Критически опасные уязвимости в популярных 3g- и...

How to build Big BrotherWith blackjack and h--kers

Yunusov Timur,Senior expert, Head of dept

How to build Big BrotherWith blackjack and h--kersWith 3G modems and hackersYunusov Timur,Senior expert, Head of dept

How to build Big Brother

When/Who/Where/And why???

• 2014-2015

Автор



• 2014-2015• «root via SMS» SCADA Strange Love

https://youtu.be/T9AFFIVpCa8 • Russia and the whole world

https://youtu.be/T9AFFIVpCa8

Автор



• 2014-2015• «root via SMS» SCADA Strange Love

https://youtu.be/T9AFFIVpCa8 • Russia and the whole world• Cause nobody cares(((

https://youtu.be/T9AFFIVpCa8

Автор


Boring numbers

Автор


Boring numbers

• >10 (8 diff) 3G/4G modems/routers• 75% vulns to RCE/fw modification• 60% RCE are 0days

Автор


Boring numbers

• ~60 000 devices/1M/Telco• 5000 devices/1W/SecurityLab• 100% vulns to RCE/fw modification

Автор


How?

Автор


How?

+

Автор


How?1. Identification2. Code injection3. Data interception4. SIM cloning / GSM Attacks5. Host Infection6. APT7. Return to 1.

Автор


Identification

Автор


Identification• WHOIS?

Автор


Identification<img src="http://192.168.0.1/img/1.png" style="height:0;width:0;" onload="set('1')"><img src="http://192.168.0.1/img/2.jpg" style="height:0;width:0;" onload="set('2')"><img src="http://hostname/img/3.png" style="height:0;width:0;" onload="set('3')"><img src="http://127.0.0.1:5000/request" style="height:0;width:0;" onload="set('4')">

Автор


Identification• GeoIP?

Автор


Code Injection• Public exploits + old FW• Blackbox• FW Access + FW RE + IDA• FW modification + Arbitrary upload

Автор


Code Injection• Public exploits + old FW

Автор


Code Injection• Blackbox

• ?action=ping||shutdown –r 0||• ?date=;ping blahblah.com;

Автор


Code Injection• Blackbox

Автор


Code Injection• FW Access + FW RE + IDA• Greetings:

• Kirill Nesterov, • Dmitry Sklyarov

Автор


Code Injection• FW modification + Arbitrary upload

Автор



• Integrity attacks

Автор



• Integrity attacks• Remote upload (CSRF/XSS)

Автор



• Integrity attacks• Remote upload (CSRF/XSS)• Local upload (diag mode)

Автор



• Integrity attacks

Автор


FW Integrity Control• FW encrypted via RC4• RSA Digital Signature +SHA1

Автор


FW Integrity Control

Автор


FW Integrity Control• FW encrypted via RC4

Автор


FW Integrity Control• FW encrypted via RC4

• Constant keystream FAIL• Part1 XOR Part2 FAIL• FW1 XOR FW2 FAIL• Lot of plaintext (CDROM) FAIL

Автор


FW Integrity Control• FW encrypted via RC4 FAIL

Автор


FW Integrity Control• RSA Digital Signature +SHA1

• AR: !<arch>:• FW• pkginfo: <7742526>• Sign=RSA(SHA1(FW[0..7742526]))

Автор



Автор



• ar --add data.tar.gz• ar -v

• data.tar.gz• sign• pkginfo• data.tar.gz

Автор


FW Integrity Control• RSA Digital Signature +SHA1 FAIL

• ar --add data.tar.gz• ar -v

• data.tar.gz• sign• pkginfo• data.tar.gz

Автор


FW upload/CSRF

http://blog.kotowicz.net/2011/04/how-to-upload-arbitrary-file-contents.html


FW upload/ XSS • HUAWEI PSIRT 436642 (2015-05-29)

http://www1.huawei.com/en/security/psirt/security-bulletins/security-notices/archive/hw-436642.htm


Data interception• Cell ID• WiFi• SMS• HTTP• SSL


Data interception• Cell ID

• http://opencellid.org/ + XSS

http://opencellid.org/

http://opencellid.org/

Автор


Data interception• WiFi

Автор


Data interception• SMS

Автор


Data interception• HTTP

• ARP-spoofing• DNS-spoofing

Автор


Data interception• SSL

• Host RCE

Автор


SIM Cloning• Fake BTS + Binary SMS • GEO(!)• IMSI

https://media.blackhat.com/us-13/us-13-Nohl-Rooting-SIM-cards-Slides.pdf

Автор


SIM Cloning• Use The Force

Автор


SIM Cloning• Diag mode

Автор


SIM Cloning• Send AT commands

• AT+CMGF=0

Автор


GSM Attacks• Huawei: Remote(!) osmocomm for beggars• VxWorks on baseband hi6920

― Loaded by Linux ― Packed on flash ― dmesg => load vxworks ok, entey 0x50d10000 ― Cshell

• OS communication • Builtin debuger

― Nearly all names of objects/functions ― POSIX + documentation

Автор


Host Infection• BadUSB• Fake diagnostic tools/CDROM• HTML Injection + 0day• Even real diagnostic tools =))

Автор


Host Infection• BadUSB

• Android gadget driver (supported_functions patching)

• HID Gadget onboard!• Lots of boring stuff

Автор


Host Infection• Drive By Download• CDROM

Автор


Host Infection• HTML Injection + 0day

Автор


Host Infection• Kudos to @cyberpunkych• Lots of other stuff at yota.hlsec.ru• But nobody cares(((

Автор


APT

Ident

RCE

Data

GSM

Host

APT

Автор


APT

Автор


APT• Subscribers attacks Subscribers

• LISTEN 0.0.0.0:80• Firewalls

Автор


Boring numbers

Автор


Fun numbers

• Remote Code Execution via WEB: 5 dev• Arbitrary FW modification (rem/loc): 6 dev• CSRF: 5 dev• XSS: 4 dev


DEMO


Kudos

• @cyberpunkych• D. Sklyarov• K. Nesterov• Al. Osipov• @SCADASL

Stay secure!Questions?

Критически опасные уязвимости в популярных 3g- и...

Internet