迪翁·古斯与马里乌斯·穆恩奇_通过模糊测试层-2来克服状态找到基带漏洞.pdf

1、#BHUSA BlackHatEventsOvercoming State:Finding Baseband Overcoming State:Finding Baseband Vulnerabilities by Fuzzing Layer-2Vulnerabilities by Fuzzing Layer-2Speakers:Dyon Goos&Marius Muench#BHUSA BlackHatEventsDyon:-Independent security researcher-MSc(Vrije Universiteit Amsterdam)-Spent the last 2 y

2、ears in baseband stacks:)About UsMarius:-Assistant Professor(University of Birmingham),UK-Baseband research since 2018-Co-creator of FirmWire-Captures flags with Tasteless#BHUSA BlackHatEventsThis talkLayer-3Layer-2Layer-1 Layer-3Layer-2Layer-1#BHUSA BlackHatEventsBasebands#BHUSA BlackHatEvents 11:2

3、5 GSMBasebands-Modern phones are a collection of processors-Including:Application Processor(AP)&Cellular Processor(CP)-CP also referred to as“Baseband”-Implements most layers of cellular communication stack-Lucrative attack surface-Myriad of parsers,legacy code,obscure featuresAPCP#BHUSA BlackHatEve

4、ntsThe code running on basebands-Core OS functionality:-Scheduler,timers,interrupts-Messaging-Cellular stack implementation:-Stack is split into“tasks”-Tasks communicate via message queuesCustom Real-Time Operating Systems(RTOS),providing:#BHUSA BlackHatEventsBaseband Security ResearchPlenty of atte

5、ntion in recent years,e.g.:#BHUSA BlackHatEventsWhat about Layer-2?When we started,most research/findings focus on cellular L3(or higher)Lets have a look at layer-2 ourselves!Lets start with the lowest hanging fruits:-GSM Layer-2-Fuzzing#BHUSA BlackHatEventsGSM Protocol StackLayer-3Layer-2Layer-1 LA

6、PDmLayer-2 RR MM Phy CM CC SMS SSRR :Radio Resource MM :Mobility ManagementCM :Connection ManagementCCSMSSSPhy:PhysicalLAPDm:Link Access Protocol on the Dm Channel(LAPDm)CC :Call ControlSMS:Short Messaging ServiceSS :Supplementary Services#BHUSA BlackHatEventsGSM Layer 2-Link Access Protocol on the