1
00:00:01,440 --> 00:00:05,990
Hi, my name is Per Thorsen and I am the founder of Passwords.com.

2
00:00:06,190 --> 00:00:14,950
I'm really happy to be speaking once again at the Crypto & Privacy Village here, this time at the DEF CON Safe Mode 2020 edition.

3
00:00:15,750 --> 00:00:23,310
My talk is entitled Hacking Like Paris Hilton 14 Years Later and Still Winning.

4
00:00:23,630 --> 00:00:31,810
And this is a talk that has been in the making for quite a few years by me now.

5
00:00:31,810 --> 00:00:36,410
So I'm really, really happy to sort of tell the entire story on this one.

6
00:00:36,470 --> 00:00:40,150
First, a very quick introduction of myself.

7
00:00:40,150 --> 00:00:57,490
Here you have a tweet a couple of years ago when I said that I do have a certain interest in passwords and Cormac Hurley at Microsoft Research, he responds back saying that, confirm I have a healthy curiosity while Thorsen is pathologically obsessed with passwords and,

8
00:00:57,490 --> 00:00:58,950
well, digital authentication.

9
00:00:58,950 --> 00:01:02,270
So that's basically me in a nutshell .

10
00:01:02,810 --> 00:01:13,330
Now, I do say this because for this talk it's important for me to provide a bit of background and context to the stuff that I'm going to talk about.

11
00:01:13,330 --> 00:01:29,130
I'm going to talk about essentially two topics, hijacking of mobile phones in different ways and also voicemail hacking, getting access to your or somebody else's voicemail with the provider in question that you are using.

12
00:01:29,810 --> 00:01:31,970
And why am I talking about this?

13
00:01:31,970 --> 00:01:35,290
Well, my interest is in passwords and digital authentication.

14
00:01:35,710 --> 00:01:44,930
And in some cases, we have stuff like two-factor authentication, which is, you know, everybody is talking about now, you should be using two-factor authentication.

15
00:01:45,030 --> 00:01:46,310
I agree.

16
00:01:46,310 --> 00:01:52,650
But in a lot of cases, people are using their mobile phones to do exactly this.

17
00:01:52,770 --> 00:02:04,930
In fact, you know, you are using two-factor authentication using text messages, maybe email, which more and more people are probably using on their phones or iPads anyway.

18
00:02:05,290 --> 00:02:09,310
There can be also voice-based SMS two-factor authentication.

19
00:02:09,530 --> 00:02:17,930
You have in-app push messages, you have TOTP authenticator apps, Google Authenticator is probably the most common one.

20
00:02:17,930 --> 00:02:28,230
And of course, maybe you're using WebAuthn as well, either through a hardware key or maybe you have it integrated in your operating system like Android has today.

21
00:02:30,250 --> 00:02:45,680
And if I want to hack into your account somewhere and you are using two-factor authentication, two-factor authentication, well, it doesn't actually block me from hacking your account.

22
00:02:45,680 --> 00:02:47,860
It makes it more difficult.

23
00:02:47,920 --> 00:02:57,940
But the only thing that is certain in life are death and taxes and everything else can be hacked and probably will be sooner or later.

24
00:02:58,280 --> 00:03:11,340
So mobile hijacking, something that came up to me many, many years ago when we saw sort of like two-factor authentication by SMS coming in as a thing that some were using.

25
00:03:11,340 --> 00:03:14,900
And I got curious, well, how can I bypass this?

26
00:03:14,900 --> 00:03:16,360
How can I hack it?

27
00:03:16,360 --> 00:03:17,840
And so on.

28
00:03:18,880 --> 00:03:40,220
So seven years ago, actually, the Norwegian Government Agency for Financial Supervision and Regulation, they issued their annual report about the financial market in Norway with lots of interesting information to some nerds, including losses due to like skimming,

29
00:03:40,220 --> 00:03:46,400
fiscal card skimming, and also online banking attacks as an example.

30
00:03:46,940 --> 00:03:57,400
And they said, and this is 2013, they did say that they were expecting a rapid increase in mobile hacking.

31
00:03:57,400 --> 00:04:20,160
And they said that they were cautious and they were concerned about the fact that people were starting to have their entire digital life, including banks, including passport information, your money, and your digital life on your phone, and you would be carrying your phone with you all the time.

32
00:04:21,100 --> 00:04:36,280
And it was, you know, I'm sort of willing to say that they were basically ahead of their time, at least for Norway, where I live, because did we see any, you know, sudden increase in mobile hacking in 2013?

33
00:04:37,560 --> 00:04:38,700
Not really.

34
00:04:38,700 --> 00:04:42,680
And it also depends on what kind of mobile hacking are we talking about.

35
00:04:42,880 --> 00:04:47,120
Now, here's a typical example that you have probably seen.

36
00:04:47,120 --> 00:04:50,520
Now, the message here is a text message received in Norwegian.

37
00:04:50,760 --> 00:04:57,300
And the simple translation is, you know, we could not invoice your membership for this month.

38
00:04:57,300 --> 00:05:01,060
Try again or update your payment details in order to continue watching Netflix.

39
00:05:01,220 --> 00:05:05,280
And there's a totally legit link down below that you're supposed to click.

40
00:05:05,800 --> 00:05:16,340
Now, I was actually sitting on my couch in my living room and watching Netflix with a woman next to me on a Saturday evening.

41
00:05:16,800 --> 00:05:24,520
And, you know, we had turned down the... but I had turned down the lights and we had some... we had some chips and we had some food and we, you know, enjoying a good movie.

42
00:05:24,660 --> 00:05:27,520
And then suddenly it says ping in her phone.

43
00:05:27,520 --> 00:05:30,660
And politely, of course, I stop Netflix and I look away.

44
00:05:30,660 --> 00:05:34,440
And she's typing and she's typing and she's typing even more on her phone.

45
00:05:34,440 --> 00:05:38,520
And I'm, well, I'm sort of getting curious about, you know, what happened now.

46
00:05:38,860 --> 00:05:47,040
And then she suddenly asks me, is it common that Netflix asks for your social security number?

