Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station...
Transcript of Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station...
![Page 1: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/1.jpg)
Base Jumping
Attacking the GSM baseband and base station
Tuesday, 20 July 2010
![Page 2: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/2.jpg)
Overview
❖GSM❖Base Station❖Base Band❖Conclusion
2
Tuesday, 20 July 2010
![Page 3: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/3.jpg)
GSM: The Protocol
3
Tuesday, 20 July 2010
![Page 4: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/4.jpg)
Documents
4
❖Dozens of docs❖Thousands of pages❖Important one (defines L3)
❖GSM 04 08
Tuesday, 20 July 2010
![Page 5: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/5.jpg)
5
Tuesday, 20 July 2010
![Page 6: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/6.jpg)
6
Tuesday, 20 July 2010
![Page 7: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/7.jpg)
7
Logical Channels
Broadcast Channels (BCH) Broadcast Control Channel (BCCH) Frequency Correction Channel (FCCH) Synchronization Channel (SCH) Cell Broadcast Channel (CBCH)
Tuesday, 20 July 2010
![Page 8: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/8.jpg)
Logical Channels, cont.❖ Common Control Channels (CCCH) Paging Channel (PCH) Random Access Channel (RACH) Access Grant Channel (AGCH)
8
Tuesday, 20 July 2010
![Page 9: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/9.jpg)
Logical Channels, cont.
Standalone Dedicated Control Channel (SDCCH) Associated Control Channel (ACCH) Fast Associated Control Channel (FACCH) Slow Associated Control Channel (SACCH)
9
Tuesday, 20 July 2010
![Page 10: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/10.jpg)
GSM Channels
10
❖Opening a channel is slow❖Can take seconds
❖Specific channels for specific uses
Tuesday, 20 July 2010
![Page 11: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/11.jpg)
Opening a channel
11
Tuesday, 20 July 2010
![Page 12: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/12.jpg)
12
Tuesday, 20 July 2010
![Page 13: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/13.jpg)
12
RACH
Tuesday, 20 July 2010
![Page 14: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/14.jpg)
12
RACH
AGCH
Tuesday, 20 July 2010
![Page 15: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/15.jpg)
12
RACH
AGCH
LCH
Tuesday, 20 July 2010
![Page 16: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/16.jpg)
13
Tuesday, 20 July 2010
![Page 17: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/17.jpg)
13
PCH
Tuesday, 20 July 2010
![Page 18: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/18.jpg)
13
RACH
PCH
Tuesday, 20 July 2010
![Page 19: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/19.jpg)
13
RACH
PCH
AGCH
Tuesday, 20 July 2010
![Page 20: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/20.jpg)
13
RACH
PCH
AGCH
LCH
Tuesday, 20 July 2010
![Page 21: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/21.jpg)
14
MS
BTS
BTSBSCMSC
ARFCN
Tuesday, 20 July 2010
![Page 22: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/22.jpg)
15
Base Transceiver StationBTS
Base StationController
BSC
Mobile StationController
MSC
Mobile StationMS
Base Station Sub-SystemBSS
Tuesday, 20 July 2010
![Page 23: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/23.jpg)
16
MSBSSMSCHLR
VLR
Tuesday, 20 July 2010
![Page 24: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/24.jpg)
Mobile Identifiers
17
Tuesday, 20 July 2010
![Page 25: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/25.jpg)
18
Tuesday, 20 July 2010
![Page 26: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/26.jpg)
18
IMSI
Tuesday, 20 July 2010
![Page 27: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/27.jpg)
18
IMSI
IMEI
Tuesday, 20 July 2010
![Page 28: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/28.jpg)
GSM Attacks
19
Tuesday, 20 July 2010
![Page 29: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/29.jpg)
20
Tuesday, 20 July 2010
![Page 30: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/30.jpg)
RACHell
21
❖Request channel allocation❖Flood the BSS with requests❖First announced by Dieter Spaar at DeepSec
❖Prevent everyone from using that cell
Tuesday, 20 July 2010
![Page 31: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/31.jpg)
22
RACHell
Tuesday, 20 July 2010
![Page 32: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/32.jpg)
22
RACHell
Tuesday, 20 July 2010
![Page 33: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/33.jpg)
22
RACHell
Tuesday, 20 July 2010
![Page 34: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/34.jpg)
22
RACHell
Tuesday, 20 July 2010
![Page 35: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/35.jpg)
22
RACHell
Tuesday, 20 July 2010
![Page 36: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/36.jpg)
22
RACHell
Tuesday, 20 July 2010
![Page 37: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/37.jpg)
22
?
