1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
|
% Day 2
\part{Security Research}
\section{Researching GSM/3G security}
\subsection{An interesting observation}
\begin{frame}{GSM/3G protocol level security}
\begin{itemize}
\item Observation
\begin{itemize}
\item Both GSM/3G and TCP/IP protocol specs are publicly available
\item The Internet protocol stack (Ethernet/Wifi/TCP/IP) receives lots of scrutiny
\item GSM networks are as widely deployed as the Internet
\item Yet, GSM/3G protocols receive no such scrutiny!
\end{itemize}
\item There are reasons for that:
\begin{itemize}
\item GSM industry is extremely closed (and closed-minded)
\item Only about 4 closed-source protocol stack implementations
\item GSM chip set makers never release any hardware documentation
\end{itemize}
\end{itemize}
\end{frame}
\subsection{The closed GSM industry -- Handset side}
\begin{frame}{The closed GSM industry}{Handset manufacturing side}
\begin{itemize}
\item Only very few companies build GSM/3.5G baseband chips today
\begin{itemize}
\item Those companies buy the operating system kernel and the protocol stack from third parties
\end{itemize}
\item Only very few handset makers are large enough to become a customer
\begin{itemize}
\item Even they only get limited access to hardware documentation
\item Even they never really get access to the firmware source
\end{itemize}
\end{itemize}
\end{frame}
\subsection{The closed GSM industry -- Network side}
\begin{frame}{The closed GSM industry}{Network manufacturing side}
\begin{itemize}
\item Only very few companies build GSM network equipment
\begin{itemize}
\item Basically only Ericsson, Nokia-Siemens, Alcatel-Lucent and Huawei
\item Exception: Small equipment manufacturers for picocell / nanocell / femtocells / measurement devices and law enforcement equipment
\end{itemize}
\item Only operators buy equipment from them
\item Since the quantities are low, the prices are extremely high
\begin{itemize}
\item e.g. for a BTS, easily 10-40k EUR
\item minimal network using standard components definitely in the 100,000s of EUR range
\end{itemize}
\end{itemize}
\end{frame}
\begin{frame}{The closed GSM industry}{Operator side}
From my experience with Operators (prove me wrong!)
\begin{itemize}
\item Operators are mainly finance + marketing today
\item Many operators outsources
\begin{itemize}
\item Network servicing / deployment, even planning
\item Other aspects of business like Billing
\end{itemize}
\item Operator just knows the closed equipment as shipped by manufacturer
\item Very few people at an operator have knowledge of the protocol beyond what's needed for operations and maintenance
\end{itemize}
\end{frame}
\begin{frame}{GSM networks are victim and source of attacks on user privacy}
\includegraphics[bb=0in 0in 12in 6in,clip,width=5.3in,page=7]{nohl-slides-14.pdf}
\end{frame}
\begin{frame}{Network operator and manufacturer can install software on a phone}
\includegraphics[bb=0in 0in 12in 6in,clip,width=5.3in,page=8]{nohl-slides-14.pdf}
\end{frame}
\subsection{Security implications}
\begin{frame}{The closed GSM industry}{Security implications}
The security implications of the closed GSM industry are:
\begin{itemize}
\item Almost no people who have detailed technical knowledge outside the protocol stack or GSM network equipment manufacturers
\item No independent research on protocol-level security
\begin{itemize}
\item If there's security research at all, then only theoretical (like the A5/2 and A5/1 cryptanalysis)
\item Or on application level (e.g. mobile malware)
\end{itemize}
\item No open source protocol implementations
\begin{itemize}
\item which are key for making more people learn about the protocols
\item which enable quick prototyping/testing by modifying existing code
\end{itemize}
\end{itemize}
\end{frame}
\begin{frame}{Security analysis of GSM}{How would you get started?}
If you were to start with GSM protocol level security analysis, where and
how would you start?
\begin{itemize}
\item On the handset side?
\begin{itemize}
\item Difficult since GSM firmware and protocol stacks are closed and proprietary
\item Even if you want to write your own protocol stack, the layer 1 hardware and signal processing is closed and undocumented, too
\item Known attempts
\begin{itemize}
\item The TSM30 project as part of the THC GSM project
\item MADos, an alternative OS for Nokia DTC3 phones
\end{itemize}
\item Since 2010 we have a new project: {\tt OsmocomBB}
\end{itemize}
\end{itemize}
\end{frame}
\begin{frame}{Security analysis of GSM}{How would you get started?}
If you were to start with GSM protocol level security analysis, where and
how would you start?
\begin{itemize}
\item On the network side?
\begin{itemize}
\item Difficult since equipment is not easily available and normally extremely expensive
\item However, network is very modular and has many standardized/documented interfaces
\item Thus, if equipment is available, much easier/faster progress
\item Also, using SDR (software defined radio) approach, special-purpose / closed hardware can be avoided
\end{itemize}
\end{itemize}
\end{frame}
\begin{frame}{Security analysis of GSM}{The bootstrapping process}
\begin{itemize}
\item Read GSM specs day and night (> 1000 PDF documents)
\item Gradually grow knowledge about the protocols
\begin{itemize}
\item OpenBSC: Obtain actual GSM network equipment (BTS)
\item OpenBTS: Develop SDR based GSM Um Layer 1
\end{itemize}
\item Try to get actual protocol traces as examples
\item Start a complete protocol stack implementation from scratch
\item Finally, go and play with GSM protocol security
\end{itemize}
\end{frame}
|
