start	end	text
1440	5990	Hi, my name is Per Thorsen and I am the founder of Passwords.com.
6190	10330	I'm really happy to be speaking once again at the Crypto & Privacy Village here,
10330	14950	this time at the DEF CON Safe Mode 2020 edition.
15750	23310	My talk is entitled Hacking Like Paris Hilton 14 Years Later and Still Winning.
23630	30290	And this is a talk that has been in the making for quite a few years
30290	36410	by me now. So I'm really, really happy to sort of tell the entire story on this one.
36470	44110	First, a very quick introduction of myself. Here you have a tweet a couple of years ago when I
44110	49090	said that I do have a certain interest in passwords and Cormac Hurley at Microsoft Research,
49090	55250	he responds back saying that, confirm I have a healthy curiosity while Thorsen is pathologically
55250	61670	obsessed with passwords and, well, digital authentication. So that's basically me in a
61670	69650	nutshell. Now, I do say this because for this talk it's important for me to provide a bit of
69650	75110	background and context to the stuff that I'm going to talk about. I'm going to talk about
75110	81110	essentially two topics, hijacking of mobile phones in different ways and also voicemail hacking,
81110	87930	getting access to your or somebody else's voicemail with the provider in question that
87930	94190	you are using. And why am I talking about this? Well, my interest is in passwords and digital
94190	101070	authentication. And in some cases, we have stuff like two-factor authentication, which is, you know,
101070	106310	everybody is talking about now, you should be using two-factor authentication. I agree.
106310	114170	But in a lot of cases, people are using their mobile phones to do exactly this. In fact,
114650	118510	you know, you are using two-factor authentication using text messages,
118510	124930	maybe email, which more and more people are probably using on their phones or iPads anyway.
125290	132010	There can be also voice-based SMS two-factor authentication. You have in-app push messages,
132010	137930	you have TOTP authenticator apps, Google Authenticator is probably the most common one.
137930	143070	And of course, maybe you're using WebAuthn as well, either through a hardware key or maybe
143070	150550	you have it integrated in your operating system like Android has today. And
152370	158280	if I want to hack into your account somewhere and you are using two-factor authentication,
158920	165680	two-factor authentication, well, it doesn't actually block me from hacking your account.
165680	172220	It makes it more difficult. But the only thing that is certain in life are death and taxes and
172220	180060	everything else can be hacked and probably will be sooner or later. So mobile hijacking,
180060	185040	something that came up to me many, many years ago when we saw sort of like
185800	192640	two-factor authentication by SMS coming in as a thing that some were using. And I got curious,
192640	197840	well, how can I bypass this? How can I hack it? And so on.
198880	205780	So seven years ago, actually, the Norwegian Government Agency for Financial Supervision
205780	213280	and Regulation, they issued their annual report about the financial market in Norway with lots
213280	220220	of interesting information to some nerds, including losses due to like skimming,
220220	229140	fiscal card skimming, and also online banking attacks as an example. And they said, and this
229140	238440	is 2013, they did say that they were expecting a rapid increase in mobile hacking. And they said
238440	244400	that they were cautious and they were concerned about the fact that people were starting to have
244400	252700	their entire digital life, including banks, including passport information, your money,
252700	260160	and your digital life on your phone, and you would be carrying your phone with you all the time.
261100	267220	And it was, you know, I'm sort of willing to say that they were basically ahead of their time,
267220	274560	at least for Norway, where I live, because did we see any, you know, sudden increase in mobile
274560	281700	hacking in 2013? Not really. And it also depends on what kind of mobile hacking are we talking
281700	288620	about. Now, here's a typical example that you have probably seen. Now, the message here is a
288620	295740	text message received in Norwegian. And the simple translation is, you know, we could not invoice
295740	299900	your membership for this month. Try again or update your payment details in order to continue
299900	305280	watching Netflix. And there's a totally legit link down below that you're supposed to click.
305800	309660	Now, I was actually sitting on my couch in my living room and watching Netflix
310800	318580	with a woman next to me on a Saturday evening. And, you know, we had turned down the... but I
318580	322460	had turned down the lights and we had some... we had some chips and we had some food and we,
322460	328160	you know, enjoying a good movie. And then suddenly it says ping in her phone. And politely,
328160	332600	of course, I stop Netflix and I look away. And she's typing and she's typing and she's typing
332600	338520	even more on her phone. And I'm, well, I'm sort of getting curious about, you know, what happened now.
