>>Thank you for making out to day three of Def Con. It is hard for 90% of the audience. We're
glad that you're here. First the agenda. We're going to go over the attacks surface on the cell
phone. What you can find, what is available to you. We're going to be talking about testing
environments both virtually and the real world testing environment and doing live
demonstrations ‑ ‑ demonstrations at the end. My name is Brian Gorenc. I run a
research team, my responsibility is running the zero initiative, the world's largest vendor
diagnostic program. And I'm also responsible for running the phone to own competition through
the programs we have been able to inject $10 million into the white hat research marketplace.
We're proud of that, outside of that, I do a lot of hunting, but typically they don't lead the
vulnerabilities, only once in a while. I'm also on twitter. >> My name is Matt Molinyawe. I'm
a researcher. I work for Ryan. Pointers from there are really delirious. I have hours of
YouTube video that and watch at work, because I work a lot. And part of the fund team that
helped Internet explorer 11 and windows 8.1 and doing a lot of cleanup, it is mess to clean up
your mess, so it writes clean and shiny. And I like scientific calculators. In my free time, I
go under DJ, I was a two time finalist in AMC. So are some pictures from DJ clips. And I
also scratched on the 2014 song security by chase. I also beat contra using a laser in the top
nine. [ Applause ] You can see it on YouTube. I did it in like 17 minutes. I beat clog.
National hero status. I do martial arts. So anything I want to say, do the shit out of the
things you like to do. My name is DJ on twitter, too. >> The whole point of this talk is to
‑ ‑ it is about Celly and what is going to go through SMS/MMS. What we like about this
technology, it is always on, and in your pocket. There is limited defenses between you're the
phone and attacker. Everything going through the provider. A lot of the vendors outside of
apple and Google and those guys once the phone has entered the marketplace it is EOL. There is
no engineering team out there ready to push patches and no real clean way to get a patch
out through the field. We experienced this a lot. We have been trying to get patches out
for the mobile area and it is quite difficult. There has been a lot of research in the area,
of course. Every one rolling around and doing their own mutation. We're going to give
you building blocks to get into the area and get interested in phones. In this case, we're
using android devices in the demonstration. So bug hunting itself and what is available on
the phone. For messages services we have SMS, short messaging service, it is a technology,
many of you know this, but there is actually different encoding steps and different alphabets to
send to the phone. Seven bit 160 characters, 140, and a 70 character UTF16 to the phone.
You overlay messages and do segmentation in the messages using the data header. That's
available to you, that is good way for processing errors in that type of segmentation and
multimedia messaging services is your gateway into sending malicious audio and video file
and pictures to the phone. Most of these are processed without user interaction. And it allows
you to use it quickly. And the community alert mobile system. There are three different types
of alert messages to send to a phone. One is presidential, one is eminent threats, weather, and
then amber alerts. The interesting thing about this type of messaging, the user can
opt out of the amber alerts and threat alerts, but not the president alerts. If you can
find a venerability alert in the presidential message you are going to own a lot of people
that way. On the screen, the message that we got yesterday sitting in the hotel room. Enjoy
that. There's a lot of file formats available through the MMS protocol that will allow you
to get, decode execution on the phone itself. We listed some on the slides. We actually just
have the source codes looking for the handlers for the various file types. There is a lot of
legacy formats on the phone typically coded a long time ago, they have not gone through a
secure life cycle and an easy bug in there, we found a bug or two in the file formats while we
were fuzzing. We are talking about fuzzing itself. There is a lot of existing workout there
that you can leverage, if you need fuzzing seeds there is good locations you can also Google
this file type, the file type that you want to fuzz and get a large corpus of data and send it
to the libraries and then the phone like we're about to show you. And you can get mutation
libraries for PDUs and things like that. A lot of research in the area. In this case we used
our mutations, you will see that in a video later on. It is easy to do press pretajing, you role
your own wrapper and have a database to store it. So I'm going it turn it over to Matt.
