Accelerate3g5 -- blobb » History » Version 28
blobb, 04/20/2017 08:55 PM
| 1 | 1 | blobb | h1. Accelerate3g5 -- blobb |
|---|---|---|---|
| 2 | 2 | blobb | |
| 3 | h2. Summary |
||
| 4 | |||
| 5 | 3 | blobb | Trying to come up with a fuzzing interface. |
| 6 | |||
| 7 | 2 | blobb | h3. Participants |
| 8 | |||
| 9 | * André Boddenberg (email: dr.blobb@gmail.com) |
||
| 10 | |||
| 11 | h2. Details |
||
| 12 | 3 | blobb | |
| 13 | 26 | blobb | First setting up the femtocell and understand basics of UMTS communication. (almost done) |
| 14 | 25 | blobb | Collecting information e.g. slides, talks, docu about fuzzing of wireless protocols. (started) |
| 15 | Writing some code to craft requests and run fuzz tests against subscriber. (tbd) |
||
| 16 | 1 | blobb | |
| 17 | Note: first time fuzzing. |
||
| 18 | |||
| 19 | 25 | blobb | h2. Test devices |
| 20 | |||
| 21 | TD1: Samsung Galaxy S5 Mini (G800F) |
||
| 22 | OS: Lineage OS (14.1/7.1.1) |
||
| 23 | BB: G800FXXU1BPC3 |
||
| 24 | SIM: MicroSIM |
||
| 25 | |||
| 26 | TD2: LG Nexus 5 (hammerhead) |
||
| 27 | OS: Android Marshmallow (6.0) |
||
| 28 | BB: M48974A-2.0.50.2.27 |
||
| 29 | SIM: MicroSIM |
||
| 30 | |||
| 31 | TD3: HTC One M9 |
||
| 32 | OS: Android Lollipop (5.1) |
||
| 33 | BB: 01.04_U11440601_71.02.50709G_F |
||
| 34 | SIM: NanoSIM (cutted MicroSIM) |
||
| 35 | |||
| 36 | |||
| 37 | 7 | blobb | h2. Journal |
| 38 | |||
| 39 | _2017-03-07_ |
||
| 40 | 2 | blobb | pick up package at the sysmocom office. |
| 41 | 10 | blobb | having an informative conversation with Neels about jenkins.osmocom. |
| 42 | 8 | blobb | |
| 43 | 11 | blobb | _2017-03-12_ |
| 44 | 10 | blobb | Set up wiki page. |
| 45 | 26 | blobb | Seeing femtocell on network interface. |
| 46 | 1 | blobb | Compiled source as described, but couldn't configure/launch CN successfully (yet). |
| 47 | 26 | blobb | Next time will try Neels' launch script and same IP range. |
| 48 | 1 | blobb | |
| 49 | _2017-03-15_ |
||
| 50 | Reading "data sheet [overview]":http://www.ipaccess.com/uploads/wysiwyg_editor/files/2017/S8_S16-Datasheet-v1.0.pdf "data sheet [details]":https://fccid.io/pdf.php?id=1462491 about ip.access nano3G S8. |
||
| 51 | Configuring femtocell via telnet (dry run). |
||
| 52 | Running in HLR issue mentioned in wiki when invoking run.sh. |
||
| 53 | 12 | blobb | |
| 54 | 26 | blobb | _2017_04-02_ |
| 55 | |||
| 56 | Lecture about Fuzzing: |
||
| 57 | 28 | blobb | "SMS Fuzzing - SIM Toolkit Attack - B. Alecu (2013)":https://www.defcon.org/images/defcon-21/dc-21-presentations/Alecu/DEFCON-21-Bogdan-Alecu-Attacking-SIM-Toolkit-with-SMS-WP.pdf |
| 58 | 26 | blobb | |
| 59 | Talks about Fuzzing: |
||
| 60 | 28 | blobb | "Using OpenBSC for fuzzing of GSM handsets - H. Welte (2009)":http://mirror.fem-net.de/CCC/26C3/mp4/26c3-3535-en-using_openbsc_for_fuzzing_of_gsm_handsets.mp4 |
| 61 | 26 | blobb | |
| 62 | Slides about Fuzzing: |
||
| 63 | 28 | blobb | "MobiDeke: Fuzzing the GSM Protocol Stack - S. Dudek& G. Delugr(2012)":http://archive.hack.lu/2012/Fuzzing_The_GSM_Protocol_Stack_-_Sebastien_Dudek_Guillaume_Delugre.pdf |
| 64 | "Fuzzing your GSM phone - Harald Welte (2009)":https://events.ccc.de/congress/2009/Fahrplan/attachments/1503_openbsc_gsm_fuzzing.pdf |
||
| 65 | "Fuzzing the Phone in your Phone - C. Miller & C. Mulliner (2009)":https://engineering.purdue.edu/dcsl/reading/2011/jevin-fuzzing.pdf |
||
| 66 | |||
| 67 | 26 | blobb | |
| 68 | 1 | blobb | _2017-04-19_ |
| 69 | 25 | blobb | Resolving HLR issue and set all IPs correct in *.cfg files. |
| 70 | hNodeB connects to owmo-hnbgw, but no UE is connecting to it. |
||
| 71 | Adding SIM cards to hlr.db, after creating db successfully (thanks |
||
| 72 | 1 | blobb | |
| 73 | _2017-04-20_ |
||
| 74 | 27 | blobb | rebuild with correct branch/tag (openbsc:vlr_3G,libosmo-sccp:old_sua) |
| 75 | TD1 and TD2 *successfully connected* to the femtocell!!! *\o/* |
||
| 76 | TD3 gets IP address but can not be called. *TODO*: investigate with wireshark |
||
| 77 | 25 | blobb | voice calls work (TD1->TD2, TD2->TD1). |
| 78 | 27 | blobb | data is not working *TODO*: make it work :) |
| 79 | 24 | blobb | |
| 80 | 7 | blobb | |
| 81 | 24 | blobb | h2. Conclusions |
| 82 | 1 | blobb | |
| 83 | 25 | blobb | - UE's are connecting and voice calls are working :) |
| 84 | >- network LED does not indicate whether IP has been assigned by DHCP server. |
||
| 85 | >- umts LED does indicate whether cell is connected to hnbgw, etc pp. |
