00:00:00.000-->00:00:05.000
>>Hello, ah okay. So, good
morning. Uh, thank you for so
much for making so much time.

00:00:11.000-->00:00:16.000
Uh, Well uh, we are happy to be
here umm, to -to share our work
with you. Um, this is an

00:00:24.625-->00:00:29.625
vulnerability and exploitation
we name it as Ghost Telephonist.
It's about a problem in CS

00:00:32.708-->00:00:37.708
Fallback in the LTE network. So,
let me firstly, oh, give a brief
self-introduction. Okay we, we

00:00:45.375-->00:00:50.375
come from the 360 technology
and, 360 is the leading internet
security company in China and

00:00:56.417-->00:01:01.417
like and McAfee and Symantec and
our corporate detects antivirus
security software for uh

00:01:03.667-->00:01:08.667
personal computers and cell
phones. Umm, for us, we come
from the Unicorn Team. This team

00:01:13.625-->00:01:18.625
is um, one research group in 360
and this team was built in 2014.
We focus on the security issues

00:01:24.750-->00:01:31.375
in many kinds of wireless
systems, wi- wireless
telecommunication systems. And

00:01:31.375-->00:01:36.375
our previous works include, uh,
like uh, GPS spoofing in Def Con
23. The year before last year,

00:01:41.083-->00:01:46.083
ok. An LTE redir -redirection
attack in Def Con 24 and also
the PLC attack in Black Hat in

00:01:50.208-->00:01:55.208
last year. So, this year, we
bring the work about the
vulnerability in 4G LTE. Ah in

00:02:00.708-->00:02:05.708
the CS Fallback procedure. Okay,
so what is CS Fallback? Um, now
let me briefly introduce the

00:02:10.667-->00:02:15.667
voice solutions in the LTE
network. As we all know um,
different from 2G and 3G, In LTE

00:02:20.125-->00:02:25.125
network, the circuit switch was
removed and only packet switches
left. So now there are mainly 3

00:02:29.333-->00:02:34.333
solutions for voice in LTE. The
first one is the VoLTE, Voice
Over IP. This is the -the final

00:02:40.125-->00:02:45.125
objective for the network
evolution. In the second
solution is um the case we

00:02:49.083-->00:02:54.083
discussed today, CS Fallback.
Circuit switch Fallback. It
means when um, when subscriber

00:02:59.417-->00:03:04.417
takes voice call, the cellphone
has to switch from the 4G to 2G
or 3G. The third solution is

00:03:10.292-->00:03:15.292
simultaneous voice and LTE. The
cell phone keeps two con
-connections simultaneously, one

00:03:18.208-->00:03:23.208
is in 4G and the other is 3G or
2G. The solution has higher
price and more rapid power

00:03:27.333-->00:03:32.333
consumption on the terminal
because it has two basebands
chipsets running. Um, at the

00:03:37.708-->00:03:42.708
beginning of this year, we were
working on a project about the
well-known GSM Man-in-the-Middle

00:03:49.167-->00:03:54.167
attack and we're debugging on
some modifications on OsmocomBB.
This is a very uh famous project

00:03:57.417-->00:04:02.417
for GSM protocol. We tried to
send fake paging response and
then we were surprised to find,

00:04:06.375-->00:04:11.375
um, some fake paging response
messages were accepted by the
network. There's no

00:04:14.875-->00:04:19.875
authentication and the core was
successfully built. We think
it's quite strange and so we

00:04:24.292-->00:04:29.292
started to have a deep look into
it. See the two pictures. This
is the signaling log uhh on some

00:04:40.875-->00:04:45.875
engineering mode of some cell
phone. In the part of the red,
red blocks, uh you can see the

00:04:50.792-->00:04:55.792
-the left figure. We confirmed
in the normal 2G core,
authentication does exist for

00:04:59.458-->00:05:04.458
every core. You can see here as
uh .core confirmed. Here is the
.authentic- oh sorry. This- this

00:05:14.500-->00:05:19.500
figure is the authentication
request and response. So in
normal 2G core we find AKA does