He will go over emulation. >> All right. We just pulled out the android listed there. You
can use these commands to create armed devices. And ‑ ‑ you can go through the UI by that
command. It is easy to like having the scripts rolling. So if IOS there was not a good
fall ‑ ‑ default message app on there, for windows phone the link is there. It has a
messaging app. It looks pretty dope. I didn't get a lot of time to play with it much, but you
can attack it from there. As far as android, there are two things. I used the android SDK
that gives you the benefit of the versions for the ones that ‑ ‑ something, you can have
images and six images, but they tend to be slow, they are going through QMU, but emulation is
slow, because it emulating instructions on A6 or 64. And this is a ‑ ‑ A6 virtual box
machine. It is user friendly and available at Jenny motion. For debugging ‑ ‑ issued this
command, this slide is mainly for me. Because I forget stuff, I will copy and paste this
later. I should probably write, screw it. But I'm super lazy and need to get on that. A lot of
stuff that people can do is faster than me. You run GBD, find your process. And you run
the GDB for your harm and then run the target remote command and then your live debugging
continues. That's it. If you want to be cool, run python and catch all of the output and send
the commands and that all she wrote. You could send it to a database. So if scripting ‑ ‑
basically ‑ ‑ um, you can script SMS commands to the send PDU command on the Telenet
channel. There's a lot of prior research here. A lot of gods are there and they have already done
that. So ‑ ‑ so I had, Matt and I ‑ ‑ it is really awesome ‑ ‑ it is about three or four weeks
of me telling, talking to myself saying why do you suck so bad, man, this is awesome. [ Laughter
] So, so yeah. You guys should just, if you have ‑ ‑ fields, whatever, you don't have to, you
will see much I failed. But if you guys should fail fast and fail often and then you'll
eventually get success. But not for me. Luckily for me I just completely gave up and went
straight to backing up MMS messages using backup. So you know, I did that and I pulled
stuff from my phone and throw it to an emulator and I know that MMS is on an android emulator.
Despite what the Internets. I Googled three weeks and it sucked. I was not getting
success. So anyway, decompiled the code. Worked, found out that the MMS ‑ ‑ SMS/MMS file is
where all of the good stuff is stored. And I figured hey, I don't have to write Java, I did
that for seven years and got tired if it, so I'm just going to write python. So that's it.
Okay. The two directors that you see is where the database lives and the assets that your
database will point to. And the tables that you see, that's, I figured all of that out by
sending a text message or picture message to myself, it would be in the sent folder but
could not send, the emulators can not taught to each other. So I saw how the database was
effected and after that played with the values and get into the inbox after that. So just push
the database to your phones reset the commissions and you're set. Basically you can send, you
know, taps and clicks to the phone with monkey runner. So it is unscriptable. Here I'm going
to play this video. I'm pulling down the database and generating test cases. And I pulled down
the page. Now, it is inserting the test cases into the database. And ‑ ‑ I believe the
next ‑ ‑ blip that you will see a little bit more. So now it has inserted the database into the
phone now it is sending all over the JPEGs that were mutating. Now I'm restarting the phone. So
you reboot the phone, it will initialize the database and load this into your messaging app.
You can see the red it is working really hard. It is working really hard processing
stuff. Here we are clicking the messaging app. It is going to acquire it again. There you go,
a thousand messages I threw into the emulator. Now I'm going to go and click through one of
them. This is a big deal. I thought this was not possible. But hey it is working. Now you
can click through your test case. Cool. So that's our, that's our picture that we
inserted into the database. [ Applause ] This next test case, I'm sorry. Yes? Go back. Okay.
Yeah. This next little guy is a picture from, of the canteen, like I just pulled down the
corpus of hacker fisher from Coney Island, I thought it would be funny to have a we dog
situation. Here are pictures of hackers hacking, I'm going to screw with this. But anyway. [
Laughter ] Okay. So I'm going to turn it over to Brian. He is going to talk about keeping
real. >> So for the real world app setup, you will need a set of receivers and transserve s to
send messages to the device. We have been using the USP in our lab. There is a lunch of SDR
devices out there to allow you to get the base station and get the messages to your targets.
Next is a mission if you're trying to find zero base, it is best not to be blasting them all
over the place. Somebody, especially at Def Con will pick it up. We have a discloser on
the stage. This is what we use. We will talk about that more later. It will isolate all of
the radios inside of the box so you don't use it. Next is the software, this is a base station
and it is very handy with ‑ ‑ USRP. Then you need your cell phones, of course. We wanted to
go try ‑ ‑ to do BTS. And failed heavily. And Matt set it up for me. I'm a loser. So we
used the combination of source environments. So ‑ ‑ we used the combination of course codes
some from the networks. We referenced them heavily when setting up open DTS. Because
we're using a NSA research device, you to build it with the dash, dash and the UHB compiler
to get the correct trance receiver in there, that is important to know. And the
driver for the research device from the company, there is a link on slide, it will get the
correct firmware on there and understand what exactly is in the SRP. So those who have not
seen a USRP. That is what it looks like. You can come up after the talk and take a look.
