Embed Size (px)
Citation preview
Ha
cki
ng
Josh
ua
La
cke
y, P
h.D
.
Background
•P
h.D
., M
ath
em
atic
s. U
niv
ers
ity o
f O
reg
on
. 19
95 –
2000
•Se
nio
r Eth
ica
l Ha
cke
r. IB
M G
lob
al
Serv
ice
s. 1
999
–20
05
•Se
cu
rity
Soft
wa
re D
eve
lop
er.
M
icro
soft
SW
I Att
ac
k Te
am
. 20
05 –
Introduction
Ha
cki
ng
as
a W
hite
Ha
t
Re
qu
irem
en
ts•
Tec
hn
ica
l Ta
lk•
On
e 5
0 m
inu
te le
ctu
re
Pe
rso
na
l Re
qu
irem
en
ts•
No
t b
orin
g
Question
Wh
y w
ou
ld a
nyo
ne
sp
en
d $
1.5k
–$2
k p
er d
ay
for a
pe
ne
tra
tion
te
st?
Answer
•C
ost
/be
ne
fit
•R
isk
an
aly
sis
–h
ow
?
•Ex
am
ple
–a
n M
SRC
bu
lletin
co
sts
be
twe
en
$1
00k
an
d $
200k
.–
de
sig
n re
vie
w, t
hre
at
mo
de
l re
vie
w,
his
tory
of
pro
du
ct/
fea
ture
, tra
inin
g
sta
tistic
s fe
ed
into
th
e ri
sk a
na
lysis
.–
this
de
term
ine
s if
mo
re w
ork
mu
st b
e
pe
rfo
rme
d.
Answer
The
go
al o
f a
ny
pe
ne
tra
tion
te
st o
r e
thic
al h
ac
k is
to
de
term
ine
th
e tr
uth.
Truth
Is w
ha
t w
e b
elie
ve, w
ha
t w
e h
ave
b
ee
n t
old
ac
tua
lly t
rue
?
Is w
ha
t w
e d
esi
gn
ed
, wh
at
we
im
ple
me
nte
d s
ec
ure
?
Truth
•A
dve
rsa
rial S
itua
tion
s–
“of
co
urs
e w
e d
id t
his
sec
ure
ly”
•A
cq
uis
itio
ns
–q
ua
lity
an
aly
sis
–u
nkn
ow
n e
nvi
ron
me
nt
•Ta
len
t–
“ne
ver e
ven
th
ou
gh
t o
f th
at”
Truth
The
be
st p
lan
s in
clu
de
se
cu
rity
an
aly
sis
in a
ll p
ha
ses
of
de
velo
pm
en
t.
•D
esi
gn
–P
en
etr
atio
n t
est
ing
du
ring
de
sign
ph
ase
p
rovi
de
s fe
ed
ba
ck
be
fore
im
ple
me
nta
tion
.–
The
wo
rst
flaw
s a
re d
esi
gn
fla
ws.
•Im
ple
me
nta
tion
–So
ftw
are
de
velo
pe
rs w
ho
un
de
rsta
nd
h
ow
to
writ
e s
ec
ure
co
de
.
Truth
Do
es
it re
ally
co
st $
1.5k
–$2
k p
er d
ay
pe
r pe
ne
tra
tion
te
ste
r?
For t
op
-leve
l pe
ne
tra
tion
te
ste
rs, t
he
se
are
th
e s
tan
da
rd s
ec
urit
y c
on
sulta
nt’
s fe
es.
The
ma
in re
aso
n is
th
at
the
ta
len
t re
qu
ired
is n
ot
so c
om
mo
n.
Examples
Exa
mp
les
fro
m w
ork
.
Pro
ble
m:
I ca
nn
ot
dis
cu
ss a
ny
of
my
go
od
exa
mp
les.
Examples
Exa
mp
les
fro
m m
y re
sea
rch
.
–80
2.11
Fra
gm
en
tatio
n A
tta
ck
–V
W K
ey
Fob
–G
SM
Examples
Mo
st o
f w
ha
t I’m
go
ing
to
sp
ea
k a
bo
ut
is w
ork
s-in
-pro
gre
ss.
The
re w
ill b
e a
lot
of
qu
est
ion
s a
nd
ve
ry
few
an
swe
rs.
802.11 Fragmentation Attack
(Th
is is
fin
ish
ed
rese
arc
h.)
