summaryrefslogtreecommitdiff
path: root/2017/osmocom-knf2017/osmocom-overview.tex
blob: 0905e86e4779adf39579e69918bcf7cbca41bfe3 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
% $Header: /cvsroot/latex-beamer/latex-beamer/solutions/conference-talks/conference-ornate-20min.en.tex,v 1.7 2007/01/28 20:48:23 tantau Exp $

\documentclass{beamer}

\usepackage{url}
\makeatletter
\def\url@leostyle{%
  \@ifundefined{selectfont}{\def\UrlFont{\sf}}{\def\UrlFont{\tiny\ttfamily}}}
\makeatother
%% Now actually use the newly defined style.
\urlstyle{leo}


% This file is a solution template for:

% - Talk at a conference/colloquium.
% - Talk length is about 20min.
% - Style is ornate.



% Copyright 2004 by Till Tantau <tantau@users.sourceforge.net>.
%
% In principle, this file can be redistributed and/or modified under
% the terms of the GNU Public License, version 2.
%
% However, this file is supposed to be a template to be modified
% for your own needs. For this reason, if you use this file as a
% template and not specifically distribute it as part of a another
% package/program, I grant the extra permission to freely copy and
% modify this file as you see fit and even to delete this copyright
% notice. 


\mode<presentation>
{
  \usetheme{Warsaw}
  % or ...

  \setbeamercovered{transparent}
  % or whatever (possibly just delete it)
}


\usepackage[english]{babel}
% or whatever

%\usepackage[latin1]{inputenc}
% or whatever

\usepackage{times}
\usepackage[T1]{fontenc}
% Or whatever. Note that the encoding and the font should match. If T1
% does not look nice, try deleting the line with the fontenc.


\title{osmocom.org - FOSS for mobile comms}

\subtitle
{community based Free / Open Source Software for communications}

\author{Harald Welte <laforge@gnumonks.org>}

\institute
{gnumonks.org\\hmw-consulting.de\\sysmocom GmbH}
% - Use the \inst command only if there are several affiliations.
% - Keep it simple, no one is interested in your street address.

\date[] % (optional, should be abbreviation of conference name)
{Nov 26, 2017, KNF-Kongress}
% - Either use conference name or its abbreviation.
% - Not really informative to the audience, more for people (including
%   yourself) who are reading the slides online

\subject{Communications}
% This is only inserted into the PDF information catalog. Can be left
% out. 



% If you have a file called "university-logo-filename.xxx", where xxx
% is a graphic format that can be processed by latex or pdflatex,
% resp., then you can add a logo as follows:

% \pgfdeclareimage[height=0.5cm]{university-logo}{university-logo-filename}
% \logo{\pgfuseimage{university-logo}}



% Delete this, if you do not want the table of contents to pop up at
% the beginning of each subsection:
%\AtBeginSubsection[]
%{
%  \begin{frame}<beamer>{Outline}
%    \tableofcontents[currentsection,currentsubsection]
%  \end{frame}
%}


% If you wish to uncover everything in a step-wise fashion, uncomment
% the following command: 

%\beamerdefaultoverlayspecification{<+->}


\begin{document}

\begin{frame}
  \titlepage
\end{frame}

\begin{frame}{Outline}
  \tableofcontents[hideallsubsections]
  % You might wish to add the option [pausesections]
\end{frame}


% Structuring a talk is a difficult task and the following structure
% may not be suitable. Here are some rules that apply for this
% solution: 

% - Exactly two or three sections (other than the summary).
% - At *most* three subsections per section.
% - Talk about 30s to 2min per frame. So there should be between about
%   15 and 30 frames, all told.

% - A conference audience is likely to know very little of what you
%   are going to talk about. So *simplify*!
% - In a 20min talk, getting the main ideas across is hard
%   enough. Leave out details, even if it means being less precise than
%   you think necessary.
% - If you omit details that are vital to the proof/implementation,
%   just say so once. Everybody will be happy with that.

\begin{frame}{About the speaker}
\begin{itemize}
	\item Using + toying with Linux since 1994
	\item Kernel / bootloader / driver / firmware development since 1999
	\item IT security expert, focus on network protocol security
	\item Former core developer of Linux packet filter netfilter/iptables
	\item Board-level Electrical Engineering
	\item Always looking for interesting protocols (RFID, DECT, GSM)
	\item OpenEXZ, OpenPCD, Openmoko, OpenBSC, OsmocomBB, OsmoSGSN
\end{itemize}
\end{frame}


