## 3 JTAG Exploitations
### Baseband Attacks: Remote Exploitation of Memory Corruptions in Cellular Protocol Stacks  
The GPRS/GSM 1 st generation system was launched and commercialized in the 1990s. At that time, companies were charging significant money even for incoming calls. However, the consistent and advanced development of cellular network (e.g., 2G, 3G, and 4G) not only made it available to people throughout the world but also companies now mostly only charge money for Internet service on mobile phones. Currently, IOT power efficient protocols are emerging, such as LoRaWAN, NBIoT, InGenu, and SigFox, in the market. These protocols are currently in the first phase of the development and industry sees this as one of the emerging business model. Some of the protocols use open radio band for the communication such as LoRaWAN protocol which uses 433 MHz/868 MHz/915 MHz open frequencies but the newest IoT radio protocols such as NBIoT have been developed around existing cellular technology since cellular network has been widely deployed already around the world.  
[PERSON] [18] experimented and exploited memory corruption in 2G protocol stack. In his experiment, the author set up an illegitimate BTS (Base Transceiver Station) to target mobile station (MS) in the vicinity. This BTS broadcasts fake network and surprisingly mobile station (MS) connects to this BTS not only due to strongest signal received by it but also GSM does not provide any protection against fake BTSs. While experimenting with GSM and UMTS stack, the author found some of exploitable bugs: (1) When the cell phone accesses network service for first time, a 32-bit long TMSI number is assigned to handset which is variable by nature. By sending longer TMSI such as 128 bytes, it caused iPhones/mobile phones to crash. (2) For authentication between BTS and MS, BTS sends challenge to the handset. This challenge is a 16-byte value called RAND value for GSM and AUTN value for UMTS. The author forcibly transmitted three messages, each 16-byte long. These messages are stored in the buffer and apparently cause stack overflow. To show these exploitation, The JTAG access is required to get debug messages from firmware. Most chipsets in mobile phones have configurable JTAG access nowadays. However, access to PCB board through JTAG interface is provided by OEM manufacturer not chipset manufacturer. The author experimented on mobile phones such as HTC dream and Apple iPhones to get JTAG access. Before, HTC dream has provided limited JTAG access but author changed the register flag by setting breakpoint at secondary boot process whereas iPhone JTAG was completely locked down from the company itself giving more security, but debug messages and baseband crash report logs can be found at /Library/Logs/CrashReporter/Baseband location. The author exploited HTC mobile through JTAG interface by turning ON auto-answer facility provided in the 2G protocol stack. The TMSI and AUTN bug exploitation method is used in this experiment. When AUTN payload is forwarded to testcall UDP port after establishing channel using testcall command, this bug turns ON auto-answer facility without understanding of user. The TMSI overflow bug concept which is described earlier is used to configure auto-answer facility in iPhone. A LOCATION UPDATING REQUEST is sent by mobile to the BTS as soon as it connects to fake network. Here, the BTS sends intentional LOCATION UPDATING ACCEPT reply with some payload. This enabled auto-answer call in iPhone. These experiments showed successful exploitation of memory corruption in GSM baseband software stack through JTAG interface. In case of IOT protocols and its stack development, these considerations should be considered to make IOT products secure.