 44. âŠother times you donât
- 45. all I need is RCE Love ! ï⯠telnet/snmp? ï⯠Internal interface only ï⯠Blocked by browsers ï⯠http/UPNP? ï⯠Attack via browser (CSRF) ï⯠broadband ï⯠?
- 46. web â trivial stuff CSRF Insufficient authentication XSS
- 48. Basic impact ï⯠Info disclosure ï⯠Change settings ï⯠DNS (intercept traffic) ï⯠SMS Center (intercept SMS) ï⯠Manipulate (Set/Get) ï⯠SMS ï⯠Contacts ï⯠USSD ï⯠WiFi networks
- 49. Advanced impact ï⯠Self-service portal access ï⯠XSS (SMS) to âpwnâ browser ï⯠CSRF to send âpassword resetâ USSD ï⯠XSS to transfer password to attacker ï⯠âBrickâ ï⯠PIN/PUK âbruteforceâ ï⯠Wrong IP settings
- 50. DEMO
- 53. Cute, but⊠ï⯠You need to have firmware ïâŻSometimes you get lucky⊠ïâŻâŠother times you donât ï⯠Integrity control ïâŻAt least should beâŠ
- 54. dig deeper⊠ï⯠Direct shell calls ï⯠awk to calculate Content-Length ï⯠Other trivial RCE
- 57. Iâve got The Power
- 59. Cute, but⊠ï⯠Get firmware? ïâŻYes it nice, but⊠ï⯠Find more bugs? ïâŻWe have enough⊠ï⯠Get SMS, send USSD? ïâŻCan be done via CSRF/XSS⊠ï⯠PWN the subscriber?
- 61. PWN â PWNÂ
- 62. ProïŹt!111Â
- 63. Sometimes you get luckyâŠ
- 64. Details ï⯠Dashboard install webserver on localhost ï⯠Host diagnostics (ipconfig, tracesâŠ) ï⯠Windows âshellâ script based! ï⯠Very âsecureâ! ï⯠Interacts with USB modem webserver ï⯠Donât care about origin (you donât need even XSS)
- 66. It still in USB!
- 67. It still in (bad) USB! hQps://srlabs.de/blog/wpâcontent/uploads/2014/07/SRLabsâBadUSBâBlackHatâv1.pdfÂ
- 70. Android gadget driver âąâŻ Implemented in android.c âąâŻ Composite driver wrapper with some UI âąâŻ /sys/class/android_usb/android0 ââŻenabled ââŻfunc]ons ââŻClass/Protocol/SubClass etc. ââŻList of supported func]ons âąâŻ Your favorite phone can become audio_source instead of mass storageÂ
- 73. Sad Linux âąâŻ By default kernel doesnât have g_hid support âąâŻ Hard to build universal HID driver for diïŹerent versions ââŻvermagic ââŻFunc]on prototypes/structures changes over ]me ââŻDiïŹerent CPU âąâŻ Vendors have a hobby â rewrite kernel at unexpected places âąâŻ Fingerprint device before hack it!Â
- 74. DEMO
- 75. Resume ï⯠For telcos ï⯠All your 3/4G modems/routers are 5/>< belong to us ï⯠For everybody ï⯠Please donât plug computers into your USB ï⯠Even if it your harmless network printer 4G modem
- 76. The Chip
- 77. What is SIM: for hacker ââŻMicrocontroller âąâŻ Own OS âąâŻ Own file system âąâŻ Application platform and API ââŻUsed in different phones (even after upgrade) ââŻOS in independent, but can kill all security âąâŻ Baseband access âąâŻ OS sandbox bypass
- 78. What has Karsten taught us? ï⯠Not all TARs are equally secure ï⯠If you are lucky enough you could find something to bruteforce ï⯠If you are even more lucky you can crack some keys ï⯠Or some TARs would accept commands without any crypto at all hQps://srlabs.de/roo]ngâsimâcards/Â
- 79. Getting the keys ï⯠Either using rainbow tables or by plain old DES cracking ï⯠We've chosen the way of brute force ï⯠Existing solutions were too slow for us ï⯠So why not to build something new?