47
00:05:47,300 --> 00:05:53,700
And that's the moment when I turn on the lights and turn off the TV and said, hey, love's gotta wait.

48
00:05:53,700 --> 00:05:56,520
We do have a security problem at hand.

49
00:05:56,520 --> 00:05:57,940
Give me your phone.

50
00:05:59,040 --> 00:05:59,720
And I got it.

51
00:05:59,720 --> 00:06:03,700
And this is, this is the text message that I saw on screen.

52
00:06:03,700 --> 00:06:08,040
And I say, well, you have probably already given away your username and your password.

53
00:06:08,040 --> 00:06:11,380
So now we have to change that for Netflix.

54
00:06:11,520 --> 00:06:12,600
Simple scam.

55
00:06:12,600 --> 00:06:16,240
A lot of people, lots of people fall victim to this one.

56
00:06:16,280 --> 00:06:18,040
But it's the big thing.

57
00:06:18,520 --> 00:06:21,140
Well, monetary wise, I don't know.

58
00:06:21,140 --> 00:06:23,500
Is it a threat to society?

59
00:06:24,160 --> 00:06:25,940
No, not really.

60
00:06:27,000 --> 00:06:32,040
But we have also had other and more, should I say, interesting cases in here in Norway.

61
00:06:32,040 --> 00:06:43,220
As an example, we had a minister in the government who actually went on a holiday trip to Iran with his new Iranian girlfriend.

62
00:06:43,580 --> 00:06:50,400
And when you are a minister, you know, you should be sort of careful of that, at least in the current political climate.

63
00:06:50,660 --> 00:06:54,440
And he did travel and he did not tell the secret police.

64
00:06:54,440 --> 00:06:57,840
He didn't tell any intelligence services or lifeguards.

65
00:06:57,840 --> 00:07:00,340
He didn't tell the prime minister or anyone else.

66
00:07:00,340 --> 00:07:02,700
He just went for it.

67
00:07:02,780 --> 00:07:04,560
And that's a big no-no.

68
00:07:04,740 --> 00:07:10,760
And when he came back, back, one of the statements that he issued was pretty amazing.

69
00:07:10,760 --> 00:07:14,240
He said that, you know, he had been, you know, traveling before.

70
00:07:14,240 --> 00:07:16,980
He knew his stuff when it comes to security.

71
00:07:16,980 --> 00:07:26,760
So he said that his phone was secure because most of the time it was turned off and was just left in the hotel room in Iran.

72
00:07:27,200 --> 00:07:37,540
Now, this and a lot more about, you know, this person and in this case led to the simple fact he was forced to resign from his position.

73
00:07:39,830 --> 00:07:50,410
Now, for mobile hijacking, I will be talking about port-out attacks, which I have chosen to call them, and to differentiate that a little bit from sim-swap attacks.

74
00:07:50,490 --> 00:08:03,750
And I will also talk about spoofing, the sort of the thing of, you know, what can you do when you are trying to pretend to be somebody else, or if you actually succeed in becoming somebody else.

75
00:08:03,970 --> 00:08:13,990
There is also traditional fraud involved in mobile hijacking as something as simple as having an insider issuing a sim card for you in the wrong name and so on.

76
00:08:13,990 --> 00:08:16,030
I will not be talking about that.

77
00:08:17,870 --> 00:08:24,110
Port-out attacks are the simple process of transferring a phone number to another operator.

78
00:08:24,110 --> 00:08:27,150
That is one of the things you can do in Norway.

79
00:08:27,150 --> 00:08:32,030
You don't have to change your number, you can transfer it freely to any operator you want to.

80
00:08:32,850 --> 00:08:51,730
And when I started working for my current employer three years ago, I came to, you know, for my first workday on August 1st, and I have been a customer of one telecom provider, Telenor, since basically the dawn of time, more or less.

81
00:08:52,310 --> 00:09:05,710
And my employer said, you know, just give us your name and your phone number, and, you know, we'll take care of porting it to the new provider that we are using, we will be paying for your phone subscription, period.

82
00:09:06,210 --> 00:09:10,950
And I was like, you just need my name and my phone number?

83
00:09:10,950 --> 00:09:12,250
Yeah, that's it.

84
00:09:12,250 --> 00:09:17,550
So I said, well, it's Peter Horsheim, and my phone number is da-da-da-da-da.

85
00:09:17,550 --> 00:09:33,750
And by the way, phone numbers are by default public available to anyone in Norway, unless you specifically say, I do not want my number listed, or eventually also I want a secret phone number, there's a difference there.

86
00:09:36,650 --> 00:09:57,170
And my employer just sent an email to their telco saying that we want to transfer the subscription for Pears phone, current phone, this is the name, this is the phone number, and we want to port that out and over to your service, and we want it done as soon as possible,

87
00:09:57,170 --> 00:09:58,550
by email.

88
00:09:58,910 --> 00:10:11,490
And I got handed a new SIM card and envelope at work, and then I was told that, and this was on a Tuesday, and I was told that the port out will happen on Friday, midday noon.

89
00:10:12,470 --> 00:10:20,710
The porting actually happened on Thursday, 124 hours before it was supposed to happen, it happened at 12 o'clock.

90
00:10:20,810 --> 00:10:30,610
So suddenly my phone stopped working, and I had to take out the current SIM card and insert a new card from the new provider I had been given at work.

91
00:10:30,610 --> 00:10:49,470
And this means that there was a time window of approximately 48 hours, maybe even less, where I would have to sort of detect that something is wrong, understand what is actually happening right now, and then act before it would be too late.

92
00:10:50,430 --> 00:11:09,510
And not only that, I have also been told, without being told the exact time frames, I have been told that you can ask these telecom operators as well to do a very quick port of your number, and then it will probably happen in a few hours.

93
00:11:11,670 --> 00:11:34,250
And not only was this process going faster than expected, it happened in 48 hours or less, but for me to be able to understand, you know, if somebody initiated that without asking me or telling me at all, these are the two text messages that I would have to understand and react upon before it was too late.

94
00:11:34,270 --> 00:11:39,470
The first text message came from my current provider, which was Telenor.

