3 Sep
2013
3 Sep
'13
7:01 p.m.
Hey, I finally watched Nico's talk "let me answer that for you" and heard
him say he ported layer2/3 to target.
Also found a mailing list message about him cleaning it up and putting it up on git and
sending it to a few folks.
Did that code ever get shared? Would be cool to play around with and is certainly
something I would eventually want to accomplish for my project of making a phone that
works by itself.
-Craig
3 Sep
3 Sep
8:15 p.m.
Hi,
On Tue, Sep 3, 2013 at 7:01 PM, Craig Comstock <craig_comstock(a)yahoo.com> wrote:
Hey, I finally watched Nico's talk "let me
answer that for you" and heard
him say he ported layer2/3 to target.
No.
He implemented a very basic l2/l3 that just did exactly what the
attack needed (which in comparison to the whole 'mobile' application
is very little) and nothing more.
Cheers,
Sylvain
8:27 p.m.
Sure,
I suspected as much but had to ask. :)
For the time being I'll probably keep my focus on nuttx-bb and/or making a UI
prototype in osmocom to see how it feels.
Thanks,
Craig
________________________________
From: Sylvain Munaut <246tnt(a)gmail.com>
To: Craig Comstock <craig_comstock(a)yahoo.com>
Cc: "baseband-devel(a)lists.osmocom.org" <baseband-devel(a)lists.osmocom.org>
Sent: Tuesday, September 3, 2013 1:15 PM
Subject: Re: layer2/3 ported to target? paging attack code?
Hi,
On Tue, Sep 3, 2013 at 7:01 PM, Craig Comstock <craig_comstock(a)yahoo.com> wrote:
Hey, I finally watched Nico's talk "let me
answer that for you" and heard
him say he ported layer2/3 to target.
No.
He implemented a very basic l2/l3 that just did exactly what the
attack needed (which in comparison to the whole 'mobile' application
is very little) and nothing more.
Cheers,
Sylvain
3:07 p.m.
Excerpts from Tim Ehlers's message of 2013-09-04 14:07:55 +0200:
On Tue, 3 Sep 2013, Craig Comstock wrote:
Hi,
The code is available here
http://tinyurl.com/fun-with-paging
(apply on osmocom changeset 4f0acac4c1fa538082f54cb14bef0841aa9c8abb)
but as sylvain said, it's not a complete layer2/3 port to the phone.
It only handles the paging requests (and a bit SMSs)
Kevin
I suspected as much but had to ask. :)
but anyhow, the code would be interesting. :)
Cheers
Tim
4:13 p.m.
Anyone tried it? I've downloaded the patch and applied it to the changset
you said. Compilation is ok. Should it generate new images to dump to
phone? I can see only standard targets.
Dario
On Wed, Sep 4, 2013 at 3:07 PM, Kevin Redon <ml(a)mail.tsaitgaist.info> wrote:
Excerpts from Tim Ehlers's message of 2013-09-04
14:07:55 +0200:
On Tue, 3 Sep 2013, Craig Comstock wrote:
Hi,
The code is available here
http://tinyurl.com/fun-with-paging
(apply on osmocom changeset 4f0acac4c1fa538082f54cb14bef0841aa9c8abb)
but as sylvain said, it's not a complete layer2/3 port to the phone.
It only handles the paging requests (and a bit SMSs)
Kevin
I suspected as much but had to ask. :)
but anyhow, the code would be interesting. :)
Cheers
Tim
8:46 p.m.
On Wed, 4 Sep 2013, Dario Lombardo wrote:
Hi,
Anyone tried it? I've downloaded the patch and
applied it to the
changset you said. Compilation is ok. Should it generate new images to
dump to phone? I can see only standard targets.Dario
yes, as I can see, the rssi Target has been modified. So need to load that
target with the modified osmocon, which opens another UNIX-Socket
/tmp/osmocom_mi to read the victims TMSI. Whith "*" you can toggle the
attack modes, which are DETACH, PAGING, RANGE_PAGING, ALL_PAGING,
STEAL_SMS.
My only problem is, that I can't find out how to send the TMSI over the
Socket. If I only send the TMSI with e.g. socat, I get
Err from socket: Bad address
from osmocon...
What do I miss?
