Sniffing GSM communication via OTA SMS

"Root via SMS: 4G access level security assessment" Sergey Gordeychik, Alexander Zaytsev !!!!!!!!!!!!!!!!!!!!!!!!!!! Hi everyone! The video was presented on PacSec 2014 and targeted vulnerabilities of specific SIM cards. You can find more below. https://www.slideshare.net/SergeyGord... So the vulns and toolkit are very old and I don't do telecom security any more... More recent attack with similar impact are based on SS7 please check https://positive-tech.com/research/ss... !!!!!!!!!!!!!!!! Having developed a test set, we started to research how safe it is for clients to use 4G networks of the telecommunication companies. During the research we have tested SIM-cards, 4G USB modems, radio components, IP access network. First of all we looked for the vulnerabilities that could be exploited remotely, via IP or radio network. And the result was not late in arriving. In some cases we managed to attack SIM-cards and install a malicious Java applet there, we were able to update remotely USB modem firmware, to change password on a selfcare portal via SMS and even to get access to the internal technological network of a carrier. Further attack evolution helped to understand how it is possible to use a simple SMS as an exploit that is able not only to compromise a USB modem and all the communications that go through it, but also to install bootkit on a box, that this modem is connected to.