3 ms·

Well, the article says that it doesn't DoS the base station, but a group of stations called a location area. This location area in Berlin for example is 200 squ

Well, the article says that it doesn't DoS the base station, but a group of stations called a location area. This location area in Berlin for example is 200 square kilometers. That's quite a bit more than a single base station. And all you need is a cheap GSM feature phone. You could probably turn it on and literally toss it on a bus to take a quarter of the city offline with a rolling DoS jammer. Hard to find in case someone tries.

grugq 13y ago
For "basestation" read "the network". The partitioning of responsibility within a GSM network is relevant to this attack only in regards to which component maintains the "signals-pending table". There are a number of different locations this could be stored, depending on how the network is setup. They are doubtless using osmocom-bb, which is an open source baseband implementation for a number of older phones using an old baseband board. The implementation of the attack is not relevant to the attack itself. You could implement it with an SDR, or with osmocom-bb compatible boards, or whatever. It is still a race condition that they've figured out how to win. The solution is simple. The network needs to maintain to "signals-pending table" entry for a mobile until it successfully authenticates, or the entry times out. If they are flushing the entry after an unsuccessful authentication attempt then it enables a DoS, such as this one. I still have a hard time believing this is how it actually works because it seems like the network is behaving incorrectly.
- bad_user 13y ago
  I also don't believe that's how it works, for SMS at least. Authentication can also fail due to a broken device or to a poor connection. Does that mean SMS messages can get lost? Doesn't make sense. Also, since this is a race condition, it means that the exploit can't block all incoming calls.
  - Xylakant 13y ago
    They figured out a race condition that they will always win. So yes, the exploit currently can block all incoming calls.

grugq 13y ago

For "basestation" read "the network". The partitioning of responsibility within a GSM network is relevant to this attack only in regards to which component maintains the "signals-pending table". There are a number of different locations this could be stored, depending on how the network is setup. They are doubtless using osmocom-bb, which is an open source baseband implementation for a number of older phones using an old baseband board. The implementation of the attack is not relevant to the attack itself. You could implement it with an SDR, or with osmocom-bb compatible boards, or whatever. It is still a race condition that they've figured out how to win. The solution is simple. The network needs to maintain to "signals-pending table" entry for a mobile until it successfully authenticates, or the entry times out. If they are flushing the entry after an unsuccessful authentication attempt then it enables a DoS, such as this one. I still have a hard time believing this is how it actually works because it seems like the network is behaving incorrectly.

bad_user 13y ago
I also don't believe that's how it works, for SMS at least. Authentication can also fail due to a broken device or to a poor connection. Does that mean SMS messages can get lost? Doesn't make sense. Also, since this is a race condition, it means that the exploit can't block all incoming calls.
- Xylakant 13y ago
  They figured out a race condition that they will always win. So yes, the exploit currently can block all incoming calls.