00:05:21.542-->00:05:26.542
exist for every core. But in the
4G network in the CS Fallback
case, the network doesn't

00:05:30.792-->00:05:35.792
require authentication. We found
this may be the root of this
problem. It was introduced by

00:05:39.042-->00:05:44.042
the CS Fallback procedure. Um,
this slide show the signaling
flow of CS Fallback mobile

00:05:49.167-->00:05:54.167
terminated core procedure. You
can see some uh network elements
here um MME for 4G LTE network

00:05:58.500-->00:06:03.500
and MS -MSC for 2G and 3G
network. Okay, when there is a
core for a UE, for one user

00:06:07.750-->00:06:12.750
terminal, the network firstly
sends paging response on the 4G
network from MME to UE. And the

00:06:17.292-->00:06:22.292
4G will be sends RRC connection
release message here. In this
message the network tells the UE

00:06:27.750-->00:06:32.750
which 2G base station it should
connect. In this step, uh there
is another vulnerability we

00:06:36.000-->00:06:41.000
presented in last year, that is
the LTE redirection attack. Uh,
this problem is still under

00:06:43.500-->00:06:48.500
discussion in standardization
groups and it hasn't been solved
until now. Um, when the UE falls

00:06:53.375-->00:06:58.375
back to 2G, it will send paging
response directly from UE to
MSC. Okay, and from this depth

00:07:04.917-->00:07:09.917
to uh the -the –the core setup
okay, there is no
authentication. So, um the whole

00:07:15.125-->00:07:20.125
principle is like, the network
has different doors, for example
the depth 1 is the door for LTE

00:07:26.875-->00:07:31.875
and the right one is the door
for GSM. So no matter what door
the subscriber wants to enter,

00:07:34.583-->00:07:41.417
the door requires the subscriber
to show the badge of this door.
And once the badge passes the

00:07:41.417-->00:07:48.167
check, the subscriber enters the
network space. And now there's
one exception. When subscriber

00:07:48.167-->00:07:53.167
goes out from the door of LTE,
she –he -he shouts, "Be quick, I
have a call on GSM". So it, this

00:07:58.750-->00:08:03.750
urgent case in this special case
the door of GSM does not check
his badge. Ok, so after the

00:08:12.458-->00:08:17.458
discovery of this uh problem, we
started to think about how to
exploit and the direct idea is

00:08:21.458-->00:08:26.458
to send fake paging response and
then impersonate the victim's
cell phone and hijack its uh

00:08:29.167-->00:08:34.167
link. This picture shows our
experiment setting. We use the
C118 cell phone where OsmocomBB

00:08:39.750-->00:08:44.750
layer1 is running. And the C118
is connected to laptop which
runs OsmocomBB layer 2 and 3. In

00:08:50.250-->00:08:55.250
this picture, we use 2C 118 cell
phones to improve the attack and
efficiency. Umm, now let's watch

00:09:02.542-->00:09:07.542
demo video to -to know how did
attack looks like and then we
explain the tactical details.

00:09:13.708-->00:09:18.708
This video records the whole
attack procedure, okay. We use 2
cellphone one is the victim's

00:09:30.167-->00:09:35.167
cellphone and use the -wow So
firstly, we check uh the 2 cell
phones work. – work in the

00:09:54.875-->00:09:59.875
normal mode. We firstly use the
victim's cell phone cause uh uh
a normal cell phone. Okay, so

00:10:09.333-->00:10:14.333
both of them works normally wow
ah [sigh] Okay, so during the
-the 2 cores, we captured the

00:10:23.792-->00:10:28.792
TMSI of the victim's cell phone.
And we start the attack. We set
the TMSI on this Macbook. Attack

00:10:47.042-->00:10:52.042
this TMI site. This is the
victim's cell phone TMSI site.
And now we call the victim's

00:11:05.042-->00:11:10.042
cell phone again. Now the core
is connected to the victim's
cell phone um hasn't response.

00:11:20.750-->00:11:25.750
The core is connected to the the
telephonist. Next we open the
Gmail uh Google account webpage.

