blob: 95cd1c29c4ac65b6ae4fa0e158d24cd2c39a70d8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
<?xml version="1.0" encoding="UTF-8"?>
<chapter id="chapter_sniff">
<title>Sniffing your SIM</title>
<section id="hw_setup">
<title>Connecting your device</title>
<para>You will need to put your SIM into the SIMtrace hardware, connect
one of the four flex cables to the SIMtrace hardware, put the other side
into the SIM socket of your phone. Use USB to connect the SIMtrace hardware
to the PC. On your PC you should be able to see the USB device now.</para>
<figure><title>Connecting the SIMtrace Hardware</title>
<mediaobject>
<imageobject>
<imagedata fileref="images/simtrace_hw_setup.png" width="15cm"/>
</imageobject>
<textobject><phrase>SIMtrace being connected</phrase></textobject>
</mediaobject>
</figure>
</section>
<section id="launching_simtrace">
<title>Launching SIMtrace</title>
<screen>
$ <command>./simtrace</command>
simtrace - GSM SIM and smartcard tracing
(C) 2010 by Harald Welte <laforge@gnumonks.org>
</screen>
<para>Launching the <command>simtrace</command> will try to find
the SIMtrace hardware and then try to claim the USB device. The
application will send the received data encapsulated in the GSMTAP
format on localhost and the IANA assigned GSMTAP port.</para>
</section>
<section id="launching_wireshark">
<title>Launching Wireshark</title>
<para>The <command>wireshark</command> application will start a GUI
and given the right permissions you should be able listen to the
localhost interface and filter for the GSMTAP port on 4729. You should
be able to see the decoded messages like in the figure below.</para>
<figure><title>GSMTAP in Wireshark</title>
<mediaobject>
<imageobject>
<imagedata fileref="images/wireshark-sim.png" width="16cm"/>
</imageobject>
<textobject><phrase>SIMtrace sending data</phrase></textobject>
</mediaobject>
</figure>
</section>
<section id="known_firmware_issues">
<title>Known Firmware Issues</title>
<section>
<title>Combined ATR/APDU message</title>
<para>For some cards the firmware does not send an USB message at
the end of the ATR. The ATR and first APDU will be send in one message
and the host utility fails to split APDUs and nothing will be traced.
A band-aid for the firmware exists and can be found on the mailinglist.
</para>
</section>
<section>
<title>Lost bytes</title>
<para>For some new high speed cards the firmware can lose bytes. The
issue appears to be when the received bytes will be copied to the memory
of the USB controller. The workaround is to reduce the size of the buffer.
</para>
</section>
</section>
<section id="other_modes">
<title>Other modes</title>
<para>The hardware is capable to be used as an ordinary card reader,
provide Man-In-The-Middle (MITM) attacks, or operate as a SIM. The
firmware currently does not have support for these modes.</para>
<para>The SIMtrace hardware supports ISO7816 Part 3 T=0/T=1 protocols,
it basically can be used to intercept and analyze any traffic from (ISO7816)
smart cards. This includes SIM cards, Pay TV cards (smart card for CAM),
ATM cards, chip credit card, PKI smart cards, e-passport etc. etc. However
watch out: You have to make your chip card fitting in the "SIM card size"
ID-000 reader or build another adapter.</para>
</section>
</chapter>
|
