1 00:00:10,910 --> 00:00:12,530 Hey guys! 2 00:00:12,530 --> 00:00:16,070 Hope you're doing great and safe. 3 00:00:16,710 --> 00:00:28,950 I'm thrilled to give a lecture at Aerospace Village this year and that's an honor for me and appreciated. 4 00:00:28,970 --> 00:00:31,970 I hope you will enjoy my presentation. 5 00:00:34,210 --> 00:00:43,090 In fact, today I'm not going to talk about ordinary topics regarding aviation, something like that. 6 00:00:43,090 --> 00:00:54,390 Actually, I'm going to talk about a novel topic, something more practical and different from anything you've heard before. 7 00:00:54,910 --> 00:01:02,230 Because we are at DEF CON, so we must talk about something possible which makes sense. 8 00:01:02,230 --> 00:01:14,390 This presentation covers radio-based and signaling vulnerabilities which impact on passengers, airplanes, and other avionics components. 9 00:01:14,610 --> 00:01:29,010 Also, I will give you a deep and clear perspective like a malicious passenger, a malpractice in a radio field, and a hacker who has an access to the mobile network. 10 00:01:32,250 --> 00:01:35,390 Hello, my friends, and welcome to my talk. 11 00:01:35,490 --> 00:01:43,290 I'm Ali Abdullahi, a cybersecurity engineer with over eight years of experience in a variety of fields. 12 00:01:43,550 --> 00:01:56,450 I love to share my experience and little knowledge with others and also love bug hunting to make our world a safer place for everyone. 13 00:01:56,870 --> 00:02:17,450 And I'm a regular speaker and trainer at famous cybersecurity and hacking conferences like Cocoon B-Sides, Typhoon Con, Cyber Jungle, OWASP APSEC Days, Confidence, and this year except Aerospace Village, DEF CON Red Team, and APSEC Village. 14 00:02:23,460 --> 00:02:35,320 So, please consider all avionic components as well as airplanes as victims while I am presenting my research. 15 00:02:35,320 --> 00:02:46,560 This is because each component, like passenger, entertainment, navigation systems, etc., are subscribers when using mobile communications. 16 00:02:46,560 --> 00:02:57,640 So, the purpose of this talk is to deep dive into this communication which is called Air-to-Ground or A2G. 17 00:02:57,640 --> 00:03:07,260 And I'm going to show you possible attack vectors from radio and signaling points of view which Frieden denotes. 18 00:03:12,280 --> 00:03:15,060 What is A2G system? 19 00:03:15,380 --> 00:03:26,360 A2G stands for Air-to-Ground system which is based on mobile or cellular technologies like GSM, UMTS, and LTE. 20 00:03:27,540 --> 00:03:40,760 Aircrafts, UAVs, etc., and the main usage of this system is to bring high-speed connections when you are flying on the ground. 21 00:03:41,200 --> 00:03:47,260 However, when you are on the sea, airplane can take advantage from satellite communications. 22 00:03:48,100 --> 00:04:02,590 But there are some big differences between A2G and satellites like low latency, ease of use, low cost implementation, and more flexibility. 23 00:04:07,040 --> 00:04:17,750 The first and foremost usage of Air-to-Ground is to bring mobile broadband connectivity for passengers when flying. 24 00:04:17,750 --> 00:04:26,230 Other avionic components in airplane like EFB and IFE could take advantage from this network. 25 00:04:26,710 --> 00:04:31,530 Improving onboard cabin services, real-time monitoring, 26 00:04:35,150 --> 00:04:41,270 easy and flexible management, or other advantages of Air-to-Ground systems. 27 00:04:44,980 --> 00:04:53,440 So, here is the whole architecture of the system. 28 00:04:53,540 --> 00:05:04,280 As you can see, an airplane in this picture connected to the ground via direct Air-to-Ground system or using satellite communications. 29 00:05:05,060 --> 00:05:16,800 So, there are some base stations or radio towers which call BTS, Node-B in 3G or E-Node-B in 4G. 30 00:05:18,520 --> 00:05:24,400 Some of this network call radio access network or RAN. 31 00:05:24,720 --> 00:05:33,620 And the second part is the mobile core network which handles signal and communications and connected to the RAN and other networks. 