SecuritateSecuritate mobilamobila ––

AtacuriAtacuri prinprin SMSSMS

PrezentatorPrezentator::

BogdanBogdan ALECUALECU

http://mhttp://m--sec.netsec.net

Twitter: @Twitter: @msecnetmsecnet

InformatiiInformatii generalegenerale despredespre SMSSMS

AmenintariAmenintari

WAPWAP

InterceptareInterceptare trafictrafic de datede date

DemoDemo

InformatiiInformatii generalegenerale

SMS SMS -- Short Message Service Short Message Service reprezintareprezinta un un mod de mod de comunicarecomunicare prinprin mesajemesaje text text intreintretelefoaneletelefoanele mobile / mobile / fixefixe, , utilizandutilizand un protocol un protocol standardizatstandardizat. . EsteEste un mod de un mod de comunicarecomunicareeficaceeficace; ; utilizatorulutilizatorul scriescrie un text, un text, apasaapasa SEND SEND sisimesajulmesajul e e livratlivrat aproapeaproape instant instant catrecatre destinatardestinatar. .

FolositFolosit pentrupentru maimai multemulte scopuriscopuri: MMS : MMS ––Multimedia Messaging Service, OTA Multimedia Messaging Service, OTA –– Over The Over The Air Air –– configurareaconfigurarea telefonuluitelefonului, , notificarinotificari pentrupentrumesageriamesageria vocalavocala, email, fax, , email, fax, microplatimicroplati –– plataplataunorunor sumesume micimici pentrupentru diferitediferite serviciiservicii => => SECURITATE!SECURITATE!

InformatiiInformatii generalegenerale

““Un Un dispozitivdispozitiv mobilmobil activactiv trebuietrebuie sasa fie fie

capabilcapabil de a de a primiprimi un un mesajmesaj scurtscurt de de

tipultipul TPDU TPDU -- Transfer protocol data unit Transfer protocol data unit

-- (SMS(SMS--DELIVER) in DELIVER) in oriceorice moment, moment,

indiferentindiferent dacadaca existaexista un un apelapel sausau trafictrafic

de date in de date in derularederulare. Un . Un raportraport vava fifi

trimistrimis intotdeaunaintotdeauna catrecatre SC (SC (ServiciulServiciul

de de mesajemesaje); ); confirmandconfirmand fie ca fie ca teltel a a

primitprimit mesajulmesajul sausau ca ca mesajulmesajul nunu a a fostfost

livratlivrat, , incluzindincluzind sisi motivulmotivul refuzuluirefuzului..””

ETSI TS 100 901 V7.5.0 (2001ETSI TS 100 901 V7.5.0 (2001--12), 12), pagpag

1313

AmenintariAmenintari -- SMSSMS

SMS SPAMSMS SPAM

SMS spoofingSMS spoofing

NotificariNotificari SMSSMS

AlteAlte tipuritipuri

AmenintariAmenintari -- SMSSMS

SMS SPAMSMS SPAM

CompaniileCompaniile oferaofera serviciiservicii de de publicitatepublicitate

prinprin SMSSMS

MesajeMesaje cu cu castiguricastiguri falsefalse

InginerieInginerie socialasociala –– ““SunaSuna--ma urgent ma urgent pepe nr nr

astaasta: 0900323421! Mama: 0900323421! Mama””

AmenintariAmenintari -- SMSSMS

SMS SpoofingSMS Spoofing

ServiciiServicii online online cece permit permit modificareamodificarea

expeditoruluiexpeditorului (numeric / (numeric / alfanumericalfanumeric))

GreuGreu de de opritoprit, , maimai ales ales dacadaca tinemtinem cont de cont de

roamingroaming

EficientaEficienta maimai mare in mare in atacurileatacurile de tip de tip

inginerieinginerie socialasociala

AmenintariAmenintari -- SMSSMS

NotificariNotificari SMSSMS

VoicemailVoicemail

FaxFax

EE--mailmail

VideoVideo

UtilizatorulUtilizatorul nunu poatepoate scoatescoate iconicon--ulul de de

notificarenotificare asupraasupra primiriiprimirii unuiunui astfelastfel de de

mesajmesaj

AmenintariAmenintari -- SMSSMS

NotificariNotificari SMS SMS

(voicemail)(voicemail)

AmenintariAmenintari -- SMSSMS

NotificariNotificari SMS SMS

(email)(email)