95
00:11:39,570 --> 00:11:55,390
In Norwegian it says, you know, thank you for being a customer with us, sorry to see you go, and here's a questionnaire with an HTTP link, unencrypted link, where they just want to ask me a single question about, you know, why did I leave or would I like to come back again.

96
00:11:55,690 --> 00:12:03,070
And from my new phone provider, selected by my employer, I also got a text message.

97
00:12:03,090 --> 00:12:15,110
Interesting fact number one, the sender number is an invalid phone number, it's not possible to respond back to the number 470-5050, as you can see on the slide.

98
00:12:15,370 --> 00:12:23,290
And it says, welcome to Telia, which is the name of the operator, and your phone number is now transferred to us, have a nice day, best regards, Telia.

99
00:12:23,290 --> 00:12:24,170
That's it.

100
00:12:24,750 --> 00:12:35,550
And I'm just imagining my own mother receiving these two text messages, and I am very certain that she would not really understand what's happening here.

101
00:12:35,690 --> 00:12:45,530
And I'm not sure if she would actually call either of these two operators in time to understand what just happened.

102
00:12:48,730 --> 00:13:09,590
And one of the things that I did as part of this, because I've been working for several years looking into, you know, this issue of sort of like being able to hijack somebody's phone number through social engineering and so on, and I talked to the largest financial newspaper in Norway,

103
00:13:09,590 --> 00:13:25,230
dug a snag sleeve about this when I was sort of ready and said, I have some theories, I have some facts, but I need to be careful not to step over, you know, the red line on what is legal and what is illegal to do.

104
00:13:25,230 --> 00:13:36,750
But you are a newspaper, so you can sort of defend doing things that might be considered shady, because you are sort of working for the public and you should look into this.

105
00:13:36,750 --> 00:13:38,010
So they did.

106
00:13:38,090 --> 00:13:49,150
And they actually made an agreement with one of the most famous bloggers that we have in Norway, Sofie Elisa, and they asked her, would it be okay for us to try to sort of hijack your phone number?

107
00:13:49,150 --> 00:13:50,870
And she agreed to that.

108
00:13:50,970 --> 00:13:55,250
And the newspaper actually has a video online that you can watch for free.

109
00:13:55,250 --> 00:14:15,310
It's like three minutes long, where a female reporter from the newspaper that looks nothing like this blogger she goes out on the street to a couple of sales people from a phone company, and she hands over a business card that is fake.

110
00:14:15,310 --> 00:14:18,410
Obviously, she printed it on her own printer.

111
00:14:18,410 --> 00:14:24,630
And she says, I'm Sofie Elisa and I would like to port my number over to you.

112
00:14:24,630 --> 00:14:32,190
And with the fake business card only, they accept that as a valid ID and initiates the process.

113
00:14:32,490 --> 00:14:37,870
And the newspaper and of course, Sofie Elisa, they were shocked that, is it that easy?

114
00:14:38,310 --> 00:14:41,010
You know, you can affect business cards really.

115
00:14:42,210 --> 00:14:45,290
This was scary and was scary to me, was scary to the newspaper.

116
00:14:45,290 --> 00:14:50,270
It was very scary to everyone to be precise.

117
00:14:51,790 --> 00:14:58,550
Now for SimSwap, I know that SimSwap is the standard term to use, especially in the US on these things.

118
00:14:58,590 --> 00:15:06,430
And I wanted to make a difference between what I call mobile hijacking and SimSwap attacks or port out and SimSwap attacks here.

119
00:15:06,810 --> 00:15:16,810
SimSwap to me is the same as in the US, you will get new SIM cards for a specific subscription for a specific phone number.

120
00:15:17,310 --> 00:15:19,490
I don't know if you can do this in the US.

121
00:15:19,490 --> 00:15:22,510
I don't know if you can do this in Sweden or for that matter.

122
00:15:22,570 --> 00:15:31,270
But at least in Norway, as part of your current service with your phone company, you can get the new SIM card and you don't need any sort of valid reason.

123
00:15:31,270 --> 00:15:34,370
You can just say, I want a new SIM card and you will get one.

124
00:15:34,430 --> 00:15:36,730
You can also get the twin SIM card.

125
00:15:36,730 --> 00:15:40,090
So you can have two phones that are essentially the same.

126
00:15:40,090 --> 00:15:43,570
So if somebody calls you, it will ring in both phones.

127
00:15:43,730 --> 00:15:55,750
And you can also get a data SIM card that, you know, given the name, you can not use it for making or accepting phone calls in or out, but you can use it for data traffic only.

128
00:15:55,750 --> 00:16:04,690
And you can get a specific data SIM card for your existing service subscription with all the operators, to the best of my knowledge.

129
00:16:06,330 --> 00:16:08,710
And the same thing applies here.

130
00:16:08,710 --> 00:16:26,210
Fake ID will probably get you one of these SIM cards that will also, given the circumstances, you will also be able to do sort of full or at least limited sort of surveillance of whatever victim you are targeting.

131
00:16:27,970 --> 00:16:35,070
So it became very obvious to us that we have a problem with identifying people.

132
00:16:35,070 --> 00:16:40,910
And we also have a problem in a business to business relationship and in general with authorization.

133
00:16:41,410 --> 00:16:57,290
If you are not ordering or changing a phone subscription for yourself, but for somebody else, how do we identify and how do we find out whether you're authorized to make those changes on behalf of another person?

134
00:16:57,330 --> 00:17:00,310
Obviously, there was a problem with this.

135
00:17:00,670 --> 00:17:15,410
One of the revelations made by the newspaper was that the telecom operator Telia, which is working out of many different countries, it's home base is in Sweden.

136
00:17:16,130 --> 00:17:37,290
They found out that in Sweden, the government requires Telia to ask for proper ID when you are setting up, terminating or changing or moving a phone subscription, like passport or something, digital ID, which is government approved.

137
00:17:37,970 --> 00:17:43,590
Now, Telia also operates in Norway, and we also have digital identities in Norway called Bank ID.

138
00:17:44,190 --> 00:17:49,690
And in Sweden, they are using Bank ID to identify their customers.