\section{Researching communications systems}

\subsection{The Rolle of FOSS}

\begin{frame}{What this talk is about}
\begin{itemize}
	\item Implementing GSM/GPRS/3G network elements as FOSS
	\item Applied Protocol Archaeology
	\item Doing all of that on top of Linux (in userspace)
	\item From two nerds with a BTS off e-bay to a community project, several companies and real-world deployments around the globe
\end{itemize}
\end{frame}


\begin{frame}{Research in TCP/IP/Ethernet}
Assume you want to do some research in the TCP/IP/Ethernet
communications area,
\begin{itemize}
	\item you use off-the-shelf hardware (x86, Ethernet card)
	\item you start with the Linux / *BSD stack
	\item you add the instrumentation you need
	\item you make your proposed modifications
	\item you do some testing
	\item you write your paper and publish the results
\end{itemize}
\end{frame}

\begin{frame}{Research in (mobile) communications}
Assume it is 2008 (before Osmocom) and you want to do some research in mobile comms
\begin{itemize}
	\item there is no FOSS implementation of any of the protocols or
		functional entities
	\item almost no university has a test lab with the required
		equipment.  And if they do, it is black boxes that you
		cannot modify according to your research requirements
	\item you turn away at that point, or you cannot work on really
		exciting stuff
	\item only chance is to partner with commercial company, who
		puts you under NDAs and who wants to profit from your
		research
\end{itemize}
\end{frame}

\begin{frame}{Running small (mobile) networks}
Assume it is 2008 (before Osmocom) and you want to run a small cellular network for research,
education, testing. You
\begin{itemize}
	\item go to Ericsson/Huawei/ZTE/Nokia/Alcatel/...
	\item spend lots of time convincing them that you’re an eligible customer
	\item spend a six-digit figure for even the most basic full network
	\item end up with black boxes that you can neither study or improve
	\begin{itemize}
		\item WTF?
		\item I used FOSS protocol stacks for the Internet since 1994 and hacked on them since 1999. I knew a better world.
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{GSM/3G vs. Internet}
\begin{itemize}
	\item Observation
	\begin{itemize}
		\item Both GSM/3G and TCP/IP protocol specs are publicly available
		\item The Internet protocol stack (Ethernet/Wifi/TCP/IP) receives lots of scrutiny
		\item GSM networks are as widely deployed as the Internet
		\item Yet, GSM/3G protocols receive no such scrutiny!
	\end{itemize}
	\item There are reasons for that:
	\begin{itemize}
		\item GSM industry is extremely closed (and closed-minded)
		\item Only about 4 closed-source protocol stack implementations
		\item GSM chipset makers never release any hardware documentation
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{GSM is more than phone calls}
Listening to phone calls is boring...
\begin{itemize}
	\item Machine-to-Machine (M2M) communication
	\begin{itemize}
		\item BMW can unlock/open your car via GSM
		\item Alarm systems often report via GSM
		\item Smart Metering (Utility companies)
		\item GSM-R / European Train Control System
		\item Vending machines report that their cash box is full
		\item Control if wind-mills supply power into the grid
		\item Transaction numbers for electronic banking
	\end{itemize}
\end{itemize}
\end{frame}

\section{The Osmocom project}

\begin{frame}{Enter Osmocom}
In 2008, two crazy Germans (Dieter Spaar + yours truly) started to write FOSS for GSM.
\begin{itemize}
	\item to boldly go where no FOSS hacker has gone before
	\item where protocol stacks are deep
	\item and acronyms are plentiful
	\item we went from {\tt bs11-abis} to {\tt bsc\_hack} to OpenBSC to OsmoNITB + OsmoBSC
	\item many other projects were created
	\item finally leading to the {\em Osmocom} umbrella project
\end{itemize}
\end{frame}

\begin{frame}{Siemens BS-11 via ebay}
\begin{figure}[h]
\centering
\includegraphics[width=50mm]{BS11_BTS.jpg}
\end{figure}
\end{frame}


\begin{frame}{Simplifying the GSM Network}
\begin{figure}[h]
\centering
\includegraphics[width=99mm]{gsm-digraph-box.png}
\end{figure}
\begin{figure}[h]
\centering
\includegraphics[width=60mm]{gsm-digraph-nitb.png}
\end{figure}
\end{frame}

\begin{frame}{Osmocom / osmocom.org}
\begin{itemize}
	\item Osmocom == Open Soruce Mobile Communications
	\item Classic collaborative, community-driven FOSS project
	\item Gathers creative people who want to explore this
		industry-dominated closed mobile communications world
	\item communication via mailing lists, IRC
	\item soure code in git, information in trac/wiki
	\item http://osmocom.org/
\end{itemize}
\end{frame}