Serio
us
De
sig
n F
law
–tr
yin
g t
o g
au
ge
h
ow
mu
ch
th
is c
ost
is d
iffic
ult.
(E
spe
cia
lly s
inc
e m
ost
p
eo
ple
/co
mp
an
ies
ha
ven
’t
ad
dre
sse
d t
his
…)
Wo
uld
ha
ve b
ee
n e
xtre
me
ly d
iffic
ult
to
find
in d
esi
gn
ph
ase
an
ywa
y.
(Alth
ou
gh
po
ssib
le.)
802.11 Fragmentation Attack
Best
pre
vio
us
att
ac
k:W
ea
kne
sse
s in
th
e K
ey
Sch
ed
ulin
g
Alg
orit
hm
of R
C4.
Flu
hre
r, M
an
tin, S
ha
mir.
•V
en
do
rs c
ou
nte
red
by
no
t u
sing
we
ak
IVs.
•U
nfo
rtu
na
tely
, th
is w
as
no
t e
no
ug
h.
(Alth
ou
gh
m
an
y th
ou
gh
t it
wa
s.)
802.11 Fragmentation Attack
A v
uln
era
bili
ty e
xist
s in
th
e IE
EE 8
02.1
1 p
roto
co
l wh
ich
allo
ws
an
att
ac
ker t
he
a
bili
ty t
o t
ran
smit
WEP
en
cry
pte
d
pa
cke
ts w
itho
ut
kno
win
g t
he
e
nc
ryp
tion
ke
y.
This
vu
lne
rab
ility
allo
ws
an
att
ac
ker t
o
de
cry
pt
pa
cke
ts a
s w
ell.
This
wa
s d
isc
lose
d t
o C
ERT
on
Se
pte
mb
er 1
6, 2
003.
802.11 Fragmentation Attack
RC
4 En
cry
ptio
n
If w
e d
en
ote
by E_k(P)
the
en
cry
ptio
n o
f th
e p
lain
-te
xt
me
ssa
ge
P b
y th
e R
C4
en
cry
ptio
n m
eth
od
with
ke
y k,
w
e h
ave
E_k(P) = X + P
Wh
ere
X is
th
e p
seu
do
-ra
nd
om
bit-
stre
am
ge
ne
rate
d b
y th
e R
C4
PR
GA
with
ke
y k
.
An
d t
hu
s E_k(P) + P = X
802.11 Fragmentation Attack
Log
ica
l Lin
k C
on
tro
l Pa
cke
ts
The
mo
st c
om
mo
n L
LC/S
NA
P p
ac
ket
see
n o
n a
n 8
02.1
1 n
etw
ork
is t
he
Eth
ern
et
typ
e L
LC w
ith IP
.
Exp
licitl
y, t
his
pa
cke
t c
on
sists
of t
he
follo
win
g e
igh
t b
yte
s.
P' = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x08, 0x00 }
802.11 Fragmentation Attack
Log
ica
l Lin
k C
on
tro
l Pa
cke
ts
Eac
h e
nc
ryp
ted
pa
cke
t o
n a
n 8
02.1
1 n
etw
ork
is
en
ca
psu
late
d in
a lo
gic
al-l
ink
co
ntr
ol p
ac
ket.
Tha
t is,
ea
ch
pa
cke
t P
is t
he
co
nc
ate
na
tion
of
P',
giv
en
a
bo
ve, a
nd
so
me
P'‘.
P = P' P''
802.11 Fragmentation Attack
Log
ica
l Lin
k C
on
tro
l Pa
cke
ts
By t
he
ab
ove
co
mm
en
ts o
n R
C4,
we
ca
n f
ind
th
e f
irst
eig
ht
byt
es
of
the
pse
ud
o-r
an
do
m b
it-st
rea
m X
' g
en
era
ted
by
the
ke
y u
sed
to
en
cry
pt
this
pa
cke
t,
X' = E_k(P') + P'
Bec
au
se w
e k
no
w t
he
pla
in-t
ext
P',
we
ca
n e
nc
ryp
t a
ny
arb
itra
ry e
igh
t b
yte
s w
ith k
ey
k. W
e h
ave
, fo
r an
y e
igh
t b
yte
te
xt Q
,
E_k(Q) = X' + Q
802.11 Fragmentation Attack
802.