AmenintariAmenintari -- SMSSMS

AlteAlte tipuritipuri

Flash SMS (Class 0) Flash SMS (Class 0) –– utilizatorulutilizatorul vedevede

mesajulmesajul direct, direct, farafara a intra in Inboxa intra in Inbox

Silent SMS Silent SMS –– DCS 0xC0 = Message Waiting DCS 0xC0 = Message Waiting

Indication Group: Discard MessageIndication Group: Discard Message

AmenintariAmenintari -- SMSSMS

AlteAlte tipuritipuri

Flash SMSFlash SMS

AmenintariAmenintari -- SMSSMS

AlteAlte tipuritipuri

Silent SMSSilent SMS

WAPWAP

Wireless Application ProtocolWireless Application Protocol

Arhitectura de Arhitectura de retearetea specificaspecifica

Set de reguliSet de reguli

Limbaj specificLimbaj specific: Wireless Markup Language : Wireless Markup Language (WML)(WML)

PaginiPagini HTML HTML ajustateajustate pentrupentru dimensiuneadimensiuneaecranuluiecranului telefonuluitelefonului

WAPWAP

WAP PushWAP Push

PermitePermite trimitereatrimiterea de de continutcontinut WAP cu o WAP cu o

interventieinterventie minima din minima din parteapartea utilizatoruluiutilizatorului

2 2 tipuritipuri: Service Indication / Service Load: Service Indication / Service Load

WAP PushWAP Push

Service Indication (SI) Service Indication (SI) permitepermite trimitereatrimiterea

de de notificarinotificari utilizatoruluiutilizatorului intrintr--un mod un mod

asincronasincron

WAP PushWAP Push

Service Indication (SI)Service Indication (SI)

WAP PushWAP Push

Service Load (SL) Service Load (SL) determinadetermina ““aplicatiaaplicatia”” de de

pepe telefontelefon sasa incarceincarce sisi execute un execute un

serviciuserviciu

WAP PushWAP Push

Service Load (SL)Service Load (SL)

WAP Push WAP Push -- securitatesecuritate

TeoriaTeoria: : DoarDoar un un anumitanumit numarnumar esteeste autorizatautorizat pentrupentrutrimiteretrimitere; ; PracticaPractica: : dacadaca nunu e e configuratconfigurat binebine, un , un telefontelefonacceptaaccepta de la de la oriceorice numarnumar astfelastfel de de mesajemesaje

PePe Windows Mobile Windows Mobile trebuiesctrebuiesc verificateverificate setarilesetarile din din HKLMHKLM\\SecuritySecurity\\PoliciesPolicies\\PoliciesPolicies

; SL Message Policy ; (default: SECROLE_PPG_TRUSTED) ; SL Message Policy ; (default: SECROLE_PPG_TRUSTED) [HKEY_LOCAL_MACHINE[HKEY_LOCAL_MACHINE\\SecuritySecurity\\PoliciesPolicies\\Policies] Policies] "0000100c"=dword:800 ; SI Message Policy ; (default: "0000100c"=dword:800 ; SI Message Policy ; (default: SECROLE_PPG_AUTH | SECROLE_PPG_TRUSTED) SECROLE_PPG_AUTH | SECROLE_PPG_TRUSTED) [HKEY_LOCAL_MACHINE[HKEY_LOCAL_MACHINE\\SecuritySecurity\\PoliciesPolicies\\Policies] Policies] "0000100d"=dword:c00 "0000100d"=dword:c00

WAP Push WAP Push -- securitatesecuritate

SECROLE_PPG_TRUSTED: Trusted Push Proxy SECROLE_PPG_TRUSTED: Trusted Push Proxy Gateway. Messages assigned this role indicate Gateway. Messages assigned this role indicate that the content sent by the Push Initiator is that the content sent by the Push Initiator is trusted by the Push Proxy Gateway. This role trusted by the Push Proxy Gateway. This role implies that the device trusts the Push Proxy implies that the device trusts the Push Proxy Gateway (SECROLE_TRUSTED_PPG).Gateway (SECROLE_TRUSTED_PPG).

SECROLE_PPG_AUTH: Push Initiator SECROLE_PPG_AUTH: Push Initiator Authenticated. Messages assigned this role Authenticated. Messages assigned this role indicate that the Push Initiator is authenticated by indicate that the Push Initiator is authenticated by the Push Proxy Gateway. This role implies that the Push Proxy Gateway. This role implies that the device trusts the Push Proxy Gateway the device trusts the Push Proxy Gateway (SECROLE_TRUSTED_PPG).(SECROLE_TRUSTED_PPG).

