Project

General

Profile

Accelerate3g5 -- blobb » History » Version 30

blobb, 04/20/2017 09:11 PM

1 1 blobb
h1. Accelerate3g5 -- blobb
2 2 blobb
3
h2. Summary
4
5 3 blobb
Trying to come up with a fuzzing interface.
6
7 2 blobb
h3. Participants
8
9
* André Boddenberg (email: dr.blobb@gmail.com)
10
11
h2. Details
12 3 blobb
13 26 blobb
First setting up the femtocell and understand basics of UMTS communication.  (almost done)
14 25 blobb
Collecting information e.g. slides, talks, docu about fuzzing of wireless protocols. (started)
15
Writing some code to craft requests and run fuzz tests against subscriber. (tbd)
16 1 blobb
17
Note: first time fuzzing.
18
19 25 blobb
h2. Test devices
20
21
TD1: Samsung Galaxy S5 Mini (G800F) 
22
 OS: Lineage OS (14.1/7.1.1) 
23
 BB: G800FXXU1BPC3
24
SIM: MicroSIM
25
26
TD2: LG Nexus 5 (hammerhead)
27
 OS: Android Marshmallow (6.0) 
28
 BB: M48974A-2.0.50.2.27
29
SIM: MicroSIM
30
31
TD3: HTC One M9
32
 OS: Android Lollipop (5.1)
33
 BB: 01.04_U11440601_71.02.50709G_F
34
SIM: NanoSIM (cutted MicroSIM)
35
36
37 7 blobb
h2. Journal
38
39
_2017-03-07_
40 2 blobb
pick up package at the sysmocom office.
41 10 blobb
having an informative conversation with Neels about jenkins.osmocom.
42 8 blobb
43 11 blobb
_2017-03-12_
44 10 blobb
Set up wiki page.
45 26 blobb
Seeing femtocell on network interface.
46 1 blobb
Compiled source as described, but couldn't configure/launch CN successfully (yet).
47 26 blobb
Next time will try Neels' launch script and same IP range.
48 1 blobb
49
_2017-03-15_
50
Reading "data sheet [overview]":http://www.ipaccess.com/uploads/wysiwyg_editor/files/2017/S8_S16-Datasheet-v1.0.pdf "data sheet [details]":https://fccid.io/pdf.php?id=1462491 about ip.access nano3G S8.
51
Configuring femtocell via telnet (dry run).
52
Running in HLR issue mentioned in wiki when invoking run.sh.
53 12 blobb
54 26 blobb
_2017_04-02_
55
56
Lecture about Fuzzing:
57 29 blobb
"SMS Fuzzing - SIM Toolkit Attack - B. Alecu, defcon21 2013":https://www.defcon.org/images/defcon-21/dc-21-presentations/Alecu/DEFCON-21-Bogdan-Alecu-Attacking-SIM-Toolkit-with-SMS-WP.pdf
58 30 blobb
"Fuzzing the GSM Protocol - B. Hond, master thesis 2011":www.ru.nl/publish/pages/769526/scriptie-brinio-final-brinio_hond.pdf
59 26 blobb
60
Talks about Fuzzing:
61 30 blobb
"SMS Fuzzing - Sim Toolkit Attack - B. Alecu, Deepsec 2011":http://www.securitytube.net/video/2518
62 29 blobb
"Using OpenBSC for fuzzing of GSM handsets - H. Welte, 26c3 2009":http://mirror.fem-net.de/CCC/26C3/mp4/26c3-3535-en-using_openbsc_for_fuzzing_of_gsm_handsets.mp4
63 26 blobb
64
Slides about Fuzzing:
65 29 blobb
"MobiDeke: Fuzzing the GSM Protocol Stack - S. Dudek & G. Delugr, hack.lu 2012":http://archive.hack.lu/2012/Fuzzing_The_GSM_Protocol_Stack_-_Sebastien_Dudek_Guillaume_Delugre.pdf
66 30 blobb
"Base Jumping - Attacking the GSM BB and BTS - grugq, 2010":http://conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1%20-%20The%20Grugq%20-%20Attacking%20GSM%20Basestations.pdf
67 29 blobb
"Fuzzing your GSM phone - Harald Welte, 26c3 2009":https://events.ccc.de/congress/2009/Fahrplan/attachments/1503_openbsc_gsm_fuzzing.pdf
68
"Fuzzing the Phone in your Phone - C. Miller & C. Mulliner, Blackhat 2009":https://engineering.purdue.edu/dcsl/reading/2011/jevin-fuzzing.pdf
69 30 blobb
"Injecting SMS Messages into Smart Phones for Security Analysis - C. Mulliner, 2009":https://www.mulliner.org/security/sms/feed/injecting_sms_mulliner_miller.pdf
70
"Security Testing esp. Fuzzing - E. Poll, ????":https://www.cs.ru.nl/E.Poll/ss/slides/12_Fuzzing.pdf
71 28 blobb
72 26 blobb
73 1 blobb
_2017-04-19_
74 25 blobb
Resolving HLR issue and set all IPs correct in *.cfg files. 
75
hNodeB connects to owmo-hnbgw, but no UE is connecting to it.
76
Adding SIM cards to hlr.db, after creating db successfully (thanks
77 1 blobb
78
_2017-04-20_
79 27 blobb
rebuild with correct branch/tag (openbsc:vlr_3G,libosmo-sccp:old_sua)
80
TD1 and TD2 *successfully connected* to the femtocell!!! *\o/*
81
TD3 gets IP address but can not be called. *TODO*: investigate with wireshark
82 25 blobb
voice calls work (TD1->TD2, TD2->TD1). 
83 27 blobb
data is not working *TODO*: make it work :)
84 24 blobb
85 7 blobb
86 24 blobb
h2. Conclusions
87 1 blobb
88 25 blobb
- UE's are connecting and voice calls are working :) 
89
>- network LED does not indicate whether IP has been assigned by DHCP server.
90
>- umts LED does indicate whether cell is connected to hnbgw, etc pp.
Add picture from clipboard (Maximum size: 48.8 MB)