139
00:17:49,750 --> 00:17:51,910
So it was a pretty easy question.

140
00:17:51,910 --> 00:17:56,650
Are you using Bank ID or something similar in Norway as well?

141
00:17:56,650 --> 00:17:59,970
And Telia, they responded, no, we don't do that.

142
00:18:00,270 --> 00:18:04,010
And when the question came up, why don't you do that?

143
00:18:04,010 --> 00:18:11,910
The answer to the question was saying that we do as we are required to do by the government in Norway.

144
00:18:12,290 --> 00:18:30,350
And the answer to that, again, is the government in Norway didn't require the telephone operators to ask for any kind of solid ID, being it on paper, like passport or driver's license, or a digital version of a digital ID.

145
00:18:30,770 --> 00:18:32,990
Again, a big surprise.

146
00:18:33,730 --> 00:18:48,050
So I looked to the Federal Trade Commission in the US, more specifically to Lori Cranor, who is normally a professor at Carnegie Mellon University, and she wrote several articles on the Federal Trade Commission website.

147
00:18:48,130 --> 00:18:54,650
One where she talks about how she got her phone hijacked through a SimSwap attack.

148
00:18:54,790 --> 00:18:57,930
It's an interesting article, it's definitely worth reading.

149
00:18:57,930 --> 00:19:07,810
And one of the things she did was to ask all the major mobile carriers in the US what consumers could do to protect themselves from a mobile account takeover.

150
00:19:08,330 --> 00:19:16,670
One of the most important steps you can take is to establish a password or PIN that is required before making changes to your mobile account.

151
00:19:16,670 --> 00:19:22,570
Each of the carriers offers this feature to the customers in a slightly different way.

152
00:19:23,270 --> 00:19:39,190
And this was sort of good, I mean, social engineering, PIN guessing, and so on, can probably still get past this, but at least it's one more speed bump for the bad actors to try to hijack your number and do a SimSwap attack.

153
00:19:39,350 --> 00:19:46,970
But interestingly, none of the providers in Norway had any feature like this at all in place.

154
00:19:47,130 --> 00:19:53,130
And to the best of my knowledge, they are still working on figuring out how to do this in Norway.

155
00:19:54,670 --> 00:20:13,230
So as a result of this, or one of many results out of this process, which, you know, culminated in the spring of 2019, that means last year, is our Minister of Digitalization at the time, Nikolai Astrup, he instructed the Norwegian Communications Authority,

156
00:20:13,230 --> 00:20:22,230
NKOM, to implement security functions in order to prevent mobile hijacking in cooperation with the telecom sector.

157
00:20:22,230 --> 00:20:31,010
That is a pretty serious move to do when you instruct them to work on this immediately.

158
00:20:32,150 --> 00:20:53,690
And not only that, but also in September 2019, the government also released a hearing named Actions to Prevent Mobile Hijacking, as a direct consequence of the stories made by Dagens Næringsliv and by me earlier in the spring.

159
00:20:53,690 --> 00:21:08,930
This came out and there was a hearing process until December 2019, where, you know, everybody, government organizations and private people, could then give their input on the proposal for changing changes to the existing law.

160
00:21:09,050 --> 00:21:18,610
Now, this hasn't passed into law yet, but we are sort of waiting for the results from the hearings to see what's going to happen next.

161
00:21:21,790 --> 00:21:38,470
And also, while working with this on my own, and together with Dagens Næringsliv, I was not aware that a news website for the IT and security industry in Denmark, were also looking into the same thing, more or less, in Denmark with different providers.

162
00:21:38,490 --> 00:21:46,590
Simply, social engineering into stores selling SIM cards, making replacement SIM cards, and so on.

163
00:21:47,310 --> 00:21:51,450
And they succeeded many, many times.

164
00:21:51,590 --> 00:22:06,370
And, you know, they posted this article, among many others, saying that after multiple failures, telcos are actually considering to completely stop handing out SIM cards in physical stores.

165
00:22:07,070 --> 00:22:11,950
Now, Norway is next to Sweden, next to Denmark, and next to Finland.

166
00:22:11,950 --> 00:22:12,770
They are neighbours.

167
00:22:12,770 --> 00:22:18,670
And we are very much alike in society, in law, in language, and so on.

168
00:22:19,170 --> 00:22:38,270
But one of the things that has been fascinating to me is to see the different reactions from the telcos, from newspapers, from, you know, normal people like you and me on the streets, and from politicians, on how they have reacted to these stories in the media.

169
00:22:38,510 --> 00:22:50,790
Because stopping completely to hand out SIM cards in physical stores, haven't even been mentioned by anyone in Norway or in Sweden at all.

170
00:22:51,150 --> 00:22:57,790
But it is pretty much the same operators working in these three countries.

171
00:22:57,790 --> 00:23:04,270
So it's kind of like, are you people not even talking to each other internally in the same company?

172
00:23:04,270 --> 00:23:06,430
Or what is happening here?

173
00:23:09,030 --> 00:23:20,310
So to sort of more better and better exemplify the problem of spoofing, I say, what if I could be you as a bad actor?

174
00:23:20,310 --> 00:23:22,270
Now, this is Crypto and Privacy Village.

175
00:23:22,270 --> 00:23:25,010
You know, we have had lots of talks on this.

176
00:23:25,030 --> 00:23:29,610
You are most probably watching EFF closely.

177
00:23:29,610 --> 00:23:34,750
You are watching what is happening in your country right now in terms of privacy.

178
00:23:34,750 --> 00:23:38,250
It doesn't look good in quite a few places all over the world.

179
00:23:38,630 --> 00:23:53,390
Now, in Norway, we do consider ourselves, you know, a very safe, solid, democratic country with a government that, you know, well, we trust our government, believe it or not.

180
00:23:53,890 --> 00:23:58,310
But still, there are cases where things are happening.

181
00:23:58,310 --> 00:24:06,990
Now, this one is an article or series of articles that were released in the fall of 2019, Chasing Max.

182
00:24:07,330 --> 00:24:12,650
And this is about a guy that has been caught by the police.