\subsection{Osmocom sub-projects}

\begin{frame}{OpenBSC}
\begin{itemize}
	\item first Osmocom project
	\item Implements GSM A-bis interface towards BTS
	\item Primarily supports sysmoBTS and ip.access nanoBTS
	\item Limited support for some Siemens, Ericsson and Nokia BTS models
	\item can implement only BSC function (osmo-bsc) or a fully
		autonomous self-contained GSM network (osmo-nitb) that
		requires no external MSC/VLR/AUC/HLR/EIR
	\item deployed in (at least) > 300 installations world-wide, commercial and research
\end{itemize}
\end{frame}

\begin{frame}{First OpenBSC test installation (HAR 2009)}
\begin{figure}[h]
\centering
\includegraphics[width=60mm]{bts_tree_full.jpg}
\end{figure}
\end{frame}

\begin{frame}{Osmocom Cellular Network use cases}
\begin{itemize}
	\item can be used either as pure BSC (A-over-IP)
	\begin{itemize}
		\item suitable for operators with existing core (MSC/VLR/HLR/AUC)
		\item easy integration into existing infrastructure
	\end{itemize}
	\item or together with OsmoMSC, OsmoHLR to form a Network In The Box
	\begin{itemize}
		\item suitable for private / autonomous small networks (PBX style)
		\item no dependency on any other external component
		\item connect to the outside via ISDN or VoIP (using
			linux call router, osmo-sip-connector)
		\item off-shore drilling rigs, underground mining, alternative to PMR
	\end{itemize}
\end{itemize}
\end{frame}


\begin{frame}{OsmoPCU / OsmoSGSN / OsmoGGSN}
\begin{itemize}
	\item extends the Osmocom based network from GSM to GPRS/EDGE by
		implementing the classic PCU, SGSN and GGSN functional
		entities
	\item OsmoGGSN based on pre-existing OpenGGSN code that was abandoned by original
		author
	\item Works only with BTSs that provides Gb interface, like
		sysmoBTS or nanoBTS
	\item Suitable for research only, not production ready
\end{itemize}
\end{frame}

\begin{frame}{OsmoSGSN / OsmoGGSN use cases}
\begin{itemize}
	\item Testing of M2M devices using your own BTS+SGSN+GGSN
	\item Mobile malware research (analyze cellular data traffic of
		apps)
	\item Any type of GPRS related research
	\item Teaching, training on mobile data protocols/interfaces
		(RLC, MAC, LLC, SNDCP, BSSGP, NS, GTP, etc.)
	\item 3G / 3.5G support since 2016 by means of IuPS interface
\end{itemize}
\end{frame}

\begin{frame}{OsmoBTS}
\begin{itemize}
	\item OpenBSC/OsmoNITB takes care of BTS and higher elements
	\item OsmoBTS implements a BTS with A-bis/IP back-haul to OpenBSC
	\item Developed primarily for sysmoBTS hardware
	\item Ported to various other hardware, even by some BTS vendors!
\end{itemize}
\begin{figure}[h]
\centering
\includegraphics[width=99mm]{osmobts-hardware.png}
\end{figure}

\end{frame}

\begin{frame}{Osmocom 3G}
\begin{itemize}
	\item Osmo{BTS,PCU,BSC,MSC,HLR,SGSN,GGSN} developed for 2G/2.5G/2.75G
	\item in 2015/2016, we added 3G/3.5G support
	\item OsmoMSC got IuCS interface
	\item OsmoSGSN got IuPS interface
	\item OsmoHLR got support for 3G mutual authentication
	\item OsmoHNBGW for talking Iuh to femtocells
\end{itemize}
\end{frame}

\begin{frame}{Osmocom Cellular Network in 2017}
\begin{figure}[h]
\centering
\includegraphics[width=110mm]{osmocom-cellnet-topology.png}
\end{figure}
\end{frame}

