Using SIM Tunneling to Travel at Light Speed
Introduces MobileAtlas, an open-source testbed that decouples physical SIM cards from cellular modems globally to uncover international roaming and metering flaws.
Summary
Challenges in Global Cellular Roaming Research
Auditing international cellular networks requires physical access to diverse carrier roaming partnerships, mobile rate plans, and geographically dispersed base stations.
Introducing the MobileAtlas SIM-Tunneling Framework
Adrian Dabrowski and Gabriel Gegenhuber present MobileAtlas, an open-source measurement platform that decouples physical SIM cards from modems via low-latency network tunnels.
Uncovering Data Metering Flaws and Free-Riding
Auditing commercial carrier roaming configurations revealed widespread traffic accounting discrepancies, enabling zero-rated data consumption and unmetered data tunneling.
Tracking Roaming Victims via Progress Tones
The authors expose widespread IPv6 firewall misconfigurations and demonstrate fingerprinting unique carrier progress audio tones to track victims across international borders.
Related talks
War Stories·43 min
Tracy Mosley
Tracy Mosley traces the generational evolution of cellular networks from 2G to 5G, breaking down core network topologies, attack surfaces, and protocol vulnerabilities.
Red Team Village·23 min
Ali Abdollahi
Ali Abdollahi analyzes cellular core network security mechanisms, reviewing IMSI catchers, diameter routing flaws, and protocol bypasses from a red team perspective.
Main Stage·40 min
Matthias Fischer · Patrick Wardle
Reveals critical baseband and firmware vulnerabilities in popular cellular modems that allow remote over-the-air exploitation and device takeover.