183
00:24:12,650 --> 00:24:32,870
And he is charged for hacking the accounts of approximately 50 different random women around the country, extracting pictures, videos, contact details, harvesting usernames and passwords, gaining access to Instagram, Facebook, and so on.

184
00:24:32,870 --> 00:24:37,150
50 women randomly all over Norway.

185
00:24:37,950 --> 00:24:41,550
And the newspaper told us a story about Nina.

186
00:24:42,470 --> 00:24:43,730
Nina was smart.

187
00:24:43,730 --> 00:24:58,170
Nina was using two-factor authentication, SMS-based two-factor authentication for her phone account, for Facebook, for Google, for Apple, and so on.

188
00:24:58,170 --> 00:25:14,110
And she woke up one morning with a picture like this, where she had received authorization codes from different services, like Microsoft, like Google, like Apple, in order to do a password reset.

189
00:25:14,710 --> 00:25:19,270
And she had lost access to a lot of her accounts.

190
00:25:19,370 --> 00:25:25,370
And she really couldn't understand how did this happen, because I was using two-factor authentication.

191
00:25:26,210 --> 00:25:30,550
And lots of people say that, well, if you have two-factor authentication, you're secure, right?

192
00:25:30,770 --> 00:25:31,850
Wrong.

193
00:25:33,290 --> 00:25:47,850
What they actually found out in this particular case is that Nina was using Telia, one of the telecom providers in Norway, and they had a service called SMS Copy.

194
00:25:48,390 --> 00:26:12,450
You could log on to their web page, like, you know, my page, and you could configure the SMS Copy service, which is essentially a message service, so that if you receive a text message to your phone, Telia will also silently forward that text message either to another phone number or send it to an email address.

195
00:26:12,590 --> 00:26:15,870
You know, what could possibly go wrong with this?

196
00:26:17,650 --> 00:26:31,210
And in order to get access to the my page at Telia, you needed a username and a password, and they did not offer any kind of two-factor authentication at all.

197
00:26:31,650 --> 00:26:42,950
So what this bad guy did, who is now being prosecuted by the police, he went to that page and tried to log in with a lot of different usernames and passwords.

198
00:26:42,950 --> 00:26:45,850
And as we know, people are reusing passwords.

199
00:26:45,850 --> 00:26:52,310
And I suspect that he got in through credential stuffing or online password spraying.

200
00:26:53,130 --> 00:27:09,830
And by getting in there, he could configure the SMS Copy service, he could order a password reset from different services, and although Nina received the messages, she received them in the middle of the night when she was sleeping, and he was up and he received the same messages,

201
00:27:09,830 --> 00:27:14,430
and by that he gained access to all the accounts of these women.

202
00:27:17,590 --> 00:27:35,890
And that, I think, serves as a really hard and scary example of what the possible consequences can be if you don't have secured your entire chain with two-factor authentication or something else.

203
00:27:36,890 --> 00:27:44,720
Two-factor authentication can be bypassed in so many different settings and scenarios.

204
00:27:46,490 --> 00:27:53,310
Now, this was about hijacking your phone number and receiving your text messages and so on.

205
00:27:54,310 --> 00:27:58,090
But I've also been looking into voicemail hacking.

206
00:27:58,090 --> 00:28:22,310
And this goes back again to the title of Paris Hilton, because all the way back in 2006, there was a lot of articles around the world saying that Paris Hilton and Lindsay Lohan had got into a sort of a disagreement, and they were trying to hack each other's phone numbers,

207
00:28:22,310 --> 00:28:27,530
spread them online, and also gain access to each other's voicemail boxes.

208
00:28:27,790 --> 00:28:34,190
And the story is, to the best of my knowledge, is that Paris Hilton gained access to the voicemail box of Lindsay Lohan.

209
00:28:34,630 --> 00:28:41,410
And in even mainstream Norwegian media, this was mentioned on August 27, 2006.

210
00:28:41,510 --> 00:28:52,610
And not only did they mention this happening, they also actually mentioned the specific service that Paris Hilton had been using to do this.

211
00:28:53,830 --> 00:28:59,950
Now, if you Google voicemail hacking, you will find interesting results.

212
00:28:59,950 --> 00:29:15,530
One of them is a talk that has been presented at DEF CON before, that also includes a tool that you can use for some services with voicemail, where you can try to basically brute force the PIN code to get into the voicemail boxes.

213
00:29:15,530 --> 00:29:25,310
Some voicemail boxes will have a four-digit PIN, three digits, five, six digits that are randomly selected and provided by the telco to the user.

214
00:29:25,570 --> 00:29:31,610
Other telecom providers may allow you to select your own PIN.

215
00:29:31,710 --> 00:29:45,330
One of the things we know from PIN code research is that as soon as you allow users to select their own PIN code, those PIN codes are not going to be any good at all, in pretty much all cases.

216
00:29:46,630 --> 00:30:08,190
And there was also, back in 10 years ago, there was also a large scandal with News of the World in the UK, where the British royal family got their phones and their voicemail hacked by reporters that were able to extract messages that were, you know, most definitely not meant for the public to listen into.

217
00:30:08,590 --> 00:30:19,850
This was a big scandal, and also in this case, the suspicion was targeted against the same service as Paris Hilton had been using several years earlier.

218
00:30:21,830 --> 00:30:25,770
Now, this is probably a picture that you have seen before.

219
00:30:25,950 --> 00:30:30,770
In order to do a password reset at Microsoft, you have several different options.

220
00:30:30,770 --> 00:30:41,090
You can have an email sent to you with a link that you need to click to gain access, or you can also ask to use an authentication app if you have a TOTP app installed.

221
00:30:41,170 --> 00:30:44,050
And you can also have an SMS sent to you.

222
00:30:44,050 --> 00:30:50,230
So there, you know, with SMS, you already see one problem with the SMS copy service.

223
00:30:50,590 --> 00:31:05,050
But there are also services where, you know, to do a password reset and so on, you can also ask the service provider to give you a robot call and to read the PIN code for you out loud.

