start	end	text
10910	21270	Hey guys! Hope you're doing great and safe. I'm thrilled to give a lecture at Aerospace Village
21270	31970	this year and that's an honor for me and appreciated. I hope you will enjoy my presentation.
34210	39090	In fact, today I'm not going to talk about ordinary topics
39090	47970	regarding aviation, something like that. Actually, I'm going to talk about a novel topic,
47970	54390	something more practical and different from anything you've heard before.
54910	62230	Because we are at DEF CON, so we must talk about something possible which makes sense.
62230	68350	This presentation covers radio-based and signaling vulnerabilities which impact on
68350	76970	passengers, airplanes, and other avionics components. Also, I will give you a deep
76970	83330	and clear perspective like a malicious passenger, a malpractice in a radio field,
83330	89010	and a hacker who has an access to the mobile network.
92250	99010	Hello, my friends, and welcome to my talk. I'm Ali Abdullahi, a cybersecurity engineer with
99010	106190	over eight years of experience in a variety of fields. I love to share my experience and
106190	115070	little knowledge with others and also love bug hunting to make our world a safer place for
115070	123090	everyone. And I'm a regular speaker and trainer at famous cybersecurity and hacking conferences
123090	132530	like Cocoon B-Sides, Typhoon Con, Cyber Jungle, OWASP APSEC Days, Confidence, and this year
132530	147420	except Aerospace Village, DEF CON Red Team, and APSEC Village. So, please consider all avionic
147420	156220	components as well as airplanes as victims while I am presenting my research. This is because
156220	164160	each component, like passenger, entertainment, navigation systems, etc., are subscribers when
164160	173660	using mobile communications. So, the purpose of this talk is to deep dive into this communication
173660	180940	which is called Air-to-Ground or A2G. And I'm going to show you possible attack vectors
180940	187260	from radio and signaling points of view which Frieden denotes.
192280	201580	What is A2G system? A2G stands for Air-to-Ground system which is based on mobile or cellular
201580	209740	technologies like GSM, UMTS, and LTE. Aircrafts, UAVs, etc.,
212240	219280	and the main usage of this system is to bring high-speed connections when you are flying on
219280	225640	the ground. However, when you are on the sea, airplane can take advantage from satellite
225640	235560	communications. But there are some big differences between A2G and satellites like
235560	242590	low latency, ease of use, low cost implementation, and more flexibility.
247040	255230	The first and foremost usage of Air-to-Ground is to bring mobile broadband connectivity for
255230	263830	passengers when flying. Other avionic components in airplane like EFB and IFE could take advantage
263830	271530	from this network. Improving onboard cabin services, real-time monitoring,
275150	281270	easy and flexible management, or other advantages of Air-to-Ground systems.
284980	297740	So, here is the whole architecture of the system. As you can see, an airplane in this picture
297740	304280	connected to the ground via direct Air-to-Ground system or using satellite communications.
305060	316800	So, there are some base stations or radio towers which call BTS, Node-B in 3G or E-Node-B in 4G.
318520	327300	Some of this network call radio access network or RAN. And the second part is the mobile core
327300	333620	network which handles signal and communications and connected to the RAN and other networks.
334280	345410	In this picture, EPC staff or wall packet core or circuit switch in LTE technology.
345970	352870	Well, now I'm going to talk about possible offensive scenarios in radio access networks.
353690	361970	Whenever an attacker has unauthorized access to their base station by breaking defense or
361970	367530	maybe as an insider attacker can intercept the connections and manipulate it between
367530	374070	airplane and the ground. So, in this case, our malefactor located on the ground.
381980	390400	This one is a hot topic, in-flight fake BTS or IMSI catcher. You may hear it many many times
390400	398200	about a fake BTS or fake base stations and IMSI catchers in the news. But this time,
398200	405400	it's different because the vector is something else. And this is our first part of attacker chain.
406040	414180	To do this, malicious passenger or malefactor jamming the current signals in the field using
414180	423120	jammers and after that will run an IMSI catcher or fake BTS to perform a man-in-the-middle to
423120	431800	retrieve one of the most valuable value called IMSI. In this case, an attacker will gather
431800	438960	all passengers and components IMSI numbers to perform further exploitation.