32 00:05:34,280 --> 00:05:45,410 In this picture, EPC staff or wall packet core or circuit switch in LTE technology. 33 00:05:45,970 --> 00:05:52,870 Well, now I'm going to talk about possible offensive scenarios in radio access networks. 34 00:05:53,690 --> 00:06:09,750 Whenever an attacker has unauthorized access to their base station by breaking defense or maybe as an insider attacker can intercept the connections and manipulate it between airplane and the ground. 35 00:06:09,990 --> 00:06:14,070 So, in this case, our malefactor located on the ground. 36 00:06:21,980 --> 00:06:28,020 This one is a hot topic, in-flight fake BTS or IMSI catcher. 37 00:06:28,020 --> 00:06:36,600 You may hear it many many times about a fake BTS or fake base stations and IMSI catchers in the news. 38 00:06:36,620 --> 00:06:41,780 But this time, it's different because the vector is something else. 39 00:06:41,780 --> 00:06:45,400 And this is our first part of attacker chain. 40 00:06:46,040 --> 00:07:08,600 To do this, malicious passenger or malefactor jamming the current signals in the field using jammers and after that will run an IMSI catcher or fake BTS to perform a man-in-the-middle to retrieve one of the most valuable value called IMSI. 41 00:07:08,660 --> 00:07:18,960 In this case, an attacker will gather all passengers and components IMSI numbers to perform further exploitation. 42 00:07:25,780 --> 00:07:28,700 Again, another hot topic. 43 00:07:29,180 --> 00:07:46,580 In-flight sniffing, to perform it, we need to have an RTL-STR or BladeRF, HankRF, USRP or Osmocom and Motorola C115 or C118. 44 00:07:46,720 --> 00:07:55,760 And in this scenario, while an attacker uses these equipment, he or she can sniff all in-transit data. 45 00:07:57,200 --> 00:08:07,160 As you can see, all packets sent and received like voice, data and network info have captured here. 46 00:08:07,160 --> 00:08:26,140 You can see all LTRC protocols packets here and signal connection release packets captured here and all paging requests captured and you can see in this picture. 47 00:08:28,900 --> 00:08:34,740 Here is another proof of concept which points to an IMSI number. 48 00:08:39,200 --> 00:08:50,220 So, in this picture, you can see all SIM card details which an attacker retrieved via Osmocom BB. 49 00:08:54,980 --> 00:09:07,280 In other scenario, an attacker can take advantage from an open-source script called TeamC Sniffer to sniff all TeamC numbers on board. 50 00:09:09,960 --> 00:09:12,480 What is TeamC actually? 51 00:09:12,500 --> 00:09:28,120 As I told you before, because IMSI number is a unique value for each subscriber, it is very important to less exchange the actual IMSI number in radio networks. 52 00:09:28,280 --> 00:09:37,920 Components use TeamC which is a random number based on the actual IMSI value to reduce the risk of IMSI disclosure. 53 00:09:39,000 --> 00:09:49,400 And here you can see the attacker sniffing all TeamC number on board or in the field. 54 00:09:53,020 --> 00:10:17,960 If GSM technology works or an attacker can jam the LTE or UMTS frequencies to force the network to downgrade to GSM, the attacker can review the network encryption level to analyze the security level or maybe if there is no sufficient encryption. 55 00:10:18,520 --> 00:10:22,140 And this is a very good news for a hacker. 56 00:10:30,760 --> 00:10:36,980 Well, well, well, this is time to start one of 57 00:10:43,040 --> 00:10:46,940 this is time to clone passenger sim card. 58 00:10:46,940 --> 00:10:48,880 It's interesting. 59 00:10:48,980 --> 00:11:03,800 To do this malicious scenario, we need just to some basic info regarding the targeted sim card which gathered from previous states and a sim card reader or even our osmocom environment. 