224
00:31:05,470 --> 00:31:26,210
So one of the things I was curious about is, hmm, can I initiate a password reset for someone online and ask that service to make a phone call and just, well, go directly to voicemail and enter that PIN code into the voicemail box, so I can get access afterwards,

225
00:31:26,210 --> 00:31:29,470
listen to the code and use it to get access to an account.

226
00:31:29,470 --> 00:31:30,950
Interesting experiment.

227
00:31:31,770 --> 00:31:34,550
So, you know, let's hack.

228
00:31:35,010 --> 00:31:41,510
And what I did, I used the same service as Paris Hilton from 2006, which is called Spoof Card.

229
00:31:41,510 --> 00:31:47,630
They are still operational today, and they are still doing their fancy little tricks today.

230
00:31:47,630 --> 00:31:51,990
But of course, they do say that this service is to protect your privacy.

231
00:31:51,990 --> 00:31:56,430
And you should, of course, not use this for any kind of legal purposes.

232
00:31:57,130 --> 00:31:58,410
So I did.

233
00:31:59,010 --> 00:32:03,270
And the case number one was Telenor, the biggest telco in Norway.

234
00:32:03,630 --> 00:32:07,670
I managed to get access to people's voicemail.

235
00:32:07,670 --> 00:32:10,570
Of course, I did this under a responsible disclosure.

236
00:32:10,610 --> 00:32:18,230
And I also talked to my potential victims, friends, family and others, co-workers, and asked them, can I try this?

237
00:32:18,230 --> 00:32:20,550
And if you want to listen in, you can do that.

238
00:32:20,550 --> 00:32:32,490
I showed them how I could very easily use Spoof Card to get access to their voicemail, listen to the messages, delete them, and also change the welcoming message for the voicemail.

239
00:32:32,770 --> 00:32:38,250
I told Telenor about this on a Tuesday and on the Thursday they had fixed it.

240
00:32:38,250 --> 00:32:42,270
So in less than 48 hours, which is really, really good.

241
00:32:43,830 --> 00:33:06,130
They also, of course, after, you know, fixing this, there was a media article and they said that they were sorry for this and they acknowledged that this vulnerability had probably been available for use and abuse for 13 years or more, you know, dating all the way back to the Paris Hilton incident.

242
00:33:06,550 --> 00:33:08,510
13 years.

243
00:33:09,170 --> 00:33:21,810
An interesting thing is, this specific service, Spoof Card, was mentioned all the way back in 2006 in Norwegian mainstream media.

244
00:33:21,810 --> 00:33:31,570
But when Telenor was informed about this in November 2019, they said, never heard of it.

245
00:33:31,570 --> 00:33:37,650
Which is, well, I mean, you don't have to read mainstream media, do you?

246
00:33:37,650 --> 00:33:44,090
But in this case, I was a bit, well, surprised.

247
00:33:45,390 --> 00:34:10,770
And as a consequence of my findings in this, the Norwegian government agency that are overseeing the telecom industry in Norway, they chose to issue a fine of 1.5 million Norwegian kroner, that is equivalent of 165,000 US dollars today, as a fine because they didn't have sufficient security for the voicemail system.

248
00:34:10,950 --> 00:34:20,090
And depending on the country you're in, if you're in the US, I would guess a fine of 165,000 US dollars doesn't sound much.

249
00:34:20,090 --> 00:34:26,070
In Norway, to the company, it's pocket change, not even that.

250
00:34:26,070 --> 00:34:34,290
But it is very, very rare that any company is being given any fine at all by this government agency.

251
00:34:34,290 --> 00:34:40,230
So that sort of underlines the seriousness of this security breach.

252
00:34:40,230 --> 00:34:55,850
And also our Norwegian data protection agency, they also issued a reprimand to Telenor saying that this is really not good, and you have basically violated two different GDPR articles on this.

253
00:34:55,850 --> 00:35:02,810
But since you have already been fined once, we are not going to slap another fine on top of that.

254
00:35:02,810 --> 00:35:06,590
That's usually not how it's being done here in Norway.

255
00:35:07,970 --> 00:35:14,970
And there's case number two, because I asked friends in other countries as well, can I try to hack your voicemail box?

256
00:35:15,110 --> 00:35:28,530
So with Telia in Denmark, the version two news website in Denmark, they tried this out on my behalf, and they found that this works.

257
00:35:28,530 --> 00:35:30,090
I approved it for them.

258
00:35:30,090 --> 00:35:44,580
I talked directly to Telia, they fixed it, and they also ended up in the news saying that this is a big scandal, and it's not just in Denmark, it also applies to other providers in Norway and in Sweden.

259
00:35:48,070 --> 00:35:57,990
And kind of fascinating that version two even have an article saying that Telia is now considering better voicemail security.

260
00:35:57,990 --> 00:36:03,610
So I'm sort of waiting to see what's going to happen there, but hopefully it has already improved.

261
00:36:04,550 --> 00:36:11,150
Case number three is Tele2, which is the third provider that I found vulnerable in this.

262
00:36:11,150 --> 00:36:14,730
Based in Sweden, they operate in eight different countries.

263
00:36:14,730 --> 00:36:18,370
I tested against voicemail boxes of people in Sweden.

264
00:36:18,370 --> 00:36:19,810
I found them to be vulnerable.

265
00:36:19,810 --> 00:36:22,030
I got access to their voicemail.

266
00:36:22,470 --> 00:36:35,550
I do not know about the, you know, hackability of Tele2 voicemail boxes in other countries where they operate, because I didn't test, but Tele2 says, nope, they are not vulnerable.

267
00:36:35,550 --> 00:36:39,070
So hopefully that's true.

268
00:36:40,110 --> 00:36:45,350
At least, again, this also led to media attention in Sweden.

269
00:36:45,390 --> 00:36:55,270
Again, back to, you know, my fascination of the different ways of how this was handled, or wasn't handled at all in the different countries.

270
00:36:55,270 --> 00:36:58,450
In Norway, there was a lot of media attention on this.

271
00:36:58,450 --> 00:37:00,270
Mainstream media picked it up.

272
00:37:00,270 --> 00:37:01,650
There have been issued a fine.