11 F
rag
me
nta
tion
Sec
tion
9.4
of t
he
199
9 IE
EE 8
02.1
1 p
roto
co
l sp
ec
ific
atio
n p
rovi
de
s a
me
tho
d t
o
fra
gm
en
t p
ac
kets
wh
en
ne
ed
ed
. M
ore
ove
r, e
ac
h f
rag
me
nt
is e
nc
ryp
ted
in
div
idu
ally
.
802.11 Fragmentation Attack
By tr
ans
mitt
ing
pa
cke
ts in
fra
gm
ent
s, a
n a
ttac
ker c
an
inje
ct a
rbitr
ary
pa
cke
ts
into
a W
EP e
ncry
pte
d 8
02.1
1 w
irele
ss
netw
ork
.
802.11 Fragmentation Attack Example
Ca
ptu
re a
pa
cke
t, in
clu
din
g t
he
802
.11
he
ad
ers
, off
a W
EP e
nc
ryp
ted
ne
two
rk.
41
49
16
5e
8a
a4
ae
e9
f1
50
0c
33
02
21
a2
38
bd
fc
6f
3c
01
0a
0e
96
4f
2d
06
70
41
95
06
51
c5
05
cf
14
66
e1
76
db
00
47
f9
55
01
00
11
da
50
24
00
00
17
75
ea
35
0e
00
75
ee
37
5a
04
00
01
02
41
08
802.11 Fragmentation Attack Example
If w
e p
ars
e t
he
802
.11
he
ad
er,
we
fin
d t
his
p
ac
ket
co
nta
ins
the
fo
llow
ing
.
type: data frame, data only
to_ds: 1, from_ds: 1, more_frag: 0,
retry: 0, pwr_mgt: 0, more_data: 0,
wep: 1, order: 0
dur: 102
a1: 00-04-5A-37-EE-75
a2: 00-0E-35-EA-75-17
a3: 00-00-24-50-DA-11
seq: frag= 00, num = 0010
data:
55 f9 47 00 db 76 e1 66 14 cf05 c5 51 06 95 41
70 06 2d 4f 96 0e 0a 01 3c 6f fcbd38 a2 21 02
33 0c 50 f1 e9 aea4 8a 5e 16 49 41
802.11 Fragmentation Attack Example
The
firs
t 10
en
cry
pte
d d
ata
byt
es
are
:
db 76 e1 66 14 cf05 c5 51 06
Ass
um
ing
th
at
we
ha
ve a
IPv4
pa
cke
t w
ith a
Eth
ert
ype
LLC
/SN
AP
he
ad
er,
the
pla
in-t
ext
da
ta is
:
aaaa03 00 000008 00 45 00
The
refo
re t
he
firs
t te
n b
yte
s o
f th
e p
seu
do
-ra
nd
om
bit-
stre
am
are
de
rive
d a
s fo
llow
s.
db 76 e1 66 14 cf05 c5 51 06
+ aaaa03 00 000008 00 45 00
-------------------------------
71 dc e2 66 14 cf0d c5 14 06
802.11 Fragmentation Attack Example
Sup
po
se w
e w
ish
to
tra
nsm
it a
n IC
MP
ec
ho
req
ue
st.
45 00 002c 7a 0f 00 00ff 01 33 b9 01 02 03 04 E..,z.....3.....
0a 01 00 02 08 00 6d 81 5d 02 2f 96 69 6e 6a 65 ......m.]./.inje
63 74 65 64 20 70 61 63 6b 65 74 00 ctedpacket.
802.11 Fragmentation Attack Example
Bre
ak
this
pa
cke
t in
to f
rag
me
nts
.
fragment 0:
data: aaaa
03 00 0000
crc: f2 bb 67 21
fragment 1:
data: 08 00 45 00 002c
crc: 22 e7 83 c3
fragment 2:
data: 25 4c 00 00ff 01
crc: 8a 4d 83 9f
fragment 3:
data: 88 7c 0a 01 00 02
crc: a7 d1 72 ff
[�]
802.11 Fragmentation Attack Example
For e
ac
h p
iec
e o
f fr
ag
me
nte
d d
ata
, en
cry
pt
with
th
e p
seu
do
-ra
nd
om
bit
stre
am
an
d
att
ac
h a
n 8
02.1
1 h
ea
de
r.
fragment 0:
type: data frame, data only
to_ds: 1, from_ds: 0, more_frag: 1,
retry: 0, pwr_mgt: 0, more_data: 0,
wep: 1, order: 0
dur: 0
a1:
00-04-5A-37-EE-75
a2:
00-0E-35-EA-75-17
a3:
00-00-24-50-DA-11
seq:
frag= 00, num = 0024
data:
55 f9 47 00 db 76 e1 66 14 cfff 7e 73 27
802.11 Fragmentation Attack Example
Co
ntin
ue
.