00:11:31.458-->00:11:36.458
We tried to reset this account's
password by entering the
telephone number. And in the

00:11:44.458-->00:11:49.458
-the Google account will send a
verification short message to
the cell phone. The telephonist

00:11:57.500-->00:12:02.500
receive this verification short
message. Now we import the
verification code. Okay now we

00:12:14.208-->00:12:19.208
can reset the password.
[Clapping] Now we create a new
password. Sign In. Okay, done.

00:12:56.125-->00:13:01.125
This is my Gmail account. Um,
okay this video was uh, recorded
in March in this year. And in

00:13:12.583-->00:13:17.583
this month, July, we –we noticed
that uh Google announced its new
2 factor authentication scheme.

00:13:21.250-->00:13:26.250
The new scheme delivers the
verification code through
Google's uh special application

00:13:31.083-->00:13:36.083
on Android cell phones. So maybe
this attack umm does not work to
Google now. Okay Okay, so let my

00:13:47.458-->00:13:52.458
colleague Yuwue introduce more
technical details. >>Hi good
morning, I'm Yuwue. Now let me

00:13:58.417-->00:14:03.417
introduce the first
exploitation, the simplest one.
The attacker, way the meet the

00:14:10.792-->00:14:15.792
ghost telephonist can impose,
impersonate the victim's cell
phone to receive the core. The

00:14:28.833-->00:14:33.833
attacks steps in our experiment,
at least here, the first step is
beating the PCH the paging

00:14:40.792-->00:14:45.792
Channel and secondly address the
TMSI or IMSI in the paging
messages. The third step is the

00:14:55.708-->00:15:00.708
case step. Forging a paging
response messaging with a
captured TMSI or IMSI. After

00:15:08.000-->00:15:13.000
this step, we check whether the
network accepts the paging
-paging response. If it accepts,

00:15:17.167-->00:15:22.167
it will enter the core setups
procedure. If not, we will wait
for the next paging messages. So

00:15:31.625-->00:15:36.625
in this attack we pickup victim
randomly so we call this method
as random hijack. In the random

00:15:46.875-->00:15:51.875
hi -hijack exploitation, the
attacker listen under 2G paging
channel, extract TMSI from the

00:15:58.917-->00:16:03.917
paging request and then forging
and send the paging response
constantly. However, the network

00:16:07.458-->00:16:12.458
standard set the 4G network
through the send paging request
the way as TMSI. And the TMSI

00:16:17.167-->00:16:22.167
has no relationship with the 2G
TMSI. So someone may ask, "Why
do the network send the paging

00:16:27.417-->00:16:32.417
request on 2G site with the
-while the standard site send
paging on the 4G site?" I don't

00:16:37.708-->00:16:42.708
know either. But in fact we
found that the same on C118.
Also receive CS Fallback paging

00:16:47.833-->00:16:52.833
request on 2G site. So my guess
is operators configured the
network to do so in order to

00:17:00.542-->00:17:05.542
optimize the network to decrease
the late -latency of setting up
a voice call. Here is the

00:17:13.792-->00:17:18.792
success example. You can see
C118 have no SIM card. But after
a fake paging response, we

00:17:27.000-->00:17:32.000
successfully receive the a call
from the number 139 balla balla.
This slide explains the attack

00:17:39.458-->00:17:44.458
signaling. In this figure, UE
hasn't wait represents the
victim. UE has an F. Represent

00:17:51.167-->00:17:56.167
the attacker. When there is a
incoming call for the victim,
the MSC in 2G network will

00:18:04.375-->00:18:09.375
request the MME in 4G network to
transmit paging request. When
the victim receive the paging

00:18:16.875-->00:18:21.875
request, it will send to eNB and
extend the service request to
ask for a 4S Fallback to accept

00:18:31.667-->00:18:36.667
the incoming call in 2G. In the
normal scenario after fallback,
the victim will send a paging

00:18:44.875-->00:18:49.875
response to establish a
connection. But in this
attacking scenario, because the

00:18:54.250-->00:18:59.250
attacker is constantly sending
paging response with the
victim's TMSI number so the call