338860	347040	And then she suddenly asks me, is it common that Netflix asks for your social security number?
347300	351920	And that's the moment when I turn on the lights and turn off the TV and said,
351920	357940	hey, love's gotta wait. We do have a security problem at hand. Give me your phone.
359040	364500	And I got it. And this is, this is the text message that I saw on screen. And I say, well,
364500	370280	you have probably already given away your username and your password. So now we have to change that
370280	377040	for Netflix. Simple scam. A lot of people, lots of people fall victim to this one. But it's the
377040	385940	big thing. Well, monetary wise, I don't know. Is it a threat to society? No, not really.
387000	392040	But we have also had other and more, should I say, interesting cases in here in Norway.
392040	400720	As an example, we had a minister in the government who actually went on a holiday trip to Iran with
400720	406400	his new Iranian girlfriend. And when you are a minister, you know, you should be sort of careful
406400	413120	of that, at least in the current political climate. And he did travel and he did not tell
413120	418800	the secret police. He didn't tell any intelligence services or lifeguards. He didn't tell the prime
418800	425900	minister or anyone else. He just went for it. And that's a big no-no. And when he came back,
425900	431680	back, one of the statements that he issued was pretty amazing. He said that, you know,
431680	436980	he had been, you know, traveling before. He knew his stuff when it comes to security.
436980	443720	So he said that his phone was secure because most of the time it was turned off and was just
443720	452420	left in the hotel room in Iran. Now, this and a lot more about, you know, this person and in this
452420	461990	case led to the simple fact he was forced to resign from his position. Now, for mobile hijacking,
461990	467510	I will be talking about port-out attacks, which I have chosen to call them, and to differentiate
467510	473970	that a little bit from sim-swap attacks. And I will also talk about spoofing, the sort of the
473970	479190	thing of, you know, what can you do when you are trying to pretend to be somebody else,
479190	486110	or if you actually succeed in becoming somebody else. There is also traditional fraud involved
486110	492170	in mobile hijacking as something as simple as having an insider issuing a sim card for you
492170	496030	in the wrong name and so on. I will not be talking about that.
497870	504110	Port-out attacks are the simple process of transferring a phone number to another operator.
504110	508810	That is one of the things you can do in Norway. You don't have to change your number,
508810	514930	you can transfer it freely to any operator you want to. And when I started working for
514930	523490	my current employer three years ago, I came to, you know, for my first workday on August 1st,
523490	530890	and I have been a customer of one telecom provider, Telenor, since basically the dawn of time,
530890	536490	more or less. And my employer said, you know, just give us your name and your phone number,
536490	541950	and, you know, we'll take care of porting it to the new provider that we are using,
541950	548730	we will be paying for your phone subscription, period. And I was like, you just need my
548730	555070	name and my phone number? Yeah, that's it. So I said, well, it's Peter Horsheim,
555070	561030	and my phone number is da-da-da-da-da. And by the way, phone numbers are by default public
562030	568950	available to anyone in Norway, unless you specifically say, I do not want my number listed,
568950	573750	or eventually also I want a secret phone number, there's a difference there.
576650	585610	And my employer just sent an email to their telco saying that we want to transfer the
585610	590130	subscription for Pears phone, current phone, this is the name, this is the phone number,
590130	597170	and we want to port that out and over to your service, and we want it done as soon as possible,
597170	603730	by email. And I got handed a new SIM card and envelope at work, and then I was told that,
603730	611490	and this was on a Tuesday, and I was told that the port out will happen on Friday, midday noon.
612470	617990	The porting actually happened on Thursday, 124 hours before it was supposed to happen,
617990	624630	it happened at 12 o'clock. So suddenly my phone stopped working, and I had to take out the
625170	630610	current SIM card and insert a new card from the new provider I had been given at work.
630610	637710	And this means that there was a time window of approximately 48 hours, maybe even less,
637710	644950	where I would have to sort of detect that something is wrong, understand what is actually
644950	651510	happening right now, and then act before it would be too late. And not only that,
651510	658710	I have also been told, without being told the exact time frames, I have been told that
658710	665450	you can ask these telecom operators as well to do a very quick port of your number,
665450	669510	and then it will probably happen in a few hours.