fragment 1:
type: data frame, data only
to_ds: 1, from_ds: 0, more_frag: 1,
retry: 0, pwr_mgt: 0, more_data: 0,
wep: 1, order: 0
dur: 0
a1:
00-04-5A-37-EE-75
a2:
00-0E-35-EA-75-17
a3:
00-00-24-50-DA-11
seq:
frag= 01, num = 0024
data:
55 f9 47 00 79 dc a7 66 14 e3 2f 22 97 c5
802.11 Fragmentation Attack Example
No
w t
ran
smit
the
fra
gm
en
ts.
The
ac
ce
ss p
oin
t w
ill d
ec
ryp
t e
ac
h fr
ag
me
nt
an
d c
om
bin
e t
he
m in
to a
sin
gle
de
cry
pte
d
pa
cke
t a
nd
fo
rwa
rd it
to
th
e d
est
ina
tion
.
802.11 Fragmentation Attack Example
I om
itte
d q
uite
a fe
w d
eta
ils, b
ut
this
is t
he
a
tta
ck.
It
ha
s b
ee
n v
erif
ied
to
wo
rk a
ga
inst
a
ll te
ste
d a
cc
ess
po
ints
. U
nd
ers
tan
da
ble
as
all
this
is s
pe
cifi
ed
in t
he
pro
toc
ol.
For a
n e
xce
llen
t w
rite
-up
of
this
att
ac
k, s
ee
A
nd
rea
Bitt
au
’sp
ap
er.
(Be
tte
r ve
rsio
n t
ha
t I
co
-au
tho
red
is c
om
ing
so
on
.)
htt
p:/
/ww
w.t
oo
rco
n.o
rg/2
005/
slid
es/
ab
itta
u/p
ap
er.p
df
Research
No
w t
o t
alk
ab
ou
t so
me
rese
arc
h t
ha
t is
n’t
fin
ishe
d.
But
first
, a s
ma
ll a
sid
e.
Software Radio
On
ce
up
on
a t
ime
, ra
dio
wa
s fo
r h
ard
wa
re g
ee
ks.
–Ex
pe
nsiv
e e
qu
ipm
en
t.
–Fo
r dig
ital s
ign
als
, ve
ry e
xpe
nsi
vee
qu
ipm
en
t.•
An
d s
om
etim
es
no
t a
vaila
ble
to
th
e g
en
era
l p
ub
lic.
–O
f c
ou
rse
cu
sto
m h
ard
wa
re w
as
alw
ays
a
n o
ptio
n.
Software Radio
•N
ow
we
ha
ve in
exp
en
sive
“fr
on
t e
nd
” h
ard
wa
re.
•U
ses
you
r co
mp
ute
r as
the
“b
ac
k e
nd
” p
roc
ess
or.
–Ev
ery
sig
na
l is
no
w o
nly
a m
att
er o
f so
ftw
are
.–
Fre
e a
nd
inc
rea
sing
ly fu
ll-fe
atu
red
SD
R li
bra
ries.
•U
SRP
–Th
e U
niv
ers
al S
oft
wa
re R
ad
io P
erip
he
ral.
htt
p:/
/ww
w.e
ttu
s.c
om
USRP
USRP
•Tw
o A
/D D
/A c
on
vert
ers
–A
/D @
64M
sam
ple
s/se
c–
D/A
@ 1
28M
sam
ple
s/se
c
•A
ltera
FPG
A–
Fie
ld P
rog
ram
ma
ble
Ga
te A
rra
y
•D
au
gh
terb
oa
rd in
terf
ac
es
–Fo
r RF
inte
gra
tion
•Ba
sicR
Xa
nd
Ba
sicTX
–d
irec
t in
terf
ac
e t
o
AD
/DA
•TV
RX
–c
ab
le T
V t
un
er i
nte
rfa
ce
•D
BSR
X –
sate
llite
TV
tu
ne
r in
terf
ac
e
Daughterboards
•Ba
sic
RX
@ 6
4Msa
mp
les/
sec
–R
ec
eiv
e fr
eq
ue
nc
ies
up
to
32M
Hz
•Br
oa
dc
ast
AM
•Sh
ort
wa
ve
–A
liase
d f
req
ue
nc
ies
with
de
cre
ase
d
sig
na
l str
en
gth
.•
No
t so
go
od
for d
igita
l.
