Download presentation
Presentation is loading. Please wait.
1
GSM Global System for Mobile Communications, 1992
Security in mobile phones System used all over the world 5. april 2019 Sikkerhed04, Aften Trusler
2
GSM: Threat Model What Who Why How Cloning Eavesdropping Tracking
Criminals Secret Services Why Break Confidentiality Free phone calls Reveal whereabouts How Break Crypto Exploit bad design Beskriv trusler separat? 5. april 2019 Sikkerhed04, Aften Trusler
3
GSM: Security Policy Security Objectives Strategy Authentication
No tracking Confidential Calls Strategy Crypto SIM PIN codes 5. april 2019 Sikkerhed04, Aften Trusler
4
GSM-system SIM Base station HLR VLR PIN IMSI Ki 5. april 2019
Sikkerhed04, Aften Trusler
5
GSM: mechanisms authentication
PIN VLR SIM (phone) Comp128 SRES||Kc = EKi(RAND) IMSI IMSI RAND SRES Kc RAND IMSI SRES RAND SRES Kc Base station HLR 5. april 2019 Sikkerhed04, Aften Trusler
6
GSM: mechanisms No tracking
When SIM registers on network TMSI – temporary/anonymous IMSI But IMSI must still be sent initially 5. april 2019 Sikkerhed04, Aften Trusler
7
GSM: mechanisms Confidentiality
All conversation encrypted Key: Kc Algoritme: among others, A5 (was secret, like Comp128) 5. april 2019 Sikkerhed04, Aften Trusler
8
GSM: attack1 on authentication
VLR SIM (phone) SRES||Kc = EKi(RAND) cleartext! IMSI IMSI RAND SRES Kc RAND IMSI SRES RAND SRES Kc Base station HLR 5. april 2019 Sikkerhed04, Aften Trusler
9
GSM: attack2 on authentication
Access to SIM well chosen challenges Exploit weaknesses in Comp128 Find Ki 5. april 2019 Sikkerhed04, Aften Trusler
10
GSM: attack/tracking When SIM registers on network
TMSI – temporary/anonymous IMSI But IMSI sent initially IMSI-catcher Strong signal Pretend not to understand ”forstå” TMSI SIM sends IMSI 5. april 2019 Sikkerhed04, Aften Trusler
11
GSM: attack on Confidentiality
All conversation encrypted Key: Kc Algorithm: A5 and others(originally secret, like Comp128) A5 and the way it is used has weaknesses Attack can be done within minutes 5. april 2019 Sikkerhed04, Aften Trusler
12
GSM: what can we learn? Krypto the weakest link?!
Kerchhoffs principle (Comp128 og A5 secret) Misunderstanding of architecture Transmission of keys in cleartext Was GSM security a succes or a failure? for who? 5. april 2019 Sikkerhed04, Aften Trusler
13
Buffer overflows Very ”popular” securitybreach
Microsoft estimates internal expense of $ pr. patch Problem caused by bad code and languages that do not protect against it C, C++ Change to Java, C#, …,? Does’t always help, many OS’s are written in C 5. april 2019 Sikkerhed04, Aften Trusler
14
Stack overruns void foo(char* input){ char buf[3]; strcpy(buf, input);
Compiled program Addr Code 0001 main: 0002 push argv[0] 0003 goto foo 0004 pop 0005 goto exit 0006 foo: 0007 allocate buf 0008 push buf 0009 push input 0010 goto strcpy 0011 return 0012 bar: 0013 push ”Gotcha!” 0014 goto printf 0015 pop 0016 return void foo(char* input){ char buf[3]; strcpy(buf, input); } void bar(void){ printf(”Gotcha!”); int main(int argc, char* argv[]) { foo(argv[1]) return 0; 5. april 2019 Sikkerhed04, Aften Trusler
![Stack overruns void foo(char* input){ char buf[3]; strcpy(buf, input);](http://slideplayer.com./slide/16208589/95/images/14/Stack+overruns+void+foo%28char%2A+input%29%7B+char+buf%5B3%5D%3B+strcpy%28buf%2C+input%29%3B.jpg "Compiled program. Addr Code main: 0002 push argv[0] 0003 goto foo pop goto exit foo: 0007 allocate buf push buf push input goto strcpy return bar: 0013 push Gotcha! 0014 goto printf pop return. void foo(char* input){ char buf[3]; strcpy(buf, input); } void bar(void){ printf( Gotcha! ); int main(int argc, char* argv[]) { foo(argv[1]) return 0; 5. april Sikkerhed04, Aften. Trusler.")