WAP Push WAP Push -- securitatesecuritate

WAPWAP

ConfigurareaConfigurarea telefonuluitelefonului pentrupentru accesacces la Internet la Internet

/ date / date poatepoate fifi facutafacuta manualmanual

PentruPentru o o configurareconfigurare maimai usoarausoara, , rapidarapida sisi

pentrupentru eventualeleeventualele schimbarischimbari, a , a fostfost creatcreat un un

standard standard cece permitepermite configurareaconfigurarea de la de la distantadistanta

ProgramareaProgramarea Over The Air (OTA) Over The Air (OTA) folosestefoloseste

standardulstandardul OMA OMA –– Open Mobile AllianceOpen Mobile Alliance

ProgramareaProgramarea se face se face prinprin SMSSMS--uriuri special special

conceputeconcepute

WAP WAP -- provisioningprovisioning

FolosesteFoloseste protocolulprotocolul WAPWAP

WBXML (WAP Binary XML) WBXML (WAP Binary XML) prinprin Wireless Wireless

Application EnvironmentApplication Environment

Wireless Session ProtocolWireless Session Protocol

Wireless Datagram ProtocolWireless Datagram Protocol

SMSSMS

WAP WAP -- provisioningprovisioning

ConfigurareaConfigurarea se se scriescrie in XML (conform in XML (conform

specificatiilorspecificatiilor de la de la

http://http://www.openmobilealliance.orgwww.openmobilealliance.org))

XMLXML--ulul se se vava codificacodifica in WAP Binary XMLin WAP Binary XML

WBXML se WBXML se vava encapsulaencapsula intrintr--oo data de tip data de tip

Wireless Session Protocol Wireless Session Protocol

DateleDatele se se vorvor codificacodifica intrintr--un un mesajmesaj Push, Push, definitdefinit

in Wireless Session Protocolin Wireless Session Protocol

WAP WAP -- provisioningprovisioning

MesajulMesajul Push Push continecontine diferitidiferiti parametriparametri, ,

unulunul fiindfiind parametrulparametrul ““SECSEC”” pentrupentru

autentificareautentificare pepe bazabaza de de ““cheiecheie”” comunacomuna

USERPIN: string ASCII USERPIN: string ASCII codificatcodificat in in

zecimalezecimale

NETWPIN: NETWPIN: cheiacheia esteeste specificaspecifica reteleiretelei sisi

cunoscutacunoscuta ((teoreticteoretic) ) doardoar de de catrecatre operatoroperator

USERNETWPIN: USERNETWPIN: combinatiecombinatie a a celorcelor 22

WAP WAP -- provisioningprovisioning

NETWPIN: IMSI = MCC+MNC+MSIN NETWPIN: IMSI = MCC+MNC+MSIN

(Mobile Subscription Identification (Mobile Subscription Identification

Number)Number)

PretPret: 2: 2--5 euro5 euro--centicenti

In general In general limitatlimitat pentrupentru companiicompanii, se , se cerecere

un un volumvolum mare de mare de interogariinterogari

WAP WAP -- provisioningprovisioning

<<wapwap--provisioningdocprovisioningdoc>>

<characteristic type="NAPDEF"><characteristic type="NAPDEF">

<<parmparm name="NAME" value="name="NAME" value="NewAPNNewAPN"/>"/>

<<parmparm name="NAPID" value="name="NAPID" value="NewAPN_NAPID_MENewAPN_NAPID_ME"/>"/>

<<parmparm name="BEARER" value="GSMname="BEARER" value="GSM--GPRS"/>GPRS"/>

<<parmparm name="NAPname="NAP--ADDRESS" value="ADDRESS" value="apn.operator.roapn.operator.ro"/>"/>

<<parmparm name="NAPname="NAP--ADDRTYPE" value="APN"/>ADDRTYPE" value="APN"/>

</characteristic></characteristic>

<characteristic type=<characteristic type=““APPLICATION">APPLICATION">

<<parmparm name="NAME" value="name="NAME" value="NewAPNNewAPN"/>"/>

<<parmparm name="APPID" value="w2"/>name="APPID" value="w2"/>

<<parmparm name="TOname="TO--NAPID" value="NAPID" value="NewAPN_NAPID_MENewAPN_NAPID_ME"/>"/></characteristic></characteristic>