•Ba
sic
TX@
128
Msa
mp
les/
sec
–Tr
an
smit
fre
qu
en
cie
s u
p t
o 6
4MH
z
Daughterboards
•TV
RX
–c
ab
le T
V t
un
er
–R
ec
eiv
e fr
eq
ue
nc
ies
fro
m 5
0MH
z to
90
0MH
z•
Bro
ad
ca
st F
M•
Po
lice
(a
na
log
an
d d
igita
l)•
An
alo
g c
ellu
lar p
ho
ne
s (A
MP
S)•
Dig
ital m
ob
ile p
ho
ne
s–
DA
MP
S–
GSM
–iD
EN
•Et
c, e
tc, e
tc.
Daughterboards
•D
BSR
X –
sate
llite
TV
tu
ne
r–
Re
ce
ive
fre
qu
en
cie
s fr
om
800
MH
z to
2.
5(+
)GH
z•
GSM
•C
DM
A•
Blu
eto
oth
•80
2.11
•H
ydro
ge
n (
Ra
dio
Ast
ron
om
y)•
Etc
, etc
, etc
.
Wireless Communication Security
Soft
wa
re R
ad
io–
Ch
ea
p h
ard
wa
re.
–Ea
sily
ava
ilab
le.
–H
igh
ly fl
exi
ble
.
Exa
min
ing
the
se
cur
ity o
f co
mp
lex
wire
less
pro
toc
ols
is n
ow
po
ssib
le fo
r th
e in
de
pe
nde
nt re
sea
rche
r.
We
will
gra
du
ally
se
e m
ore
an
d m
ore
of
wire
less
pro
toc
ol
vuln
era
bili
ties
an
no
un
ce
d.
Examples
Vo
lksw
ag
en
Ke
y Fo
b
Eve
ry d
ay
I un
loc
k m
y c
ar w
ith a
rad
io.
Ho
w
sec
ure
is t
his
? I
’m s
ure
if w
e a
ske
d w
e
wo
uld
be
to
ld t
ha
t, “
of
co
urs
e t
his
is
sec
ure
.”
Wh
at
is t
he
tru
th?
Wh
at
is t
he
–A
lgo
rith
m?
–Q
ua
lity
of P
RN
G?
(If
use
d.)
Firs
t st
ep
is t
o g
ath
er d
ata
.
Examples
Vo
lksw
ag
en
Ke
y Fo
b
Fin
d k
ey
fob
tra
nsm
it fr
eq
ue
nc
y•
FFT
sign
al s
ea
rch
•Fr
eq
ue
nc
y g
rab
be
r•
FCC
ID S
ea
rch
:
htt
ps:
//g
ullf
oss
2.fc
c.g
ov/
pro
d/o
et/
cf/
ea
s/re
po
rts/
Ge
ne
ricSe
arc
h.c
fm
VW Key Fob
•FF
T Si
gn
al S
ea
rch
VW Key Fob
•FC
C ID
Se
arc
h–
Ge
t FC
C ID
fro
m d
evi
ce
.–
Gra
nte
e c
od
e is
firs
t th
ree
lett
ers
.•
VW
Ke
y Fo
b: N
BG
–Fr
eq
ue
nc
y is
315
MH
z.–
Mo
du
latio
n t
ype
is A
1D•
Am
plit
ud
e m
od
ula
tion
da
ta t
ran
smis
sio
n, d
ou
ble
si
de
ba
nd
, with
ou
t u
sin
g a
mo
du
latin
g s
ub
ca
rrie
r.
VW Key Fob
•M
od
ula
tion
–FC
C g
ave
us
mo
du
latio
n.
–C
an
rec
og
niz
e d
iffe
ren
t m
od
ula
tion
ty
pe
s fr
om
FFT
an
d ra
w s
ign
al.
•Es
tima
te b
an
dw
idth
. Fi
lter.
Exa
min
e c
lose
ly.