00:19:05.125-->00:19:10.125
is taken over by the attacker.
Once the telephonist hijacks an
incoming call, what can he do in

00:19:19.167-->00:19:24.167
further? The caller will
recognize the calling the voice
is abnormal, but the attacker

00:19:29.292-->00:19:34.292
may do something like the social
engineering. For example, he may
say, "Your friend encounter an

00:19:37.875-->00:19:42.875
accident. He is in the hospital.
He needs $2000 from -for the
rest co- costs." In this

00:19:49.625-->00:19:54.625
scenario, it may generate
serious conse -consequence.
Anyway, now the attacker only

00:19:57.875-->00:20:02.875
know the victim's TMSI or IMSI.
He don't know who is the victim
and he don't know further

00:20:10.292-->00:20:15.292
information. In what can we do
for the attacker, can we know
the victim cell phone number?

00:20:22.000-->00:20:27.000
See, this picture, we found
during one hijacked the call.
The telephonist can make a call

00:20:33.042-->00:20:38.042
out to a burner phone by sending
CM Service request and messages.
And the separate is they

00:20:44.750-->00:20:51.667
starting trigger authentic tic
doesn't trigger an
authentication either. The

00:20:51.667-->00:20:56.667
network will directly responds
to CM Series accept. By this
way, we can see the victim's

00:21:02.667-->00:21:07.667
phone number on this screen to
this burner phone. We call it as
phone number catcher. Here we

00:21:15.083-->00:21:20.083
summarize the attack steps by
showing this signaling flow.
Telephonists get the control

00:21:24.042-->00:21:29.042
from here. It sends paging
response then the network sends
back setup and the call is can

00:21:35.792-->00:21:40.792
canfor conform. After the call
is hijacked, the telephonist
make a call out by sending

00:21:46.125-->00:21:51.125
holding messages and the CM
service requests. We can send,
we can see the network side

00:21:58.625-->00:22:03.625
sends back a setup message. It
doesn't require authentication.
This picture shows the pickup

00:22:07.750-->00:22:12.750
records. Here we, here there
records captured by Wireshark on
laptop that Osmocom is running

00:22:20.833-->00:22:25.833
on. You can see the hold message
to the end of this call. The
network does not require

00:22:34.250-->00:22:41.208
authentication as long as the
telephonist doesn't hang up the
call, the connection will be

00:22:41.208-->00:22:46.208
maintained. And at the same
time, short message can be
received or trans -transmitted.

00:22:55.333-->00:23:00.333
We tried to make a targeted
attack to attacker test the
phone which gave us the ability

00:23:03.000-->00:23:08.000
to debug and uh log the
signaling. After our
investigation, we find a two way

00:23:11.625-->00:23:16.625
to implement a targeted per
-persistent hijack. First we can
send a paging response back

00:23:20.250-->00:23:25.250
constantly using the test phone
TMSI or IMSI which we can get
easily. No matter whether there

00:23:29.667-->00:23:34.667
is a paging response or not, or
we could use the ISDN number
also know as a cell phone

00:23:38.208-->00:23:43.208
number. In this case, we knows
the victim's phone number, we
can call the victim and the cape

00:23:45.792-->00:23:50.792
-charact, capt the vic –victim's
TMSI in the air. Then we can
launch a targeted attack. We

00:23:55.375-->00:24:00.375
previously mentioned the attack
method. Now let's go to the next
slide and introduce the details

00:24:03.958-->00:24:08.958
about how to implement a
targeted hijack. Firstly, we can
use TMSI to attack the victim as

00:24:14.750-->00:24:21.417
we discussed. With this
attacking method, we could
constantly sending paging

00:24:21.417-->00:24:26.417
response to the attacking to the
networking using the victim's
Tim -TMSI. Once there is a call

00:24:29.917-->00:24:35.667
to the victim, the call
procedure will set up. We can
directly take over this

00:24:35.667-->00:24:40.667
procedure because we can respond
to paging request requests
quicker than the victim. This

