3 ms·

GoIP-1 GSM gateway could be harnessed for phone fraud by hackers

43 points by ValtteriL 5y ago

pabl0rg 5y ago
Are there any non-chinese suppliers of gsm gateways?
- pabs3 5y ago
  Sysmocom sell devices with the Osmocom open source GSM stacks: https://osmocom.org/ https://osmocom.org/ https://www.sysmocom.de/ https://www.sysmocom.de/
- Nextgrid 5y ago
  Teltonika 4G routers can be used as gateways at least for SMS. They run OpenWRT and you get shell access out of the box so you could potentially get voice working too.
kuroguro 5y ago
I played around with a GoIP-4 a few years ago. Btw the old dbladm backdoor still worked IIRC at the end of 2020 but needed some re (I suspect it still does) - you can dump the code from firmware updates. They mark new challenge types with a letter in front of the numbers when you try to log in. I got the original (no prefix) and S, H, N type challenges working. Also possible to extract and reassemble custom firmware updates (if you want to run custom code) after you get admin rights - the package is only protected by an md5 in the header. Be sure to have a jtag ready, you'll need it the first few tries. Here's some old notes on the PKG format: https://gist.github.com/tostercx/3f2f2776736fbdaf9b8fa77c2037b7f1 https://gist.github.com/tostercx/3f2f2776736fbdaf9b8fa77c203... The FS is either cramfs or squashfs.
denton-scratch 5y ago
I used to own a GSM modem. It could in principle be hooked-up to a microphone and speaker to make voice calls; I used it only for SMS. It accepted AT commands from a serial port. You had to put a SIM in it. Apart from all the funky web-interfaces (with their security defects), isn't that basically what this GoIP-1 device is? Like, you can use it to send SMS; but it's not free, it's charged to the SIM account, right? So if you're stupid enough to put the web interface for this thing on the big, bad internet, then strangers can use your SIM card to send "free" text messages. But much the same would happen if you left your phone on a park bench.

43 points by ValtteriL 5y ago

pabl0rg 5y ago

Are there any non-chinese suppliers of gsm gateways?

pabs3 5y ago
Sysmocom sell devices with the Osmocom open source GSM stacks: https://osmocom.org/ https://osmocom.org/ https://www.sysmocom.de/ https://www.sysmocom.de/
Nextgrid 5y ago
Teltonika 4G routers can be used as gateways at least for SMS. They run OpenWRT and you get shell access out of the box so you could potentially get voice working too.

kuroguro 5y ago

I played around with a GoIP-4 a few years ago. Btw the old dbladm backdoor still worked IIRC at the end of 2020 but needed some re (I suspect it still does) - you can dump the code from firmware updates. They mark new challenge types with a letter in front of the numbers when you try to log in. I got the original (no prefix) and S, H, N type challenges working. Also possible to extract and reassemble custom firmware updates (if you want to run custom code) after you get admin rights - the package is only protected by an md5 in the header. Be sure to have a jtag ready, you'll need it the first few tries. Here's some old notes on the PKG format: https://gist.github.com/tostercx/3f2f2776736fbdaf9b8fa77c2037b7f1 https://gist.github.com/tostercx/3f2f2776736fbdaf9b8fa77c203... The FS is either cramfs or squashfs.

denton-scratch 5y ago

I used to own a GSM modem. It could in principle be hooked-up to a microphone and speaker to make voice calls; I used it only for SMS. It accepted AT commands from a serial port. You had to put a SIM in it. Apart from all the funky web-interfaces (with their security defects), isn't that basically what this GoIP-1 device is? Like, you can use it to send SMS; but it's not free, it's charged to the SIM account, right? So if you're stupid enough to put the web interface for this thing on the big, bad internet, then strangers can use your SIM card to send "free" text messages. But much the same would happen if you left your phone on a park bench.