\begin{frame}{OsmocomBB}
\begin{itemize}
	\item Full baseband processor firmware implementation of a mobile phone (MS)
	\item We re-use existing phone hardware and re-wrote the L1, L2,
		L3 and higher level logic
	\item Higher layers reuse code from OpenBSC wherever possible
	\item Used in a number of universities and other research contexts
\end{itemize}
\begin{figure}[h]
\centering
\includegraphics[width=50mm]{c123_pcb.jpg}
\end{figure}
\end{frame}

\begin{frame}{OsmocomBB use cases}
\begin{itemize}
	\item Applied security research on Infrastructure
	\begin{itemize}
		\item Fuzzing / exploiting of protocol parsers on network side
		\item RACH denial of service
		\item Check if networks use random padding
		\item Detect IMSI catchers or other fals base stations
		\item Assess GSM network (operator) security level
	\end{itemize}
	\item Study + learn how a GSM stack / phone work
	\item Protocol tracing of your own transactions with the network
\end{itemize}
\end{frame}


\begin{frame}{OsmocomTETRA}
\begin{itemize}
	\item SDR implementation of a TETRA radio-modem (PHY/MAC)
	\item Rx is fully implemented, Tx only partial
	\item Can be used for air interface interception
	\item Accompanied by wireshark dissectors for the TETRA protocol
		stack
\end{itemize}
\end{frame}

\begin{frame}{OsmocomTETRA use cases}
\begin{itemize}
	\item Analysis/assessment of TETRA network security
	\item Learn how TETRA works on teh lowest levels (L1, MAC, L3)
	\item Protocol analysis / sniffing / intercepting unencrypted networks
\end{itemize}
\end{frame}

\begin{frame}{OsmocomGMR}
\begin{itemize}
	\item ETSI GMR (Geo Mobile Radio) is "GSM for satellites"
	\item GMR-1 used by Thuraya satellite network
	\item OsmocomGMR implements SDR based radiomodem + PHY/MAC (Rx)
	\item Partial wireshark dissectors for the protocol stack
	\item Reverse engineered implementation of GMR-A5 crypto
	\item Speech codec is proprietary, still needs reverse engineering
\end{itemize}
\end{frame}

\begin{frame}{OsmocomGMR use cases}
\begin{itemize}
	\item Analysis/assessment of GMR/Thuraya security (there is none)
	\item Learn and understnad how satellite telephony L1 and protocol work
	\item Actual interception of SMS + data
	\item Voice still difficult due to proprietary undocumented codec
\end{itemize}
\end{frame}

\begin{frame}{OsmocomDECT}
\begin{itemize}
	\item ETSI DECT (Digital European Cordless Telephony) is used in
		millions of cordless phones
	\item deDECTed.org project started with open source protocol
		analyzers and demonstrated many vulnerabilities
	\item OsmocomDECT is an implementation of the DECT hardware
		drivers and protocols for the Linux kernel
	\item Integrates with Asterisk
\end{itemize}
\end{frame}

\begin{frame}{OsmocomOP25}
\begin{itemize}
	\item APCO25 is Professional PMR system used in the US
	\item Can be compared to TETRA in Europe
	\item OsmocomOP25 is again SDR receiver + protocol analyzer
	\item Use cases like OsmocomTETRA
\end{itemize}
\end{frame}

\begin{frame}{OsmoSDR}
\begin{itemize}
	\item small, low-power / low-cost USB SDR hardware
	\item higher bandwidth than FunCubeDonglePro
	\item much lower cost than USRP
	\item Open Hardware
	\item Developer units available
\end{itemize}
\begin{figure}[h]
\centering
\includegraphics[width=70mm]{osmosdr.jpg}
\end{figure}
\end{frame}

\begin{frame}{rtl-sdr}
\begin{itemize}
	\item re-purpose a USD 20 DVB-T USB dongle based on Realtek chipset
	\item deactivate/bypass DVB-T demodulator / MPEG decoder
	\item pass baseband samples via high-speed USB into PC
	\item no open hardware,  but Free Software
\end{itemize}
\begin{figure}[h]
\centering
\includegraphics[width=70mm]{ezcap_top.jpg}
\end{figure}
\end{frame}

\begin{frame}{OsmocomSIMTRACE}
\begin{itemize}
	\item Hardware protocol tracer for SIM - phone interface
	\item Wireshark protocol dissector for SIM-ME protocol (TS 11.11)
	\item Can be used for SIM Application development / analysis
	\item Also capable of SIM card emulation and man-in-the-middle attacks
\end{itemize}
\begin{figure}[h]
\centering
\includegraphics[width=60mm]{simtrace_and_phone.jpg}
\end{figure}
\end{frame}

