Hacker News Reader

Comment by rootsudo | Hacker News Reader

There's so many fun things you can do w/ telecom networks that it's a bit sad to see the phreaking community dead nowadays or relegated to just "modifying" roms.

You could enable any phone to be a receiver for SMS and literally see the network traffic around you on the SMS paging channel. The phone real time operating system actually discards messages that do not match your number (to put it very very high level.)

https://silo.tips/download/exploiting-open-functionality-in-...

Also, great reads if you can find them: Qualcomm standard PDF's.

View on HN

Dead!? I know not of what you speak sir :D .

https://pastebin.com/QhTPLGfg

https://shadytel.su/files/necsploits.htm

... that .su TLD

You jelly, comrade?

For GSM simply receiving everything on PCH does not buy you much, because even ignoring encryption (IIRC even PCH is encrypted) most of traffic there is simply RR sublayer signaling (RR PAGING REQUEST and RR IMMEDIATE ASSIGNMENT messages and nothing much else).

What the linked presentation describes is somewhat obvious DoS attack on the infrastructure that depends on ability to cheaply inject larger number of SM-MT messages into the network which authors assume will exhaust the downlink capacity of the network. My assumption is that in such case the first resource that will actually get exhausted is uplink capacity of RACH as the paged MS will attempt to allocate SDCCH in order to complete the paging procedure. I also assume that any currently deployed implementation of GSM has reasonable enough QoS implementation that this cannot happen in practice (especially in relation SMS because various SMS-related accidental RR exhaustions were somewhat common in early implementations). By the way nothing prevents you from causing cell-level DoS of similar type by simply spamming the RACH (except the fact that your local equivalent of FCC will be very unhappy and will be knocking on your door in surprisingly short time).

For me the lightbulb went off in college with NIS and NFS when I realized the network expects me to tell it my user name so I can mount my home directory. Before that point I thought of these systems as well designed, unhackable things - after all, they had real multitasking right? Not like the dinky DOS machines I grew up with. But after that point the veil was lifted. And the older/more legacy a system was the worse it was.

"You could enable any phone to be a receiver for SMS and literally see the network traffic around you on the SMS paging channel. The phone real time operating system actually discards messages that do not match your number ..."

This is literally true, and actually, you can do it with an SDR device and the GNURadio liveCD.

However, this data will all be encrypted. Even on 2G networks, you can't just camp at a cellular base station and watch SMS fly by ...

With the right decryption tools, you nearly can. All you need is the 2TB precomputed Berlin Tables and the code to implement them.

What are Berlin Tables? Are they the same as Rainbow Tables?

Yep, named that way after the city their discoverers are based at. https://srlabs.de/bites/decrypting-gsm/

At least from my point-of-view a lot of these activities went away as the feds started clamping down. When you can get a prison sentence for serializing URLs it just doesn't make sense to risk it anymore.

Reply on news.ycombinator.com