Presentation Title Attacking GSM Base Stations and Mobile Phone Basebands
Presentation Abstract
Recent technological advances have placed GSM tools within the reach of today’s security researchers and hackers. It is finally possible to directly explore the lowest levels of the GSM stack.
This talk focuses on both sides of the GSM network where the users and network directly interact: the Um (air) interface. The primary technological focus of this talk is on the exposed interfaces between the GSM networks and users. This covers the base station system — the network components which communicate with mobile phones — and the base band — the component of the mobile phone which communicates with the network.
During the talk the two main components of the attack system will be demoed – malicious basestations and malicious basebands. The base station enables fuzzing mobile phone basebands, as well as other attacks. The baseband is used to test GSM network equipment for flaws, as well as exploit backend systems. The demos will target the Maxis and DiGi networks, showing vulnerabilities in the GSM protocol.
Trust us, you’ll *want* to turn off your phone for the duration of this talk!
About The Grugq
The Grugq is a pioneering information security researcher with over a decade of professional experience. He has worked extensively with digital forensic analysis, binary reverse engineering, rootkits, Voice over IP, telecommunications and financial security. The Grugq’s professional career has included Fortune 100 companies, leading information security firms and innovative start-ups. Currently living in Thailand, the Grugq works as a senior security researcher for Coseinc. While not on engagements, the Grugq continues his research on security, forensics and beer.
Claims to Fame:
* pioneered anti-forensics
* developed “userland exec”
* released voip attack software
* decade of experience in info sec
* long term liaison w/ digital underground
* described as “extremely handsome” [by his mom]
* 1992 sussex County 3-legged race, 2nd place
The Grugq has spoken at dozens of conferences over the last 7 years; provided expert training courses to .gov, .mil, police and businesses; domain expertise on forensics, voip, telecommunications and financial systems.