Cellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
summary
Reverse‑engineered baseband and userland clients speak SyncML/WBXML, built custom servers and used OpenBTS and a USRP B210 to deliver WAP push and bootstrap payloads. Found static IMEI/shared‑secret auth, hardcoded test HTTP hosts, integer overflows and arbitrary‑read bugs that leak ASLR and allow ROP chains. Proofs‑of‑concept include a single WAP lock screen bypass and full code execution on iOS, Android, BlackBerry, hotspots and IoT, affecting about 1.8–2 billion devices using a common Redbend V4/V5 70–90% market share client.
AI-written summary · about
chapters (33)
- 0:00Intro
- 0:54Researcher Backgrounds
- 2:27History and Prior Standards
- 3:41The Current Standard
- 4:37OMA-DM: Managed Objects
- 7:57Devices with OMA-DM
- 9:37Embedded Client Locations
- 11:06The Reference Toolkit
- 12:01RedBend Software
- 13:33Network Architecture Diagram
- 14:23OMA-DM "Standard" Security
- 15:30Initial OTA Payload Types
- 16:51DM Bootstrap Payload Example • Used for initial Device Provisioning
- 17:54OMA-DM Tree Serialization
- 19:01Client Side Parsing
- 20:52Cellular Testing Hardware
- 22:37Identifying Control Clients - Phones
- 24:12Identifying Control Clients - Embedded Devices
- 25:37Simulating Cellular Environments
- 27:09Over Global Carrier Networks
- 29:07Rogue Base Station Attacks
- 31:21Vulnerabilities in Authentication
- 32:35Transport Security and Encryption Flaws
- 36:14MInside Out BaseBand Attacks
- 37:16Carrier Customizations
- 40:27Code Execution Without Memory Corruption
- 42:52Vulnerability Example: Reading Memory
- 44:40Notable Weaknesses in Exploit Mitigations
- 46:23OTA Exploit Delivery
- 48:14Bypassing ASLR with OTA Feng Shui
- 50:14Killing the Canary
- 51:23Dynamically Building ROP Chains
- 53:40OTA Code Execution Status
related talks
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
44mExposing Critical Threats In Millions Of Connected Devices
40mIntegrating Mobile Devices into your Penetration Testing Program
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
48mMobile Device Mismanagement
25mAttacking Mobile Broadband Modems Like a Criminal Would
54mExposing device features on 4G & 5G networks
35mPractical Mobile App Attacks By Example