Project

General

Profile

Actions

Accelerate3g5 -- blobb » History » Revision 41

« Previous | Revision 41/153 (diff) | Next »
blobb, 04/20/2017 09:23 PM


Accelerate3g5 -- blobb

Summary

Trying to come up with a fuzzing interface.

Participants

Details

First setting up the femtocell and understand basics of UMTS communication. (almost done, data!)
Collecting information e.g. slides, talks, docu about fuzzing of wireless protocols. (done)
Writing some code to craft requests and run fuzz tests against subscriber. (tbd)

Note: first time fuzzing.

Test devices

TD1: Samsung Galaxy S5 Mini (G800F)
OS: Lineage OS (14.1/7.1.1)
BB: G800FXXU1BPC3
SIM: MicroSIM

TD2: LG Nexus 5 (hammerhead)
OS: Android Marshmallow (6.0)
BB: M48974A-2.0.50.2.27
SIM: MicroSIM

TD3: HTC One M9
OS: Android Lollipop (5.1)
BB: 01.04_U11440601_71.02.50709G_F
SIM: NanoSIM (cutted MicroSIM)

Journal

2017-03-07
Pick up package at the sysmocom office.
Having an informative conversation with Neels about jenkins.osmocom.

2017-03-12
Set up wiki page.
Seeing femtocell on network interface.
Compiled source as described, but couldn't configure/launch CN successfully (yet).
Next time will try Neels' launch script and same IP range.

2017-03-15
Reading data sheet [overview] data sheet [details] about ip.access nano3G S8.
Configuring femtocell via telnet (dry run).
Running in HLR issue mentioned in wiki when invoking run.sh.

2017_04-02
Collecting input about fuzzing:

papers:

SMS Fuzzing - SIM Toolkit Attack - B. Alecu, defcon21 2013
SMS Vulnerability Analysis on Feature Phones - N. Golde, 2011
Fuzzing the GSM Protocol - B. Hond, master thesis 2011

talks:

SMS Fuzzing - Sim Toolkit Attack - B. Alecu, Deepsec 2011
Using OpenBSC for fuzzing of GSM handsets - H. Welte, 26c3 2009

slides:

MobiDeke: Fuzzing the GSM Protocol Stack - S. Dudek & G. Delugr, hack.lu 2012
Base Jumping - Attacking the GSM BB and BTS - grugq, 2010
Fuzzing your GSM phone - Harald Welte, 26c3 2009
Fuzzing the Phone in your Phone - C. Miller & C. Mulliner, Blackhat 2009
Injecting SMS Messages into Smart Phones for Security Analysis - C. Mulliner, 2009
Security Testing esp. Fuzzing - E. Poll, ????

2017-04-19
Resolving HLR issue and set all IPs correct in *.cfg files.
hNodeB connects to owmo-hnbgw, but no UE is connecting to it.
Adding SIM cards to hlr.db, after creating db successfully (thanks

2017-04-20
Rebuild with correct branch/tag (openbsc:vlr_3G,libosmo-sccp:old_sua)
TD1 and TD2 successfully connected to femtocell!!! \o/
TD3 gets IP address but can not be called. TODO: investigate with wireshark
Voice calls work (TD1->TD2, TD2->TD1).
Data is not working TODO: make it work =)

Conclusions

- UE's are connecting and voice calls are working.

- network LED does not indicate whether IP has been assigned by DHCP server.
- umts LED does indicate whether cell is connected to hnbgw, etc pp.

Files (9)
build_3G.sh_old build_3G.sh_old 1.63 KB script to build 3G tailored CN stack to run nano3G (holding necessary branches/tags) blobb, 04/20/2017 11:48 PM
configure_nano3G.exp configure_nano3G.exp 520 Bytes expect script to configure nano3G in an automated manner (cuz we're lazy) blobb, 04/22/2017 08:19 PM
build_3G.sh build_3G.sh 959 Bytes refactored version of build_3G.sh_old (now with functions) blobb, 04/24/2017 09:34 PM
find_nano3G.sh find_nano3G.sh 823 Bytes script to find nano3G on network via nmap (portpattern) blobb, 04/25/2017 11:48 AM
nano3G_PCB_back.JPG View nano3G_PCB_back.JPG 3.32 MB full quality image blobb, 05/10/2017 02:47 PM
nano3G_PCB_front.jpg View nano3G_PCB_front.jpg 3.75 MB full quality image blobb, 05/10/2017 02:47 PM
nano3G_PCB_front_preview.jpg View nano3G_PCB_front_preview.jpg 586 KB small image for preview blobb, 05/10/2017 02:54 PM
nano3G_PCB_back_preview.jpg View nano3G_PCB_back_preview.jpg 548 KB small image for preview blobb, 05/10/2017 02:54 PM
ssh_banner.jpg View ssh_banner.jpg 31.7 KB blobb, 05/10/2017 03:01 PM

Updated by blobb almost 7 years ago · 41 revisions

Add picture from clipboard (Maximum size: 48.8 MB)