https://docs.srsran.com/en/latest/index.html

4G - 5G attacking

https://asset-group.github.io/disclosures/5ghoul/disclosure.html & jamming -> https://ningning-hou.github.io/homepage/files/rewrite_Jamming_TOSN.pdf

Starlink router

https://olegkutkov.me/2021/12/25/analysis-and-reverse-engineering-of-the-original-starlink-router/

Medvejatnik (вскрытие замков)

https://www.youtube.com/channel/UCnJzwMaQxQux3kTqoGYC6hg

RFID протоколы и как их похекать с помощью Flipper Zero

https://github.com/Ondrik8/HARD_device_attack/blob/master/The_Hardware_Hacking_Handbook_Breaking_Embedded_Security_with_Hardware.pdf

interactive-shell-via-bluetooth

Фреймворки для тестирования проникновения IOT:

  https://gitlab.com/expliot_framework/expliot
  https://gitlab.com/invuls/iot-projects/iotsecfuzz
  https://github.com/threat9/routersploit

Инструменты reverse инжиниринга прошивки IOT:

  https://github.com/ReFirmLabs/binwalk
  https://github.com/craigz28/firmwalker
  https://github.com/fkie-cad/FACT_core
  https://github.com/david-a-wheeler/flawfinder
  https://github.com/rampageX/firmware-mod-kit
  https://github.com/radareorg/r2ghidra-dec
  https://github.com/CERTCC/trommel
  https://github.com/ChrisTheCoolHut/Firmware_Slap
  https://github.com/angr/angr
  

РУССКИЙ НАЦИОНАЛЬНЫЙ ХАКИНГ : Павел Жовнер

Собираем глушилку из г-на и палок

PENIOT: Penetration Testing Tool for IoT

JavaScript Exploit Can Now Carry Out DDR4 Rowhammer Attacks

Awesome-Cellular-Hacking

Please note multiple researchers published and compiled this work. This is a list of their research in the 3G/4G/5G Cellular security space. This information is intended to consolidate the community’s knowledge. Thank you, I plan on frequently updating this “Awesome Cellular Hacking” curated list with the most up to date exploits, blogs, research, and papers.

The idea is to collect information like the BMW article below, that slowly gets cleared and wiped up from the Internet - making it less accessible, and harder to find. Feel free to email me any document or link to add.

Rogue BTS & CDMA/GSM Traffic Impersonation and Interception

How to create an Evil LTE Twin/LTE Rogue BTS How to setup a 4G/LTE Evil Twin Base Station using srsLTE and a USRP SDR device.
How To Build Your Own Rogue GSM BTS For Fun and Profit “In this blog post I’m going to explain how to create a portable GSM BTS which can be used either to create a private ( and vendor free! ) GSM network or for GSM active tapping/interception/hijacking … yes, with some (relatively) cheap electronic equipment you can basically build something very similar to what the governments are using from years to perform GSM interception.”
Practical attacks against GSM networks: Impersonation “Impersonating a cellular base station with SDR: With the flexibility, relative low cost of Software Defined Radio (SDR) and abundance of open source projects that emulate a cell tower, successfully impersonating a GSM Base Station (BTS) is not a difficult task these days.”
Building a Portable GSM BTS Using BladeRF/PI “I was always amazed when I read articles published by some hackers related to GSM technology. However, playing with GSM technologies was not cheap until the arrival of Software Defined Radios (SDRs), besides not being something easy to be implemented.”
rtl.sdr.com Tutorial-Analyzing GSM with-Airprobe and Wireshark “The RTL-SDR software defined radio can be used to analyze cellular phone GSM signals, using Linux based tools GR-GSM (or Airprobe) and Wireshark. This tutorial shows how to set up these tools for use with the RTL-SDR.”
Traffic Interception for Penetration Testing Engagements “Within the penetration testing domain quite often we have to deal with different technologies and devices. It’s important to cover all aspects of connectivity of a device being tested which is why we have built a GSM/GPRS interception capability. There are a number of different devices and systems that make use of GSM/GPRS, non-exhaustively we commonly see:”

