Here - iSEC Partners

More documents

Recommendations

Info

Wireless Signal Range • Approximately 40’ • Environmental factors • Adjust signal strength • Amplify 14
Console Access! • SCS-26UC4 • 57600 8 N 1 • Uboot delay: “Press any key to interrupt boot” • Root shell • Run /etc/init.d/rc 5 • Root on fully functional device • SCS-2U01 • 115200 8 N 1 • Magic sysreq + i • Root login • Run /etc/init.d/rc 5 • Root on fully functional device 15
Page 1 and 2: Doug DePerry Tom Ritter Andrew Rahi
Page 3 and 4: No User Interaction • This is not
Page 5 and 6: Prior Art • BH 2011 “Femtocells
Page 7 and 8: Agenda Rooting Exploring • Filesy
Page 9 and 10: Rooting the Femtocell(s) SCS-26UC4
Page 11 and 12: SCS-2U01 Hardware • Faraday FA626
Page 13: Custom Cable • USB FTDI + HDMI =
Page 17 and 18: Exploring the Femtocell 17
Page 19 and 20: I am root, but… • This terminal
Page 21 and 22: Be Persistent • Read every single
Page 23 and 24: Let’s go after the data • We’
Page 25 and 26: I want packets! • Custom kernel m
Page 27 and 28: Voice: Lots ‘o packets • Its mo
Page 29 and 30: Voice - Codec? RFC 3558: Value Rate
Page 31 and 32: Voice - Codec? 31
Page 33 and 34: SMS • These specs suck • But we
Page 35 and 36: SMS http://www.youtube.com/watch?v=
Page 37 and 38: MMS http://www.youtube.com/watch?v=
Page 39 and 40: iMessage • And when you Denial of
Page 41 and 42: Data Traffic 41
Page 43 and 44: Data Middling • Try 1: • Do it
Page 45 and 46: Data Middling • Try 5: • DNS Hi
Page 47 and 48: Miniature Cell Towers • Eavesdrop
Page 49 and 50: CDMA Terminology • No SIM Cards n
Page 51 and 52: Cloning basics - Real Towers • Ev
Page 53 and 54: Connecting to a Femtocell • The f
Page 55 and 56: The Perfect Clone • (p)ESN/MIN va
Page 57 and 58: Cloning Implications • Cloning ca
Page 59 and 60: Cloning Scenario 1 When both the TA
Page 61 and 62: Cloning Scenario 2 When only the TA
Page 63 and 64: Cloning Video http://www.youtube.co
Page 65 and 66:
Femtocells are a Bad Idea 65
Page 67 and 68:
Short Term Mitigations • Harden t
Page 69 and 70:
Root is always possible • We got
Page 71 and 72:
Femtocell Handset Registration Vend
Page 73 and 74:
Long Term Mitigations • Get rid o
Page 75 and 76:
Mitigation Summary • Short Term
Page 77 and 78:
Announcing FemtoCatcher • Detects
Page 79 and 80:
Future Work 79
Page 81 and 82:
WAP 81
Page 83 and 84:
Internal Femtocell Network • Femt
show all

Here - iSEC Partners

Create successful ePaper yourself

Delete template?

Save as template?