Project

General

Profile

Accelerate3g5 -- blobb » History » Version 118

blobb, 05/01/2017 11:11 AM

1 1 blobb
h1. Accelerate3g5 -- blobb
2 2 blobb
3
h2. Summary
4
5 3 blobb
Trying to come up with a fuzzing interface.
6
7 2 blobb
h3. Participants
8
9 85 blobb
* André (email: dr.blobb@gmail.com)
10 2 blobb
11
h2. Details
12 3 blobb
13 115 blobb
First setting up the femtocell and understand necessary basics of UMTS communication to do so. (done)
14 36 blobb
Collecting information e.g. slides, talks, docu about fuzzing of wireless protocols. (done)
15 62 blobb
Writing some code to craft requests and run fuzz tests against subscriber. (to be done)
16 1 blobb
17
Note: first time fuzzing.
18
19 25 blobb
h2. Test devices
20
21
TD1: Samsung Galaxy S5 Mini (G800F) 
22
 OS: Lineage OS (14.1/7.1.1) 
23
 BB: G800FXXU1BPC3
24
SIM: MicroSIM
25
26
TD2: LG Nexus 5 (hammerhead)
27
 OS: Android Marshmallow (6.0) 
28
 BB: M48974A-2.0.50.2.27
29
SIM: MicroSIM
30
31
TD3: HTC One M9
32
 OS: Android Lollipop (5.1)
33
 BB: 01.04_U11440601_71.02.50709G_F
34
SIM: NanoSIM (cutted MicroSIM)
35
36 87 blobb
TD4: Samsung S3 (GT-I9300)
37
 OS: Android Jelly Bean (4.3)
38
 BB: I9300XXUGNA8
39 88 blobb
SIM: MicroSim
40 87 blobb
41 118 blobb
 