<<wapwap--provisioningdocprovisioningdoc>>

WAP WAP -- provisioningprovisioning

<<wapwap--provisioningdocprovisioningdoc> > -- continecontine toatatoata informatiainformatiatransmisatransmisa

<characteristic <characteristic ……> > -- grupeazagrupeaza informatiainformatia in in unitatiunitatilogicelogice

<<…… value="NAPDEF"/> value="NAPDEF"/> -- configuramconfiguram un un nounounetwork access pointnetwork access point

<<parmparm name="APPID" value="w2"/> name="APPID" value="w2"/> --mapeazamapeaza configuratiaconfiguratia la la activitatileactivitatile de de browsingbrowsing

InformatiiInformatii la la http://http://www.openmobilealliance.orgwww.openmobilealliance.org

WAP WAP -- provisioningprovisioning

<<wapwap--provisioningdocprovisioningdoc>>

<characteristic type="BOOTSTRAP"><characteristic type="BOOTSTRAP">

<<parmparm name="NAME" value=name="NAME" value=““Operator NET"/>Operator NET"/>

<<parmparm name="PROXYname="PROXY--ID" ID" value="value="OpNET_ProxyOpNET_Proxy"/>"/>

</characteristic></characteristic>

<characteristic type="NAPDEF"><characteristic type="NAPDEF">

<<parmparm name="NAME" value="name="NAME" value="OpNETOpNET"/>"/>

<<parmparm name="NAPID" value="name="NAPID" value="OpNET_NAPIDOpNET_NAPID"/>"/>

<<parmparm name="BEARER" value="GSMname="BEARER" value="GSM--GPRS"/>GPRS"/>

<<parmparm name="NAPname="NAP--ADDRESS" value="net"/>ADDRESS" value="net"/>

<<parmparm name="NAPname="NAP--ADDRTYPE" value="APN"/>ADDRTYPE" value="APN"/>

</characteristic></characteristic>

WAP WAP -- provisioningprovisioning

<characteristic type="PXLOGICAL"><characteristic type="PXLOGICAL">

<<parmparm name="NAME" value="name="NAME" value="OpNETOpNET"/>"/>

<<parmparm name="PROXYname="PROXY--ID" value="ID" value="OpNET_ProxyOpNET_Proxy"/>"/>

<characteristic type="PXPHYSICAL"><characteristic type="PXPHYSICAL">

<<parmparm name="PHYSICALname="PHYSICAL--PROXYPROXY--ID" ID" value="value="OpNET_PhProxyOpNET_PhProxy"/>"/>

<<parmparm name="PXADDR" value=name="PXADDR" value=““192.168.1.1"/>192.168.1.1"/>

<<parmparm name="PXADDRTYPE" value="IPV4"/>name="PXADDRTYPE" value="IPV4"/>

<<parmparm name="TOname="TO--NAPID" value="NAPID" value="OpNET_NAPIDOpNET_NAPID"/>"/>

<characteristic type="PORT"><characteristic type="PORT">

<<parmparm name="PORTNBR" value="8080"/>name="PORTNBR" value="8080"/>

</characteristic></characteristic>

</characteristic></characteristic>

</characteristic></characteristic>

WAP WAP -- provisioningprovisioning

<characteristic type="APPLICATION"><characteristic type="APPLICATION">

<<parmparm name="APPID" value="w2"/>name="APPID" value="w2"/>

<<parmparm name="NAME" value="name="NAME" value="OpNETOpNET"/>"/>

<<parmparm name="TOname="TO--PROXY" PROXY" value="value="OpNET_ProxyOpNET_Proxy"/>"/>

<characteristic type="RESOURCE"><characteristic type="RESOURCE">

<<parmparm name="NAME" value="name="NAME" value="OpNETOpNET"/>"/>

<<parmparm name="URI" name="URI" value="http://value="http://www.google.comwww.google.com"/>"/>

<<parmparm name="STARTPAGE"/>name="STARTPAGE"/>

</characteristic></characteristic>

</characteristic></characteristic>

</</wapwap--provisioningdocprovisioningdoc>>

WAP WAP -- provisioningprovisioning

TeoreticTeoretic aceastaaceasta configurareconfigurare poatepoate fifi facutafacuta

doardoar de de catrecatre operator, de la un operator, de la un numarnumar

predefinitpredefinit

PutemPutem analizaanaliza SMSSMS--ulul prinprin WireSharkWireShark

PutemPutem adaugaadauga un alt un alt numarnumar

WAP WAP -- provisioningprovisioning<?xml version="1.0"?><?xml version="1.0"?>

<!DOCTYPE <!DOCTYPE wapwap--provisioningdocprovisioningdoc PUBLIC "PUBLIC "--//WAPFORUM//DTD PROV 1.0//EN" //WAPFORUM//DTD PROV 1.0//EN" "http://"http://www.wapforum.org/DTD/prov.dtdwww.wapforum.org/DTD/prov.dtd">">

