summaryrefslogtreecommitdiff
path: root/2010/gsm_security-dc2010/gsm_security-openbsc.tex
blob: 47d77e86e80e7abe928e72890df0e09e52a5eb95 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
% $Header: /cvsroot/latex-beamer/latex-beamer/solutions/conference-talks/conference-ornate-20min.en.tex,v 1.7 2007/01/28 20:48:23 tantau Exp $

\documentclass{beamer}

% This file is a solution template for:

% - Talk at a conference/colloquium.
% - Talk length is about 20min.
% - Style is ornate.



% Copyright 2004 by Till Tantau <tantau@users.sourceforge.net>.
%
% In principle, this file can be redistributed and/or modified under
% the terms of the GNU Public License, version 2.
%
% However, this file is supposed to be a template to be modified
% for your own needs. For this reason, if you use this file as a
% template and not specifically distribute it as part of a another
% package/program, I grant the extra permission to freely copy and
% modify this file as you see fit and even to delete this copyright
% notice. 


\mode<presentation>
{
  \usetheme{Warsaw}
  % or ...

  \setbeamercovered{transparent}
  % or whatever (possibly just delete it)
}


\usepackage[english]{babel}
% or whatever

\usepackage[latin1]{inputenc}
% or whatever

\usepackage{times}
\usepackage[T1]{fontenc}
% Or whatever. Note that the encoding and the font should match. If T1
% does not look nice, try deleting the line with the fontenc.


\title{GSM security nightmares}

\subtitle
{Running your own GSM network with OpenBSC}

\author{Harald Welte}

\institute
{gnumonks.org\\gpl-violations.org\\OpenBSC\\airprobe.org\\hmw-consulting.de}
% - Use the \inst command only if there are several affiliations.
% - Keep it simple, no one is interested in your street address.

\date[DORS/CLUC 2010] % (optional, should be abbreviation of conference name)
{DORS/CLUC 2010, May 2010, Zagreb/Croatia}
% - Either use conference name or its abbreviation.
% - Not really informative to the audience, more for people (including
%   yourself) who are reading the slides online

\subject{GSM Security}
% This is only inserted into the PDF information catalog. Can be left
% out. 



% If you have a file called "university-logo-filename.xxx", where xxx
% is a graphic format that can be processed by latex or pdflatex,
% resp., then you can add a logo as follows:

% \pgfdeclareimage[height=0.5cm]{university-logo}{university-logo-filename}
% \logo{\pgfuseimage{university-logo}}



% Delete this, if you do not want the table of contents to pop up at
% the beginning of each subsection:
%\AtBeginSubsection[]
%{
%  \begin{frame}<beamer>{Outline}
%    \tableofcontents[currentsection,currentsubsection]
%  \end{frame}
%}


% If you wish to uncover everything in a step-wise fashion, uncomment
% the following command: 

%\beamerdefaultoverlayspecification{<+->}


\begin{document}

\begin{frame}
  \titlepage
\end{frame}

\begin{frame}{Outline}
  \tableofcontents
  % You might wish to add the option [pausesections]
\end{frame}


% Structuring a talk is a difficult task and the following structure
% may not be suitable. Here are some rules that apply for this
% solution: 

% - Exactly two or three sections (other than the summary).
% - At *most* three subsections per section.
% - Talk about 30s to 2min per frame. So there should be between about
%   15 and 30 frames, all told.

% - A conference audience is likely to know very little of what you
%   are going to talk about. So *simplify*!
% - In a 20min talk, getting the main ideas across is hard
%   enough. Leave out details, even if it means being less precise than
%   you think necessary.
% - If you omit details that are vital to the proof/implementation,
%   just say so once. Everybody will be happy with that.

\begin{frame}{About the speaker}
\begin{itemize}
	\item Using + playing with Linux since 1994
	\item Kernel / bootloader / driver / firmware development since 1999
	\item IT security specialist, focus on network protocol security
	\item Board-level Electrical Engineering
	\item Always looking for interesting protocols (RFID, DECT, GSM)
\end{itemize}
\end{frame}