671670	678450	And not only was this process going faster than expected, it happened in 48 hours or less,
678450	684810	but for me to be able to understand, you know, if somebody initiated that without asking me or
684810	691270	telling me at all, these are the two text messages that I would have to understand
691810	697850	and react upon before it was too late. The first text message came from my current provider,
697850	702190	which was Telenor. In Norwegian it says, you know, thank you for being a customer with us,
702190	709070	sorry to see you go, and here's a questionnaire with an HTTP link, unencrypted link, where they
709070	714470	just want to ask me a single question about, you know, why did I leave or would I like to come back
714470	723070	again. And from my new phone provider, selected by my employer, I also got a text message.
723090	729410	Interesting fact number one, the sender number is an invalid phone number, it's not possible
729410	736190	to respond back to the number 470-5050, as you can see on the slide. And it says,
736190	741110	welcome to Telia, which is the name of the operator, and your phone number is now transferred
741110	746790	to us, have a nice day, best regards, Telia. That's it. And I'm just imagining my own mother
746790	753490	receiving these two text messages, and I am very certain that she would not really understand
753490	760050	what's happening here. And I'm not sure if she would actually call either of these two operators
760690	771590	in time to understand what just happened. And one of the things that I did as part of this,
771590	776950	because I've been working for several years looking into, you know, this issue of sort of
776950	785890	like being able to hijack somebody's phone number through social engineering and so on,
785890	791370	and I talked to the largest financial newspaper in Norway, dug a snag sleeve about this when I
791370	800110	was sort of ready and said, I have some theories, I have some facts, but I need to be careful not to
800110	806870	step over, you know, the red line on what is legal and what is illegal to do. But you are a newspaper,
806870	813570	so you can sort of defend doing things that might be considered shady, because you are sort of
813570	819150	working for the public and you should look into this. So they did. And they actually made an
819150	824430	agreement with one of the most famous bloggers that we have in Norway, Sofie Elisa, and they
824430	829950	asked her, would it be okay for us to try to sort of hijack your phone number? And she agreed to
829950	835850	that. And the newspaper actually has a video online that you can watch for free. It's like
835850	843210	three minutes long, where a female reporter from the newspaper that looks nothing like this blogger
843570	852970	she goes out on the street to a couple of sales people from a phone company, and she hands over
853390	859270	a business card that is fake. Obviously, she printed it on her own printer. And she says,
859270	867290	I'm Sofie Elisa and I would like to port my number over to you. And with the fake business card only,
867290	873910	they accept that as a valid ID and initiates the process. And the newspaper and of course,
873910	880210	Sofie Elisa, they were shocked that, is it that easy? You know, you can affect business cards
880210	887550	really. This was scary and was scary to me, was scary to the newspaper. It was very scary to
887550	896210	everyone to be precise. Now for SimSwap, I know that SimSwap is the standard term to use,
896210	901630	especially in the US on these things. And I wanted to make a difference between what I call
901630	908230	mobile hijacking and SimSwap attacks or port out and SimSwap attacks here. SimSwap to me is the
908230	915990	same as in the US, you will get new SIM cards for a specific subscription for a specific phone
915990	921090	number. I don't know if you can do this in the US. I don't know if you can do this in Sweden or
921090	926830	for that matter. But at least in Norway, as part of your current service with your phone company,
926830	931910	you can get the new SIM card and you don't need any sort of valid reason. You can just say,
931910	937210	I want a new SIM card and you will get one. You can also get the twin SIM card. So you can have
937210	943570	two phones that are essentially the same. So if somebody calls you, it will ring in both phones.
943730	949450	And you can also get a data SIM card that, you know, given the name, you can not use it for
949450	956070	making or accepting phone calls in or out, but you can use it for data traffic only. And you can
956070	962750	get a specific data SIM card for your existing service subscription with all the operators,
962750	972510	to the best of my knowledge. And the same thing applies here. Fake ID will probably get you one
972510	979010	of these SIM cards that will also, given the circumstances, you will also be able to do sort
979010	986210	of full or at least limited sort of surveillance of whatever victim you are targeting.
987970	995550	So it became very obvious to us that we have a problem with identifying people. And we also
995550	1000910	have a problem in a business to business relationship and in general with authorization.
1001410	1009350	If you are not ordering or changing a phone subscription for yourself, but for somebody else,
1009350	1015950	how do we identify and how do we find out whether you're authorized to make those changes on behalf
1015950	1023090	of another person? Obviously, there was a problem with this. One of the revelations made by the
1023090	1032290	newspaper was that the telecom operator Telia, which is working out of many different countries,
1032290	1043310	it's home base is in Sweden. They found out that in Sweden, the government requires Telia to ask
1043310	1050830	for proper ID when you are setting up, terminating or changing or moving a phone subscription,
1051470	1057290	like passport or something, digital ID, which is government approved.
