Project

General

Profile

Wiki » History » Version 27

Philipp, 02/04/2016 11:46 AM

1 24 Philipp
{{toc}}
2 2 Karsten
3 24 Philipp
h1. SIMtester
4 1 Karsten
5 24 Philipp
SIMtestes assess SIM card security in two dimensions:
6
7 1 Karsten
* *Cryptanalytic attack surface.* Collect cryptographic signatures and encryptions of known plaintexts
8
9 9 Anonymous
* *Application attack surface.* Generate a list of all application identifiers (TAR) and find "unprotected" (MSL(Minimum Security Level)=0) applications
10 1 Karsten
11 24 Philipp
h2. Overview
12 1 Karsten
13 24 Philipp
The current version (v.1.8.1) introduces a lot of new, useful features:
14
15
| Feature                                          |Version *1.5*|Version *1.8.1*|
16
| PIN disable/verify/skip                          | yes         | yes           |
17
| Fuzzer                                           | yes         | yes           |
18
| APDU scanner                                     | yes         | yes           |
19
| TAR scanner                                      | yes         | yes           |
20
| OTA-Passthrough-Fuzzer                           | no          | *yes*         |
21
| OTA-APDU scanner                                 | no          | *yes*         |
22
| File Scanner                                     | no          | *yes*         |
23
| Fuzzing with constants                           | no          | *yes*         |
24
| 2G fallback                                      | no          | *yes*         |
25
26
Improvements:
27
28
* *Configurable OTA-Response handling* The user can now choose how the reply to OTA-Messages should be handled. Its possible to choose between SMS-DELIVER-REPORT (option -sdr) or SMS-SUBMIT (default)
29
* *OTA-Passthrough-Fuzzer* The OTA-Fuzzing functionality has been extended. The fuzzer can try vary the OTA message parameters (PID, DCS, UDHI, IEI/CPH) in order to find alternate configurations that let the message through
30
* *File Scanner* Some cards might contain proprietary files in addition to the standardized files. The filescanner allows the user to scan for hidden files in the cards file system. Its also possible just to check the standard files for their presence
31
* *Fuzzing with constants* Its now possible to keep the KIC, KID, SPI1, SPI2 bytes constant while fuzzing
32
* *APDU-Scanner* Its now also possible to scan for instructions (INS) instead of classes (CLA)
33
* *Multi-reader handling* Its now possible to iterate multiple card readers (option -la) to gather the card info faster
34
* *2G Fallback* In rare cases, some cards might react problematic when the 3G APDU format is used. In case of problems the user can now decide to use the 2g APDU format only
35
36
h2. Install
37
38
h3. Prerequisites
39
40 21 Peter
* Java 1.7 (code can be easily tweaked to compile under Java 1.6 or even lower if needed)
41
* PC/SC reader (via pcsc daemon) –or–
42 1 Karsten
* Osmocom phone (via libosmosim)
43 21 Peter
44 17 Anonymous
h3. Download
45 10 Anonymous
46 27 Philipp
# "Pre-compiled .jar with libraries":https://opensource.srlabs.de/attachments/download/117/SIMtester_v1.8.1.zip
47 19 Peter
# "Live-System":https://opensource.srlabs.de/projects/mobile-network-assessment-tools/wiki/GSMmap-live
48
49 1 Karsten
h3. Source code
50
51 24 Philipp
SIMTester is a GPL-licensed Java application (JAR archive), both sources and binaries are accessible under SIMTester GIT.
52 23 Philipp
53 1 Karsten
<pre> git clone https://opensource.srlabs.de:/git/SIMtester.git</pre>
54
55 24 Philipp
h2. Running SIMtester
56 11 Anonymous
57 24 Philipp
h3. Run from LiveISO
58 11 Anonymous
59 1 Karsten
Choose "Run Test" -> "SIM" from main menu, follow instructions.
60
61 24 Philipp
h3. Run pre-compiled binary
62 1 Karsten
63 25 Philipp
Unpack: <pre> unzip SIMTester_v1.8.1.zip</pre>
64 1 Karsten
65
<pre>
66
java -jar SIMTester.jar <arguments>
67
</pre>
68
69 24 Philipp
In case Java has problems to find the libpcsclite shared object, just submit the path manually:
70 1 Karsten
71 24 Philipp
<pre>
72
java -Dsun.security.smartcardio.library=/lib/x86_64-linux-gnu/libpcsclite.so.1 -jar SIMTester.jar <arguments>
73
</pre>
74
75
h3. Compile SIMtester
76
77