- 80. Getting the keys ï⯠So why not to build something new? ï⯠Bitcoin mining business made another twist ï⯠Which resulted in a number of affordable FPGAs on the market ï⯠SoâŠ
- 81. The rig ï⯠Hereâs what weâve done â proto #1
- 82. The rig ï⯠Hereâs what weâve done â proto #2
- 83. The rig ï⯠Hereâs what weâve done â final edition
- 84. The rig ï⯠Some specs: Hardware Speed (Mcrypt/sec) Time for DES (days) Time for 3DES (part of key is known, days) Intel CPU (Core i7-2600K) 475 1755,8 (~5 years) 5267,4 Radeon GPU (R290X) 3`000 278 834 Single chip (xs6slx150-2) 7`680 108,6 325,8 ZTEX 1.15y 30`720 27,2 81,6 Our rig (8*ZTEX 1.15y) 245`760 3,4 10,2 + descrypt bruteforcer â hQps://twiQer.com/GiBsUngiven/status/492243408120213505Â
- 85. Now what? ï⯠So you either got the keys or didnât need them, whatâs next? ï⯠Send random commands to any TARs that accept them ï⯠Send commands to known TARs
- 86. Now what? ï⯠Send random commands to TARs that accept them ï⯠Many variables to guess: CLA INS P1 P2 P3 PROC DATA SW1 SW2 ï⯠Good manuals or intelligent fuzzing needed ï⯠Or you'll end up with nothing: not knowing what you send and receive
- 87. Now what? ï⯠Send commands to known TARs ï⯠Card manager (00 00 00) ï⯠File system (B0 00 00 - B0 FF FF) ï⯠âŠ
- 88. Now what? Card manager (TAR 00 00 00) ï⯠Holy grail ï⯠Install custom applets and jump off the JCVM ï⯠Not enough technical details ï⯠No successful POC publicly available ï⯠But there are SIM cards allowing to install apps with no security at all! ï⯠Someone have done it for sureâŠ
- 89. Now what? File system (B0 00 00 - B0 FF FF) ï⯠Stores interesting stuff: TMSI, Kc ï⯠May be protected by CHV1 == PIN code
- 90. Now what? ï⯠File system (TAR B0 00 00 - B0 FF FF) ï⯠Simple well documented APDU commands (SELECT, GET RESPONSE, READ BINARY, etc.) ï⯠Has it's own access conditions (READ, UPDATE, ACTIVATE, DEACTIVATE | CHV1, CHV2, ADM)
- 91. Attack? ï⯠No fun in sending APDUs through card reader ï⯠Let's do it over the air! ï⯠Wrap file system access APDUs in binary SMS ï⯠Can be done with osmocom, some gsm modems or SMSC gateway
- 92. Attack? ï⯠Binary SMS can be filtered ï⯠Several vectors exist: ï⯠Intra-network ï⯠Inter-network ï⯠SMS gates ï⯠Fake BTS/FemtoCell
- 93. Attack? ï⯠Wait! What about access conditions? ï⯠We still need a PIN to read interesting stuff ï⯠Often PIN is set to 0000 by operator and is never changed ï⯠Otherwise needs bruteforcing
- 94. Attack? ï⯠PIN bruteforce ï⯠Only 3 attempts until PIN is blocked ï⯠Needs a wide range of victims to get appropriate success rate ï⯠Provides some obvious possibilitiesâŠ
- 95. Attack? ï⯠Byproduct attack â subscriber DoS ï⯠Try 3 wrong PINs ï⯠PIN is locked, PUK(CHV2) requested ï⯠Try 10 wrong PUKs ï⯠PUK is locked ï⯠Subscriber is locked out of GSM network - needs to replace SIM card
- 96. Attack? ï⯠To sniff we still got to figure out the ARFCN ï⯠There are different ways⊠ï⯠Catching paging responses on CCCH feels like the most obvious way ï⯠Still have to be coded â go do it! ï⯠Everything could be built on osmocom-bbâŠ
- 97. Attack? ï⯠Assuming we were lucky enough ï⯠We do have the OTA key either donât need one ï⯠Weâve got the PIN either donât need one ï⯠All we need is to read two elementary files ï⯠MF/DF/EF/Kc and MF/DF/EF/loci ï⯠Go look at SIMTracer!
- 98. Attack? ï⯠Assuming we were lucky enough ï⯠We now got TMSI and Kc and don't need to rely on Kraken anymore ï⯠Collect some GSM traffic with your SDR of choice or osmocom-bb phone ï⯠Decrypt it using obtained Kc ï⯠Or just clone the victim for a while using obtained TMSI & Kc ï⯠Looks like A5/3 friendly! ï⯠Profit!
- 99. DEMO
- 100. So? ï⯠Traffic decryption only takes 2 binary messages ï⯠DoS takes 13 binary messages and can be done via SMS gate ï⯠There are valuable SMS-packages. Catch the deal. ï⯠There are also USSDsâŠ
- 101. âWhat a girl to do?â ï⯠Change PIN, maybe⊠ï⯠Run SIMTester! ï⯠Use PSTN FTW:( ï⯠Pigeon mail anyone?
- 102. Resume ï⯠For telcos ï⯠Check all your SIMs ï⯠Train your/contractor of SIM/App/Sec ï⯠For everybody ï⯠Pray
- 103. Thanks!