15
Program.exe ”baz” Addr Code 0001 main: 0002 push argv[0] 0003 goto foo
0004 pop 0005 goto exit 0006 foo: 0007 allocate buf 0008 push buf 0009 push input 0010 goto strcpy 0011 return 0012 bar: 0013 push ”Gotcha!” 0014 goto printf 0015 pop 0016 return Stack Addr Data 5601 5604 b buf a z ret adr foo 5608 b 5610 z Stack Addr Data 5601 5602 5607 5608 5610 Stack Addr Data 5601 5604 buf - ret adr foo 5608 b a 5610 z 5. april 2019 Sikkerhed04, Aften Trusler
![Program.exe baz Addr Code 0001 main: 0002 push argv[0] 0003 goto foo](http://slideplayer.com./slide/16208589/95/images/15/Program.exe+baz+Addr+Code+0001+main%3A+0002+push+argv%5B0%5D+0003+goto+foo.jpg "0004 pop goto exit foo: 0007 allocate buf push buf push input goto strcpy return bar: 0013 push Gotcha! 0014 goto printf pop return. Stack. Addr Data b buf. a. z ret adr foo b z. Stack. Addr Data Stack. Addr Data buf ret adr foo b. a z. 5. april Sikkerhed04, Aften. Trusler.")
16
Program.exe ”baz12” Addr Code 0001 main: 0002 push argv[0]
0003 goto foo 0004 pop 0005 goto exit 0006 foo: 0007 allocate buf 0008 push buf 0009 push input 0010 goto strcpy 0011 return 0012 bar: 0013 push ”Gotcha!” 0014 goto printf 0015 pop 0016 return Stack Addr Data 5601 5604 b buf a z ret adr foo 5608 b 5610 z Stack Addr Data 5601 5602 5607 5608 5610 5611 Stack Addr Data 5601 5604 buf - ret adr foo 5608 b a 5610 z 5. april 2019 Sikkerhed04, Aften Trusler
![Program.exe baz12 Addr Code 0001 main: 0002 push argv[0]](http://slideplayer.com./slide/16208589/95/images/16/Program.exe+baz12+Addr+Code+0001+main%3A+0002+push+argv%5B0%5D.jpg "0003 goto foo pop goto exit foo: 0007 allocate buf push buf push input goto strcpy return bar: 0013 push Gotcha! 0014 goto printf pop return. Stack. Addr Data b buf. a. z ret adr foo b z Stack. Addr Data Stack. Addr Data buf ret adr foo b. a z april Sikkerhed04, Aften. Trusler.")
17
What was wrong? We copied into buf and did not check if we had room
Values outside were changed=> program behavior changed! 5. april 2019 Sikkerhed04, Aften Trusler
18
Solution? Change Language :) Write better code!!!
Not (always) an option :( Write better code!!! Education ”Secure” libraries 5. april 2019 Sikkerhed04, Aften Trusler
19
Buffer overflows: morale
Attacks that directly target the Trusted Computing Base Serious! Undermines most security policies Solution primarily to write robust code. 5. april 2019 Sikkerhed04, Aften Trusler
Similar presentations
![Secure Programming Lai Zit Seng November 2012. A Simple Program int main() { char name[100]; printf(What is your name?\n); gets(name); printf(Hello,](/14/4268741/big_thumb.jpg "Secure Programming Lai Zit Seng November 2012. A Simple Program int main() { char name[100]; printf(What is your name?\n); gets(name); printf(Hello,>")