\section{GSM/3G security}

\begin{frame}{GSM/3G protocol security}
\begin{itemize}
	\item Observation
	\begin{itemize}
		\item Both GSM/3G and TCP/IP protocol specs are publicly available
		\item The Internet protocol stack (Ethernet/Wifi/TCP/IP) receives lots of scrutiny
		\item GSM networks are as widely deployed as the Internet
		\item Yet, GSM/3G protocols receive no such scrutiny!
	\end{itemize}
	\item There are reasons for that:
	\begin{itemize}
		\item GSM industry is extremely closed (and closed-minded)
		\item Only about 4 closed-source protocol stack implementations
		\item GSM chipset makers never release any hardware documentation
	\end{itemize}
\end{itemize}
\end{frame}

\subsection{The closed GSM industry}

\begin{frame}{The closed GSM industry}{Handset manufacturing side}
\begin{itemize}
	\item Only very few companies build GSM/3.5G baseband chips today
	\begin{itemize}
		\item Those companies buy the operating system kernel and the protocol stack from third parties
	\end{itemize}
	\item Only very few handset makers are large enough to become a customer
	\begin{itemize}
		\item Even they only get limited access to hardware documentation
		\item Even they never really get access to the firmware source
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{The closed GSM industry}{Network manufacturing side}
\begin{itemize}
	\item Only very few companies build GSM network equipment
	\begin{itemize}
		\item Basically only Ericsson, Nokia-Siemens, Alcatel-Lucent and Huawei
		\item Exception: Small equipment manufacturers for picocell / nanocell / femtocells / measurement devices and law enforcement equipment
	\end{itemize}
	\item Only operators buy equipment from them
	\item Since the quantities are low, the prices are extremely high
	\begin{itemize}
		\item e.g. for a BTS, easily 10-40k EUR
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{The closed GSM industry}{Operator side}
\begin{itemize}
	\item Operators are mainly banks today
	\item Typical operator outsources
	\begin{itemize}
		\item Billing
		\item Network planning / deployment / servicing
	\end{itemize}
	\item Operator just knows the closed equipment as shipped by manufacturer
	\item Very few people at an operator have knowledge of the protocol beyond what's needed for operations and maintenance
\end{itemize}
\end{frame}

\subsection{Security implications}

\begin{frame}{The closed GSM industry}{Security implications}
The security implications of the closed GSM industry are:
\begin{itemize}
	\item Almost no people who have detailed technical knowledge outside the protocol stack or GSM network equipment manufacturers
	\item No independent research on protocol-level security
	\begin{itemize}
		\item If there's security research at all, then only theoretical (like the A5/2 and A5/1 cryptanalysis)
		\item Or on application level (e.g. mobile malware)
	\end{itemize}
	\item No open source protocol implementations
	\begin{itemize}
		\item which are key for making more people learn about the protocols
		\item which enable quick prototyping/testing by modifying existing code
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{Security analysis of GSM}{How would you get started?}
If you were to start with GSM protocol level security analysis, where and
how would you start?
\begin{itemize}
	\item On the handset side?
	\begin{itemize}
		\item Difficult since GSM firmware and protocol stacks are closed and proprietary
		\item Even if you want to write your own protocol stack, the layer 1 hardware and signal processing is closed and undocumented, too
		\item Known attempts
		\begin{itemize}
			\item The TSM30 project as part of the THC GSM project
			\item mados, an alternative OS for Nokia DTC3 phones
		\end{itemize}
		\item none of those projects successful so far
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{Security analysis of GSM}{How would you get started?}
If you were to start with GSM protocol level security analysis, where and
how would you start?
\begin{itemize}
	\item On the network side?
	\begin{itemize}
		\item Difficult since equipment is not easily available and normally extremely expensive
		\item However, network is very modular and has many standardized/documented interfaces
		\item Thus, if equipment is available, much easier/faster progress
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{Security analysis of GSM}{The bootstrapping process}
\begin{itemize}
	\item Read GSM specs day and night (> 1000 PDF documents) ;)
	\item Gradually grow knowledge about the protocols
	\item Obtain actual GSM network equipment (BTS)
	\item Try to get actual protocol traces as examples
	\item Start a complete protocol stack implementation from scratch
	\item Finally, go and play with GSM protocol security
\end{itemize}
\end{frame}


