mirror of
https://sharelatex.tu-darmstadt.de/git/681e0e7a3a9c7c9c6b8bb298
synced 2025-12-08 05:27:59 +00:00
56 lines
3.4 KiB
TeX
56 lines
3.4 KiB
TeX
% !TeX root = ../Thesis.tex
|
|
|
|
%************************************************
|
|
\chapter{Implementation}\label{ch:implementation}
|
|
%************************************************
|
|
\glsresetall % Resets all acronyms to not used
|
|
|
|
% - Goal of this thesis is security analysis using differential testing
|
|
% - first idea (naive implementation): use simtrace2 to capture traffic between the LPA (ue) and euicc
|
|
% - simtrace2 sends apdus to socket via udp packet -> read data from socket -> analyse apdu command for instruction type
|
|
% - save recored traffic to file
|
|
% - insert other euicc into pcsc card reader -> replay each apdu to euicc
|
|
% - check for differences in the responses
|
|
% - problem: rsp uses signed nonces -> can't replay data
|
|
% - next idea: implement lpa to perform actions via code -> not rely on manual interaction with esim manufacturer lpa app, manufacturer lpa introduce traffic that is not necessary for the intended action
|
|
% - use the lpa to produce traffic for the euicc in the pcsc card reader, but mutate it before sending
|
|
% - record the returned status codes and check if different euicc behaves the same (crashes at the same point or returns the same status word)
|
|
% - on the slower side -> rsp is stateful and we rely on the sm-dp+ from the profile vendor
|
|
% - small problem: we basically just fuzz the asn1 parser of the euicc sometimes
|
|
% - alternative: fuzz valid input data
|
|
% - oss-fuzz proposes python hypothesis as a framework for fuzzing via python
|
|
% - python hypothesis: property based testing library -> we define input structure and hypothesis produces data that is valid for the given structure
|
|
% - tests for edge cases
|
|
% - in the following sections i will go into details on how each implementation work
|
|
|
|
\section{Tracing}
|
|
\label{sec:tracing}
|
|
|
|
% functions:
|
|
% - trace traffic from the simtrace2, map the traffic to function calls i.e. identify which function the call handles, record the traced traffic
|
|
% - replay: replay the previously recorded traffic to euicc in pcsc reader, check for differences in responses
|
|
% parts:
|
|
% - pcsc_link: wrapper for the python smartcard library, handles session establishment to reader, and apdu/tpdu transmission, automatically handles requesting of available data i.e. status word 61XX
|
|
% - card: represents card in the pcsc card reader, identifies card type (i.e sgp22, sgp.22 test, normal sim, etc) and which applications are installed (ISDR, ECASD, etc), used to send apdus to pcsc card through pcsc link
|
|
% - tracer: dummy implementation of card for instruction interpretation and apdu parsing, uses pysim gsmtap as apdu source
|
|
% - recorder: handles tracer thread and recording of apdus, starts tracer main thread (continously listens for new apdus from gsmtap until timeout is reached or canceld by user) and records apdu to recording, has target isd-r as argument
|
|
% - recording: represents a list of recorded apdus, handles source and target isd-r addresses, file saving and loding as well as checking if the file is replayable
|
|
% - replay: establishes connection to pcsc via pcsc link, loads recorded apdus and sends them over the link to the connected euicc, switches out source isd-r and target isd-r during replay, compares response status word to recorded status word on prints an error if there is a difference
|
|
|
|
\section{LPA}
|
|
\label{sec:lpa}
|
|
|
|
%
|
|
|
|
\section{Fuzzing}
|
|
\label{sec:fuzzing}
|
|
|
|
\subsection{Data Fuzzing}
|
|
\label{subsec:data_fuzzing}
|
|
|
|
\subsection{APDU Fuzzing}
|
|
\label{subsec:apdu_fuzzing}
|
|
|
|
\section{CLI}
|
|
\label{sec:cli}
|