Build a Free Cell Traffic Capture Tool with VxWorks
Qihoo 360 researchers Yuwei Zheng and Haoqi Shan demonstrate hacking a VxWorks-based femtocell base station to construct a low-cost cellular traffic capture and monitoring appliance.
Summary
Cellular Connectivity in Modern Connected Devices
With automobiles, smart meters, and IoT consumer devices increasingly relying on cellular modems for telemetry and updates, intercepting mobile network traffic is vital for security evaluations.
Reverse Engineering VxWorks Femtocells
Yuwei Zheng and Haoqi Shan explore the firmware architecture of commercially available femtocell small cells running the VxWorks real-time operating system (RTOS).
Developing an Open Traffic Interception Tool
The researchers demonstrate exploiting the base station's operating system to tap radio protocol stacks, enabling passive capture and analysis of 2G/3G/4G cellular traffic without costly hardware.
Security Analysis of IoT Cellular Protocols
The authors showcase real-world captures of connected vehicle telemetry, highlighting unencrypted communications and firmware update flaws exposed via cellular network monitoring.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Village Interviews·1 min
A rapid spotlight on the Maritime Hacking Village exploring shipboard control networks, satellite navigation, and vessel cybersecurity at DEF CON 34.
Main Stage·40 min
Matthias Fischer · Patrick Wardle
Reveals critical baseband and firmware vulnerabilities in popular cellular modems that allow remote over-the-air exploitation and device takeover.