Hey guys! Hope you're doing great and safe. I'm thrilled to give a lecture at Aerospace Village
this year and that's an honor for me and appreciated. I hope you will enjoy my presentation.
In fact, today I'm not going to talk about ordinary topics
regarding aviation, something like that. Actually, I'm going to talk about a novel topic,
something more practical and different from anything you've heard before.
Because we are at DEF CON, so we must talk about something possible which makes sense.
This presentation covers radio-based and signaling vulnerabilities which impact on
passengers, airplanes, and other avionics components. Also, I will give you a deep
and clear perspective like a malicious passenger, a malpractice in a radio field,
and a hacker who has an access to the mobile network.
Hello, my friends, and welcome to my talk. I'm Ali Abdullahi, a cybersecurity engineer with
over eight years of experience in a variety of fields. I love to share my experience and
little knowledge with others and also love bug hunting to make our world a safer place for
everyone. And I'm a regular speaker and trainer at famous cybersecurity and hacking conferences
like Cocoon B-Sides, Typhoon Con, Cyber Jungle, OWASP APSEC Days, Confidence, and this year
except Aerospace Village, DEF CON Red Team, and APSEC Village. So, please consider all avionic
components as well as airplanes as victims while I am presenting my research. This is because
each component, like passenger, entertainment, navigation systems, etc., are subscribers when
using mobile communications. So, the purpose of this talk is to deep dive into this communication
which is called Air-to-Ground or A2G. And I'm going to show you possible attack vectors
from radio and signaling points of view which Frieden denotes.
What is A2G system? A2G stands for Air-to-Ground system which is based on mobile or cellular
technologies like GSM, UMTS, and LTE. Aircrafts, UAVs, etc.,
and the main usage of this system is to bring high-speed connections when you are flying on
the ground. However, when you are on the sea, airplane can take advantage from satellite
communications. But there are some big differences between A2G and satellites like
low latency, ease of use, low cost implementation, and more flexibility.
The first and foremost usage of Air-to-Ground is to bring mobile broadband connectivity for
passengers when flying. Other avionic components in airplane like EFB and IFE could take advantage
from this network. Improving onboard cabin services, real-time monitoring,
easy and flexible management, or other advantages of Air-to-Ground systems.
So, here is the whole architecture of the system. As you can see, an airplane in this picture
connected to the ground via direct Air-to-Ground system or using satellite communications.
So, there are some base stations or radio towers which call BTS, Node-B in 3G or E-Node-B in 4G.
Some of this network call radio access network or RAN. And the second part is the mobile core
network which handles signal and communications and connected to the RAN and other networks.
In this picture, EPC staff or wall packet core or circuit switch in LTE technology.
Well, now I'm going to talk about possible offensive scenarios in radio access networks.
Whenever an attacker has unauthorized access to their base station by breaking defense or
maybe as an insider attacker can intercept the connections and manipulate it between
airplane and the ground. So, in this case, our malefactor located on the ground.
This one is a hot topic, in-flight fake BTS or IMSI catcher. You may hear it many many times
about a fake BTS or fake base stations and IMSI catchers in the news. But this time,
it's different because the vector is something else. And this is our first part of attacker chain.
To do this, malicious passenger or malefactor jamming the current signals in the field using
jammers and after that will run an IMSI catcher or fake BTS to perform a man-in-the-middle to
retrieve one of the most valuable value called IMSI. In this case, an attacker will gather
all passengers and components IMSI numbers to perform further exploitation.
Again, another hot topic. In-flight sniffing, to perform it, we need to have an RTL-STR or
BladeRF, HankRF, USRP or Osmocom and Motorola C115 or C118. And in this scenario, while an attacker
uses these equipment, he or she can sniff all in-transit data. As you can see, all packets
sent and received like voice, data and network info have captured here. You can see all LTRC
protocols packets here and signal connection release packets captured here and all paging
requests captured and you can see in this picture. Here is another proof of concept
which points to an IMSI number. So, in this picture, you can see all SIM card details
which an attacker retrieved via Osmocom BB. In other scenario, an attacker can take advantage
from an open-source script called TeamC Sniffer to sniff all TeamC numbers on board.
What is TeamC actually? As I told you before, because IMSI number is a unique value for each
subscriber, it is very important to less exchange the actual IMSI number in radio networks.
Components use TeamC which is a random number based on the actual IMSI value to reduce the
risk of IMSI disclosure. And here you can see the attacker sniffing all TeamC number on board
or in the field. If GSM technology works or an attacker can jam the LTE or UMTS frequencies to
force the network to downgrade to GSM, the attacker can review the network encryption level
to analyze the security level or maybe if there is no sufficient encryption.
And this is a very good news for a hacker. Well, well, well, this is time to start one of
this is time to clone passenger sim card. It's interesting. To do this malicious scenario,
we need just to some basic info regarding the targeted sim card which gathered from
previous states and a sim card reader or even our osmocom environment.
Okay, dear passengers, I have all your mobile device TeamC number and we are going to
perform denial of service. Okay, so this is our first DOS scenario. And in this case,
we will take advantage from IMSI detach request to disrupt mobile node availability in radio
network. So here is another way. So passengers, please don't worry because we are going to
DOS again. In this case, the attacker will abuse paging requests and will respond to it
instead of the real mobile node. So most of mobile network operators or MNOs and service providers
all around the world are still using traditional and vulnerable mobile technologies like GSM
and UMTS. So in this case, all mobile core network vulnerabilities like SS7 and SIGTRAN
are possible because the attacker also has passenger's IMSI number.
These attacks categorize in approximately four classes, fraud, spoofing, denial of service,
and privacy violation. For example, sending a purge query, which is a map or mobile application
port message to the core network will purge a subscriber information from the database or even
DOS the passengers using update location message or cause impersonating.
So now I'm going to talk about other attack vectors inside the core network and that is exploiting
the onboard mobile nodes using packet data. The picture illustrates the connection between
the airplane and the core network specifically packet data by using air-to-ground, the airplane
connected to the base station. After that, using S1U interface, the data will reach to
serving gateway. And the next node is packet gateway, which is connected to the internet or
any PLMN. Okay, so in this scenario, attacker will cause data or packet manipulation,
availability disruption, or even fraud by performing a brute force attack on
TID or Tunneling Endpoint Identifier. Actually, TID specifies GTP or GPRS tunneling protocol
endpoints to transmitting the data. So in this case, a packet data request sent to the core
network from, for example, a passenger. However, during the procedures of transmitting the data
between mobile node and SGW-PGW, an attacker brute forcing TID to exploit it. So the connection
disrupts and the attacker can perform denial of service, fraud, etc. Hey folks, that's awesome
because again, we are going to perform denial of service manipulation and fraud, this time by
abusing GTP or GPRS tunneling protocol, which is playing a vital role in packet core. These are
going to done because the attacker has passengers information. In this case, like the previous one,
the attacker will abuse GTP delete session request to cause DOS or even impersonation, as well as
create PDB context request. After these procedures, the attacker could take advantage from
in-flight passengers data session to perform fraud, terminate passengers data flow, or even
intercepting the data. Thank you, my dear friends, for your attention. You can stay in touch with me
on Twitter and LinkedIn. And many thanks to Aerospace Village organizers and sponsors
to deliver such great events. I will come back soon with my new research and hope to see you soon.
Stay safe.