RACHell
Tuesday, 20 July 2010
![Page 38: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/38.jpg)
23
Tuesday, 20 July 2010
![Page 39: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/39.jpg)
23
Our Target
Tuesday, 20 July 2010
![Page 40: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/40.jpg)
Demo - RACHell
24
Tuesday, 20 July 2010
![Page 41: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/41.jpg)
IMSI Flood
❖Send IMSI ATTACH messages❖pre-authentication❖Overload the HLR/VLR infrastructure❖Prevent everyone using the network
25
Tuesday, 20 July 2010
![Page 42: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/42.jpg)
26
IMSI Flood
Tuesday, 20 July 2010
![Page 43: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/43.jpg)
26
IMSI Flood
Tuesday, 20 July 2010
![Page 44: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/44.jpg)
26
IMSI Flood
Tuesday, 20 July 2010
![Page 45: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/45.jpg)
26
IMSI Flood
Tuesday, 20 July 2010
![Page 46: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/46.jpg)
26
IMSI Flood
Tuesday, 20 July 2010
![Page 47: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/47.jpg)
26
IMSI Flood
Tuesday, 20 July 2010
![Page 48: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/48.jpg)
26
IMSI Flood
Tuesday, 20 July 2010
![Page 49: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/49.jpg)
How hard to get an IMSI?
27
Tuesday, 20 July 2010
![Page 50: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/50.jpg)
IMSI DETACH
❖Send multiple Location Update Requests including a spoofed IMSI❖Unauthenticated
❖Prevent SIM from receiving calls and SMS
❖Discovered by Sylvain Munaut
28
Tuesday, 20 July 2010
![Page 51: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/51.jpg)
29
IMSI DETACH
Tuesday, 20 July 2010
![Page 52: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/52.jpg)
29
IMSI DETACH
Tuesday, 20 July 2010
![Page 53: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/53.jpg)
29
IMSI DETACH
Tuesday, 20 July 2010
![Page 54: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/54.jpg)
29
IMSI DETACH
Tuesday, 20 July 2010
![Page 55: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/55.jpg)
29
IMSI DETACH
Tuesday, 20 July 2010
![Page 56: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/56.jpg)
29
IMSI DETACH
Tuesday, 20 July 2010
![Page 57: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/57.jpg)
29
IMSI DETACH
Tuesday, 20 July 2010
![Page 58: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/58.jpg)
Baseband Fuzzing
30
Tuesday, 20 July 2010
![Page 59: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/59.jpg)
31
=+
How to make a smartphone
Tuesday, 20 July 2010
![Page 60: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/60.jpg)
32
Two separate computers
Tuesday, 20 July 2010
![Page 61: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/61.jpg)
32
Two separate computers
Tuesday, 20 July 2010
![Page 62: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/62.jpg)
33
Baseband
❖Controls the radio❖Separate CPU and code base❖RTOS❖Written in C❖Typically legacy code base (decades)
Tuesday, 20 July 2010
![Page 63: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/63.jpg)
Coseinc GSM FuzzFarm❖OpenBTS based fuzzer delivery engine
❖Targetting❖ iPhone❖HTC (Android)❖Palm Pre❖Blackberry❖Nokia
34
Tuesday, 20 July 2010
![Page 64: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/64.jpg)
35
Tuesday, 20 July 2010
![Page 65: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/65.jpg)
Conclusion
36
Tuesday, 20 July 2010
![Page 66: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/66.jpg)
GSM Trouble
37
❖GSM is no longer a walled garden❖GSM spec has security problems❖Expect many more issues as OSS reduces costs for entry
Tuesday, 20 July 2010
![Page 67: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/67.jpg)
Future work
❖More GSM stack fuzzing❖Next gen protocol stacks
38
Tuesday, 20 July 2010
![Page 68: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/68.jpg)
39
Thanks to
Harald Walte, Osmocom-bb & OpenBTS
Tuesday, 20 July 2010
![Page 69: Base Jumping - GitHub Pages...Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Tuesday, 20 July 2010 Overview GSM Base Station Base Band Conclusion 2 Tuesday,](https://reader034.fdocuments.in/reader034/viewer/2022042203/5ea4f88b0a957e4797580b5b/html5/thumbnails/69.jpg)
Questions?
40
Tuesday, 20 July 2010