Rogue Base Stations or Evil BTS’s, 2G/3G/4G

OpenBTS software is a Linux application that uses a software-defined radio to present a standard 3GPP air interface to user devices, while simultaneously presenting those devices as SIP endpoints to the Internet

YateBTS is a software implementation of a GSM/GPRS radio access network based on Yate and is compatible with both 2.5G and 4G core networks comprised in our YateUCN unified core network server. Resiliency, customization and technology independence are the main attributes of YateBTS

BladRF and YateBTS Configuration

srsLTE is a free and open-source LTE software suite developed by SRS (www.softwareradiosystems.com)

Installing a USRP Device on Linux

sudo add-apt-repository ppa:ettusresearch/uhd
sudo apt-get update
sudo apt-get install libuhd-dev libuhd003 uhd-host
uhd_find_devices
cd /usr/lib/uhd/utils/
./uhd_images_downloader.py
sudo uhd_usrp_probe 

sudo uhd_usrp_probe
[INFO] [UHD] linux; GNU C++ version 7.4.0; Boost_106501; UHD_3.14.1.1-release
[INFO] [B200] Detected Device: B*****
[INFO] [B200] Operating over USB 3.
[INFO] [B200] Initialize CODEC control...
[INFO] [B200] Initialize Radio control...
[INFO] [B200] Performing register loopback test...
[INFO] [B200] Register loopback test passed
[INFO] [B200] Setting master clock rate selection to 'automatic'.
[INFO] [B200] Asking for clock rate 16.000000 MHz...
[INFO] [B200] Actually got clock rate 16.000000 MHz.
  _____________________________________________________
 /
|       Device: B-Series Device

Troubleshooting SDR’s that are running BTS software

Common issues:

Improper FW
Lack of proper antennas
Wrong cellular phone type
Wrong SIM
Not configured correctly - Mobile Country Codes (MCC) and Mobile Network Codes (MNC)
Incorrect software BTS settings
Virtualized platform is not fast enough
Wrong SDR firmware

JAMMING SPECIFC ATTACKS

4.5 Radio Jamming Attacks Jamming attacks are a method of interrupting access to cellular networks by exploiting the radio frequency channel being used to transmit and receive information. Specifically, this attack occurs by decreasing the signal to noise ratio by transmitting static and/or noise at high power levels across a given frequency band. This classification of attack can be accomplished in a variety of ways requiring a varying level of skill and access to specialized equipment. Jamming that targets specific channels in the LTE spectrum and is timed specifically to avoid detection is often referred to as smart jamming. Broadcasting noise on a large swath of RF frequencies is referred to as dumb jamming.

4.5.1 Jamming UE Radio Interface A low cost, high complexity attack has been proposed to prevent the transmission of UE signaling to an eNodeB.

4.5.2 Jamming eNodeB Radio Interface Base stations may have physical (e.g., fiber optic) or wireless (e.g., microwave) links to other base stations. These links are often used to perform call handoff operations. As mentioned in section 4.5.1, it may be possible to jam the wireless connections eNodeBs use to communicate with each other. Although theoretical, the same type of smart jamming attacks that are used against the UE could be modified to target communicating eNodeBs, which would prevent the transmission of eNodeB to eNodeB RF communication.

