1. Module 54 (Cellular Telephone Network Security)
At the end of this Module, you'll have seen how security researchers have demonstrated serious security problems with cellular telephone devices that can compromise the confidentiality of messages sent over the cellular telephone network. You'll be familiar with a few scenarios of simple hardware hacking and see how it can open the door to sophisticated network hacking.
Module 54

2. Cellular Telephony Several radio communication standards
GSM (Global System for Mobile communications) Worldwide (mostly) standard. Uses Service Identity Module (SIM) card.
CDMA (Code Division Multiple Access) Primarily in the U.S. and Canada. Developed by Qualcomm.
LTE (Long Term Evolution) Probably the only standard going forward. Will use Voice over LTE for voice calls.
Module 54

3. Why does it Matter
Can you hear me?
Module 54

4. What if my Service is Bad?
Use a femtocell: small, low-powered, base station
Connects to your high-speed (hopefully) internet connection.
Communicates using your carrier's radio standard to cellular telephones nearby
Transmits communications by wrapping them in IP and sending them to a server maintained by your carrier.
Module 54

5. Pictured below are (left) the Samsung femtocell used by Verizon for serving CDMA devices and (right) the CISCO Microcell used by AT&T for serving 2G and 3G GSM handsets.
Module 54

6. Both Have Been Hacked
ISEC partners demonstrated hacked Samsung SCS-26UC4 and SCS-2U01
LMG Security used this ability to create an Intrusion Detection System (IDS) for cell phones that runs on the femtocell. Normally it's difficult to detect intrusions that only exhibit behavior on the cell network. (How do we sniff?)
fail0verflow has demonstrated a CISCO microcell hack as well.
Module 54

7. ISEC's Diagram showing Femtocell Connectivity
Module 54

8. Samsung LMG's Exploit Approach
Dec. 2012: Richard Allen found that the exposed HDMI port on the SCS-26UC4 is, in fact, a serial port. A serial cable connected at 57600:8N1 can communicate to the console.
The machine is a linux box running the U-boot boot loader.
The U-boot interrupt key has been modified, but it can be determined through experimentation.
LMG interrupted the boot and added init=/bin/sh to the boot parameters, yielding a root command prompt.
Module 54

9. Samsung LMG's Exploit Approach
LMG imaged the file system both with dcfldd (dumping the contents of the device) and with tar (to dump the file and directory structure).
Ftp code was on the Montevista Linux distro being used by the device.
The system uses an ARM926EJ processor, so Android binaries can operate on it. LMG copied binaries for nc and dcfldd onto the device.
Upon connecting the device to the internet, it downloaded new software that set the Uboot wait time to 0 (disabling the ability to interrupt). :-(
Module 54

10. Samsung LMG's Exploit Approach
LMG purchased additional SCS-26UC4's (returning those with new firmware) until they found one that could boot properly.
They identified and implemented a method to keep the system from updating.
LMG Modified the kernel to support expanded iptables functionality that was necessary to export traffic necessary to implement intrusion detection.
Module 54

11. LMG IDS Physical Setup Faraday Cage External connectors
Internal Contents
Module 54

12. IDS Plan All traffic is routed to an external machine
External machine inspects packets using snort and flags those that match expected malware patterns
Possible C&C servers
Malicious domains
Malware filenames
Malware binary excerpts
Expected communications
Expected infected client POSTs
C&C commands
Module 54

13. CISCO fail0verflow's Exploit Approach
Identified an Ralink System-on-Chip (SoC) and found it's serial communication port (header JP1) which operates at baud
Machine boots with u-boot
Issues u-boot md command to dump flash memory over the serial port.
Lmza compressed raw linux kernel image
System tools: busybox 1.8.2
Two users: root and ssh with same password (non-dictionary) guessed after 5 days of processing.
Module 54

14. CISCO Wizard Service is accessible over the WAN interface
Supports a function named BackdoorPacketCmdLine that accepts a linux command as its argument.
Provides full, unauthenticated, remote backdoor execution.
Communication over UDP
Responses sent to IP
Module 54