Cellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
summary
Reverse engineering of basebands and SyncML clients shows over 2 billion devices expose carrier-managed device control, with a single vendor (Redbend VDirect) shipping a SyncML-derived client to most manufacturers. Tests use NanoBTS/OpenBSC and femtocells to deliver WAP pushes; a single WAP push can force devices to use HTTP test servers and bypass weak SSL (hostname verifier overridden). Authentication relies on IMEI plus a hardcoded key, enabling remote commands; multiple integer-overflow and arbitrary-read bugs allow OTA code execution, demos are partially successful.
AI-written summary · about
chapters (29)
- 0:00Intro
- 1:00How this Research Began
- 1:53The Current Standard
- 3:01OMA-DM: Managed Objects
- 4:41Devices with OMA-DM
- 5:46Embedded Client Locations
- 6:45The Reference Toolkit
- 7:46RedBend Software
- 8:48"RedBend Enabled" Devices
- 9:14Network Architecture Diagram
- 10:04OMA-DM "Standard" Security
- 11:34Initial OTA Payload Types
- 12:31NIA Payload Example
- 13:35DM Bootstrap Payload Example • Used for initial Device Provisioning
- 14:12OMA-DM Tree Serialization
- 15:16Client Side Parsing
- 18:00Cellular Testing Hardware
- 19:13Identifying Control Clients - Phones
- 21:12Identifying Control Clients - Embedded Devices
- 22:32Simulating Cellular Environments
- 23:59Android Tracer
- 26:02Cellular Network Attacks
- 28:15Rogue Base Station Attacks
- 32:09Vulnerabilities in Authentication
- 33:57Transport Security and Encryption Flaws
- 41:37Code Execution Without Memory Corruption
- 42:28Types of Vulnerabilities found
- 42:58Vulnerability Example: Reading Memory
- 47:19Bypassing ASLR with OTA Feng Shui
related talks
01h 01mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
44mExposing Critical Threats In Millions Of Connected Devices
54mExposing device features on 4G & 5G networks
40mIntegrating Mobile Devices into your Penetration Testing Program
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
48mMobile Network Hacking, IP Edition
49mAll the 4G Modules Could be Hacked
44mNew Vulnerabilities in 5G Networks