UICC Reverse Engineering (Telecom) - Page 1
Forum section: electronics / projects

author: Agent
author_rank: Contributor
timestamp: June 13, 2017, 03:27:04 pm
content: My end goal is to connect my own phone with my own sim card to a network simulator. I can easily get my phone connected to the network simulator with a test sim. I am interested in the security between the UE, UICC, and network. I would rather have the phone connected to a simulated LTE network but if W-CDMA is easier, I will take that route. I have equipment that can intercept the traffic between the UICC and the phone.From what I understand there are two methods that could be used to authenticate the phone on my simulated network. (Please correct me if I’m wrong)K-KeyOP or OPc KeyFrom what I can tell the OP key is not something that can be pulled from a SIM. It is used to generate the OPc key. So when the UICC is first provisioned, that must mean that the OPc key is sent to UICC and stored, so the eNodeb can communicate with the device. The only opportunity to intercept this key is when the UICC is first provisioned?RANDAUTNIntegrity Key (IK)Ciphering Key (CK)I can clearly see the IK and CK from the intercepted traffic between the phone and UICC. I have not been able to locate the random number or the authentication token. The IK and CK are regenerated every time the UICC losses power. So I would have to enter the new keys every time the phone is power cycled which isn’t ideal. I can also see the ASME key (Kasme) and I’m not sure exactly what this is. It doesn’t change when the phone is power cycled.So my best method of attack is this:Have the phone off and connected to the network simulator. Turn on the phone and pull the CK and IK and input them into the network simulator settings. Turn on the network simulator and it should connect? I still will have to figure out how to get the RAND and AUTN. The phone will be shielded from the live network.Any input or explanations would be appreciated.

author: tmbinc
author_rank: Frequent Contributor
timestamp: June 14, 2017, 04:39:14 pm
content: (Out of curiosity, which network simulator are you using?)By design authentication is bidirectional, otherwise you could man-in-the-middle attack them. Theoretically you can disable authentication, encryption and integrity but the phones I have refuse, at least for LTE, a connection without authentication.The issue is that you can't come up with a valid RAND/AUTN-pair to send to the (non-test) UICC that you don't know the key for. Hence, you can't authenticate a random phone to your network simulator, unless you know the keys for the UICC (=test sim card). You can't grab a RAND/AUTN pair from a live network to replay on your simulated network because SEQN (on the UICC) will have changed so the RAND/AUTN pair is not valid anymore.http://www.sharetechnote.com/html/Handbook_LTE_Authentication.htmlhas some more details.

author: Agent
author_rank: Contributor
timestamp: June 16, 2017, 03:29:49 pm
content: That's a familiar name! TMBinc as in Xell from the 360 days? I'm currently using an Anritsu MD8475A, just because it is the most convenient to use. I also have access to R&S, Anite , and Spirent platforms. How does the ADM code come into play when programming UICC? Can I reprogram the entire UICC if I have the ADM code? There is so much going on between UE, UICC, and network I am having trouble compartmentalizing the stages and planning a method of attack. I'll take a look at that link in a few. I'm really interested in this and I figure this would be the best way to learn.

author: Agent
author_rank: Contributor
timestamp: July 18, 2017, 04:23:07 pm
content: So I have an old UICC card that is still activated and I noticed that there were authentication credentials. Its so old in fact that it doesn't even support LTE. The access technology is UTRAN. I can clearly see the RAND, AUTN, and other info.(See attached) Why is the info displayed for older UICCs but not the new ones? Since I now have all the fields that the network simulator requires, will I be able to connect to it? Or will dropping the signal from the live network require new keys/numbers?EDIT: Toggling airplane mode does generate new keys and authentication information.EDIT2: The newer sims do display authentication information. I must have missed it.