CERT/Media Alerts

Voice over LTE implementations contain multiple vulnerabilities - CERT ALERT

5G Cellular Attacks

2G-4G/LTE Cellular Attacks

This is Your President Speaking:Spoofing Alerts in 4G LTE Networks
Hacking Public Warning System in LTE Mobile Networks
RF Exploitation: IoT/OT Hacking with SDR
Forcing a targeted LTE Cellphone Into an Eavesdropping Network
Hacking Cellular Networks
Bye-Bye-IMSI-Catchers
White-Stingray: Evaluating IMSI Catchers Detection Applications
Breaking_LTE_on_Layer_Two
LTE/LTE-A Jamming, Spoofing, and Sniffing: Threat Assessment and Mitigation
Exploring LTE security and protocol exploits with open source software and low-cost software radio by Roger Jover
LTE PROTOCOL EXPLOITS: IMSI CATCHERS,BLOCKING DEVICES AND LOCATION LEAKS
Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems
Using OpenBTS - “Experimental_Security_Assessment_of_BMW_Cars by KeenLab”
LTE Security – How Good Is It?
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-187.pdf -Small Tweaks do Not Help: Differential Power Analysis of MILENAGE Implementations in 3G/4G USIM Cards
#root via SMS: 4G access level security assessment
Small Tweaks do Not Help: Differential Power Analysis of MILENAGE Implementations in 3G/4G USIM Cards
LTE security and protocol exploits
LTE Recon - (Defcon 23)
LTE Pwnage: Hacking HLR/HSS and MME CoreNetwork Elements
Synacktiv
WiFi IMSI Catcher
Analysis of the LTE Control Plane
Demystifying the Mobile Network by Chuck McAuley
(https://www.defcon.org/images/defcon-22/dc-22-presentations/Pierce-Loki/DEFCON-22-Pierce-Loki-NSA-PLAYSET-GSM.pdf)
VoLTE Phreaking - Ralph Moonen
[Baseband Attacks: Remote Exploitation of Memory Corruptions in Cellular Protocol Stack] (https://www.usenix.org/system/files/conference/woot12/woot12-final24.pdf)
Hiding in Plain Signal:Physical Signal Overshadowing Attack on LTE
LTE Security Disabled—Misconfiguration in Commercial Network
Shupeng-All-The-4G-Modules-Could-Be-Hacked

SIM Specific Attacks

Stingray’s

https://www.wired.com/story/dcs-stingray-dhs-surveillance/
https://www.vice.com/en_us/article/gv5k3x/heres-how-much-a-stingray-cell-phone-surveillance-tool-costs
https://www.nyclu.org/en/stingrays

SS7/Telecom Specific

D1T2 - Bypassing GSMA Recommendations on SS7 Networks - Kirill Puzankov
http://www.hackitoergosum.org/2010/HES2010-planglois-Attacking-SS7.pdf
Getting in the SS7 kingdom: hard technology and disturbingly easy hacks= to get entry points in the walled garden

Github/Code Repo’s

https://github.com/Synacktiv-contrib/Modmobjam
https://github.com/Synacktiv-contrib/Modmobmap

Misc IMSI/Cellular Tools

https://github.com/Evrytania/LTE-Cell-Scanner
https://harrisonsand.com/imsi-catcher/
https://github.com/Oros42/IMSI-catcher
https://github.com/CellularPrivacy/Android-IMSI-Catcher-Detector
https://github.com/ptrkrysik/gr-gsm/wiki/Passive-IMSI-Catcher

Resources

RTL-SDR
MCC-MNC Codes for Base Stations
RFSec-ToolKit
FakeBTS
https://rmusser.net/docs/Wireless.html#cn

Misc

Touching the Untouchables: Dynamic Security
https://www.eff.org/pages/cell-site-simulatorsimsi-catchers
http://leetupload.com/blagosphere/2014/03/28/analyze-and-crack-gsm-downlink-with-a-usrp/
AT&T Microcell FAIL - fail0verflow (Older blog article, but still a good read)

////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

CAR hacking

https://freecodecamp.org/news/hacking-cars-a-guide-tutorial-on-how-to-hack-a-car-5eafcfbbb7ec/
https://cactuscon.com/2021-talks-and-workshops/introduction-to-car-hacking-basics
https://amazon.com/Car-Hackers-Handbook-Penetration-Tester/dp/1593277032
https://github.com/jaredthecoder/awesome-vehicle-security
https://medium.com/@yogeshojha/car-hacking-101-practical-guide-to-exploiting-can-bus-using-instrument-cluster-simulator-part-i-cd88d3eb4a53
https://medium.com/@souravbaghz/a-quick-guide-to-hack-car-intro-to-canghost-f9370a0a51b5
https://youtube.com/watch?v=nn-_3AbtEkI