5 ms·

There's so many fun things you can do w/ telecom networks that it's a bit sad to see the phreaking community dead nowadays or relegated to just "modifying" roms

There's so many fun things you can do w/ telecom networks that it's a bit sad to see the phreaking community dead nowadays or relegated to just "modifying" roms. You could enable any phone to be a receiver for SMS and literally see the network traffic around you on the SMS paging channel. The phone real time operating system actually discards messages that do not match your number (to put it very very high level.) https://silo.tips/download/exploiting-open-functionality-in-sms-capable-cellular-networks https://silo.tips/download/exploiting-open-functionality-in-... Also, great reads if you can find them: Qualcomm standard PDF's.

dfox 6y ago
For GSM simply receiving everything on PCH does not buy you much, because even ignoring encryption (IIRC even PCH is encrypted) most of traffic there is simply RR sublayer signaling (RR PAGING REQUEST and RR IMMEDIATE ASSIGNMENT messages and nothing much else). What the linked presentation describes is somewhat obvious DoS attack on the infrastructure that depends on ability to cheaply inject larger number of SM-MT messages into the network which authors assume will exhaust the downlink capacity of the network. My assumption is that in such case the first resource that will actually get exhausted is uplink capacity of RACH as the paged MS will attempt to allocate SDCCH in order to complete the paging procedure. I also assume that any currently deployed implementation of GSM has reasonable enough QoS implementation that this cannot happen in practice (especially in relation SMS because various SMS-related accidental RR exhaustions were somewhat common in early implementations). By the way nothing prevents you from causing cell-level DoS of similar type by simply spamming the RACH (except the fact that your local equivalent of FCC will be very unhappy and will be knocking on your door in surprisingly short time).
doctorshady 6y ago
Dead!? I know not of what you speak sir :D . https://pastebin.com/QhTPLGfg https://pastebin.com/QhTPLGfg https://shadytel.su/files/necsploits.htm https://shadytel.su/files/necsploits.htm
- solstice 6y ago
  ... that .su TLD
  - doctorshady 6y ago
    You jelly, comrade?
rsync 6y ago
"You could enable any phone to be a receiver for SMS and literally see the network traffic around you on the SMS paging channel. The phone real time operating system actually discards messages that do not match your number ..." This is literally true, and actually, you can do it with an SDR device and the GNURadio liveCD. However, this data will all be encrypted. Even on 2G networks, you can't just camp at a cellular base station and watch SMS fly by ...
- generalizations 6y ago
  With the right decryption tools, you nearly can. All you need is the 2TB precomputed Berlin Tables and the code to implement them.
  - computerphage 6y ago
    What are Berlin Tables? Are they the same as Rainbow Tables?
    - mschuster91 6y ago
      Yep, named that way after the city their discoverers are based at. https://srlabs.de/bites/decrypting-gsm/ https://srlabs.de/bites/decrypting-gsm/
pravus 6y ago
At least from my point-of-view a lot of these activities went away as the feds started clamping down. When you can get a prison sentence for serializing URLs it just doesn't make sense to risk it anymore.
foobarian 6y ago
For me the lightbulb went off in college with NIS and NFS when I realized the network expects me to tell it my user name so I can mount my home directory. Before that point I thought of these systems as well designed, unhackable things - after all, they had real multitasking right? Not like the dinky DOS machines I grew up with. But after that point the veil was lifted. And the older/more legacy a system was the worse it was.

dfox 6y ago

For GSM simply receiving everything on PCH does not buy you much, because even ignoring encryption (IIRC even PCH is encrypted) most of traffic there is simply RR sublayer signaling (RR PAGING REQUEST and RR IMMEDIATE ASSIGNMENT messages and nothing much else). What the linked presentation describes is somewhat obvious DoS attack on the infrastructure that depends on ability to cheaply inject larger number of SM-MT messages into the network which authors assume will exhaust the downlink capacity of the network. My assumption is that in such case the first resource that will actually get exhausted is uplink capacity of RACH as the paged MS will attempt to allocate SDCCH in order to complete the paging procedure. I also assume that any currently deployed implementation of GSM has reasonable enough QoS implementation that this cannot happen in practice (especially in relation SMS because various SMS-related accidental RR exhaustions were somewhat common in early implementations). By the way nothing prevents you from causing cell-level DoS of similar type by simply spamming the RACH (except the fact that your local equivalent of FCC will be very unhappy and will be knocking on your door in surprisingly short time).

doctorshady 6y ago

Dead!? I know not of what you speak sir :D . https://pastebin.com/QhTPLGfg https://pastebin.com/QhTPLGfg https://shadytel.su/files/necsploits.htm https://shadytel.su/files/necsploits.htm

solstice 6y ago
... that .su TLD
- doctorshady 6y ago
  You jelly, comrade?

rsync 6y ago

"You could enable any phone to be a receiver for SMS and literally see the network traffic around you on the SMS paging channel. The phone real time operating system actually discards messages that do not match your number ..." This is literally true, and actually, you can do it with an SDR device and the GNURadio liveCD. However, this data will all be encrypted. Even on 2G networks, you can't just camp at a cellular base station and watch SMS fly by ...

generalizations 6y ago
With the right decryption tools, you nearly can. All you need is the 2TB precomputed Berlin Tables and the code to implement them.
- computerphage 6y ago
  What are Berlin Tables? Are they the same as Rainbow Tables?
  - mschuster91 6y ago
    Yep, named that way after the city their discoverers are based at. https://srlabs.de/bites/decrypting-gsm/ https://srlabs.de/bites/decrypting-gsm/

pravus 6y ago

At least from my point-of-view a lot of these activities went away as the feds started clamping down. When you can get a prison sentence for serializing URLs it just doesn't make sense to risk it anymore.

foobarian 6y ago

For me the lightbulb went off in college with NIS and NFS when I realized the network expects me to tell it my user name so I can mount my home directory. Before that point I thought of these systems as well designed, unhackable things - after all, they had real multitasking right? Not like the dinky DOS machines I grew up with. But after that point the veil was lifted. And the older/more legacy a system was the worse it was.