273
00:37:01,650 --> 00:37:06,290
There have been issued a reprimand by the Data Protection Agency of Norway.

274
00:37:06,610 --> 00:37:20,870
In Denmark, there have been a little bit of media attention, but politicians have said, well, the problem is fixed, so there's nothing left for us to do, and we'll just leave it to the telecom providers to, you know, they have to talk to each other and figure out what to do.

275
00:37:20,870 --> 00:37:22,170
And that's it.

276
00:37:23,170 --> 00:37:28,790
And in Sweden, pretty much nothing has happened at all so far.

277
00:37:29,110 --> 00:37:38,490
In fact, there were one or I think it was two or three articles in total about this, and then it went completely quiet.

278
00:37:39,030 --> 00:37:53,350
But all in all, I found that several million people across Norway, Sweden and Denmark were affected by this, and have most probably been affected for 13 years or more.

279
00:37:53,350 --> 00:38:01,070
At the same time, the telecom providers, they have logs that maybe go back two, three or four weeks in time.

280
00:38:01,090 --> 00:38:10,950
So proving or disproving that this hasn't been hacked and abused by anyone for the past 13 years is completely impossible.

281
00:38:11,350 --> 00:38:19,830
So they have concluded that, well, since we haven't heard anyone complain about it, nobody has probably been hacked.

282
00:38:20,090 --> 00:38:23,330
And there's nothing we can do about that.

283
00:38:25,530 --> 00:38:43,870
So I just want to say that, you know, this is sort of still a work in progress, but I would really, really, you know, recommend you to listen in on the talk from Kelly Robinson on Sunday here at the Crypto and Privacy Village, where she will be talking about Stör shaken.

284
00:38:43,930 --> 00:38:47,230
Not saying anything more than that, just listening to that talk.

285
00:38:47,230 --> 00:38:50,110
And by that, we have reached the end.

286
00:38:50,110 --> 00:38:51,390
And I say, thank you.

287
00:38:51,390 --> 00:38:56,230
And I am ready for your questions now, or you can contact me later.

288
00:38:56,230 --> 00:39:00,730
You have my cryptic contact details here on screen.

289
00:39:00,790 --> 00:39:02,410
Thank you.

290
00:39:20,940 --> 00:39:24,540
Not saying anything more than that, just listening to that talk.

291
00:39:24,800 --> 00:39:29,020
And by that, we have reached the end and I say, thank you.

292
00:39:29,020 --> 00:39:33,840
And I am ready for your questions now, or you can contact me later.

293
00:39:33,840 --> 00:39:40,480
That was the talk, Hacking Like Paris Hilton 14 Years Later and Still Winning, by Pear.

294
00:39:44,570 --> 00:39:50,770
We have them here for our live Q&A, so please put your questions in the Discord CPV Q&A channel.

295
00:39:52,150 --> 00:40:00,090
So Pear, one of the first questions we have is, in the USA, many carriers use the phone number as a default PIN.

296
00:40:00,090 --> 00:40:07,770
So if you spoof the number and call as voicemail, you can access it using the phone number as the default PIN, if the user didn't change it, and a lot of people don't.

297
00:40:07,770 --> 00:40:10,330
Is that the same outside the US of other carriers?

298
00:40:10,670 --> 00:40:15,670
Well, I can say for sure that at least that's not what we have.

299
00:40:17,190 --> 00:40:19,110
That's not what we have here in Norway.

300
00:40:19,110 --> 00:40:29,090
I haven't seen this in Sweden or Denmark, but I really can't answer for all telecom providers in all the countries outside the US.

301
00:40:29,090 --> 00:40:30,890
That's impossible to do.

302
00:40:30,890 --> 00:40:50,250
But I do have my suspicions that you will find a lot of bad security connected to both voicemail accounts, and also in general, the accounts where you can log in on your telco homepage for, in any way, administrating your subscription with that.

303
00:40:51,410 --> 00:40:52,090
Awesome.

304
00:40:52,090 --> 00:40:53,550
Thank you so much for that.

305
00:40:54,650 --> 00:41:00,710
In your ideal world, what would you like to see exist in place of the current available options that we do have?

306
00:41:01,450 --> 00:41:06,190
Well, there are many facets to this.

307
00:41:06,190 --> 00:41:22,410
And one of the things that I pointed out early in my presentation is starting with whenever you go into a shop and say that you want a new SIM card, or if you want a data SIM card, or a twin SIM card, if you want a new subscription, if you want to change it,

308
00:41:22,410 --> 00:41:43,230
if you want to end it, to move it to another telco, and then you have the issues of logging on to your telco provider to administer your subscription there, like this SMS copy service, which is now, of course, turned off, and options like that.

309
00:41:43,230 --> 00:41:49,470
Then you also have the stuff like doing the voicemail hacking using spoofed numbers.

310
00:41:49,470 --> 00:42:04,550
Now, some of the issues are specific to each telco provider, like the absence of two-factor authentication for administrating your account.

311
00:42:04,550 --> 00:42:10,270
And then you have the security awareness training for staff on help desk, online chat, and in stores.

312
00:42:10,270 --> 00:42:22,110
But there are also problems with the basic telco networks worldwide for mobile communication using the SS7 protocol and stuff like that.

313
00:42:22,110 --> 00:42:29,430
And that is, I'm not going to say it's an unsolvable problem, but it's not up to a single telco provider to fix it.

314
00:42:29,510 --> 00:42:32,810
It's not up to a single country to fix it.

315
00:42:32,850 --> 00:42:50,130
And basically, if you are to fix the fundamental security issues that we have in the GSM networks today, all providers and makers of phones, of networking equipment, all the telcos, they have to come up with solutions.

316
00:42:50,170 --> 00:42:53,350
And you have to replace all the handsets in the world.

317
00:42:53,410 --> 00:42:55,030
And we can't do that.

318
00:42:55,030 --> 00:42:59,010
That's just impossible to expect that to basically ever happen.

319
00:42:59,090 --> 00:43:07,550
So one of the things that are coming now, which is very interesting, of course, as I said, Kelly Robinson will be talking about stir shaking.

