Mobile Hacking with SDR (2G to 5G)
Three days assessing mobile devices and networks with software-defined radio. We demonstrate attacks in practice, mostly on user equipment but also on the core network, across phones, IoT modules, connected cars and infrastructure.
- Tell 2G, 3G, 4G and 5G apart and their security mechanisms
- Downgrade security mechanisms and run protocol attacks
- Set up a 2G, 3G, 4G and 5G network on a bench
- Hunt for vulnerabilities in basebands
- Attack core networks from the outside and the inside
- Get the first reflexes to attack embedded and IoT systems
- Mobile and telecom security teams
- Device and module makers
- Red teamers extending into mobile
- Researchers on private networks
Conferences where we have taught
Our courses have run at these conferences, and most of them can also run privately for your team.
Three days, day by day
Theory then assignments on a real network you stand up yourself.
Day 1Day 1
Day 1 will introduce the mobile network and its evolution and compare the security features of 2G, 3G, 4G, and 5G. During this day, attendees will see how to make testbeds with Software-Defined Radio for the different cellular technologies and be able to analyze communications. In addition, we will learn how to observe the signaling and the data exchanged between devices and the mobile network and perform tests on connected devices/IoT devices, for example.
- Introduction to mobile networks and protocols (2G/3G/4G/5G)
- Evolution
- Security
- Attack surface on user equipment and core network
- Setup 2G, 3G, and 4G for specific needs with Software-Defined Radio
- Alternative to Software-Defined Radio
- Configuring a SIM/USIM/ISIM cards
- Setting a GSM base station with OpenBTS, OsmoBTS, and YateBTS depending on SDR devices
- Isolating the base station with a custom Faraday cage and some SDR setup
- Testing the setup to send text messages and getting voice working
- Installing a GPRS base station
- Capturing data packets of User Equipment
- Using a software SIM stack
- Configuring a custom SIM/USIM card
- Using programmed secrets on the GSM station
- Installing an LTE eNodeB station
- Testing the LTE eNodeB
- Monitoring the setup
Day 2 and 3Day 2 and 3
Days 2 and 3 will focus on attacking mobile devices in a Blackbox context without physical access to devices. These parts will lead to fundamental and smart-jamming attacks to downgrade communications and be able to intercept a device. We will also see ways to perform fuzzing tests on mobile protocol stacks to find vulnerabilities over the air but also other ways to optimize bugs hunting.
- Attacking cell phones and IoT devices using the mobile network
- Using endpoints as primary targets
- Find bugs in protocol stacks
- Pentest 2G, 3G, 4G, and 5G core networks
- Intercepting devices
- Impersonating messages and calls
- Capturing a call
- Cracking the call with precomputed tables
- Downgrading a 3G device to 2G
- Interacting with devices and capturing events
- Attacking endpoints
- Fuzzing GSM and LTE protocol stacks
- Using emulation on firmware to find bugs efficiently
- Attacking the core with M2M mobile network
- Feedback of our past missions and security challenges
- Introduction 5G-NR devices assessments
- Our tools
In a private session
The content is arranged around your needs, and we can add:
- Practical 5G radio security testing
- Practical 5G core network assessment, with our tools
- Fuzzing the core network protocol stacks
What every attendee takes home
Attendees keep the kit, the tooling and the captures.
- Hardware kit
- bladeRF 2.0 micro xA4, kept by the attendee
- Docker container
- Toolchain, scripts and captures preloaded
- Slides and tools
- Full deck and the tools used in class
- Captures
- Real network captures cleared for teaching
Prerequisites
A laptop running Linux
8 GB of RAM minimum
Programming and Linux
Knowledge of Linux and a language such as C, C++, C# or Python
Radio knowledge
Helps but is not required
Pentest or red team experience
A plus, not required
Your trainer
Wireless and hardware security specialist. Published research on 5G security, Open RAN, baseband fuzzing, interception and mapping, and power-line communication (HomePlug AV, domestic PLC, electric vehicles and charging stations). Practical work across Wi-Fi, RFID and other wireless systems.
PublicationsHow it runs and what to know
How it is taught
Hands-on from the start: you work on real radios and real hardware, with the same tools and signal captures we use on engagements. Live courses include a hardware kit you keep; on-demand courses run at your own pace, on this site.
How progress is assessed
Progress is checked through the practical exercises done during the course. A certificate of completion is issued to each participant.
How and when to enrol
Live and tailored sessions are scheduled with you after a short scoping call, usually within a few weeks. On-demand courses start as soon as your purchase is confirmed.
Accessibility
Penthertz is a registered French training organisation (no. 11788588278). If a participant has a disability or a specific need, tell us when scoping and we will adapt the setup where we can.
Run it privately for your team
Priced per group, with content adapted to your needs. Remotely, on your site or at our offices near Paris.