Here - iSEC Partners

More documents

Recommendations

Info

Full Disclosure • Disclosed vulnerabilities to the carrier early December • They worked extremely hard, over Christmas, to prepare a patch • All vulnerabilities disclosed in this presentation have been patched • We do have architectural concerns around femtocells • Concerns shared by… 4
Prior Art • BH 2011 “Femtocells: a Poisonous Needle in the Operator's Hay Stack” • SFR Femtocell (2nd biggest operator in France) • THC: Vodafone (2010/2011) • RSAXVC & Doug Kelly (Bsides KC 2011) • Rooting • Cable construction • “Do It Yourself Cellular IDS” • Black Hat 2013 5
Page 1 and 2: Doug DePerry Tom Ritter Andrew Rahi
Page 3: No User Interaction • This is not
Page 7 and 8: Agenda Rooting Exploring • Filesy
Page 9 and 10: Rooting the Femtocell(s) SCS-26UC4
Page 11 and 12: SCS-2U01 Hardware • Faraday FA626
Page 13 and 14: Custom Cable • USB FTDI + HDMI =
Page 15 and 16: Console Access! • SCS-26UC4 • 5
Page 17 and 18: Exploring the Femtocell 17
Page 19 and 20: I am root, but… • This terminal
Page 21 and 22: Be Persistent • Read every single
Page 23 and 24: Let’s go after the data • We’
Page 25 and 26: I want packets! • Custom kernel m
Page 27 and 28: Voice: Lots ‘o packets • Its mo
Page 29 and 30: Voice - Codec? RFC 3558: Value Rate
Page 31 and 32: Voice - Codec? 31
Page 33 and 34: SMS • These specs suck • But we
Page 35 and 36: SMS http://www.youtube.com/watch?v=
Page 37 and 38: MMS http://www.youtube.com/watch?v=
Page 39 and 40: iMessage • And when you Denial of
Page 41 and 42: Data Traffic 41
Page 43 and 44: Data Middling • Try 1: • Do it
Page 45 and 46: Data Middling • Try 5: • DNS Hi
Page 47 and 48: Miniature Cell Towers • Eavesdrop
Page 49 and 50: CDMA Terminology • No SIM Cards n
Page 51 and 52: Cloning basics - Real Towers • Ev
Page 53 and 54: Connecting to a Femtocell • The f
Page 55 and 56:
The Perfect Clone • (p)ESN/MIN va
Page 57 and 58:
Cloning Implications • Cloning ca
Page 59 and 60:
Cloning Scenario 1 When both the TA
Page 61 and 62:
Cloning Scenario 2 When only the TA
Page 63 and 64:
Cloning Video http://www.youtube.co
Page 65 and 66:
Femtocells are a Bad Idea 65
Page 67 and 68:
Short Term Mitigations • Harden t
Page 69 and 70:
Root is always possible • We got
Page 71 and 72:
Femtocell Handset Registration Vend
Page 73 and 74:
Long Term Mitigations • Get rid o
Page 75 and 76:
Mitigation Summary • Short Term
Page 77 and 78:
Announcing FemtoCatcher • Detects
Page 79 and 80:
Future Work 79
Page 81 and 82:
WAP 81
Page 83 and 84:
Internal Femtocell Network • Femt
show all

Here - iSEC Partners

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?