Learn, hack!

URL

http://dewy.fem.tu-ilmenau.de/CCC/23C3/audio/23C3-1545-en-advanced_attacks_against_pocketpc_phones.mp3

File name

23C3-1545-en-advanced_attacks_against_pocketpc_phones.mp3

File size

43.5 MB

MD5

bef3924a2506eef4304585981f8880e1

SHA1

3e6f0eea4cfd2e678e94a27ac8da7b0af7ca2e95

Smart phones are the new favorite target of many attackers. Also most current attacks are harmless, since these mostly rely on user mistake or lack of better knowledge. Current attacks are mostly based on logic errors rather then code inject and often are only found by accident. The talk will show some real attacks against smart phones and the kind of vulnerability analysis which lead to their discovery. This talk is about a security analysis of the PocketPC MMS (Multimedia Messaging Service) client. We will start with some background information about some older attacks against mobile phones. In the next step we will introduce to PocketPC-based phones and their security. Further we will introduce to the Multimedia Messaging Service. Here we will show how it works and how MMS messages look like under the microscope. In the main part we analyze the PocketPC MMS client and build a fuzzer for it. Since we want avoid costs by sending real MMS messages we build our own virtual mms system and make PocketPC believe that this is the real thing. In the end we will present the bugs and vulnerabilities we found, including the methods for exploiting them such as how to build your own MMS-client. So far I planned to release all information that I have kept back at defcon (exploit code, mms-client, etc...).