\subsection{The GSM network}

\begin{frame}{The GSM network}
  \begin{figure}[h]
  \centering
  \includegraphics[width=100mm]{gsm_network.png}
  \end{figure}
\end{frame}

\begin{frame}{GSM network components}
  \begin{itemize}
    \item The BSS (Base Station Subsystem)
    \begin{itemize}
      \item MS (Mobile Station): Your phone
      \item BTS (Base Transceiver Station): The {\em cell tower}
      \item BSC (Base Station Controller): Controlling up to hundreds of BTS
    \end{itemize}
    \item The NSS (Network Sub System)
    \begin{itemize}
      \item MSC (Mobile Switching Center): The central switch
      \item HLR (Home Location Register): Database of subscribers
      \item AUC (Authentication Center): Database of authentication keys
      \item VLR (Visitor Location Register): For roaming users
      \item EIR (Equipment Identity Register): To block stolen phones
    \end{itemize}
  \end{itemize}
\end{frame}

\begin{frame}{GSM network interfaces}
  \begin{itemize}
    \item Um: Interface between MS and BTS
    \begin{itemize}
	\item the only interface that is specified over radio
    \end{itemize}
    \item A-bis: Interface between BTS and BSC
    \item A: Interface between BSC and MSC
    \item B: Interface between MSC and other MSC
  \end{itemize}
  GSM networks are a prime example of an asymmetric distributed network,
  very different from the end-to-end transparent IP network.
\end{frame}


\subsection{The GSM protocols}

\begin{frame}{GSM network protocols}{On the Um interface}
  \begin{itemize}
    \item Layer 1: Radio Layer, TS 04.04
    \item Layer 2: LAPDm, TS 04.06
    \item Layer 3: Radio Resource, Mobility Management, Call Control: TS 04.08
    \item Layer 4+: for USSD, SMS, LCS, ...
  \end{itemize}
\end{frame}

\begin{frame}{GSM network protocols}{On the A-bis interface}
  \begin{itemize}
    \item Layer 1: Typically E1 line, TS 08.54
    \item Layer 2: A variant of ISDN LAPD with fixed TEI's, TS 08.56
    \item Layer 3: OML (Organization and Maintenance Layer, TS 12.21)
    \item Layer 3: RSL (Radio Signalling Link, TS 08.58)
    \item Layer 4+: transparent messages that are sent to the MS via Um
  \end{itemize}
\end{frame}


\section{Implementing GSM protocols} 

\subsection{Getting started}

\begin{frame}{Implementing GSM protocols}{How I got started!}
\begin{itemize}
	\item In September 2008, we were first able to make the BTS active and see it on a phone
	\begin{itemize}
		\item This is GSM900 BTS with 2 TRX at 2W output power (each)
		\item A 48kg monster with attached antenna
		\item 200W power consumption, passive cooling
		\item E1 physical interface
	\end{itemize}
	\item I didn't have much time at the time (day job at Openmoko)
	\item Started to read up on GSM specs whenever I could
	\item Bought a HFC-E1 based PCI E1 controller, has mISDN kernel support
	\item Found somebody in the GSM industry who provided protocol traces
\end{itemize}
\end{frame}

\subsection{Timeline}

\begin{frame}{Implementing GSM protocols}{Timeline}
\begin{itemize}
	\item In November 2008, I started the development of OpenBSC
	\item In December 2008, we did a first demo at 25C3
	\item In January 2009, we had full voice call support
	\item In June 2009, I started with actual security related stuff
	\item In August 2009, we had the first field test with 2BTS and > 860 phones
\end{itemize}
\end{frame}

