Accelerate3g5 -- blobb » History » Revision 65
Revision 64 (blobb, 04/24/2017 09:39 PM) → Revision 65/153 (blobb, 04/24/2017 09:39 PM)
h1. Accelerate3g5 -- blobb
h2. Summary
Trying to come up with a fuzzing interface.
h3. Participants
* André Boddenberg (email: dr.blobb@gmail.com)
h2. Details
First setting up the femtocell and understand necessary basics of UMTS communication to do so. (done)
Collecting information e.g. slides, talks, docu about fuzzing of wireless protocols. (done)
Writing some code to craft requests and run fuzz tests against subscriber. (to be done)
Note: first time fuzzing.
h2. Test devices
TD1: Samsung Galaxy S5 Mini (G800F)
OS: Lineage OS (14.1/7.1.1)
BB: G800FXXU1BPC3
SIM: MicroSIM
TD2: LG Nexus 5 (hammerhead)
OS: Android Marshmallow (6.0)
BB: M48974A-2.0.50.2.27
SIM: MicroSIM
TD3: HTC One M9
OS: Android Lollipop (5.1)
BB: 01.04_U11440601_71.02.50709G_F
SIM: NanoSIM (cutted MicroSIM)
h2. Journal
+_2017-03-07_+
Pick up package at Sysmocom office.
Having an informative conversation with Neels about Jenkins, Docker and build artifacts.
+_2017-03-12_+
Set up wiki page.
Seeing femtocell on network interface.
Compiled source as described, but couldn't configure/launch CN successfully (yet).
Next time will try Neels' launch script and same IP range.
+_2017-03-15_+
Reading "data sheet [overview]":http://www.ipaccess.com/uploads/wysiwyg_editor/files/2017/S8_S16-Datasheet-v1.0.pdf "data sheet [details]":https://fccid.io/pdf.php?id=1462491 about ip.access nano3G S8.
Configuring femtocell via telnet (dry run).
Running in HLR issue mentioned in wiki when invoking run.sh.
+_2017_04-02_+
Collecting input about fuzzing:
papers/theses:
>"SMS Fuzzing - SIM Toolkit Attack - B. Alecu, defcon21 2013":https://www.defcon.org/images/defcon-21/dc-21-presentations/Alecu/DEFCON-21-Bogdan-Alecu-Attacking-SIM-Toolkit-with-SMS-WP.pdf
>"SMS Vulnerability Analysis on Feature Phones - N. Golde, 2011":http://www.isti.tu-berlin.de/fileadmin/fg214/finished_theses/NicoGolde/diplom_golde.pdf
>"Fuzzing the GSM Protocol - B. Hond, master thesis 2011":http://www.ru.nl/publish/pages/769526/scriptie-brinio-final-brinio_hond.pdf
talks:
>"SMS Fuzzing - Sim Toolkit Attack - B. Alecu, Deepsec 2011":http://www.securitytube.net/video/2518
>"Using OpenBSC for fuzzing of GSM handsets - H. Welte, 26c3 2009":http://mirror.fem-net.de/CCC/26C3/mp4/26c3-3535-en-using_openbsc_for_fuzzing_of_gsm_handsets.mp4
slides:
>"MobiDeke: Fuzzing the GSM Protocol Stack - S. Dudek & G. Delugr, hack.lu 2012":http://archive.hack.lu/2012/Fuzzing_The_GSM_Protocol_Stack_-_Sebastien_Dudek_Guillaume_Delugre.pdf
>"Base Jumping - Attacking the GSM BB and BTS - grugq, 2010":http://conference.hackinthebox.org/hitbsecconf2010kul/materials/D2T1%20-%20The%20Grugq%20-%20Attacking%20GSM%20Basestations.pdf
>"Fuzzing your GSM phone - Harald Welte, 26c3 2009":https://events.ccc.de/congress/2009/Fahrplan/attachments/1503_openbsc_gsm_fuzzing.pdf
>"Fuzzing the Phone in your Phone - C. Miller & C. Mulliner, Blackhat 2009":https://engineering.purdue.edu/dcsl/reading/2011/jevin-fuzzing.pdf
>"Injecting SMS Messages into Smart Phones for Security Analysis - C. Mulliner, 2009":https://www.mulliner.org/security/sms/feed/injecting_sms_mulliner_miller.pdf
>"Security Testing esp. Fuzzing - E. Poll, ????":https://www.cs.ru.nl/E.Poll/ss/slides/12_Fuzzing.pdf
+_2017-04-19_+
Resolving HLR issue and set correct IPs in "*.cfg files":https://osmocom.org/attachments/download/2559/3G-config-example-v3.tar.
hNodeB connects to hnbgw, but no UE is connecting to it.
> [issue from wiki: ...unable to resolve DNS record look up of 0.ipaccess.pool.ntp.org... no trx].
Connect femtocell to LAN with internet access to resolve DNS record look up issue, still no phones are connecting (yet).
Adding SIM cards to hlr.db, after creating db successfully [thanks to "andreas":https://osmocom.org/projects/cellular-infrastructure/wiki/Accelerate3g5_--_andreas]
+_2017-04-20_+
Rebuild with correct branch/tag (openbsc:vlr_3G,libosmo-sccp:old_sua).
Create and attach "build_3G.sh":https://osmocom.org/attachments/download/2602/build_3G.sh (adapted from "build_2G.sh":https://osmocom.org/attachments/download/2438/build_2G.sh).
TD1 and TD2 *successfully connected* to femtocell!!! *\o/*
TD3 gets IP address but can not be called. *TODO*: investigate with wireshark
Voice calls work (TD1<->TD2).
+_2017-04-22_+
Create and attach "configure_nano3G.exp":https://projects.osmocom.org/attachments/download/2604/configure_nano3G.exp.
>Invoke expect script within "run.sh":https://projects.osmocom.org/attachments/download/2559/3G-config-example-v3.tar to automate initial nano3G configuration via telnet.
SMS works (TD1<->TD2).
+_2017-04-24_+
Attach refactored version of "build_3G.sh":https://projects.osmocom.org/attachments/download/2605/build_3G.sh.
Data works TD1<->TD2, TDx<->tun0/192.168.42.1, but TDx<->inet not! *TODO:* fix TDx<->inet issue
h2. Conclusions
- UE's are connecting and voice calls are working.
>- network LED does not indicate whether IP has been assigned by DHCP server.
>- umts LED does indicate whether cell is connected to hnbgw, etc pp.