\begin{frame}{osmo\_ss7, osmo\_map, signerl}
\begin{itemize}
	\item Erlang-language SS7 implementation (MTP3, SCCP, TCAP, MAP)
	\item SIGTRAN variants (M2PA, M2UA, M3UA and SUA)
	\item Enables us to interface with GSM/UMTS inter-operator core network
	\item Already used in production in some really nasty
		special-purpose protocol translators (think of NAT for
		SS7)
\end{itemize}
\end{frame}

\begin{frame}{osmo\_ss7, osmo\_map, signerl use cases}
\begin{itemize}
	\item Implement GSM/3G core network elements (HLR, SCF, etc.)
	\item Applications that interact with GSM/3G core network
		elements
	\item Mostly useful for small MVNOs or other operators who have
		requirements that cannot be fulfilled with off-the-shelf
		proprietary equipment.
\end{itemize}
\end{frame}

\begin{frame}{More Osmocom projects}
\begin{itemize}
	\item Have a look at http://git.osmocom.org/
	\item ~ 100 public git repositories / projects at this point
	\item way too many to cover here in this talk
	\item Often RTFS, no manual/docs
\end{itemize}
\end{frame}

\section{Non-osmocom projects}

\begin{frame}{The OpenBTS Um - SIP bridge}
\begin{itemize}
	\item OpenBTS is a SDR implementation of GSM Um radio interface
	\item directly bridges to SIP/RTP, no A-bis/BSC/A/MSC
	\item suitable for research on air interface, but very different
		from traditional GSM networks
	\item work is being done to make it interoperable with OpenBSC
\end{itemize}
\end{frame}

\begin{frame}{airprobe.org}
\begin{itemize}
	\item SDR implementation of Um sniffer
	\item suitable for receiving GSM Um downlink and uplink
	\item predates all of the other projects
	\item more or less abandoned at this point
\end{itemize}
\end{frame}

\begin{frame}{xgoldmon}
\begin{itemize}
	\item extract all GSM/GPRS and even 3G protocol messages from
		your Samsung Galaxy 2, Galaxy 3, Note 2, Nexus phone via USB
	\item feed them into your PC running xgoldmon
	\item forward them from xgoldmon via GSMTAP into wireshark
	\item https://github.com/2b-as/xgoldmon
\end{itemize}
\end{frame}

\begin{frame}{sysmocom GmbH}{systems for mobile communications}
\begin{itemize}
	\item small company, started by two Osmocom developers in Berlin
	\item provides commercial R\&d and support for professional
		users of Osmocom software
	\item develops + sells products like sysmoBTS (inexpensive,
		small-form-factor, OpenBSC compatible BTS)
	\item runs a small webshop for Osmocom related hardware items
		like SIMtrace
\end{itemize}
\end{frame}


\subsection{Future projects}

\begin{frame}{Where do we go from here?}
\begin{itemize}
	\item Now that we have GSM, GPRS, EGPRS, UMTS: LTE, of course
	\item Re-using femtocells in creative ways
	\item Proprietary PMR systems
\end{itemize}
\end{frame}

\begin{frame}{Call for contributions}
\begin{itemize}
	\item Don't you agree that classic Internet/TCP/IP is boring and
		has been researched to death?
	\item There are many more communications systems out there
	\item Never trust the industry, they only care about selling
		their stuff
	\item Lets democratize access to those communication systems
	\item Become a contributor or developer today!
	\item Join our mailing lists, use/improve our code
	\item for OsmocomBB you only need a EUR 20 phone to start
\end{itemize}
\end{frame}

\begin{frame}{Thanks}
I'd like to thank the many Osmocom developers and contributors, especially
\begin{itemize}
	\item Dieter Spaar
	\item Holger Freyther
	\item Andreas Eversberg
	\item Sylvain Munaut
	\item Neels Hofmeyr
\end{itemize}
Also, thanks to CEPT for permitting the GSM specs to be written in English (not French, the official Language of the international postal system)
\end{frame}


\begin{frame}{Thanks}
Thanks for your attention.  I hope we have time for Q\&A.

EOF.
\end{frame}


\end{document}
personal git repositories of Harald Welte. Your mileage may vary