\subsection{OpenBSC}

\begin{frame}{Security analysis of GSM}{OpenBSC}
What is OpenBSC
\begin{itemize}
	\item A {\em GSM network in a box} software
	\item Implements minimal subset of BSC, MSC, HLR, SMSC
	\item Is Free and Open Source Software licensed under GNU GPL
	\item Supports Siemens BS-11 BTS (E1) and ip.access nanoBTS (IP based)
	\item Has classic 2G signalling, voice and SMS support
	\item Implements various GSM protocols like
	\begin{itemize}
		\item A-bis RSL (TS 08.58) and OML (TS 12.21)
		\item TS 04.08 Radio Resource, Mobility Management, Call Control
		\item TS 04.11 Short Message Service
	\end{itemize}
\end{itemize}
\end{frame}

\section{Security analysis}

\subsection{Theory}

\begin{frame}{Known GSM security problems}{Scientific papers, etc}
\begin{itemize}
	\item No mutual authentication between phone and network
	\begin{itemize}
		\item leads to rogue network attacks
		\item leads to man-in-the-middle attacks
		\item is what enables IMSI-catchers
	\end{itemize}
	\item Weak encryption algorithms
	\item Encryption is optional, user does never know when it's active or not
	\item DoS of the RACH by means of channel request flooding
	\item RRLP (Radio Resource Location Protocol)
	\begin{itemize}
		\item the network can obtain GPS fix or even raw GSM data from the phone
		\item combine that with the network not needing to authenticate itself
	\end{itemize}
\end{itemize}
\end{frame}

\subsection{The Baseband}

\begin{frame}{Known GSM security problems}{The Baseband side}
\begin{itemize}
	\item GSM protocol stack always runs in a so-called baseband processor (BP)
	\item What is the baseband processor
	\begin{itemize}
		\item Typically ARM7 (2G/2.5G phones) or ARM9 (3G/3.5G phones)
		\begin{itemize}
			\item Runs some RTOS (often Nucleus, sometimes L4)
			\item No memory protection between tasks
		\end{itemize}
		\item Some kind of DSP, model depends on vendor
		\begin{itemize}
			\item Runs the digital signal processing for the RF Layer 1
			\item Has hardware peripherals for A5 encryption
		\end{itemize}
	\end{itemize}
	\item The software stack on the baseband processor
	\begin{itemize}
		\item is written in C and assembly
		\item lacks any modern security features (stack protection, non-executable pages, address space randomization, ..)
	\end{itemize}
\end{itemize}
\end{frame}

\subsection{Observations}

\begin{frame}{Interesting observations}{Learned from implementing the stack}
While developing OpenBSC, we observed a number of interesting
\begin{itemize}
	\item Many phones use their TMSI from the old network when they roam to a new network
	\item Various phones crash when confronted with incorrect messages.  We didn't even start to intentionally send incorrect messages (!)
	\item There are tons of obscure options on the GSM spec which no real network uses.  Potential attack vector by using rarely tested code paths.
\end{itemize}
\end{frame}

\subsection{GSM Protocol Fuzzing}

\begin{frame}{GSM Protocol Fuzzing}{Theoretical basis}
How to do GSM protocol fuzzing
\begin{itemize}
	\item From the handset to the network
	\begin{itemize}
		\item Basically impossible due to closeness of baseband
		\item However, some incomplete projects working on it
	\end{itemize}
	\item From the network side
	\begin{itemize}
		\item Easy in case of {\em rogue network} attacks
		\item Fuzzing target is the GSM stack in the baseband processor
	\end{itemize}
	\item As an A-bis man in the middle
	\begin{itemize}
		\item Needs access to an A-bis interface of an actual network
		\item Very attractive, since no encryption and ability to fuzz both network and handset
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{A-bis injection}{for A-bis over IP}
How to do inject messages into A-bis over IP?
\begin{itemize}
	\item Problem
	\begin{itemize}
		\item A-bis/IP uses one TCP connection for OML and RSL messages
		\item OML initialization is essential for BTS to become operational
		\item TCP makes insertion of additional messages relatively hard
	\end{itemize}
	\item Solution: Build an {\em A-bis injection proxy}
	\begin{itemize}
		\item Transparently pass OML and RSL packets between BTS and BSC
		\item Add additional stateless UDP sockets for injecting messages, one socket each for
	\end{itemize}
	\begin{itemize}
		\item injecting OML/RSL to the network
		\item injecting OML/RSL to the BTS
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{A-bis Injection Proxy}{Principle of operation}
\begin{itemize}
	\item Proxy needs to be brought between BTS and BSC
	\item Luckily, A-bis/IP SSL support not always used
	\item Thus, physical access to the Ethernet link sufficient
	\item Configure system with two interfaces
	\begin{itemize}
		\item BSC-facing interface has IP of BTS
		\item BTS-facing interface has IP of BSC / default gw
	\end{itemize}
	\item BTS will make TCP connection to proxy
	\item proxy will make independent TCP connection to BSC
\end{itemize}
\end{frame}

