Here - iSEC Partners

More documents

Recommendations

Info

Voice: Force Decode as RTP 28
Voice – Codec? RFC 3558: Value Rate Total data frame size --------------------------------------------------------- 0 Blank 0 (0 bit) 1 1/8 2 (16 bits) 2 1/4 5 (40 bits; not valid for EVRC) 3 1/2 10 (80 bits) 4 1 22 (171 bits; 5 padded at end w/ zeros) 5 Erasure 0 (SHOULD NOT be transmitted by sender) 29
Page 1 and 2: Doug DePerry Tom Ritter Andrew Rahi
Page 3 and 4: No User Interaction • This is not
Page 5 and 6: Prior Art • BH 2011 “Femtocells
Page 7 and 8: Agenda Rooting Exploring • Filesy
Page 9 and 10: Rooting the Femtocell(s) SCS-26UC4
Page 11 and 12: SCS-2U01 Hardware • Faraday FA626
Page 13 and 14: Custom Cable • USB FTDI + HDMI =
Page 15 and 16: Console Access! • SCS-26UC4 • 5
Page 17 and 18: Exploring the Femtocell 17
Page 19 and 20: I am root, but… • This terminal
Page 21 and 22: Be Persistent • Read every single
Page 23 and 24: Let’s go after the data • We’
Page 25 and 26: I want packets! • Custom kernel m
Page 27: Voice: Lots ‘o packets • Its mo
Page 31 and 32: Voice - Codec? 31
Page 33 and 34: SMS • These specs suck • But we
Page 35 and 36: SMS http://www.youtube.com/watch?v=
Page 37 and 38: MMS http://www.youtube.com/watch?v=
Page 39 and 40: iMessage • And when you Denial of
Page 41 and 42: Data Traffic 41
Page 43 and 44: Data Middling • Try 1: • Do it
Page 45 and 46: Data Middling • Try 5: • DNS Hi
Page 47 and 48: Miniature Cell Towers • Eavesdrop
Page 49 and 50: CDMA Terminology • No SIM Cards n
Page 51 and 52: Cloning basics - Real Towers • Ev
Page 53 and 54: Connecting to a Femtocell • The f
Page 55 and 56: The Perfect Clone • (p)ESN/MIN va
Page 57 and 58: Cloning Implications • Cloning ca
Page 59 and 60: Cloning Scenario 1 When both the TA
Page 61 and 62: Cloning Scenario 2 When only the TA
Page 63 and 64: Cloning Video http://www.youtube.co
Page 65 and 66: Femtocells are a Bad Idea 65
Page 67 and 68: Short Term Mitigations • Harden t
Page 69 and 70: Root is always possible • We got
Page 71 and 72: Femtocell Handset Registration Vend
Page 73 and 74: Long Term Mitigations • Get rid o
Page 75 and 76: Mitigation Summary • Short Term
Page 77 and 78: Announcing FemtoCatcher • Detects
Page 79 and 80:
Future Work 79
Page 81 and 82:
WAP 81
Page 83 and 84:
Internal Femtocell Network • Femt
show all

Here - iSEC Partners

Create successful ePaper yourself

Delete template?

Save as template?