60 00:11:11,080 --> 00:11:21,460 Okay, dear passengers, I have all your mobile device TeamC number and we are going to perform denial of service. 61 00:11:31,160 --> 00:11:36,600 Okay, so this is our first DOS scenario. 62 00:11:36,600 --> 00:11:45,920 And in this case, we will take advantage from IMSI detach request to disrupt mobile node availability in radio network. 63 00:11:54,140 --> 00:11:58,600 So here is another way. 64 00:11:58,700 --> 00:12:04,540 So passengers, please don't worry because we are going to DOS again. 65 00:12:06,730 --> 00:12:16,750 In this case, the attacker will abuse paging requests and will respond to it instead of the real mobile node. 66 00:12:29,940 --> 00:12:47,840 So most of mobile network operators or MNOs and service providers all around the world are still using traditional and vulnerable mobile technologies like GSM and UMTS. 67 00:12:48,080 --> 00:13:00,080 So in this case, all mobile core network vulnerabilities like SS7 and SIGTRAN are possible because the attacker also has passenger's IMSI number. 68 00:13:01,100 --> 00:13:11,120 These attacks categorize in approximately four classes, fraud, spoofing, denial of service, and privacy violation. 69 00:13:12,160 --> 00:13:36,470 For example, sending a purge query, which is a map or mobile application port message to the core network will purge a subscriber information from the database or even DOS the passengers using update location message or cause impersonating. 70 00:13:39,950 --> 00:13:52,870 So now I'm going to talk about other attack vectors inside the core network and that is exploiting the onboard mobile nodes using packet data. 71 00:13:52,870 --> 00:14:06,470 The picture illustrates the connection between the airplane and the core network specifically packet data by using air-to-ground, the airplane connected to the base station. 72 00:14:06,470 --> 00:14:12,510 After that, using S1U interface, the data will reach to serving gateway. 73 00:14:12,770 --> 00:14:19,810 And the next node is packet gateway, which is connected to the internet or any PLMN. 74 00:14:24,910 --> 00:14:41,090 Okay, so in this scenario, attacker will cause data or packet manipulation, availability disruption, or even fraud by performing a brute force attack on TID or Tunneling Endpoint Identifier. 75 00:14:41,150 --> 00:14:50,330 Actually, TID specifies GTP or GPRS tunneling protocol endpoints to transmitting the data. 76 00:14:50,550 --> 00:14:58,510 So in this case, a packet data request sent to the core network from, for example, a passenger. 77 00:14:58,510 --> 00:15:12,850 However, during the procedures of transmitting the data between mobile node and SGW-PGW, an attacker brute forcing TID to exploit it. 78 00:15:13,070 --> 00:15:20,310 So the connection disrupts and the attacker can perform denial of service, fraud, etc. 79 00:15:25,590 --> 00:15:42,090 Hey folks, that's awesome because again, we are going to perform denial of service manipulation and fraud, this time by abusing GTP or GPRS tunneling protocol, which is playing a vital role in packet core. 80 00:15:42,470 --> 00:15:50,750 These are going to done because the attacker has passengers information. 81 00:15:51,090 --> 00:16:06,010 In this case, like the previous one, the attacker will abuse GTP delete session request to cause DOS or even impersonation, as well as create PDB context request. 82 00:16:06,670 --> 00:16:22,610 After these procedures, the attacker could take advantage from in-flight passengers data session to perform fraud, terminate passengers data flow, or even intercepting the data. 83 00:16:28,100 --> 00:16:31,460 Thank you, my dear friends, for your attention. 84 00:16:31,460 --> 00:16:35,280 You can stay in touch with me on Twitter and LinkedIn. 85 00:16:35,460 --> 00:16:42,960 And many thanks to Aerospace Village organizers and sponsors to deliver such great events. 86 00:16:43,040 --> 00:16:47,420 I will come back soon with my new research and hope to see you soon. 87 00:16:47,420 --> 00:16:48,560 Stay safe.