We are using 900 to do the waves and the cable to connect it to the closure. It looks like this.
A Ramsey test equipment device. It is used for forensic investigations, when they grab
the drug dealer's phone, they throw it into it box. We use it for fuzzing, you can manipulate
the phone and keeps it isolated. Next, a phone, your choice, android, windows phone, apple,
whatever. When we are do it in our office, we are using the AT&T database using the values
listed on the slide. And the using the card that is shown on the slide right now. We picked
this up as a big box store. How much did all of this stuff cost? A lot. Unfortunately. The RF
enclosure is $3,000, but of course, if you do find O dat that cost is more, unless you
sell it to us. We made a lot of modifications to the box. We have a lot of pass‑ throughs
that allow us to do USB and connections so you can actually network. So we made
modifications to the box and debugging. The USRP itself, after all of the boards ‑ ‑ it
cost around $3,000. And then the cell phones itself, you know, unlock phones is about five
hundred with all of the sim cards and sim cutting tools you need. It is about $6,500 to get
into the market to actually find bugs in a real world lab setup. It is obviously cheaper
depending on which SDR device. A blade ‑ ‑ supports open SDR. But I not gotten it successfully
to work. Connecting the USRP on android. You collect the mobile networks operational, network
operators it will such and look for the base station and find it, click home and register on
the network. Then it will be time to send your text messages like you see on the slide. We
have them, we have the elite number, a (281)330‑ 8004. Go, go ‑ ‑ >> Who? >> 1900 ‑ ‑
sir‑ mix‑ a lot. You can send whatever you want. You can spoof any text message you want.
That's what we're doing on the stage. This is what it looks like. It is actually connected
to the USRP using the UHD driver we talked about it. Looks like this when it is ready to run.
Once the phones are connected you can actually use the command to, to list the phones that are
connected on the network. I have the MSI if you want it. Then ‑ ‑ sending message in open BTS ‑
‑ simple. And sending basic text messages looks like this, you see the text messages coming in
on the phone. [ Applause ] >> Uh‑ huh. >> It looks like somebody getting shot. >> Look,
like Mike Jones showed up. So we'll continue on real quick. The live demonstrations we are
fuzzing the phones you can hear them beeping in the background. There is live fuzzing going on
the stage. You more than welcome to come out and check it out afterwards. You can see like
thousands of text messages on the phones. And there is also a quick emulator setup? >> All
right. So if this guy, we just did the remote debugging to show you the test case. I clicked it,
bam it is all messed up now, man, it will feedback to the phone saying cannot support it,
but guess what, yeah. It does. Oh, man. >> Okay. >> Good stuff. >> So the last guy tried to do
a demo. Should I give you the shot before or after the demo. After the demo. I will let you
decide. >> The demo didn't work. >> He today are taking it before the demo. >> All right. New
speakers. You guys have been sucking. Show some love for these guys. [ Applause ] >>
Shots. All right. A shout‑ out right there. Good clap for this guy right here. So final slide,
these our targets a lot of data, a lot of person. Information and corporate information. This
industry needs a wake‑ up call. They cannot handle patches. If there are venerability in the
cell phone, there is a good chance outside of apple and Google you're going to have a
really hard time patching this. This is the appearance that we had with patching
vulnerabilities in the mobile space. They need a wake‑ up call, I hope the industry steps
up and gets them to actual do that. It is 2014. Whatever, you should not be sitting here not
being able to patch the software on a mobile device. I find that unacceptable. There is a
decreasing barrier of entry for this fuzzing. The SDR equipment is becoming cheaper. You can
possibly use the blade eRF to do the same type of research. It is getting cheaper as SDR is more
popular. We learned that all of the defuzzing on the desktops transfers over here to fuzzing
in mobile space. It is not as hard as it looks. We recommend people get in it. If you find
zero days we are a bug buying program, we would be happy to buy them from you. We will buy
the bugs off of you. It is worth getting into. There is a lot of vulnerabilities in the space.
And ‑ ‑ you know, they really need a wake‑ up call in the industry. Hopefully you use this
information to find good vulnerabilities. Thank you for coming out. [ Applause ]