<<wapwap--provisioningdocprovisioningdoc version="1.1">version="1.1">

<characteristic type="BOOTSTRAP"><characteristic type="BOOTSTRAP">

<<parmparm name="NAME" value=name="NAME" value=““NumeNume"/>"/>

</characteristic></characteristic>

<characteristic type="PXLOGICAL"><characteristic type="PXLOGICAL">

<<parmparm name="NAME" value=name="NAME" value=““NumeNume"/>"/>

<<parmparm name="PROXYname="PROXY--ID" value="ID" value="Trusted_ProxyTrusted_Proxy"/>"/>

<<parmparm name="NAME" value="Trusted Proxy"/>name="NAME" value="Trusted Proxy"/>

<characteristic type="PXPHYSICAL"><characteristic type="PXPHYSICAL">

<<parmparm name="PHYSICALname="PHYSICAL--PROXYPROXY--ID" value="ID" value="Trusted_PhProxyTrusted_PhProxy"/>"/>

<<parmparm name="PXADDR" value="40711111111"/>name="PXADDR" value="40711111111"/>

<<parmparm name="PXADDRTYPE" value="E164"/>name="PXADDRTYPE" value="E164"/>

<<parmparm name="TOname="TO--NAPID" value="NAPID" value="Trusted_NAPIDTrusted_NAPID"/>"/>

<<parmparm name="PUSHENABLED" value="1"/>name="PUSHENABLED" value="1"/>

<<parmparm name="PULLENABLED" value="1"/>name="PULLENABLED" value="1"/>

</characteristic></characteristic>

</characteristic></characteristic>

<characteristic type="NAPDEF"><characteristic type="NAPDEF">

<<parmparm name="NAME" value="Op"/>name="NAME" value="Op"/>

<<parmparm name="NAPID" value="name="NAPID" value="Trusted_NAPIDTrusted_NAPID"/>"/>

<<parmparm name="BEARER" value="GSMname="BEARER" value="GSM--SMS"/>SMS"/>

<<parmparm name="NAME" value="Trusted Proxy"/>name="NAME" value="Trusted Proxy"/>

<<parmparm name="NAPname="NAP--ADDRESS" value=" 40711111111 "/>ADDRESS" value=" 40711111111 "/>

<<parmparm name="NAPname="NAP--ADDRTYPE" value="E164"/>ADDRTYPE" value="E164"/>

</characteristic></characteristic>

WAP WAP -- provisioningprovisioning

<<wapwap--provisioningdocprovisioningdoc>>

<characteristic type="<characteristic type="NetworkPolicyNetworkPolicy">">

<characteristic type="<characteristic type="WiFiWiFi">">

<characteristic type="Settings"><characteristic type="Settings">

<<parmparm name="Disabled" value="1"/>name="Disabled" value="1"/>

</characteristic></characteristic>

</characteristic></characteristic>

</characteristic></characteristic>

</</wapwap--provisioningdocprovisioningdoc>>

InterceptareInterceptare trafictrafic

TraficulTraficul trecetrece prinprin proxyproxy--ulul nostrunostru

VariantaVarianta 1 1 –– Burp ProxyBurp Proxy

InterceptareInterceptare trafictrafic

TraficulTraficul trecetrece prinprin proxyproxy--ulul nostrunostru

VariantaVarianta 2 2 –– sslstripsslstrip

http://http://www.thoughtcrime.org/software/sslstripwww.thoughtcrime.org/software/sslstrip//

InterceptareInterceptare trafictrafic

DEMODEMO

ProtectieProtectie

OperatorulOperatorul poatepoate filtrafiltra acesteaceste tipuritipuri de de mesajemesaje

ProducatoriiProducatorii de de telefoanetelefoane trebuietrebuie sasa se se concentrezeconcentreze maimai multmult pepe securitatesecuritate

VerificatiVerificati constant (la constant (la felfel cum cum facetifaceti cu cu facturafactura / / creditulcreditul disponibildisponibil) ) setarilesetarile de de InternetInternet

IntrebariIntrebari??