Overview
Syllabus
Intro
Researcher Backgrounds
History and Prior Standards
The Current Standard
OMA-DM: Managed Objects
Devices with OMA-DM
Embedded Client Locations
The Reference Toolkit
RedBend Software
Network Architecture Diagram
OMA-DM "Standard" Security
Initial OTA Payload Types
DM Bootstrap Payload Example • Used for initial Device Provisioning
OMA-DM Tree Serialization
Client Side Parsing
Cellular Testing Hardware
Identifying Control Clients - Phones
Identifying Control Clients - Embedded Devices
Simulating Cellular Environments
Over Global Carrier Networks
Rogue Base Station Attacks
Vulnerabilities in Authentication
Transport Security and Encryption Flaws
MInside Out BaseBand Attacks
Carrier Customizations
Code Execution Without Memory Corruption
Vulnerability Example: Reading Memory
Notable Weaknesses in Exploit Mitigations
OTA Exploit Delivery
Bypassing ASLR with OTA Feng Shui
Killing the Canary
Dynamically Building ROP Chains
OTA Code Execution Status
Taught by
Black Hat