Upload File

+44 (0)161-820-3056 …file.digitalinterruption.com/iotmcr-sdr.pdf · 2020. 11. 12. · gsm disable...

  • Home
  • Documents
  • +44 (0)161-820-3056 …file.digitalinterruption.com/IoTMCR-SDR.pdf · 2020. 11. 12. · GSM Disable Encryption Victim MS. RAND SRES Victim MS Attacker BTS Cloned MS IMSI GSM. GSM
46
+44 (0)161-820-3056 www.digitalinterruption.com [email protected]

Upload: others

Post on 27-Jan-2021

2 views

Category:

Documents


0 download

Report

TRANSCRIPT

  • +44 (0)161-820-3056

    www.digitalinterruption.com

    [email protected]

  • 2

    Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and zero-power defenses

  • 3

  • WhoamiJahmel Harris

    @JayHarris_Sec

    Freelance Security

    Consultant and researcher

    @DI_Security

    Manchester Grey Hats

    @mcrgreyhats

    Mobile|Radio|Reverse

    Engineering

  • Section:Introduction to

    Software Defined Radio

    Attacking Radio

    Systems

    Reading Data from the

    air

    Common wireless

    protocols

  • Demod

    Antenna

    Preselect Filter

    LowNoiseAmp Mixer

    Oscillator

    IF Filter

    AudioAmp

    ToSpeaker

    Introduction

    to SDR

  • Antenna

    ADCDAC

    Introduction

    to SDR

  • USRP* HackRF One RTLSDR

    Frequency Range 1MHz–6000MHz

    1MHz-6000MHz 24MHz-1766MHz

    Bandwidth 16-61MHz 20MHz 2MHz

    Sample Rate 8-128 MS/s 20 MS/s 2.5 MS/s

    Rx/Tx Full Duplex Half Duplex Receive Only

    Price £600-£4500 £230 £10

  • The UK Frequency Allocations (http://www.roke.co.uk/resources/datasheets/uk-frequency-allocations.pdf)

  • Section:Introduction to

    Software Defined Radio

    Attacking Radio

    Systems

    Reading Data from the

    air

    Common wireless

    protocols

  • Replay

    Attacks

  • Replay

    Attacks

    Open Door

    Op

    en D

    oo

    r

    Op

    en D

    oo

    r

  • Replay

    Attacks

  • Replay

    Attacks

    Open Door

    Op

    en D

    oo

    r

    Op

    en D

    oo

    r

  • Data

    Recovery

    010100110111010101110000011001010111001001010011011001010110001101110010011001010111010001000100011000010111010001100001

  • Denial of

    Service

  • 01001110101011010100010100100100101001001010100101010010

    Fuzzing

  • Section:Introduction to

    Software Defined Radio

    Attacking Radio

    Systems

    Reading Data from the

    air

    Common wireless

    protocols

  • OOK(On Off

    Keying)

    Overvierw

    http://www.st-andrews.ac.uk/~www_pa/Scots_Guide/RadCom/part19/fig1.gif

    0 0 01 1 1 1

  • Identifying

    OOK

  • FSK

    (Frequency

    Shift Keying)

    Overview

    http://en.wikipedia.org/wiki/File:Fsk.svg

    1 1 10 0

  • Identifying

    FSK

  • 110010011101010

    110010011101010

  • Section:Introduction to

    Software Defined Radio

    Attacking Radio

    Systems

    Identifying Signals

    Common wireless

    protocols

  • GSM

    Victim MS

    BTS

    Enable Encryption

    Encrypted Traffic

  • GSM

    Victim MS

    BTS

    Enable Encryption

    Encrypted Traffic

  • Plaintext Traffic Attacker BTS

    Internet

    GSM

    Disable Encryption

    Victim MS

  • RAND

    SRES

    Attacker BTSVictim MS

    Cloned MS

    IMSI

    GSM

  • GSMAttack Vulnerable

    Replay✓

    Sniffing✓

    DoS✓

    Fuzzing✓

    Crypto attacks✓

  • Bluetooth

    Low Energy “Analysts forecast

    Bluetooth Smart to lead

    market share in wireless

    medical and fitness

    devices”

    http://www.bluetooth.com

    /Pages/Press-Releases-

    Detail.aspx?ItemID=165

  • Bluetooth

    Low Energy

    Just works

    Pin OOB

    TK->STK->LTK

  • Bluetooth

    Low Energy

    Attack Vulnerable

    Sniffing✓

    DoS✓

    Fuzzing✓

    Poor key exchange✓

  • ZigBee

  • KeyKeyKeyKeyKey

    Key

    Key

    Key

    ZigBee

  • ZigBeeAttack Vulnerable

    Replay✓

    Sniffing✓

    DoS✓

    Fuzzing✓

    Poor key exchange ✓

  • Section:Introduction to

    Software Defined Radio

    Attacking Radio

    Systems

    Reading Data from the

    air

    Common wireless

    protocols

  • +44 (0)161-820-3056

    www.digitalinterruption.com

    [email protected]


GSM Network and Services - Personliga hemsidor på KTHjohanmon/attic/2g1723/lectures/nodes.pdf · A GSM network BTS MS BSC MSC PSTN BSS – Base Station Subsystem ... 10 GSM Network

COMUNICACIONES DE EMERGENCIAS SOBRE REDES MÓVILES GSM" Ms. Ing. Filiberto Azabache Fernández Email: [email protected]

The Profession of Victim Advocacy: What It Is and Why We ... · The Profession of Victim Advocacy: What It Is and Why We Need a National Movement August 15, 2017 Ms. Bette Inch, MSCP,

Mobilitätsmanagement in GSM, GPRS und UMTS · Mobilitätsmanagement in GSM, GPRS und UMTS 4 Kein Ziel des Vortrages • Das Gebiet GSM, ... (Paging) 11, 12: MS antwortet Festnetz

Overview of GSM Architecture · 2013. 6. 18. · GSM Call Flow Scenarios . GSM Call Flow Scenarios . GSM Call Flow Scenarios • Handoff – MS scans transmission from surrounding

Stop and Prevent Bullying - Why victim becomes the victim?