42
 
43
 
44
45 7 blobb
h2. Journal
46
47 39 blobb
+_2017-03-07_+
48 42 blobb
Pick up package at Sysmocom office.
49
Having an informative conversation with Neels about Jenkins, Docker and build artifacts.
50 8 blobb
51 39 blobb
+_2017-03-12_+
52 10 blobb
Set up wiki page.
53 26 blobb
Seeing femtocell on network interface.
54 1 blobb
Compiled source as described, but couldn't configure/launch CN successfully (yet).
55 26 blobb
Next time will try Neels' launch script and same IP range.
56 1 blobb
57 39 blobb
+_2017-03-15_+
58 1 blobb
Reading "data sheet [overview]":http://www.ipaccess.com/uploads/wysiwyg_editor/files/2017/S8_S16-Datasheet-v1.0.pdf "data sheet [details]":https://fccid.io/pdf.php?id=1462491 about ip.access nano3G S8.
59
Configuring femtocell via telnet (dry run).
60
Running in HLR issue mentioned in wiki when invoking run.sh.
61 12 blobb
62 39 blobb
+_2017_04-02_+
63 33 blobb
Collecting input about fuzzing:
64 1 blobb
65 50 blobb
papers/theses:
66 33 blobb
>"SMS Fuzzing - SIM Toolkit Attack - B. Alecu, defcon21 2013":https://www.defcon.org/images/defcon-21/dc-21-presentations/Alecu/DEFCON-21-Bogdan-Alecu-Attacking-SIM-Toolkit-with-SMS-WP.pdf
67 37 blobb
>"SMS Vulnerability Analysis on Feature Phones - N. Golde, 2011":http://www.isti.tu-berlin.de/fileadmin/fg214/finished_theses/NicoGolde/diplom_golde.pdf
68 49 blobb
>"Fuzzing the GSM Protocol - B. Hond, master thesis 2011":http://www.ru.nl/publish/pages/769526/scriptie-brinio-final-brinio_hond.pdf
69 26 blobb
70 34 blobb
talks:
71 33 blobb
>"SMS Fuzzing - Sim Toolkit Attack - B. Alecu, Deepsec 2011":http://www.securitytube.net/video/2518
72
>"Using OpenBSC for fuzzing of GSM handsets - H. Welte, 26c3 2009":http://mirror.fem-net.de/CCC/26C3/mp4/26c3-3535-en-using_openbsc_for_fuzzing_of_gsm_handsets.mp4
73 26 blobb
74 34 blobb
slides:
75 33 blobb
>"MobiDeke: Fuzzing the GSM Protocol Stack - S. Dudek & G. Delugr, hack.lu 2012":http://archive.hack.lu/2012/Fuzzing_The_GSM_Protocol_Stack_-_Sebastien_Dudek_Guillaume_Delugre.pdf
76
>"Base Jumping - Attacking the GSM BB and BTS - grugq, 2010":http://conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1%20-%20The%20Grugq%20-%20Attacking%20GSM%20Basestations.pdf
77
>"Fuzzing your GSM phone - Harald Welte, 26c3 2009":https://events.ccc.de/congress/2009/Fahrplan/attachments/1503_openbsc_gsm_fuzzing.pdf
78
>"Fuzzing the Phone in your Phone - C. Miller & C. Mulliner, Blackhat 2009":https://engineering.purdue.edu/dcsl/reading/2011/jevin-fuzzing.pdf
79
>"Injecting SMS Messages into Smart Phones for Security Analysis - C. Mulliner, 2009":https://www.mulliner.org/security/sms/feed/injecting_sms_mulliner_miller.pdf
80
>"Security Testing esp. Fuzzing - E. Poll, ????":https://www.cs.ru.nl/E.Poll/ss/slides/12_Fuzzing.pdf
81 26 blobb
82 39 blobb
+_2017-04-19_+
83 43 blobb
Resolving HLR issue and set correct IPs in "*.cfg files":https://osmocom.org/attachments/download/2559/3G-config-example-v3.tar. 
84 58 blobb
hNodeB connects to hnbgw, but no UE is connecting to it. 
85
> [issue from wiki: ...unable to resolve DNS record look up of 0.ipaccess.pool.ntp.org... no trx].
86
Connect femtocell to LAN with internet access to resolve DNS record look up issue, still no phones are connecting (yet).
87 1 blobb
Adding SIM cards to hlr.db, after creating db successfully [thanks to "andreas":https://osmocom.org/projects/cellular-infrastructure/wiki/Accelerate3g5_--_andreas]
88
89 39 blobb
+_2017-04-20_+
90 1 blobb
Create and attach "build_3G.sh":https://osmocom.org/attachments/download/2602/build_3G.sh (adapted from "build_2G.sh":https://osmocom.org/attachments/download/2438/build_2G.sh).
91 68 blobb
Rebuild with correct branch/tag (openbsc:vlr_3G,libosmo-sccp:old_sua).
92 38 blobb
TD1 and TD2 *successfully connected* to femtocell!!! *\o/*
93 67 blobb
*Voice calls work* (TD1<->TD2).
94 53 blobb
95 1 blobb
+_2017-04-22_+
96
Create and attach "configure_nano3G.exp":https://projects.osmocom.org/attachments/download/2604/configure_nano3G.exp. 
97 71 blobb
> Invoke expect script within "run.sh":https://projects.osmocom.org/attachments/download/2559/3G-config-example-v3.tar to automate initial nano3G configuration via telnet. 
98 69 blobb
*SMS work* (TD1<->TD2), probably worked before but have been tested "today".
99 62 blobb
100 1 blobb
+_2017-04-24_+
101
Compile OpenBSC with --enable-mgcp-transcoding flag and create 127.0.0.2 on lo. :)
102
Attach refactored version of "build_3G.sh":https://projects.osmocom.org/attachments/download/2605/build_3G.sh.
103 81 blobb
*Data "works"* (TD1<->TD2, TDx<->tun0/192.168.42.1
104 75 blobb
>Note: data "worked" before (UEs got IP 2017-4-20). But I didn't manage to forward packets from tun0->eth0->inet yet, although the following iptable rule has been applied:
105 79 blobb
>>sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward" 
106 75 blobb
>>sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
107 73 blobb
108 74 blobb
+_2017-04-25_+
109 1 blobb
Create and attach "find_nano3G.sh":https://osmocom.org/attachments/download/2609/find_nano3G.sh.
110 102 blobb
Picked up TD4 at a friend's place. Now I don't need to change the SIM/USIM card in TD1, which is my "normal" cell phone to test functionality. *Thanks* a lot buddy :)
111 89 blobb
112 90 blobb
+_2017-04-26_+
113 92 blobb
As it actually belongs to the accelerate3g5 project, I add the "hands-on repo":https://github.com/blobbsen/repo-handson this journal.
114 99 blobb
> It provides functionality to clone necessary git repos and build accerelate3g5 CN stack.
115 7 blobb
116 93 blobb
+_2017-04-29_+
117 1 blobb
Test MMS, *doesn't* work.
118 113 blobb
I'd changed MCC and MNC from the "wiki-default":http://osmocom.org/projects/cellular-infrastructure/wiki/Configuring_the_ipaccess_nano3G values (MCC=901, MNC=98) to MCC=809 and MNC=90 on the hNodeB (telnet) to align with SIM-cards' IMSIs and avoid roaming. The result was: 
119 1 blobb
120 111 blobb
>S3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;   -> shows: 809 90 &nbsp;&nbsp;  roams: no &thinsp; (expected)
121
>S5 mini&nbsp; -> shows: 809 90 &nbsp;&nbsp;  roams: yes (confusing?!?!)
122
>Nexus 5 -> shows: 901 98 &nbsp;&nbsp;  roams: yes (expected)
123 1 blobb
124 113 blobb
125
So it seemed that configurations of MCC and MNC within osmo-msc.cfg do apply for some BB, because osmo-msc.cfg is the only config holding MCC=809 and MNC=90.
126
After aligning MCC and MNC between hNodeB and Osmo-MSC all UEs shows the correct "network name", but were all roaming... (TODO: understand roaming)
127 111 blobb
  
128
129 101 blobb
+_2017-04-30_+
130 96 blobb
Set csgAccessMode to CSG_ACCESS_MODE_CLOSED_ACCESS to avoid interfering with UEs now owned by me.
131 103 blobb
Set correct ip table rule. UE's have finally internet connection. *\o/* (GGSN listens on *lo* not on eth*)  
132 96 blobb
133 98 blobb
>sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward" 
134
>sudo iptables -t nat -A POSTROUTING -o lo -j MASQUERADE
135 96 blobb
136 114 blobb
137
+_2017-05-01_+
138
UEs are not roaming anymore *\o/*. Actually the explanation of a friend how the MCC and MNC has to be set according to the IMSI was correct, 
139 116 blobb
but I wasn't able to read the IMSI correct from the "sysmocom plastic card". Such IMSIs on the sysmocom plastic card consists of 18 digits. 
140 114 blobb
After comparing IMSIs on "plastic card" with IMSIs in delivery e-mail and using last mentioned digits it works. 
141 116 blobb
Moreover, I now know that the IMSI can ONLY hold 15 digits and consists of MCC (3), MNC (2-3) and MSIN (9-10).
142 114 blobb
143 24 blobb
h2. Conclusions
144 1 blobb
145 117 blobb
- UE's are connecting. Voice calls + SMS + data are working and UEs are *not* roaming. =)
146 100 blobb
147 84 blobb
&nbsp;
148
&nbsp;
Add picture from clipboard (Maximum size: 48.8 MB)