1057970	1063590	Now, Telia also operates in Norway, and we also have digital identities in Norway called Bank ID.
1064190	1071910	And in Sweden, they are using Bank ID to identify their customers. So it was a pretty easy question.
1071910	1078210	Are you using Bank ID or something similar in Norway as well? And Telia, they responded,
1078210	1085570	no, we don't do that. And when the question came up, why don't you do that? The answer to the
1085570	1093290	question was saying that we do as we are required to do by the government in Norway. And the answer
1093290	1101370	to that, again, is the government in Norway didn't require the telephone operators to ask for any
1101370	1109130	kind of solid ID, being it on paper, like passport or driver's license, or a digital version of a
1109130	1117890	digital ID. Again, a big surprise. So I looked to the Federal Trade Commission in the US, more
1117890	1124890	specifically to Lori Cranor, who is normally a professor at Carnegie Mellon University, and she
1124890	1130230	wrote several articles on the Federal Trade Commission website. One where she talks about
1130230	1136710	how she got her phone hijacked through a SimSwap attack. It's an interesting article, it's definitely
1136710	1142310	worth reading. And one of the things she did was to ask all the major mobile carriers in the US
1142310	1149050	what consumers could do to protect themselves from a mobile account takeover. One of the most
1149050	1153950	important steps you can take is to establish a password or PIN that is required before making
1153950	1160190	changes to your mobile account. Each of the carriers offers this feature to the customers
1160190	1168390	in a slightly different way. And this was sort of good, I mean, social engineering, PIN guessing, and
1168390	1174910	so on, can probably still get past this, but at least it's one more speed bump for the bad actors
1174910	1181990	to try to hijack your number and do a SimSwap attack. But interestingly, none of the providers
1181990	1189630	in Norway had any feature like this at all in place. And to the best of my knowledge, they are
1189630	1197570	still working on figuring out how to do this in Norway. So as a result of this, or one of many
1197570	1204210	results out of this process, which, you know, culminated in the spring of 2019, that means last
1204210	1211470	year, is our Minister of Digitalization at the time, Nikolai Astrup, he instructed the Norwegian
1211470	1218410	Communications Authority, NKOM, to implement security functions in order to prevent mobile hijacking
1219110	1228210	in cooperation with the telecom sector. That is a pretty serious move to do when you instruct them
1228210	1237770	to work on this immediately. And not only that, but also in September 2019, the government
1237770	1247170	also released a hearing named Actions to Prevent Mobile Hijacking, as a direct consequence of the
1247170	1254790	stories made by Dagens Næringsliv and by me earlier in the spring. This came out and there
1254790	1261430	was a hearing process until December 2019, where, you know, everybody, government organizations and
1261430	1267750	private people, could then give their input on the proposal for changing changes to the existing
1267750	1275510	law. Now, this hasn't passed into law yet, but we are sort of waiting for the results from the
1275510	1284630	hearings to see what's going to happen next. And also, while working with this on my own, and
1284630	1290630	together with Dagens Næringsliv, I was not aware that a news website for the IT and security
1290630	1296970	industry in Denmark, were also looking into the same thing, more or less, in Denmark with
1296970	1304690	different providers. Simply, social engineering into stores selling SIM cards, making replacement
1304690	1314670	SIM cards, and so on. And they succeeded many, many times. And, you know, they posted this article,
1314670	1321070	among many others, saying that after multiple failures, telcos are actually considering to
1321070	1330750	completely stop handing out SIM cards in physical stores. Now, Norway is next to Sweden, next to
1330750	1336710	Denmark, and next to Finland. They are neighbours. And we are very much alike in society, in law,
1336710	1343870	in language, and so on. But one of the things that has been fascinating to me is to see the
1343870	1351990	different reactions from the telcos, from newspapers, from, you know, normal people like
1351990	1357610	you and me on the streets, and from politicians, on how they have reacted to these stories in the
1357610	1365950	media. Because stopping completely to hand out SIM cards in physical stores, haven't even been
1365950	1374650	mentioned by anyone in Norway or in Sweden at all. But it is pretty much the same operators
1375310	1379350	working in these three countries. So it's kind of like,
1379350	1385030	are you people not even talking to each other internally in the same company? Or what is
1385030	1394650	happening here? So to sort of more better and better exemplify the problem of spoofing,
1394650	1402510	I say, what if I could be you as a bad actor? Now, this is Crypto and Privacy Village. You know,
1402510	1410290	we have had lots of talks on this. You are most probably watching EFF closely. You are watching
1410290	1416110	what is happening in your country right now in terms of privacy. It doesn't look good in quite
1416250	1423050	a few places all over the world. Now, in Norway, we do consider ourselves, you know, a very safe,
1423050	1431690	solid, democratic country with a government that, you know, well, we trust our government,
1431690	1439830	believe it or not. But still, there are cases where things are happening. Now, this one is an
1439830	1449810	article or series of articles that were released in the fall of 2019, Chasing Max. And this is about
1449970	1455850	a guy that has been caught by the police. And he is charged for hacking the accounts of
1455850	1465890	approximately 50 different random women around the country, extracting pictures, videos, contact
1465890	1472870	details, harvesting usernames and passwords, gaining access to Instagram, Facebook, and so on.