VW Key Fob
Ca
ptu
re s
ign
al (
am
plit
ud
e d
em
od
)
VW Key Fob
Firs
t Si
gn
al
VW Key Fob
Sam
ple
s 25
000
–35
000
of
first
sig
na
l
VW Key Fob
Sam
ple
s 31
000
–33
000
of
first
sig
na
l
VW Key Fob
Sam
ple
s 32
110
–32
880
of
first
sig
na
l
VW Key Fob
Sam
ple
d a
t 50
0kH
z–
Ho
lds
low
fo
r 250
sa
mp
les
–.5
ms
–H
old
s h
igh
fo
r 500
sa
mp
les
–1m
s
For i
niti
al p
urp
ose
s–
Sym
bo
l le
ng
th is
.5m
s–
Low
is 0
–H
igh
is 1
So t
he
sa
mp
le w
e w
ere
loo
kin
g a
t w
as
011
VW Key Fob
De
mo
d–
tra
nsm
it Fr
eq
ue
nc
y–
sign
al b
an
dw
idth
–g
ue
ss a
t sy
mb
ol m
od
ula
tion
No
w ju
st w
rite
so
me
so
ftw
are
!
VW Key Fob
Exa
min
ed
~10
0 e
xam
ple
s. N
o re
pe
ats
a
ltho
ug
h t
he
re a
re d
efin
ite p
att
ern
s.
Ne
xt s
tep
s•
Pro
ba
bly
ea
sie
st t
hin
g t
o d
o w
ou
ld b
e
to e
xam
ine
th
e d
em
od
ed
da
ta f
or
sta
tistic
al p
att
ern
s. (
Die
ha
rd)
•Se
e B
ind
vie
wp
ap
er o
n s
tra
ng
e
att
rac
tors
in T
CP
se
qu
en
ce
nu
mb
ers
.h
ttp
://w
ww
.bin
dvi
ew
.co
m/S
erv
ice
s/R
azo
r/P
ap
ers
/200
1/tc
pse
q.c
fm
Next
GSM
Do
cu
me
nta
tion
is v
ery
go
od
an
d d
esi
gn
fla
ws
ca
n b
e id
en
tifie
d t
he
re.
Wh
at
ab
ou
t im
ple
me
nta
tion
fla
ws?
•W
ha
t e
nc
ryp
tion
do
es
my
ph
on
e u
se?
–A
5/1
an
d A
5/2
ha
cke
d.
–A
ctu
ally
, ho
w d
o I
kno
w I’
m u
sing
an
y e
nc
ryp
tion
a
t a
ll?
•H
ow
ab
ou
t ra
nd
om
nu
mb
ers
?•
Ho
w a
bo
ut
ma
n-in
-th
e-m
idd
le a
tta
cks
?–
Re
qu
ires
tra
nsm
it a
nd
so
pro
ba
bly
ille
ga
l to
te
st.
GSM
Fin
d t
ran
smit
fre
qu
en
cy.
•FF
T Si
gn
al S
ea
rch
–ju
st k
no
win
g t
he
ba
nd
wid
th is
ac
tua
lly
go
od
en
ou
gh
–FC
C S
ea
rch
fo
r to
we
rs in
yo
ur a
rea
–D
oc
um
en
tatio
n
htt
p:/
/ww
w.3
gp
p.o
rg/s
pe
cs/
nu
mb
erin
g.h
tm
GSM
Turn
s o
ut
I ha
ve t
wo
str
on
g s
ign
als
re
ac
ha
ble
fro
m m
y c
om
pu
ter r
oo
m.
On
e a
t 1.
9474
GH
z a
nd
th
e o
the
r at
1.94
68G
Hz.
GSM
GSM
To
we
r at
1.94
74G
Hz
with
1M
Hz
DBS
filte
r.
GSM
Mo
du
latio
n t
ype
is G
MSK
(o
r 8P
SK)
GSM
•C
ap
ture
sig
na
l (Sa
mp
les
2M –
3M @
4Msp
s.)
GSM
•Sa
mp
les
2M –
2.00
1M
GSM
No
w, w
rite
so
me
so
ftw
are
!
•BC
CH
(SC
CH
)–
FIR
E p
arit
y–
co
nvo
lutio
na
len
co
de
r / V
iterb
ide
co
de
r–
blo
ck
inte
rlea
vin
g–
ma
p o
n b
urs
t–
co
nte
nt
pa
rsin
g
•N
ext
ch
an
ne
l
Conclusion
•P
en
etr
atio
n t
est
ing
ca
n b
e u
sefu
l –c
ost
/be
ne
fit.
Co
sts
for m
ista
kes
ca
n
be
ve
ry h
igh
.
•So
ftw
are
rad
io is
co
ol.
•M
ore
info
? I
de
as?
Se
nd
me
em
ail:
jl@th
re.a
t
