maemo.org - Talk
Page 1 of 2 1 2
Show 40 post(s) from this thread on one page

maemo.org - Talk (https://talk.maemo.org/index.php)
-   Neo900 (https://talk.maemo.org/forumdisplay.php?f=57)
-   -   GSM firewall (https://talk.maemo.org/showthread.php?t=93808)

JohnHughes 2014-09-03 15:28
GSM firewall
 
Could a Neo900 do something like this?

http://www.wired.com/2014/09/cryptop...e-cell-towers/

Wikiwide 2014-09-03 16:05
Re: GSM firewall
 
Quick message...
There was a bit of discussion on IRC about CryptoPhone and possibility of sending encrypted audio over GSM:
http://infobot.rikers.org/%23neo900/20140902.html.gz
Thank you.
~~~~~~~~~~~~~~~~~
Per aspera ad astra...

juiceme 2014-09-03 16:39
Re: GSM firewall
 
Quote:
Originally Posted by JohnHughes (Post 1438123)
Could a Neo900 do something like this?

http://www.wired.com/2014/09/cryptop...e-cell-towers/
As usual the article contained just a pinch of facts and a load of BllSHT to go :D
- yes, it is possible to hijack UE<->RAN connections
- no, it still isn't possible to actuate phone camera or sound pickup without initiating a call
- no, the "firewall" proposed on cryptophone is not feasible

nieldk 2014-09-03 18:50
Re: GSM firewall
 
Quote:
Originally Posted by juiceme (Post 1438134)
As usual the article contained just a pinch of facts and a load of BllSHT to go :D
- yes, it is possible to hijack UE<->RAN connections
- no, it still isn't possible to actuate phone camera or sound pickup without initiating a call
- no, the "firewall" proposed on cryptophone is not feasible
. Yes it is possible to hijack a phone connection
- Yes, that includes the GPRS data
- Not so sure about this one, but I feel confident,that once you have hijacked the phones GSM/GPRS you can gain enough control to activate the camera and microphone etc by several types of attack. Possibly you can do this by a specially crafted SMS, but definately I have no doubt you can do this if you hijack the phone GPRS connection.
. Why not ? The celltowers connecting the phone can be maches at the simplest by a comparison to know cell tower ID ranges or specific IDs? I think thi could be quite easily implemented.

joerg_rw 2014-09-04 00:23
Re: GSM firewall
 
Quote:
Originally Posted by JohnHughes (Post 1438123)
Could a Neo900 do something like this?

http://www.wired.com/2014/09/cryptop...e-cell-towers/
Yes.
Though I haven't read the whole article

[2014-09-04 Thu 00:26:28] <DocScrutinizer05> http://www.kuketz-blog.de/imsi-catch...droid-aimsicd/ (4.1) We'll offer similar functions ;-)
/j

dos1 2014-09-04 00:30
Re: GSM firewall
 
Quote:
Originally Posted by JohnHughes (Post 1438123)
Could a Neo900 do something like this?

http://www.wired.com/2014/09/cryptop...e-cell-towers/
Yes, our modem monitoring should cover most of cases described in this article. There should be enough support in hardware to make writing such "firewall" app possible.

See http://neo900.org/stuff/piwo/piwo.pdf (slides 39-50)

[edit] hehe, got ninja'd :)

endsormeans 2014-09-04 00:50
Re: GSM firewall
 
Very interesting....
like the idea of a firewall type app too....

dos1 ....'bout piwo ....smooth presentation...love it. :D

I don't know too many who can integrate borg picard and spongebob onto the same page. LOVE IT. :D

juiceme 2014-09-04 09:32
Re: GSM firewall
 
Quote:
Originally Posted by nieldk (Post 1438144)
Quote:
Originally Posted by juiceme (Post 1438134)
- no, it still isn't possible to actuate phone camera or sound pickup without initiating a call
- Not so sure about this one, but I feel confident,that once you have hijacked the phones GSM/GPRS you can gain enough control to activate the camera and microphone etc by several types of attack. Possibly you can do this by a specially crafted SMS, but definately I have no doubt you can do this if you hijack the phone GPRS connection.
Well, in an infinite universe anything is possible, and I do not doubt that the UMTS signaling stack is perfect: far from it. There might well be bugs that allow some undocumented functionality to emerge.
However, there is no possible legal state transition that could lead to this kind of action.

