Danisevskis, Janis

Ravishankar, Borgaonkar

Redon, Kevin

Eldorado - Ressourcen aus und für Lehre, Studium und Forschung

OutlineGSM BasicsGSM AuthenticationConclusionA Student Grade Man in the Middle Attack onthe GSM Air LinkJanis Danisevskis (TU-Berlin SECT)janis@sec.t-labs.tu-berlin.deTU-Berlin (SECT)Spring 2010 SIDAR - Graduierten-Workshop über Reaktive Sicherheit7. Juli 2010Janis Danisevskis (TU-Berlin SECT) 1/13OutlineGSM BasicsGSM AuthenticationConclusionOutline1 GSM Basics2 GSM Authentication3 ConclusionJanis Danisevskis (TU-Berlin SECT) 2/13OutlineGSM BasicsGSM AuthenticationConclusionSome BasicsSome interesting Facts about GSMno authentication needed towards Mobile Stations (MS)unencrypted air-links must always be supported by MSJanis Danisevskis (TU-Berlin SECT) 3/13OutlineGSM BasicsGSM AuthenticationConclusionExample: IMSI CatcherHello!dangling linkVictim Phone Evil base-stationLure the victim intoconnecting to ourBase stationTell it to use noencryptionReroute our victim’sphone callImpersonate thecalleeJanis Danisevskis (TU-Berlin SECT) 4/13OutlineGSM BasicsGSM AuthenticationConclusionExample: IMSI CatcherHello!dangling linkVictim Phone Evil base-stationLure the victim intoconnecting to ourBase stationTell it to use noencryptionReroute our victim’sphone callImpersonate thecalleeJanis Danisevskis (TU-Berlin SECT) 4/13OutlineGSM BasicsGSM AuthenticationConclusionExample: IMSI CatcherHello!dangling linkVictim Phone Evil base-stationLure the victim intoconnecting to ourBase stationTell it to use noencryptionReroute our victim’sphone callImpersonate thecalleeJanis Danisevskis (TU-Berlin SECT) 4/13OutlineGSM BasicsGSM AuthenticationConclusionExample: IMSI CatcherHello!dangling linkVictim Phone Evil base-stationLure the victim intoconnecting to ourBase stationTell it to use noencryptionReroute our victim’sphone callImpersonate thecalleeJanis Danisevskis (TU-Berlin SECT) 4/13OutlineGSM BasicsGSM AuthenticationConclusionDrawbacksThe victim is not registered with his home network→ can not be calledThe callee will not see the caller’s phone numberNot transparentJanis Danisevskis (TU-Berlin SECT) 5/13OutlineGSM BasicsGSM AuthenticationConclusionMore GSM BasicsVLRBSCTRAUBTSBTSMSC MSCHLRAbisAterAUmMSCBEAUCH DHLR : Home Location RegisterAUC : Authentication CenterVLR : Visitor Location RegisterMSC : Mobile Switching CenterTRAU : Transcoder Rate Adapta-tion UnitBSC : Base Station ControllerBTS : Base Transceiver StationMS : Mobile StationJanis Danisevskis (TU-Berlin SECT) 6/13OutlineGSM BasicsGSM AuthenticationConclusionAuthentication TupleA3 A8SRES KcKiRANDA3 A8SRES KcKiRANDPreshared Secret KeySession KeySigned ResponseRandom ChallengeAuthentication TupleBSCTRAUBTSBTSMSCAbisAterAUmCHLR/AuCMSJanis Danisevskis (TU-Berlin SECT) 7/13OutlineGSM BasicsGSM AuthenticationConclusionRANDS RES S RESRANDA8 A3RANDSKcKiKcJanis Danisevskis (TU-Berlin SECT) 8/13OutlineGSM BasicsGSM AuthenticationConclusionCIPH MOD COMCIPH MOD CMD:A5/1SKcRANDKi A8 A3CIPH MOD COMCIPH MOD CMD:A5/0RANDS RES S RESRANDM?A5/1??Janis Danisevskis (TU-Berlin SECT) 9/13OutlineGSM BasicsGSM AuthenticationConclusionCIPH MOD COMCIPH MOD CMD:A5/1SKcRANDKi A8 A3CIPH MOD COMCIPH MOD CMD:A5/2RANDS RESS RESRANDKc(M)→ KcKc(M)MA5/2KcKc(M)Kc(M ′)M ′A5/1KcKc(M ′)RANDKcAuthentication Tuple CompleteSRESJanis Danisevskis (TU-Berlin SECT) 10/13OutlineGSM BasicsGSM AuthenticationConclusionConsequencesWe can do anything the victim could do without her having aclue (untill her monthly phonebill arrives).Dynamic cloningExtras1 Wiretapping (including incoming calls)2 Call hijacking (impersonate the victim)3 On the fly modification (e.g. of SMS)4 Receive SMS on the victim’s behalf (think of mTAN)Janis Danisevskis (TU-Berlin SECT) 11/13OutlineGSM BasicsGSM AuthenticationConclusionWhy?Because ...Raise public awareness of GSM weaknessesThese weaknesses are being exploitedNo governmental/corporate funding neededJanis Danisevskis (TU-Berlin SECT) 12/13OutlineGSM BasicsGSM AuthenticationConclusionWhy?Because ...Raise public awareness of GSM weaknessesThese weaknesses are being exploitedNo governmental/corporate funding neededJanis Danisevskis (TU-Berlin SECT) 12/13OutlineGSM BasicsGSM AuthenticationConclusionThe EndThe EndQuestions?Janis Danisevskis (TU-Berlin SECT) 13/13

A Student Grade Man in the Middle Attack on the GSM Air-Link

https://eldorado.tu-dortmund.de/bitstream/2003/27329/1/01-05.pdf

A Student Grade Man in the Middle Attack on the GSM Air-Link

Abstract

Similar works

Full text

Available Versions

Eldorado - Ressourcen aus und für Lehre, Studium und Forschung