00:24:43.417-->00:24:48.417
also means we successfully
performed a targeted attack.
Thirdly, impli -implement,

00:24:54.250-->00:24:59.250
implementing targeted attack
with IMSI basically require the
same steps as using TMSI. But

00:25:05.917-->00:25:10.917
his method has some particular
disadvantages. The successful
rate is much lower than using

00:25:13.958-->00:25:18.958
TMSI because when the network
site receives paging request
with IMSI, it send it needs time

00:25:24.875-->00:25:29.875
to lookup the corresponding TMSI
in the network. Thus, because
the links set, thus increase

00:25:35.042-->00:25:40.042
the----link setup latency. But
the victim will directly send
the legal paging response with

00:25:44.583-->00:25:49.583
TMSI. And the setup they link
quicker than us while the
network is still looking up TMSI

00:25:56.167-->00:26:01.167
with our IMSI. Finally, when we
have the victim's phone number,
we can attack the victim in the

00:26:08.375-->00:26:13.375
following way. We need two
C118's and the one on the phone
as shown in this figure. Here is

00:26:21.333-->00:26:26.333
the steps firstly we set up 108
as a sniffer, then we use a
burner phone to call the victims

00:26:34.917-->00:26:39.917
and a trigger the regular CS
Fallback procedure. Our sniffer
will log the whole procedure

00:26:45.125-->00:26:50.125
including paging response, call
set up, et cetera. Please notice
the call setup signaling

00:26:54.667-->00:26:59.667
contains caller's phone number.
That means we can locate the
specific call setup signaling

00:27:03.042-->00:27:08.042
and trace back to find
corresponding paging response
and finally extract the victim's

00:27:10.458-->00:27:15.458
TMSI. Now we have our Tim our
victim's TMSI. So we can follow
the steps we mentioned before to

00:27:20.333-->00:27:25.333
hijack the victim. Now let's
watch the demo video. This video
shows that the targeted attack.

00:27:34.875-->00:27:39.875
We impersonate one victim's
phone and uh furthermore, we can
chose the -we can hijack this

00:27:46.542-->00:27:51.542
short messages and uh we can
choose which messages the victim
can receive. [Watching video]

00:28:06.792-->00:28:11.792
First uh we use two phones to
call each other to verify the
phone number. Then we start a

00:28:23.458-->00:28:28.458
count to see how much time it
makes to mount the attack. Yeah,
we start a counter to see how

00:28:49.875-->00:28:54.875
much time it takes to mount the
attack. Now we call the victim.
[Inaudible noise from video

00:29:44.375-->00:29:49.375
presentation] But the call have
been hijacked. So now we have
successfully hijacked the voice

00:30:07.667-->00:30:12.667
call. Let's go on to attack
short messages. So we can
successfully hijack short

00:30:23.792-->00:30:28.792
messages and furthermore we can
choose which short messages the
victim can receive. So now

00:30:40.375-->00:30:45.375
welcome my team member Lin to
introduce a more complex attack.
[Clapping] >> Sorry for the bad

00:31:06.667-->00:31:11.667
video issue. Um, well, let me
continue to explain uh umm the
first, the first demo video show

00:31:26.417-->00:31:31.417
the whole procedure. Okay, um,
this is about how to attack the
internet accounts and we know

00:31:35.667-->00:31:40.667
that uh to -to simplify the uh
user experience many internet
-internet applications permits

00:31:43.375-->00:31:49.875
login with cell phone number and
verification passwords, uh,
verification short messages,

00:31:49.875-->00:31:55.667
okay. It doesn't require
importing the login password.
And so, if attacker obtains the

00:31:55.667-->00:32:01.583
victim's cell phone number and
verification short messages, uh,
he can impersonate the victim to

00:32:01.583-->00:32:06.583
access the application. Another
attack path is using the
verification short message to

00:32:08.583-->00:32:13.583
reset the password as we show in
-in the first uh demo video. Um,
as we all know, there's some

00:32:18.833-->00:32:25.333
existing exploitations um which
can obtain verification messages
like uh, the attack we showed

