Simcard Forensics

Simcard Forensics
An Adventure in Information Gathering
SANS Network Security 2008, Episode #125
Larry Pesce
[email protected]
The Experiment
• Acquire sim reader
• Acquire quantity of used sim cards
• Read, Export SMS and Phonebook
• Analyze
http://pauldotcom.com
Episode #125
The Sim Reader
• Simple assemble your self kit from Adafruit
Industries = $17 (http://www.ladyada.net)
• FTDI serial to USB cable = $15
http://pauldotcom.com
Episode #125
The Software
• pySimReader
• A project taken
over (apparently)
by Ladyada
• Easy to use, but
crashes a lot!
http://pauldotcom.com
Episode #125
The Sims
• E-bay is your friend!
• Ask your local cell store...
- One male with box full, no eye contact
- One female with none, friendly, took
number
- Perfect opportunity to practice social
engineering/coercion
http://pauldotcom.com
Episode #125
Authentication?
http://pauldotcom.com
Episode #125
Authentication?
http://pauldotcom.com
Episode #125
Authentication!
http://pauldotcom.com
Episode #125
Authentication!
http://pauldotcom.com
Episode #125
Success!
http://pauldotcom.com
Episode #125
The Process
• Insert simcard, connect to laptop, connect to
software, read, export
• Lather, Rinse Repeat....
• Lets see what I found
http://pauldotcom.com
Episode #125
LUV YA
Unknown FIDO Card Contents
http://pauldotcom.com
Episode #125
LUV YA
Source
http://pauldotcom.com
Episode #125
LUV YA
Text
Text
Destination
http://pauldotcom.com
Episode #125
LUV YA?
Content
http://pauldotcom.com
Episode #125
LUV YA?
• With that information, we can make some
interesting assumptions.
• Not that I think that it is wrong
• But, not everyone may know...
• What could we do with that info (as a black
hat)?
http://pauldotcom.com
Episode #125
My kind of guy?
• No, not like that!
• Some interesting tastes...
http://pauldotcom.com
Episode #125
My kind of guy?
http://pauldotcom.com
Episode #125
My kind of guy?
• Drinks,
http://pauldotcom.com
Episode #125
My kind of guy?
• Drinks,
• Doors,
http://pauldotcom.com
Episode #125
My kind of guy?
• Drinks,
• Doors,
• Blunts,
http://pauldotcom.com
Episode #125
My kind of guy?
• Drinks,
• Doors,
• Blunts,
• Boobs!
http://pauldotcom.com
Episode #125
My kind of girl?
• Maybe
• Maybe not
• Let’s find out!
http://pauldotcom.com
Episode #125
My kind of girl?
http://pauldotcom.com
Episode #125
My kind of girl?
• Cooks,
http://pauldotcom.com
Episode #125
My kind of girl?
• Cooks,
• In to feet (kinky!)
http://pauldotcom.com
Episode #125
My kind of girl?
• Cooks,
• In to feet (kinky!)
• Mouth like a truck driver,
http://pauldotcom.com
Episode #125
My kind of girl?
• Cooks,
• In to feet (kinky!)
• Mouth like a truck driver,
• A little “action”?
http://pauldotcom.com
Episode #125
Where’s Chris Hansen?
http://pauldotcom.com
Episode #125
Where’s Chris Hansen?
Gives me the heebies...
http://pauldotcom.com
Episode #125
Lets do the recon
• So I’ve got all of these interesting
numbers...
http://pauldotcom.com
Episode #125
Lets do the recon
• So I’ve got all of these interesting
numbers...
http://pauldotcom.com
Episode #125
Lets do the recon
• So I’ve got all of these interesting
numbers...
http://pauldotcom.com
Episode #125
Recon FAIL
• Compare to address book
- Maybe not up to date
- Real store on phone?
• Maltego
• Google search....but
http://pauldotcom.com
Episode #125
Service Centers
• Googled for one of the Service Centers
- Actually an SMS gateway
- found file SMSDEBUG-16800.unk...
http://pauldotcom.com
Episode #125
oops.
http://pauldotcom.com
Episode #125
oops.
http://pauldotcom.com
Episode #125
oops.
Best I can tell that’s
someone else’s SMS
messages!
http://pauldotcom.com
Episode #125
Paid phone reverse
• Tried www.phonenumberscan.com
- Said name and address were “available”
- I figured $20 was worth a go
http://pauldotcom.com
Episode #125
Not so much
Blunts and boobs
I’m pregnant...
http://pauldotcom.com
Episode #125
I was hoping
• ...to have some better phone lookup results
- Know where I can (legally) get them?
• ...for names and addresses
- Imagine the fun with flickr, google maps,
parents, local law enforcement..
• ...to have better luck reading Boost Mobile and
Sprint/Nextel simcards.
• ...spend more time with location, IMSI, serials
http://pauldotcom.com
Episode #125
Not giving up
• More simcards on the way
• Looking for better phone reversing, or
phonebook matches
http://pauldotcom.com
Episode #125
Defenses
• Use a third party reader/writer
- Haven’t found a reliable, cheap one to
“format”
• Use phone to erase
- Documents findable, but can be difficult
- How can you be sure?
http://pauldotcom.com
Episode #125
Defenses
• Use BitPim
- Can be used via bluetooth
- Needs supported phone
- Not many on list
• Or, tried and true methods...
http://pauldotcom.com
Episode #125
EXERMINATE!
http://pauldotcom.com
Episode #125
EXTERMINATE!
http://pauldotcom.com
Episode #125
Beavis? Butthead?
http://pauldotcom.com
Episode #125
FIRE! FIRE!
http://pauldotcom.com
Episode #125
FIRE! FIRE!
http://pauldotcom.com
Episode #125
FIRE! FIRE!
http://pauldotcom.com
Episode #125
The final word..
• Keep your old simcards
• Don’t store SMS and Phonebook on simcard
• Dispose appropriately
http://pauldotcom.com
Episode #125