Roo2ng SIM cards The SRLabs Team
Rooting SIM cards by Karsten Nohl
Embed Size (px)
344 x 292
429 x 357
514 x 422
599 x 487
DESCRIPTION
Some DES-secured SIM cards allow for remote key cracking and applet installation; Java vulnerabilities enable attacker to remotely extract Ki, banking applet data; Mitigation options exist on network, baseband, and SIM card level.
Text of Rooting SIM cards by Karsten Nohl
1. Roo2ngSIMcards TheSRLabsTeam SRLabsTemplatev12
2. SIMcardsarefullyprogrammablecomputersystems
Applica'onsonmodernSIMcardSmartcardwithreal-2meopera2ngsystem
Basicfunc'onsSimplelesystemJavavirtualmachine Iden2ca2on(IMSI)
AddressbookCustomJavaapps Authen2ca2on(Ki& Hashfunc2on)
SMSmessages Roamingmgmt Sessionkeys Payment Tracking2 3.
SIMsecurityinvolvesmanylayersfromsmartcardstocryptography
andJavaprocesssepara2on SIMcardincludesvariousprotec'onmechanisms
Userauthen'ca'on bysimplecomparisonPIN/PUK numbersSIMauthen'ca'on
bycryptographichashfunc2on (oLenComp128inGSM; Ki Milenagein3G/4G)B
Applica'onsepara'on: JavaVMsandboxing Individualprotec2on
logicforbanking applets,iden2ca2on applets,etc.
ASecureJavadeployment usingDES/3DES/AES signature+encryp2on
Storageprotec'on throughproprietarysmartcard securitymechanismsOTA
keys JavacryptoAPI:DES/3DES/AES; some2mesRSA3 4.
AgendaSIMcardbackground A GeDngontotheSIM B StealingSIMsecrets4 5.
OTAsecuritylevelischosenbyserverwhileSIM
enforcesmandatoryminimumlevelILLUSTRATIVEBinarySMScommunica'on
OTAserver ini2ates remote transac2onTargetapp/keyset# Command Used
possibly security encrypted level and/or signedReque- sted security
levelSIMcardstoresmul2ple keysets,possiblywith
dierentprotec2onlevels Keyset3 Keyset2 Keyset1 Man- DES 3DES AES
datoryResponseprotected accordingtorequest, butnotbelowminimum
levelstoredoncardEncry- p2onSigna- ture5 6.
OTAerrorhandlingisunderspecied,possiblyopeningacack surface
BinarySMScommunica'on AOacker probescards togain materialfor DESkey
crackingCommandwith wrongsignatureUse:DES signatureRequest:DES
signatureResponsetomal-signedrequestdiersbycardtype a.(25%*
ofcards)SIMcard withDES key (prevalenceofDES keysvariesbetween
operators;canbeup to100%)(Noresponse)b.(50%*)ErrormessageSome2mes
withall-zeros signaturesc.(25%*)ErrormessageDES
signatureDatauseableforkeycracking*
Es2matedfromrela2velysmallandgeographicallyskewedmeasurementset6 7.
OTADESdonotwithstandkeycracking
Challenge:Derive56bitDESkeyfromOTAresponsesignature
Crackingstrategies Bepa'ent BruteforceonGPUThrowmoneyatit
BruteforceonFPGAclusterRidetherainbow Time-memorytrade-o
usinglargeharddisks&GPUInvestmentCracking'meEUR1.0006monthsEUR50.0001dayEUR1.500+
1yearpre-computa2on1minute (but
LOAD MORE