00:32:25.333-->00:32:30.333
here. For example, SS7, SS7
vulnerability can utilize to
hijack both core or short

00:32:34.083-->00:32:39.083
messages. Also some malware
-malwares on the cell phones
which can hijack the short

00:32:42.000-->00:32:47.000
messages content. So, uh
telephonists attack is just a
new attack method to generate

00:32:50.208-->00:32:55.208
the -the same consequence. Uh,
we verify this kind of attack,
the password reset on some of

00:33:01.167-->00:33:07.875
the internet applications uh for
example Facebook and Google
Account et. cetera. Uh, the

00:33:07.875-->00:33:12.875
steps are illustrated here. In
first step, we control the
victim's link and get the phone

00:33:16.708-->00:33:21.708
number and in step two here, um
we use a computer open the web
page um and request uh re- to

00:33:26.500-->00:33:31.500
reset the password with the
acquired the phone number. In
the step three here, um the

00:33:34.292-->00:33:41.250
telephonist receives the
verification short messages. And
finally in the step four, we use

00:33:41.250-->00:33:46.250
this verification code to reset
the login password. This picture
is the screenshot of the C118

00:33:51.333-->00:33:56.333
log and the real court in the
red rectangle proves that the
C118 received the verification

00:34:02.375-->00:34:07.375
short messages sent from
network. It says CP Data network
to MS. We investigated password

00:34:17.000-->00:34:22.000
reset routine um of a men- many
popular website and applications
um including global and Chinese

00:34:26.208-->00:34:31.208
ones. This table summarized some
of them, um. Facebook, Google
Account, WhatsApp. And in China

00:34:35.333-->00:34:40.333
there are AliPay, WeChat, DiDi
and Sina et. cetera. Some of
them requires sending short

00:34:43.667-->00:34:48.667
message from internet to cell
phone, the inbound ones. And
some of them requires sending

00:34:50.875-->00:34:55.875
short message from cell phone to
internet, the outbound ones.
Well uh, now you -you may you

00:35:04.458-->00:35:09.458
many think of this vulnerability
so dangerous and but -but we
want to emphasize that, don't

00:35:12.792-->00:35:17.792
worry so much. Um, there's some
constraints okay. In this page,
we summarize the constraints to

00:35:20.458-->00:35:27.458
launch the attack. Um, firstly,
the telephonist and the victim's
cell phone should be in the same

00:35:27.458-->00:35:32.458
paging area. It may be in
several base station's coverage.
And, secondly, the attack is

00:35:35.625-->00:35:40.625
visible only one 2G network is
in use and uses A5/1 or A5/0
encryption. Um, I -I want to uh

00:35:48.042-->00:35:53.042
say here 2G network is in use.
That means, even the CS Fallback
makes the cellphone fall back to

00:35:58.583-->00:36:03.583
3G, okay. Um, as long as 2G
network is in use, the attack is
visible okay. And um compared

00:36:13.708-->00:36:18.708
with known exploitations
telephonist attack has uh these
features. It doesn't need uh to

00:36:22.458-->00:36:27.458
access the SS7 core network and
this attack doesn't need fake
base station so it's quite easy

00:36:30.083-->00:36:35.083
to launch. The victim he keeps
online in 4G network and is not
aware of this attack as the

00:36:38.208-->00:36:43.208
picture shows here. And people
may also question that why in
that every experiment you make a

00:36:46.500-->00:36:51.500
call to the victim to trigger,
uh, the CS Fallback. "Is this
necessary for a successful

00:36:55.167-->00:37:00.167
hijack?" The answer is no. Um,
it depends on the operators
configurations. In some cases,

00:37:03.125-->00:37:10.042
we found we can directly
impersonate the victim's cell
phone to make a mobile

00:37:10.042-->00:37:15.042
originated, originated core. Um,
during our tests we noticed that
uh, we got different success for

00:37:20.417-->00:37:25.417
mm results when we attacked a
different victim, victim's cell
phones. Here lists the five cell

00:37:27.708-->00:37:33.583
phones we tested um, with
different chipsets. It is
changed that some of them um,

00:37:33.583-->00:37:38.583
which we marked with a star in
the table will get back its
control to the connection and

00:37:41.042-->00:37:46.417
after 10 seconds of our
successful hijack. This means
out attack is failed in this

00:37:46.417-->00:37:51.417
case. So what's the problem? Why
does such kind of failure exist?
Mmm, why do different cell

00:37:56.208-->00:38:01.208
phones have different behavior?
Here we went through uh, after
we -we we tested and -analyzed,

00:38:06.208-->00:38:11.208
the major reason we found cause
in this issue in the fast
return, fast return procedure.