445780	454920	Again, another hot topic. In-flight sniffing, to perform it, we need to have an RTL-STR or
454920	469180	BladeRF, HankRF, USRP or Osmocom and Motorola C115 or C118. And in this scenario, while an attacker
469180	479900	uses these equipment, he or she can sniff all in-transit data. As you can see, all packets
480540	490140	sent and received like voice, data and network info have captured here. You can see all LTRC
491250	499340	protocols packets here and signal connection release packets captured here and all paging
499340	511380	requests captured and you can see in this picture. Here is another proof of concept
511380	525160	which points to an IMSI number. So, in this picture, you can see all SIM card details
525160	538860	which an attacker retrieved via Osmocom BB. In other scenario, an attacker can take advantage
538860	547280	from an open-source script called TeamC Sniffer to sniff all TeamC numbers on board.
549960	558040	What is TeamC actually? As I told you before, because IMSI number is a unique value for each
558040	568120	subscriber, it is very important to less exchange the actual IMSI number in radio networks.
568280	575600	Components use TeamC which is a random number based on the actual IMSI value to reduce the
575600	586840	risk of IMSI disclosure. And here you can see the attacker sniffing all TeamC number on board
587330	601260	or in the field. If GSM technology works or an attacker can jam the LTE or UMTS frequencies to
601260	610840	force the network to downgrade to GSM, the attacker can review the network encryption level
610840	617960	to analyze the security level or maybe if there is no sufficient encryption.
618520	636980	And this is a very good news for a hacker. Well, well, well, this is time to start one of
643040	651080	this is time to clone passenger sim card. It's interesting. To do this malicious scenario,
651080	657760	we need just to some basic info regarding the targeted sim card which gathered from
658620	663800	previous states and a sim card reader or even our osmocom environment.
671080	678360	Okay, dear passengers, I have all your mobile device TeamC number and we are going to
678360	698000	perform denial of service. Okay, so this is our first DOS scenario. And in this case,
698000	704640	we will take advantage from IMSI detach request to disrupt mobile node availability in radio
704640	722400	network. So here is another way. So passengers, please don't worry because we are going to
722400	733550	DOS again. In this case, the attacker will abuse paging requests and will respond to it
733550	757980	instead of the real mobile node. So most of mobile network operators or MNOs and service providers
757980	766140	all around the world are still using traditional and vulnerable mobile technologies like GSM
766140	774400	and UMTS. So in this case, all mobile core network vulnerabilities like SS7 and SIGTRAN
774400	780080	are possible because the attacker also has passenger's IMSI number.
781100	788960	These attacks categorize in approximately four classes, fraud, spoofing, denial of service,
788960	798360	and privacy violation. For example, sending a purge query, which is a map or mobile application
798360	806300	port message to the core network will purge a subscriber information from the database or even
806300	816470	DOS the passengers using update location message or cause impersonating.
819950	828850	So now I'm going to talk about other attack vectors inside the core network and that is exploiting
828850	835810	the onboard mobile nodes using packet data. The picture illustrates the connection between
835810	843910	the airplane and the core network specifically packet data by using air-to-ground, the airplane
843910	850470	connected to the base station. After that, using S1U interface, the data will reach to
850470	857810	serving gateway. And the next node is packet gateway, which is connected to the internet or
857810	871370	any PLMN. Okay, so in this scenario, attacker will cause data or packet manipulation,
871930	876730	availability disruption, or even fraud by performing a brute force attack on
876730	886870	TID or Tunneling Endpoint Identifier. Actually, TID specifies GTP or GPRS tunneling protocol
886870	894590	endpoints to transmitting the data. So in this case, a packet data request sent to the core
894590	902670	network from, for example, a passenger. However, during the procedures of transmitting the data
902670	914250	between mobile node and SGW-PGW, an attacker brute forcing TID to exploit it. So the connection
914250	927490	disrupts and the attacker can perform denial of service, fraud, etc. Hey folks, that's awesome
927490	934910	because again, we are going to perform denial of service manipulation and fraud, this time by
934910	942930	abusing GTP or GPRS tunneling protocol, which is playing a vital role in packet core. These are
942930	954010	going to done because the attacker has passengers information. In this case, like the previous one,
954010	963150	the attacker will abuse GTP delete session request to cause DOS or even impersonation, as well as
963150	972730	create PDB context request. After these procedures, the attacker could take advantage from
972730	980470	in-flight passengers data session to perform fraud, terminate passengers data flow, or even
980470	993280	intercepting the data. Thank you, my dear friends, for your attention. You can stay in touch with me
993280	999700	on Twitter and LinkedIn. And many thanks to Aerospace Village organizers and sponsors
1000260	1007420	to deliver such great events. I will come back soon with my new research and hope to see you soon.
1007420	1008560	Stay safe.