Software uses several libraries, if compiled from source the following libraries are needed:
78
79
* "Apache Common CLI 1.3":http://commons.apache.org/proper/commons-cli/
80
* "Apache HttpClient 4.3.x":http://hc.apache.org/
81
* "CombinatoricsLib 2.0":https://code.google.com/p/combinatoricslib/
82
* A functional PC/SC daemon and a compatible cardreader
83
* SIMLibrary - available in the git along with SIMTester
84
85
Compile from source with:
86
TODO
87
88
h4. General options
89
90 10 Anonymous
| command line option | description |
91
|*@-vp, --verify-pin <pin>@*|verifies the PIN, works for CHV1|
92 1 Karsten
|*@-sp, --skip-pin@*|skips verification of a PIN and ignore permission errors (may produce incomplete results!)|
93
|*@-dp, --disable-pin <pin>@*|disables PIN, works for CHV1 (ideal for testing cards so no PIN database in needed)|
94
|*@-tf, --terminal-factory <PCSC/OsmocomBB>@*|what are you using as SIM card reader|
95
|*@-ri, --reader-index <index of a reader>@*|multiple PC/SC readers can be connected, first is 0|
96 24 Philipp
|*@-2g, --2g-cmds@*|Use 2G APDU format only|
97
|*@-la, --list-all@*|Try to connect to all readers and show info about cards in them|
98
|*@-nl, --no-logging@*|Skip the CSV logging|
99 1 Karsten
|*@-gsmmap, --gsmmap@*|Automatically contribute data to gsmmap.org|
100
101 24 Philipp
h4. Fuzzer
102 1 Karsten
103
Has its own intelligent logic, fuzzes ~120 chosen TARs, is divided into 3 modes:
104
* Full fuzzing (default) - all 15 keysets with all 16 fuzzing mechanisms
105
* Quick fuzzing (-qf option) - keysets 1 to 6, only 4 most successful fuzzing mechanisms
106
* Poke the card (-poke option) - same as quick fuzzing but only fuzzes 3 most common TARs (000000, B00001, B00010)
107
Custom keysets and TARs can be specified via *-t* and *-k* parameters (space being a delimiter between multiple values).
108
109 24 Philipp
In addition to this the user has the option to keep certain bytes constant during fuzzing:
110 1 Karsten
111 24 Philipp
| command line option | description |
112
|*@-kic, --kic <arg>@*|Overwrites KIC byte in all fuzzer messages to a custom value|
113
|*@-kid, --kid <arg>@*|Overwrites KID byte in all fuzzer messages to a custom value|
114
|*@-spi1, --spi1 <arg>@*|Overwrites SPI1 byte in all fuzzer messages to a custom value|
115
|*@-spi2, --spi2 <arg>@*|Overwrites SPI2 byte in all fuzzer messages to a custom value|
116
117
OTA messages are delivered over SMS with standard PID, DCS, UDHI, IEI/CPH parameters. Service providers usually will filter OTA messages by their parameters and will usually comply with the standard to make up their filter rules. Using the OTA-Passthrough fuzzer functionality, the user can check if there are alternative, undocumented parameters which can be used to get the OTA message through. If undocumented parameter constellations are found, its very likely that they are not filtered by the service provider, which would be a weakness.
118
119
| command line option | description |
120
|*@-of, --ota-fuzz@*|Fuzz OTA passthrough (PID, DCS, UDHI, IEI/CPH)|
121
|*@-ofbf, --ota-fuzz-bruteforce@*|Use 0-255 values for both PID and DCS, without this options only most common values are used.|
122
123
The response handling of OTA-Messages can be implemented in two different ways. The backend either expects an additional user data field in the SMS-DELIVER-REPORT or waits for an incoming SMS that the card issues (SMS-SUBMIT) after completing the requested operation. The user can use the following option to choose between these to methods:
124
125
| command line option | description |
126
|*@-sdr, --sms-deliver-report@*|Use SMS-DELIVER-REPORT instead of SMS-SUBMIT for PoR|
127
128
h4. TAR Scanner
129
130
Scans for valid TAR(Toolkit Application Reference) values by sending messages to them, has 3 modes:
131 10 Anonymous
* Full scan (-st option) - scans for all possible TAR values (0x000000 - 0xFFFFFF) - may take a few hours or several days depending on your SIM card speed
132
* Ranged scan (-str option) - scans for valid TAR values in pre-specified ranges to optimise the scanning duration
133
134 24 Philipp
In addition to the scan type, some options can be specified:
135
