SRLabs

Really, none of this is surprising or new. If you're bored/curious, here's some fun reading on exploring/exploiting telecom networks. Spoiler alert: it's really easy and it has been forever. Big ups to Philippe Langlois for all his great research over the years.

Interview: Telecom Security Expert Philippe Langlois on GCHQ Spying (http://www.spiegel.de/international/europe/interview-telecom-security-expert-philippe-langlois-on-gchq-spying-a-933870.html)

Vulnerabilities and Possible Attacks
against the GPRS Backbone Network (http://critis06.lcc.uma.es/files/Vulnerabilities%20and%20Possible%20Attacks%20against%20the%20GPRS%20Backbone%20Network.pdf)

Getting in the SS7 kingdom: hard
technology and disturbingly easy hacks
to get entry points in the walled garden (http://www.hackitoergosum.org/2010/HES2010-planglois-Attacking-SS7.pdf)

Telecom Signaling Attacks on 3G and LTE networks (http://www.slideshare.net/p1sec/telecom-security-from-ss7-to-all-ip-allopenv3zeronights)

GSM and 3G Security (https://webcache.googleusercontent.com/search?q=cache:WlEd4HCpl48J:www.blackhat.com/presentations/bh-asia-01/gadiax.ppt+&cd=16&hl=en&ct=clnk&gl=us&client=firefox-a)

Locating Mobile Phones
using Signalling System #7 (http://events.ccc.de/congress/2008/Fahrplan/attachments/1262_25c3-locating-mobile-phones.pdf)

SCTPscan - Finding entry points to SS7 Networks & Telecommunication Backbones…

All mobile computing and connectivity hardware is unverifiable in reality and by design. It's not some property exclusive to Google Pixels.

Their business model also does not involve selling data afaik, it's selling access to their adspaces [1] all over the internet including the ability to target people (based on information Google jealously hoard). They stand to lose just as much as most other OEMs if they did suspicious things in hardware just like Apple, Samsung etc.

If you're serious about security you will avoid using OEMs that have unfortunate patch gaps which leave device owners at the mercy to *known vulnerabilities* [1][2][3][4] as well as unknown threats which is fortunately one of GrapheneOS's many reasonable device support requirements.

[1] https://blog.google/products/ads-commerce/more-effective-media-buying-on-apps/

[2] https://srlabs.de/blog/android-patch-gap

[3] https://srlabs.de/blog/android-patch-gap-2020

[4] https://www.android-device-security.org/talks/

[5] https://techcommunity.microsoft.com/blog/vulnerability-management/research-analysis-and-guidance-ensuring-android-security-update-adoption/4216714

SRLabs | Security Research Month | Malaysia and Indonesia | February 10th - March 9th 2019 | On-site

Join us for one month of hacking research in Malaysia and Indonesia!

Every year, we (https://srlabs.de) escape the cold Berlin winter for a "Hackerurlaub" (hacker vacation). For the third year already now, we are inviting fellow hackers to join us. Flights, villa, fun and mentorship are all included.

During the month there you will work on your own project, supported by us, the SRLabs team. We are a Berlin-based hacking research collective and consulting think tank and focus on everyday technology that expose many people to risk. You may know us from our work like BadUSB [1] or SS7 Hacking [2].

How to apply?

All you need to do in preparation is to come up with a hacking target and send your application to beach[at]srlabs.de. For details, please visit https://hack-the-beach.com

[1] https://www.wired.com/2014/07/usb-security/

[2] https://www.theguardian.com/technology/2016/apr/19/ss7-hack-explained-mobile-phone-vulnerability-snooping-texts-calls

Fingerprinting has been done: https://cise.ufl.edu/~butler/pubs/sadfe11.pdf

And given you can easily reprogram thumb drives and such, it's easy to do evil stuff with them. You can plug a thumb drive with a reprogrammed firmware which will detect the OS based on IO patterns and then it can tell the OS it's also a keyboard and runs command for you.

https://srlabs.de/bites/usb-peripherals-turn/
https://srlabs.de/wp-content/uploads/2014/11/SRLabs-BadUSB-Pacsec-v2.pdf
https://github.com/brandonlw/Psychson

https://www.computerworld.com/article/2690790/tools-for-creating-malicious-usb-thumb-drives-released.html

From the article: "During their Derbycon demonstration, which is available on YouTube, the two researchers replicated the emulated keyboard attack, but also showed how to create a hidden partition on thumb drives to defeat forensic tools and how to bypass the password for protected partitions on some USB drives that provide such a feature."

cbmc: http://www.cprover.org/cbmc/applications.shtml
cmbc is easiest to install, they even have binaries.
easy samples also in the manual:
http://www.cprover.org/cprover-manual/modeling-assertions.shtml

klee: https://klee.github.io/tutorials/
pretty hard to install

coq: https://coq.inria.fr/a-short-introduction-to-coq
the real beast out there. easy to install. but hardly usable for normal hackers, because of their mathematical notation.
but it's using plain c, and you can verify c with various solvers.

z3: http://rise4fun.com/z3/tutorial
the most popular, but only python or SMT-LIB 2.0 (lisp).

for crypto https://srlabs.de/minisat-intro/ has some explanation how to break weak ciphers or hashes, knowing the weakness beforehand. but the various hackers posting on their blogs usually have better practical explanations.

SRLabs | Security Engineer | Berlin, DE | Full Time

Our security team is growing across offices, and we are looking for Security Engineers that are knowledgeable in blockchain security, application security, and vulnerabilities.

Here are a few things that you will be doing:

- Review systems to secure digital assets (e.g. cryptocurrency) from attackers

- Analyze and present results to team member and clients

- Work closely with security engineers and development teams in IT security projects

- Participate in hacking exercises, and conduct developer trainings

- Code review of blockchain implementations

Take a look at the job description: https://srlabs.breezy.hr/p/f569b4d83eb601-security-engineer-blockchain-m-f-d

Take a look at our research blog: https://www.srlabs.de/blog