\begin{frame}{scapy GSM support}{The actual fuzzing}
How to actually craft the packets for the fuzzing
\begin{itemize}
	\item GSM has many, many protocols
	\item Writing custom code will be a hard-coded special case for each of them
	\item Solution: Use scapy and implement the GSM protocols as scapy "layers"
	\begin{itemize}
		\item IPA protocol header
		\item RSL protocol layer
		\item RLL data indication / data request
		\item GSM 04.08 RR / MM / CC messages
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{OpenBSC silent calls}{A more elegant fuzzing interface}
\begin{itemize}
	\item Injection at the A-bis level has many problems
	\begin{itemize}
		\item you can only do it while a call is active
		\item you simply piggy-back on existing RR connections
	\end{itemize}
	\item The OpenBSC {\em silent call} feature can help
	\begin{itemize}
		\item we use OpenBSC to establish a RR connection
		\item in the GSM master/slave model, the phone will not close a connection unless told to do so
		\item we then send arbitrary data to the phone and receive its responses
		\item this currently only works from within OpenBSC, but we'll provide UDP injection sockets soon
	\end{itemize}
\end{itemize}
\end{frame}

\section{Summary}

\subsection{What we've learned}

\begin{frame}{Summary}{What we've learned}
\begin{itemize}
	\item The GSM industry is making security analysis very difficult
	\item It is well-known that the security level of the GSM stacks is very low
	\item We now have multiple solutions for sending arbitrary protocol data
	\begin{itemize}
		\item From a rogue network to phones (OpenBSC, OpenBTS)
		\item From an a-bis proxy to the network or the phones
	\end{itemize}
	\item There is ongoing work for a phone-based tool to fuzz the network
\end{itemize}
\end{frame}

\subsection{Where we go from here}

\begin{frame}{TODO}{Where we go from here}
\begin{itemize}
	\item The tools for fuzzing mobile phone protocol stacks are available
	\item It is up to the security community to make use of those tools (!)
	\item Don't you too think that TCP/IP security is boring
	\item Join the GSM protocol security research projects
	\item Boldly go where no man has gone before
\end{itemize}
\end{frame}

\subsection{Where we go from here}

\begin{frame}{Current Areas of Work / Future plans}
\begin{itemize}
	\item Packet data (GPRS/EDGE) support in OpenBSC
	\begin{itemize}
		\item GPRS/EDGE is used extensively on modern smartphones
		\item Enables us to play on IP level with those phones without a heavily filtered operator network
	\end{itemize}
	\item UMTS(3G) support in OpenBSC
	\item Access to MS side layer 1
	\item Playing with SIM Toolkit from the operator side
	\item Playing with MMS
	\item More exploration of RRLP
\end{itemize}
\end{frame}

\subsection{Further Reading}

\begin{frame}{Further Reading}
\begin{itemize}
	\item http://openbsc.gnumonks.org/
	\item http://airprobe.org/
	\item http://openbts.sourceforge.net/
	\item http://bb.osmocom.org/
\end{itemize}
\end{frame}

\end{document}
personal git repositories of Harald Welte. Your mileage may vary