- Smart TAR scan (scan a few random TARs to determine false response, option -stbs)
136
- Use a specified REGEXP to match response for false positives (option -stre)
137
Normally false responses should be constant (PoR status or status word), but there are corner cases in which also false responses might contain variable data.
138
139 10 Anonymous
A starting value for Full scan can be specified using *-t* option.
140 16 Anonymous
A keyset used for sending messages can be specified using *-k* option (for both Full and Ranged scans).
141
142 1 Karsten
Tip: run fuzzer first, see what keysets seem responsive (give answers other than none) and use one of those for TAR scanning, because if you use an inactive keyset it's very probable the card will NOT answer even on a valid TAR which makes TAR scanning non-functional.
143 16 Anonymous
144 1 Karsten
h5. APDU Scanner
145
146
Scans for valid APDU(Application Protocol Data Unit) values (think of APDUs as of commands to the card) on TARs without any public APDU reference, it has 2 modes:
147 24 Philipp
* LEVEL 1 scan (performed automatically after *Fuzzer* finishes and has found unprotected TARs with responses) - only scans for valid CLA(Class) 0x00 - 0xFF - it is performed via OTA(Over The Air) messages. Can also be invoked manually (option -sa)
148
* LEVEL 2 scan (option -sa -sal2) - scans for both CLA(Class) 0x00 - 0xFF and INS(Instruction) 0x00 - 0xFF - it is performed locally on card I/O on initially selected application
149 1 Karsten
150 24 Philipp
h4. Using OsmocomBB phone as a SIM reader
151 1 Karsten
152
This requires a patched firmware and a libosmosim.so library. Patched sources can be found in luca/libosmosim branch in OsmocomBB git tree:
153
154
<pre>
155
git clone git://git.osmocom.org/osmocom-bb.git
156 16 Anonymous
cd osmocom-bb/
157
git checkout luca/libosmosim
158
</pre>
159
160
once compiled use the *@layer1.compalram.bin@* firmware and copy *@libosmosim.so@* (@layer23/src/libosmosim/.libs/@) to your java.library.path folder (usually @/usr/lib/jni/@ on Linux).
161 1 Karsten
162
then just use *@-tf OsmocomBB @* to turn your Osmocom phone into a SIM card reader for SIMTester.
163 16 Anonymous
164 24 Philipp
h4. File Scanner
165 1 Karsten
166 24 Philipp
Automatically scans the files present on the SIM. This option can be used to detect non standard, proprietary files on the SIM. The scanner will start at 3F00 and automatically skips reserved values. The user has the option to add additional reserved values in order to skip files in case of problems. It is also possible to run the scanner in standard-scan-mode where only standard files are checked for their presence.
167
168
| command line option | description |
169
|*@-sf, --scan-files@*|Scans files on the SIM, starts at MF (0x3F00)|
170
|*@-sfb, --scan-files-break@*|Use with -sf, stop scanning directory when the count returned by Select APDU matched count of found files|
171
|*@-sffs, --scan-files-follow-standard@*|Use with -sf, only search for IDs that are standardized, eg. 3rd level files only between 4F00 and 4FFF etc.|
172
|*@-sfrv, --sfrv <sfrv>@*|File scanning: Add a file ID(s) to reserved values for file scanning (will be skipped).|
173
174
h2. Contribute
175
176
h3. Upload to gsmmap.org
177
178 17 Anonymous
a new option *@-gsmmap@* has been introduced in version 1.5 in order to provide upload functionality to gsmmap.org even for users not using the "Live-System":https://opensource.srlabs.de/projects/mobile-network-assessment-tools/wiki/GSMmap-live
179
180
Tor can be also used by specifying:
181 7 Anonymous
182 1 Karsten
<pre>
183 7 Anonymous
java -jar SIMTester.jar -gsmmap -socksProxyHost=127.0.0.1 -socksProxyPort=<tor_port> ... other options ...
184
</pre>
185
186 17 Anonymous
If you already have scanned your cards *without @-gsmmap@* option, you can use the web form here: http://gsmmap.org/upload.html to upload your CSV results SIMTester provided.
187 8 Anonymous
188
189 1 Karsten
190 7 Anonymous
h3. Mailing list
191 5 Karsten
192 24 Philipp
A public mailing list for announcements and discussion is found "here":https://lists.srlabs.de/cgi-bin/mailman/listinfo/simsec
193
Feel free to post your questions, observations, or results.