1472870	1481550	50 women randomly all over Norway. And the newspaper told us a story about Nina.
1482470	1489430	Nina was smart. Nina was using two-factor authentication, SMS-based two-factor
1489430	1498170	authentication for her phone account, for Facebook, for Google, for Apple, and so on.
1498170	1506630	And she woke up one morning with a picture like this, where she had received authorization codes
1506630	1513070	from different services, like Microsoft, like Google, like Apple, in order to do a password
1513070	1520950	reset. And she had lost access to a lot of her accounts. And she really couldn't understand
1520950	1527230	how did this happen, because I was using two-factor authentication. And lots of people
1527230	1531850	say that, well, if you have two-factor authentication, you're secure, right? Wrong.
1533290	1539090	What they actually found out in this particular case is that Nina was using
1540510	1547850	Telia, one of the telecom providers in Norway, and they had a service called SMS Copy.
1548390	1554430	You could log on to their web page, like, you know, my page, and you could configure the SMS
1554430	1561130	Copy service, which is essentially a message service, so that if you receive a text message
1561130	1568850	to your phone, Telia will also silently forward that text message either to another phone number
1569710	1575870	or send it to an email address. You know, what could possibly go wrong with this?
1577650	1586890	And in order to get access to the my page at Telia, you needed a username and a password,
1586890	1593990	and they did not offer any kind of two-factor authentication at all. So what this bad guy did,
1593990	1598970	who is now being prosecuted by the police, he went to that page and tried to log in
1600110	1605850	with a lot of different usernames and passwords. And as we know, people are reusing passwords.
1605850	1613470	And I suspect that he got in through credential stuffing or online password spraying. And by
1613470	1618990	getting in there, he could configure the SMS Copy service, he could order a password reset from
1618990	1624490	different services, and although Nina received the messages, she received them in the middle of the
1624490	1631030	night when she was sleeping, and he was up and he received the same messages, and by that he
1631030	1640230	gained access to all the accounts of these women. And that, I think, serves as a really
1642530	1647450	hard and scary example of what the possible consequences can be
1648330	1655890	if you don't have secured your entire chain with two-factor authentication or something else.
1656890	1664720	Two-factor authentication can be bypassed in so many different settings and scenarios.
1666490	1673310	Now, this was about hijacking your phone number and receiving your text messages and so on.
1674310	1680410	But I've also been looking into voicemail hacking. And this goes back again to the title of
1680410	1690310	Paris Hilton, because all the way back in 2006, there was a lot of articles around the world
1690310	1699210	saying that Paris Hilton and Lindsay Lohan had got into a sort of a disagreement, and they were
1699210	1706090	trying to hack each other's phone numbers, spread them online, and also gain access to each other's
1706090	1710830	voicemail boxes. And the story is, to the best of my knowledge, is that Paris Hilton
1710830	1717650	gained access to the voicemail box of Lindsay Lohan. And in even mainstream Norwegian media,
1717650	1725170	this was mentioned on August 27, 2006. And not only did they mention this happening,
1725170	1732610	they also actually mentioned the specific service that Paris Hilton had been using to do this.
1733830	1741250	Now, if you Google voicemail hacking, you will find interesting results. One of them is a talk
1741250	1747590	that has been presented at DEF CON before, that also includes a tool that you can use for some
1747590	1753870	services with voicemail, where you can try to basically brute force the PIN code to get into
1753870	1759810	the voicemail boxes. Some voicemail boxes will have a four-digit PIN, three digits, five, six
1759810	1768750	digits that are randomly selected and provided by the telco to the user. Other telecom providers
1768750	1775230	may allow you to select your own PIN. One of the things we know from PIN code research is that
1775810	1779450	as soon as you allow users to select their own PIN code,
1779450	1785330	those PIN codes are not going to be any good at all, in pretty much all cases.
