Главная
Study mode:
on
1
Intro
2
How this Research Began
3
The Current Standard
4
OMA-DM: Managed Objects
5
Devices with OMA-DM
6
Embedded Client Locations
7
The Reference Toolkit
8
RedBend Software
9
"RedBend Enabled" Devices
10
Network Architecture Diagram
11
OMA-DM "Standard" Security
12
Initial OTA Payload Types
13
NIA Payload Example
14
DM Bootstrap Payload Example • Used for initial Device Provisioning
15
OMA-DM Tree Serialization
16
Client Side Parsing
17
Cellular Testing Hardware
18
Identifying Control Clients - Phones
19
Identifying Control Clients - Embedded Devices
20
Simulating Cellular Environments
21
Android Tracer
22
Cellular Network Attacks
23
Rogue Base Station Attacks
24
Vulnerabilities in Authentication
25
Transport Security and Encryption Flaws
26
Code Execution Without Memory Corruption
27
Types of Vulnerabilities found
28
Vulnerability Example: Reading Memory
29
Bypassing ASLR with OTA Feng Shui
Description:
Explore the hidden world of cellular device control and exploitation in this Black Hat conference talk. Delve into the reverse engineering of embedded baseband and application space code, uncovering the hidden controls present in over 2 billion cellular devices worldwide. Learn about the potential for cellular exploitation on a global scale, including Over-the-Air code execution on major cellular platforms and networks. Discover the inner workings of OMA-DM, managed objects, and embedded client locations. Examine network architecture, OMA-DM security, and various payload types. Gain insights into identifying control clients in phones and embedded devices, simulating cellular environments, and conducting cellular network attacks. Explore vulnerabilities in authentication, transport security, and encryption flaws. Understand how code execution can be achieved without memory corruption and learn about bypassing ASLR with OTA Feng Shui. Walk away with detailed knowledge of these hidden control mechanisms and access to open-source tools for assessing and protecting against new threats in the cellular landscape. Read more

Cellular Exploitation on a Global Scale - The Rise and Fall of the Control Protocol

Black Hat
Add to list
0:00 / 0:00