320
00:43:07,810 --> 00:43:14,350
So I'm not going to spoil that anymore, but that's a talk that I really hope people will listen to.

321
00:43:14,530 --> 00:43:31,470
And one of the things that I'm doing as well is trying to, to the extent I can, I'm trying to pressure the Norwegian government and also the governments in Sweden and Denmark as well, together with other people, to ask the telcos to at least look into stir shaking,

322
00:43:31,470 --> 00:43:34,310
and eventually also consider, can it be implemented?

323
00:43:34,490 --> 00:43:38,450
And how can we make the rest of the world implement it as well?

324
00:43:39,210 --> 00:43:41,230
So long answer to a short question.

325
00:43:41,970 --> 00:43:43,830
Wow, that was a really great, thorough answer.

326
00:43:43,830 --> 00:43:44,850
Thank you so much.

327
00:43:45,010 --> 00:43:49,190
So another question we have is, should we just disable our voicemails then at that point?

328
00:43:49,850 --> 00:43:50,490
Oh, yeah.

329
00:43:50,490 --> 00:43:51,270
Oh, yeah.

330
00:43:51,310 --> 00:43:53,430
Disable voicemail now.

331
00:43:53,690 --> 00:44:00,710
I mean, there's absolutely no point... I can't really understand why people are using voicemail at all.

332
00:44:00,730 --> 00:44:07,330
And I was in Czech Republic last year, I think.

333
00:44:07,330 --> 00:44:18,330
And I was surprised to hear from friends in the Czech Republic that voicemail, nah, no, they don't have that with their phone subscriptions.

334
00:44:18,330 --> 00:44:24,110
And I asked around, and they couldn't think of any friends or family who had voicemail.

335
00:44:24,110 --> 00:44:32,610
In Norway, we have three companies that are providing a physical infrastructure for mobile communications.

336
00:44:32,930 --> 00:44:36,530
And then we have lots of virtual operators as well.

337
00:44:36,530 --> 00:44:43,790
And all of them, absolutely all of them, by default, provide voicemail as a part of the service.

338
00:44:43,790 --> 00:44:50,790
And there actually is no option to say, I don't want voicemail, but they do have options to turn it off.

339
00:44:51,150 --> 00:44:58,010
So one of the things I would like to see is that, you know, well, I just don't need voicemail at all.

340
00:44:58,010 --> 00:45:09,470
And I actually... I just don't pay for it either, because I can turn it off, but I'm sort of still paying for it.

341
00:45:14,090 --> 00:45:18,990
Yeah, that's actually really... huh, I did not realize that was an option in other places like that.

342
00:45:18,990 --> 00:45:19,810
Thank you.

343
00:45:20,270 --> 00:45:30,090
You kind of answered some of this question already, but someone asked, as a regular user, what can I do to protect myself, if anything, or is it completely out of my hands?

344
00:45:31,350 --> 00:45:37,250
Well, to protect yourself, you know, I'm working as a security officer for a large hotel chain.

345
00:45:37,250 --> 00:45:43,910
And of course, I've been asking my colleagues and friends about this as well, you know, what do you think about this?

346
00:45:43,910 --> 00:46:01,030
And of course, I can say, I have truly scared a lot of people by being able to sort of hack into their voicemail using a spoofed phone call, and also making phone calls that appears to be coming from your mom, or your dad, or your brother, or whoever it is.

347
00:46:01,610 --> 00:46:04,090
And they are really surprised to see that I can do that.

348
00:46:04,090 --> 00:46:06,090
So there are some things you can do.

349
00:46:06,090 --> 00:46:21,530
And the very simple thing that you can do is that whatever text message you are receiving, or the phone number, or the name that you see in the display on your phone when somebody is calling you, do not trust it.

350
00:46:21,570 --> 00:46:25,650
Because it is exceptionally easy to spoof.

351
00:46:26,670 --> 00:46:41,010
And I don't know how, you know, I don't know, you know, you're in the US, so I don't know how much people in the US in general know about phone spoofing, you know, number spoofing, and text message spoofing.

352
00:46:41,010 --> 00:46:52,890
But to people here in Norway, the vast majority of people in the IT security industry were absolutely clueless about this existing at all, when I started working with this.

353
00:46:52,890 --> 00:46:58,430
And when I did my initial presentations last year, people were shocked that this was possible.

354
00:46:58,570 --> 00:47:07,370
So as an end user, first and foremost, do not trust that the number you or the name you see in your display are correct.

355
00:47:07,370 --> 00:47:11,370
No matter who calls or texts you, do not trust it.

356
00:47:13,760 --> 00:47:18,660
As a millennial who does not pick up any phone calls at all, that's really fascinating to know about.

357
00:47:19,780 --> 00:47:21,720
Oh, yeah, you youngsters.

358
00:47:21,800 --> 00:47:23,640
Yeah, well, yeah.

359
00:47:23,640 --> 00:47:27,860
I mean, you have a completely different sort of way to protect yourself in this area.

360
00:47:27,860 --> 00:47:33,920
But I know, again, robocalls, as far as I know, is a very big problem in the US.

361
00:47:34,480 --> 00:47:38,800
It almost doesn't exist over here yet.

362
00:47:39,720 --> 00:47:45,200
Except for the operation on Microsoft is calling you to say you have a computer virus on your system.

363
00:47:45,200 --> 00:47:47,680
That's the only robocalls we get.

364
00:47:47,680 --> 00:47:52,080
And when I got one last year, I was like, yes, finally.

365
00:47:52,080 --> 00:47:53,900
So there you go.

366
00:47:54,160 --> 00:47:58,740
That is a very different reaction that I have, I think, along with other people.

367
00:47:58,740 --> 00:47:59,760
Oh, gosh.

368
00:47:59,860 --> 00:48:05,280
With that said, thank you so much again, Pear, for all of your answers to this Q&A and for your talk today.

369
00:48:05,580 --> 00:48:08,340
Please take care and enjoy the rest of your DEF CON.

370
00:48:08,500 --> 00:48:09,780
I hope you have fun.

371
00:48:10,120 --> 00:48:11,120
Thank you so much again.