Wendell Crenshaw Technologies presents

More documents

Recommendations

Info

$\H1B%-12345X@PJL JOB “HackingPrinters”$

Where to look for bugs• Layer 1 not fruitful• Layer 2: messages to short• Layer 3: specified in GSM 04.08–allows for variable length messages (TLV and LV)–Maximum length: 255 octets (length field: one octet)• However: ASN.1 used as well (e.g. RRLP)• GPRS layer very fruitful as well–GPRS not supported by OpenBTS–layer 1 different
Where to look for bugs• Layer 1 not fruitfulThings get interesting• Layer 2: messages to short• Layer 3: specified in GSM 04.08–allows for variable length messages (TLV and LV)–Maximum length: 255 octets (length field: one octet)• However: ASN.1 used as well (e.g. RRLP)• GPRS layer very fruitful as well–GPRS not supported by OpenBTS–layer 1 different
Page 2: Wendell CrenshawTechnologiespresent
Page 6 and 7: All Your BasebandAre Belong To Usov
Page 8 and 9: Part I: GSM and smartphone basics
Page 10 and 11: Layers of the GSM Um interfaceConne
Page 12 and 13: Dominant Smartphone archsvs.Applica
Page 14 and 15: Baseband market shares 3Q2009Qualco
Page 16 and 17: Baseband (in)security• Code base
Page 18 and 19: Layers of the GSM Um interfaceConne
Page 22 and 23: Initial TargetsImage credit: Yutaka
Page 24 and 25: An example (in QCOM codebase)• GS
Page 26 and 27: Baseband Exploitation• Baseband:
Page 28 and 29: Part III: Practicality
Page 30 and 31: • Siemens BS11• used byOpenBSC
Page 32 and 33: Our gear:EttusUSRPv1• price: appr
Page 34 and 35: Common failures (my experience)•
Page 36 and 37: Part V: The Baseband Apocalypse
Page 40 and 41: Is there still hope for the paranoi
Page 42 and 43: Part VI: Disclosure, outlook,conclu
Page 44 and 45: Outlook• Will see same problems f

Wendell Crenshaw Technologies presents

Create successful ePaper yourself

Delete template?

Save as template?