00:38:14.708-->00:38:19.708
Um, the chipset manufactures
implemented fast return in
different ways. When a victim's

00:38:22.042-->00:38:28.167
cell phone received a paging
message but it didn't receive
this call, uh it may launch a

00:38:28.167-->00:38:33.167
location area update procedure
in 2G. And this action will
finally leads the interruption

00:38:36.000-->00:38:41.000
of our hijack link. Here we show
a 2 cases, the first one is
about Qualcomm -Qualcomm chipset

00:38:46.583-->00:38:51.583
in this figure. The green texts
are 4G signaling and the white
texts are 2G signaling. You can

00:38:54.292-->00:38:59.292
see that Qualcomm chipsets sends
location update requests here
but there is not location update

00:39:02.542-->00:39:09.208
accept the following. So we
doubt whether the chipsets are
really complete the location

00:39:09.208-->00:39:14.208
update requests procedures. In
this case, the attack will uh
will be succeed because the LAU

00:39:18.833-->00:39:23.833
procedure is not complete so we
can maintain the connection to
do something evil. Here's the uh

00:39:26.833-->00:39:31.833
failure example. We can see the
difference this is the case of
empty page chipset. When the

00:39:34.208-->00:39:39.208
cell phone fell back to 2G, it
didn't get this call. Mmm, but
before returning to 4G the

00:39:42.542-->00:39:47.917
signaling was sent out. There is
a location update accept
immediately follow, following.

00:39:47.917-->00:39:52.917
So in this case, our –our victim
will get a -a new TMSI. That's
why the connection will be

00:39:58.042-->00:40:05.000
interrupted 10 seconds after
being successfully hijacked.
Okay, does this mean the chipset

00:40:05.000-->00:40:10.000
we marked a star or immuned to
-to this attack? No. For such
chipset issue, we can use the

00:40:15.167-->00:40:20.167
jamming to uh prevent the
victim's cell phone sending LAU
signaling to the network then uh

00:40:23.708-->00:40:28.708
we could maintain this hijack
link. Okay, we proposed uh,
countermeasures to operators and

00:40:31.167-->00:40:37.708
internet providers. We suggest
to –to add the CS Fallback
authentication in the CS

00:40:37.708-->00:40:44.000
Fallback uh procedure. The
additional latency is acceptable
and we think the final solution

00:40:44.000-->00:40:49.000
is to speed up the real LTE
deployment. And for the internet
service provider and it should

00:40:51.125-->00:40:57.417
be careful that the PSTN
authentication is not safe and
IST guidance already suggested

00:40:57.417-->00:41:02.417
that uh not use PSTN in 2 factor
authentication. Well, finally I
want to thanks to GSMA's CVD

00:41:07.167-->00:41:12.167
Program. Um, this is a new
program launched in this year.
Um, this is a program for -for

00:41:15.417-->00:41:21.250
researchers to record the
vulnerabilities related to
standards and protocols. Before

00:41:21.250-->00:41:26.250
this program, umm we have no
platform to report such uh
vulnerabilities so umm we

00:41:30.917-->00:41:35.917
reported this problem in GSMA
and we received the first
acknowledgement on the Mobile

00:41:39.000-->00:41:44.000
Security Research Hall of Fame.
GSMA also transferred this
vulnerability information every

00:41:46.583-->00:41:51.583
operators and we know um, some
related operators um, already
fix and or fixing this problem.

00:42:02.458-->00:42:07.000
Ah well that's all. Thank you
all for your patience.
[Clapping]