The only way I can see for this to happen would be if the attacker could inject malicious code into the target UE and get it running; imagine for example an instance of Prey on the device controlled by remote malicious party.
Such attack would be device-dependent however, there might be some manufacturer/model that is vulnerable to a hand-crafted attack vector specifically targeted to it but no possibility to create a generic attack.


Quote:
Originally Posted by nieldk (Post 1438144)
Quote:
Originally Posted by juiceme (Post 1438134)
- no, the "firewall" proposed on cryptophone is not feasible
. Why not ? The celltowers connecting the phone can be maches at the simplest by a comparison to know cell tower ID ranges or specific IDs? I think this could be quite easily implemented.
The attack device can easily masquarade using existing cell area&BTS signatures that it anyway can observe. There is pretty much no way that the target UE can shield against this type of attack.

joerg_rw 2014-09-04 17:32
Re: GSM firewall
 
Quote:
Originally Posted by juiceme (Post 1438194)
Well, in an infinite universe anything is possible, and I do not doubt that the UMTS signaling stack is perfect: far from it. There might well be bugs that allow some undocumented functionality to emerge.
However, there is no possible legal state transition that could lead to this kind of action.

The only way I can see for this to happen would be if the attacker could inject malicious code into the target UE and get it running; imagine for example an instance of Prey on the device controlled by remote malicious party.
Such attack would be device-dependent however, there might be some manufacturer/model that is vulnerable to a hand-crafted attack vector specifically targeted to it but no possibility to create a generic attack.




The attack device can easily masquarade using existing cell area&BTS signatures that it anyway can observe. There is pretty much no way that the target UE can shield against this type of attack.
However please note that Neo900 has NO way the GSM/UMTS stack can inject ANY commands into the main system. Our modem is sandboxed and we even do more than this, we have surveillance for the sandbox, detecting every little move the modem does, then decide if it's concerning or expected. Worst case we shoot complete modem down when it misbehaves. In that regard we're even better than cryptophone used for the IMSI-catcher "firewall" liked to in above post.

Regarding masquerading an IMSI-catcher as regular BTS (incl Cell_ID and all): _can_ be done, but begs for trouble, so usually they don't do it aiui.

/j

juiceme 2014-09-04 19:47
Re: GSM firewall
 
Quote:
Originally Posted by joerg_rw (Post 1438233)
However please note that Neo900 has NO way the GSM/UMTS stack can inject ANY commands into the main system. Our modem is sandboxed and we even do more than this, we have surveillance for the sandbox, detecting every little move the modem does, then decide if it's concerning or expected. Worst case we shoot complete modem down when it misbehaves. In that regard we're even better than cryptophone used for the IMSI-catcher "firewall" liked to in above post.
Yes. I'd expect Neo900 is of the few devices that are not vulnerable to this kind of attack at all.
The worst bunch is anything with integrated SOC running baseband having shared memory access with main CPU.

However, I personally feel that it is significantly higher risk to get your device infected with "standard" malicious SW having nothing to do with BB or 3G stack. There exist loads of crap especially for Androids aiming for that.


Quote:
Originally Posted by joerg_rw (Post 1438233)
Regarding masquerading an IMSI-catcher as regular BTS (incl Cell_ID and all): _can_ be done, but begs for trouble, so usually they don't do it aiui.
/j
True, there currently being no device that does detect it :D
(as I believe cryptophone is still vaporware...)


All times are GMT. The time now is 22:37.
Page 1 of 2 1 2
Show 40 post(s) from this thread on one page

vBulletin® Version 3.8.8