Practical Baseband Exploitation


Instructor:  Pedro Ribeiro
Dates:    June 5 to 8  2023
Capacity:  20 Seats




Baseband exploitation is often considered the cream of the offensive security field. In the last decade, only a handful of such exploits were publicly released. As a result, many researchers view the ability to silently achieve code execution on a victimís device by emulating a GSM or LTE base station as a difficult objective.


In reality, baseband exploitation is not as challenging! By following a simple list of steps, a baseband platform can be quickly opened up for research, debugging and exploitation. In this course, students will learn our systematic approach to baseband research - from setting up a fake base station using SDR and open-source BTS software, to achieving initial debugging abilities using our embedded hooking framework, and finally reverse engineering the relevant protocols, hunting for bugs and exploiting them.


By the end of this heavily hands-on course, students will become familiar with two extremely common baseband platforms, Shannon and MediaTek, gain the skills to debug these and other baseband platforms, and learn about previously discovered bugs in basebands, and how they have been exploited.


KEY LEARNING OBJECTIVES


- Understanding communication processors at the architecture level


- Extracting baseband firmware for a device


- Understanding, loading, and analysing the RTOS baseband firmware


- Basic familiarity with 3GPP protocols, in particular GSM and GPRS


- Understanding the relevant GSM and GPRS attack surfaces


- Setting up a base station (BTS) and modifying its code


- Reverse engineering the code - methods and tricks


- Bug hunting - methods, tips, and previously discovered bugs


- Exploitation tricks in the baseband




AGENDA


Session 1: Introduction, initial analysis and debugging


Introduction to communication processors (CP):

- The evolution and challenges of communication systems

- Baseband processors: An architecture overview

- CP architectures: Broadcom, Qualcomm, MediaTek, Samsung



Code extraction and initial analysis:

- Challenges of baseband code extraction

- Getting the firmware

- Initial analysis: Parsing the firmware header

- Loading into IDA: Base addresses and program segmentation



Understanding baseband Real Time Operating Systems (RTOS):

- Data structures and IPC

- Memory permissions and mappings

- Mapping the attack surface

- Identifying functions and symbols in the code and writing a function mapping script

- Extracting debug strings and parsing them to name functions in the IDB



Debugging:

- Obtaining memory dumps

- Getting RWX permissions

- Building a debugger



Session 2: Cellular protocols and static analysis


Introduction to GSM, GPRS and UMTS:

- Guide to the relevant 3GPP protocols

- Working with the specs

- Determining the protocol attack surface

- Real time packet captures, analyzing a sample PCAP



Shannon: Static analysis and an architecture overview:

- Tasks, memory management and code structure

- Debugging functionality

- Samsung IPC: Talking to the Application Processor

- The Platform Abstraction Layer and the HAL



MediaTek: A comparison with Shannon:

- Nucleus OS: implementation in MediaTek

- Debugging the MediaTek baseband

- Interaction with the AP



Setting up a rogue BTS:

- Getting started with YateBTS

- Making phone calls and sending SMS over your own network



Session 3: Finding bugs in Shannon and MediaTek


2G and 3G sub-protocols:

- Full reversing of a CC handler function in Shannon and in MediaTek

- Adapting YateBTS to run with GPRS and a primer on the protocol



Vulnerability research in LTE and 5G:

- The additional complexities of setting up an eNodeB

- Working with mutual authentication

- Enumerating pre-authentication attack surfaces



Finding Shannon bugs:

- Guiding the students towards finding a Shannon bug presented at Pwn2Own 2018

- Guiding the students towards finding a recent Shannon bug that was silently patched

- Enumerating related parsers



Finding MediaTek bugs:

- Guiding the students towards finding a GPRS bug in MediaTek (DoS)

- Analysing the bug using the adapted hooking framework

- Opening related attack surfaces in MediaTek



Session 4: Exploiting a Shannon n-day


Modifying YateBTS code to deliver the exploit payload



Exploit primitives:

- Restoring execution after a Shannon stack overflow Ė resuming the message parsing loop

- Exploiting heap overflows in Shannon OS

- Analysing the stack and heap for secondary exploitation primitives

- Challenges/exploit mitigations



Achieving code execution:

- Developing a proof of concept (PoC)

- Using ROP for a full exploit

- Loading the initial shellcode stub into global memory

- Building a custom bridgehead Ė receiving the main payload over the air

- Second stage: Modifying the systemís behaviour in order to capture traffic or escalate to the AP



Baseband emulation for vulnerability research



Escalating to the Application Processor (AP) and Android - an introduction



Pre-requisites:


- C and Python

- Good reverse engineering knowledge

- Recommended: Familiarity with ARM assembly


Hardware Requirements:


- A working laptop

- 40 GB free Hard disk space


Software Requirements:


- IDA Pro or IDA Home with ARM Architecture is a must


32-bit ARM Decompiler is OPTIONAL, but highly recommended:

  -IDA Pro users can use the accompanying Hex Rays ARM decompiler

  -Ghidraís ARM decompiler can be used as a standalone decompiler for students with IDA       Home (only if you really canít get the Hex-Rays decompiler)


- Linux / Windows / Mac OS X desktop operating systems


- VMWare Player / VMWare Workstation / VMWare Fusion MANDATORY


- Administrator / root access MANDATORY


Bio

Pedro Ribeiro is a vulnerability researcher and reverse engineer with over 15 years of experience. Pedro has found and exploited hundreds of vulnerabilities in software, hardware and firmware. He has over 160 CVE IDís attributed to his name (most of which related to remote code execution vulnerabilities) and has authored over 60 Metasploit modules which have been released publicly. He also regularly competes in Pwn2Own as part of the Flashback Team, winning the coveted Master of Pwn in 2020. Besides his public vulnerability research activities, he is the founder and director of a penetration testing and reverse engineering consultancy based in London (Agile Information Security), and of an offensive security consultancy based in continental Europe (Vectorize). More information about Pedroís publicly disclosed vulnerabilities can be found at github.com/pedrib/PoC. Flashback Teamís YouTube channel can be found at youtube.com/c/FlashbackTeam

To Register

Click here to register.