Accelerate3g5 -- blobb


Trying to come up with a fuzzing interface.



First setting up the femtocell and understand necessary basics of UMTS communication to do so. (done)
Collecting information e.g. slides, talks, docu about fuzzing of wireless protocols. (done)
Writing some code to craft requests and run fuzz tests against subscriber. (to be done)

Note: first time fuzzing.

Test devices

TD1: Samsung Galaxy S5 Mini (G800F)
OS: Lineage OS (14.1/7.1.1)

TD2: LG Nexus 5 (hammerhead)
OS: Android Marshmallow (6.0)
BB: M48974A-

TD3: HTC One M9
OS: Android Lollipop (5.1)
BB: 01.04_U11440601_71.02.50709G_F
SIM: NanoSIM (cutted MicroSIM)

TD4: Samsung S3 (GT-I9300)
OS: Android Jelly Bean (4.3)
SIM: MicroSim


Pick up package at Sysmocom office.
Having an informative conversation with Neels about Jenkins, Docker and build artifacts.

Set up wiki page.
Seeing femtocell on network interface.
Compiled source as described, but couldn't configure/launch CN successfully (yet).
Next time will try Neels' launch script and same IP range.

Reading data sheet [overview] data sheet [details] about ip.access nano3G S8.
Configuring femtocell via telnet (dry run).
Running in HLR issue mentioned in wiki when invoking

Collecting input about fuzzing:


SMS Fuzzing - SIM Toolkit Attack - B. Alecu, defcon21 2013
SMS Vulnerability Analysis on Feature Phones - N. Golde, 2011
Fuzzing the GSM Protocol - B. Hond, master thesis 2011


SMS Fuzzing - Sim Toolkit Attack - B. Alecu, Deepsec 2011
Using OpenBSC for fuzzing of GSM handsets - H. Welte, 26c3 2009


MobiDeke: Fuzzing the GSM Protocol Stack - S. Dudek & G. Delugr, 2012
Base Jumping - Attacking the GSM BB and BTS - grugq, 2010
Fuzzing your GSM phone - Harald Welte, 26c3 2009
Fuzzing the Phone in your Phone - C. Miller & C. Mulliner, Blackhat 2009
Injecting SMS Messages into Smart Phones for Security Analysis - C. Mulliner, 2009
Security Testing esp. Fuzzing - E. Poll, ????

Resolving HLR issue and set correct IPs in *.cfg files.
hNodeB connects to hnbgw, but no UE is connecting to it.

[issue from wiki: ...unable to resolve DNS record look up of no trx].

Connect femtocell to LAN with internet access to resolve DNS record look up issue, still no phones are connecting (yet).
Adding SIM cards to hlr.db, after creating db successfully [thanks to andreas]

Create and attach (adapted from
Rebuild with correct branch/tag (openbsc:vlr_3G,libosmo-sccp:old_sua).
TD1 and TD2 successfully connected to femtocell!!! \o/
Voice calls work (TD1<->TD2).

Create and attach configure_nano3G.exp.

Invoke expect script within to automate initial nano3G configuration via telnet.

SMS work (TD1<->TD2), probably worked before but have been tested "today".

Compile OpenBSC with --enable-mgcp-transcoding flag and create on lo. :)
Attach refactored version of
Data "works" (TD1<->TD2, TDx<->tun0/

Note: data "worked" before (UEs got IP 2017-4-20). But I didn't manage to forward packets from tun0->eth0->inet yet, although the following iptable rule has been applied:

sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Create and attach
Picked up TD4 at a friend's place. Now I don't need to change the SIM/USIM card in TD1, which is my "normal" cell phone to test functionality. Thanks a lot buddy, in case you might read this. :)

As it actually belongs to the accelerate3g5 project, I add the hands-on repo this journal.

It provides functionality to clone necessary git repos and build accerelate3g5 stack.


- UE's are connecting and voice calls are working.

- network LED does not indicate whether IP has been assigned by DHCP server.
- umts LED does indicate whether cell is connected to hnbgw, etc pp.


build_3G.sh_old - script to build 3G tailored CN stack to run nano3G (holding necessary branches/tags) (1.63 KB) blobb, 04/20/2017 11:48 PM

configure_nano3G.exp - expect script to configure nano3G in an automated manner (cuz we're lazy) (520 Bytes) blobb, 04/22/2017 08:19 PM Magnifier - refactored version of build_3G.sh_old (now with functions) (959 Bytes) blobb, 04/24/2017 09:34 PM Magnifier - script to find nano3G on network via nmap (portpattern) (823 Bytes) blobb, 04/25/2017 11:48 AM