Wendell Crenshaw Technologies presents

More documents

Recommendations

Info

$\H1B%-12345X@PJL JOB “HackingPrinters”$

Outlook• Will see same problems for 3GPP/UMTS• 3GPP uses mutual auth…• Need Radio Resource Control (RRC) pre-auth• RRC is about 1800 pages of specification!• ASN.1 PER !!• Only single vendor for the ASN.1 parser !!!• Femto cells as cheap attack platforms• LTE spec pre-auth simpler than 3GPP
Conclusions• Memory corruptions over the Um interface:practical even with cheap hardware• Vulnerabilities in GSM baseband codebasesplentiful• Small number of baseband vendors• Malicious code execution on baseband CPU:compromises security– Shared memory between BB & APP:total compromise
Page 2: Wendell CrenshawTechnologiespresent
Page 6 and 7: All Your BasebandAre Belong To Usov
Page 8 and 9: Part I: GSM and smartphone basics
Page 10 and 11: Layers of the GSM Um interfaceConne
Page 12 and 13: Dominant Smartphone archsvs.Applica
Page 14 and 15: Baseband market shares 3Q2009Qualco
Page 16 and 17: Baseband (in)security• Code base
Page 18 and 19: Layers of the GSM Um interfaceConne
Page 20 and 21: Where to look for bugs• Layer 1 n
Page 22 and 23: Initial TargetsImage credit: Yutaka
Page 24 and 25: An example (in QCOM codebase)• GS
Page 26 and 27: Baseband Exploitation• Baseband:
Page 28 and 29: Part III: Practicality
Page 30 and 31: • Siemens BS11• used byOpenBSC
Page 32 and 33: Our gear:EttusUSRPv1• price: appr
Page 34 and 35: Common failures (my experience)•
Page 36 and 37: Part V: The Baseband Apocalypse
Page 40 and 41: Is there still hope for the paranoi
Page 42 and 43: Part VI: Disclosure, outlook,conclu

Wendell Crenshaw Technologies presents

Create successful ePaper yourself

Delete template?

Save as template?