Cheers
Tim
10:08 p.m.
sorry, here the scripts to push the values
Excerpts from Tim Ehlers's message of 2013-09-04 20:46:34 +0200:
On Wed, 4 Sep 2013, Dario Lombardo wrote:
Hi,
Anyone tried it? I've downloaded the patch
and applied it to the
changset you said. Compilation is ok. Should it generate new images to
dump to phone? I can see only standard targets.Dario
yes, as I can see, the rssi Target has been modified. So need to load that
target with the modified osmocon, which opens another UNIX-Socket
/tmp/osmocom_mi to read the victims TMSI. Whith "*" you can toggle the
attack modes, which are DETACH, PAGING, RANGE_PAGING, ALL_PAGING,
STEAL_SMS.
My only problem is, that I can't find out how to send the TMSI over the
Socket. If I only send the TMSI with e.g. socat, I get
Err from socket: Bad address
from osmocon...
What do I miss?
Cheers
Tim
3:32 p.m.
On Thu, 5 Sep 2013, Dario Lombardo wrote:
Hi,
On Wed, Sep 4, 2013 at 10:08 PM, Kevin Redon
<ml(a)mail.tsaitgaist.info>
wrote:
sorry, here the scripts to push the values
Is the software expected to say something when the tmsi is correctly
pushed?
printf("changing victim TMSI to: ");
for (i = 0; i < msg->len && i < 4; i++) {
victim_tmsi[i] = msg->data[i];
printf("%02x ", victim_tmsi[i]);
}
puts("\n");
Best
Tim
4:38 p.m.
Thanks.
Does the POWER indications works for you? Despite of the arfcn I enter, I
get always -110.
Using RSSI from master, I can get -76 from the strongest cell (arfcn = 1).
On Thu, Sep 5, 2013 at 3:32 PM, Tim Ehlers <osmocom(a)ehlers.info> wrote:
On Thu, 5 Sep 2013, Dario Lombardo wrote:
Hi,
On Wed, Sep 4, 2013 at 10:08 PM, Kevin Redon <ml(a)mail.tsaitgaist.info>
wrote:
sorry, here the scripts to push the values
Is the software expected to say something when the tmsi is correctly
pushed?
printf("changing victim TMSI to: ");
for (i = 0; i < msg->len && i < 4; i++) {
victim_tmsi[i] = msg->data[i];
printf("%02x ", victim_tmsi[i]);
}
puts("\n");
Best
Tim
4:51 p.m.
On Thu, 5 Sep 2013, Dario Lombardo wrote:
Hi Dario,
Does the POWER indications works for you? Despite of
the arfcn I enter, I get always
-110.
Using RSSI from master, I can get -76 from the strongest cell (arfcn = 1).
I only tried one Cell (which is one of the strongest here) from O2 Germany
in my Location and Power says -68, which is (nearly) the same as
osmocombb-mobile says for that cell. So yes, I think it is working...
Best
Tim
4 Jul
4 Jul
8:21 p.m.
is it possible for having the code source of all this attack on osmocom
attack modes, which are DETACH, PAGING, RANGE_PAGING,
ALL_PAGING,
STEAL_SMS. ?
--
View this message in context:
http://baseband-devel.722152.n3.nabble.com/layer2-3-ported-to-target-paging…
Sent from the baseband-devel mailing list archive at Nabble.com.
26 Feb
26 Feb
11:15 p.m.
any one try this code? its look like work but for real not.
--
View this message in context:
http://baseband-devel.722152.n3.nabble.com/layer2-3-ported-to-target-paging…
Sent from the baseband-devel mailing list archive at Nabble.com.
5 Aug
5 Aug
6:14 a.m.
I'm facing a problem. I applied the patch and compiled successfully. However,
whenever I tried to load the firmware into the phone I got ftmtool error. I
thought it was because the cable so I try to load the original firmware with
original osmocon app, same cable of course, it worked perfectly. So I
reversed what I did and compiled again and run osmocon and still ftmtool
error? So the problem is not the cable,not the patch. The problem is osmocon
app itself. Am I right? Anyone knows what problem is it? Is it some kind of
code changing prevention?
--
View this message in context:
http://baseband-devel.722152.n3.nabble.com/layer2-3-ported-to-target-paging…
Sent from the baseband-devel mailing list archive at Nabble.com.
2822
days inactive
3889
days old
baseband-devel@lists.osmocom.org
15 comments
8 participants
participants (8)
-
alex -
Craig Comstock -
Dario Lombardo -
Dast -
Kevin Redon -
sillymonkey -
Sylvain Munaut -
Tim Ehlers