DDoSand Mitigation Solutions...30,2004 [email protected], Khirman & Son 11 DDoSExamples : SQL Slammer Victim Perpetrator Victim Victim Victim Send a specially crafted packet to the

Cellular Mobile Networks Introduction - cs.ucy.ac.cy · Motorola proprietary system ... Abis B H MS GSM

GSM Network Components. Contents GSM system architecture. Mobile Station or MS including: Base Station Subsystem or BSS including: Mobile-service Switching

Crime Victim Services' Victim Rights Act Procedures

Law$and$the$Male$Victim$of$Domestic$Violence$ Khawaja ...€¦ · Law$and$the$Male$Victim$of$Domestic$Violence$ $ Khawaja$Muhammad$Akbar$ $ Acknowledgements:$ I"thank"my"supervisor,"Ms."Helen"Reece,"without"whom"this"dissertation

GSM Mobility Databases - PcpolytechnicTwo Issues of GSM Mobility Databases • Fault Tolerance – If the location database fail, the loss or corruption of ... MS Registration •

Renaissance - Islam Victim - Islam Victim

IN THE COURT OF CRIMINAL APPEALS OF TENNESSEE AT …Ms. Jarvis testified that the victim and Defendant “never did get along. [The victim] would pack up and come home for a week or

2- Omo133000 Bsc6900 Gsm v9r13 Ms Behaviors in Idle Mode Issue 1.00

Chapter 3: GSM Mobility Management - · PDF filePrepared By: Ms. M. S. Karande Mobile Computing (17632) Page 1 of 16 Chapter 3: GSM Mobility Management Outline GSM Location Update

GSM Architecture - abcd.lkabcd.lk/sliit/Assignment Refs/Student_-_GSM_Architecture.pdf · GSM Architecture A O& M Air MS NMS BSS NSS The NMS is the operation and maintenance related

tcsyll - T John Collegetjohncollege.com/syllabus/TJIT/tce/8th.pdf · MESSAGES, SERVICES, AND CALL FLOWS IN GSM: Introduction, GSM PLMN services. UNIT - 5 GSM messages, MS-BS interface,

Français - Islam Victim - Islam Victim

Once Victim, Always Victim': Compensated Individuals

GSM 04.65, GPRS, MS-SGSN, Subnetwork Dependent Convergence Protocol (SNDCP)

Victim Assistance and Victim Compensation Formula Grants ... · MN OJP is the agency responsible for administering VOCA Victim Assistance and Victim Compensation formula grants in

Modulo GSM ABS-GSM - Dodic Elettronica · Modulo GSM ABS-GSM ABS-GSM GSM Modulo Módulo GSM ABS-GSM Módulo GSM ABS-GSM Module GSM ABS-GSM Manuale Installatore Installer Manual Manual

GSM 04.05 - Version 3.1.5 - MS - BSS Data Link Layer ... · GSM 04.05 - Version 3.1.5 - MS - BSS Data Link Layer General Aspects Author: ETSI TC-SMG Subject: GSM 04.05 - Version 3.1.5

Mobilkommunikationsnetze - GSM/UMTS · GSM – Architektur • RSS (Radio Subsystem) – „Mobilfunk“ – Mobile Station (MS) – Base Station Subsystem (BSS) oder Radio Access

bloximages.newyork1.vip.townnews.com · nbr ethnic origin not hispanic victim relationship to offender victim was nbr victim relationship to offender vict'm was victim of offense(s)

GSM Mobility Management · GSM Basic Location Update: Inter-LA Movement (1/3) aThe MS moves from LA1 to LA2, where both LAs are connected to the same MSC. aIn GSM 04.08, Nine message

Mobile Communication The Mobile Station (MS) is the user equipment in GSM. The MS is what the user can see of the GSM system, the cellular phone itself

Mobile Communications GSMHLR VLR VLR BSS PDN ISDN, PSTN RSS radiocell radiocell MS AuC OSS signaling GSM Architecture –Radio GSM 8 Subsystem (RSS) »MS -Mobile Station –Mobile

Soleil Brillant - Islam Victim - Islam Victim

GSM 07.60,GPRS ,Mobile Station (MS) Supporting GPRS

Smart Ration Card System Based on GSM Technique Ration Card System Based on GSM Technique Ms. Kritika Patil1 ,Ms. Monica Sundrani2, Ms. Sweta Kumari3, Ms. Aditi Kakde4, Prof. Mahesh

GSM 08.58 - Version 5.2.0 - Digital cellular ... · GSM 08.58 Version 5.2.0 July 1996 ... 62 9.3.12 MS Identity ... technical specifications for the implementation of Phase 2+ enhancements

INTERVIEWING THE VICTIM. Interviewing the Victim Let the victim know that you are concerned for her safety. Distract the victim from retaliation against

Victim Compensation