1786630	1793850	And there was also, back in 10 years ago, there was also a large scandal with News of the World
1794530	1800950	in the UK, where the British royal family got their phones and their voicemail hacked by reporters
1800950	1807050	that were able to extract messages that were, you know, most definitely not meant for the public to
1807050	1814670	listen into. This was a big scandal, and also in this case, the suspicion was targeted against
1814670	1819850	the same service as Paris Hilton had been using several years earlier.
1821830	1828230	Now, this is probably a picture that you have seen before. In order to do a password reset at
1828230	1832890	Microsoft, you have several different options. You can have an email sent to you with a link
1832890	1839270	that you need to click to gain access, or you can also ask to use an authentication app if you have
1839390	1846010	a TOTP app installed. And you can also have an SMS sent to you. So there, you know, with SMS,
1846010	1853110	you already see one problem with the SMS copy service. But there are also services where,
1853110	1859250	you know, to do a password reset and so on, you can also ask the service provider to give
1859250	1867190	you a robot call and to read the PIN code for you out loud. So one of the things I was curious about
1867190	1875070	is, hmm, can I initiate a password reset for someone online and ask that service to make a
1875070	1884190	phone call and just, well, go directly to voicemail and enter that PIN code into the voicemail box,
1884190	1889470	so I can get access afterwards, listen to the code and use it to get access to an account.
1889470	1897290	Interesting experiment. So, you know, let's hack. And what I did, I used the same service
1897290	1903070	as Paris Hilton from 2006, which is called Spoof Card. They are still operational today,
1903070	1909210	and they are still doing their fancy little tricks today. But of course, they do say that
1909210	1915090	this service is to protect your privacy. And you should, of course, not use this for any kind of
1915090	1923270	legal purposes. So I did. And the case number one was Telenor, the biggest telco in Norway.
1923630	1930570	I managed to get access to people's voicemail. Of course, I did this under a responsible disclosure.
1930610	1936710	And I also talked to my potential victims, friends, family and others, co-workers, and asked
1936710	1942590	them, can I try this? And if you want to listen in, you can do that. I showed them how I could
1942590	1948670	very easily use Spoof Card to get access to their voicemail, listen to the messages, delete them,
1948670	1955790	and also change the welcoming message for the voicemail. I told Telenor about this on a Tuesday
1955790	1962270	and on the Thursday they had fixed it. So in less than 48 hours, which is really, really good.
1963830	1970730	They also, of course, after, you know, fixing this, there was a media article and they said
1970730	1976770	that they were sorry for this and they acknowledged that this vulnerability had probably
1976770	1984150	been available for use and abuse for 13 years or more, you know, dating all the way back to
1984150	1995390	the Paris Hilton incident. 13 years. An interesting thing is, this specific service, Spoof Card,
1995390	2003010	was mentioned all the way back in 2006 in Norwegian mainstream media. But when Telenor
2003010	2014730	was informed about this in November 2019, they said, never heard of it. Which is, well, I mean,
2014730	2024090	you don't have to read mainstream media, do you? But in this case, I was a bit, well, surprised.
2025390	2033790	And as a consequence of my findings in this, the Norwegian government agency that are overseeing
2033790	2040070	the telecom industry in Norway, they chose to issue a fine of 1.5 million Norwegian kroner,
2040070	2047270	that is equivalent of 165,000 US dollars today, as a fine because they didn't have sufficient security
2048250	2054250	for the voicemail system. And depending on the country you're in, if you're in the US,
2054250	2062730	I would guess a fine of 165,000 US dollars doesn't sound much. In Norway, to the company,
2062730	2071710	it's pocket change, not even that. But it is very, very rare that any company is being given any fine
2071710	2080230	at all by this government agency. So that sort of underlines the seriousness of this security breach.
2080230	2087850	And also our Norwegian data protection agency, they also issued a reprimand to Telenor saying
2087850	2094330	that this is really not good, and you have basically violated two different GDPR articles
2094330	2101950	on this. But since you have already been fined once, we are not going to slap another fine on
2101950	2109770	top of that. That's usually not how it's being done here in Norway. And there's case number two,
2109770	2114970	because I asked friends in other countries as well, can I try to hack your voicemail box?
2115110	2125210	So with Telia in Denmark, the version two news website in Denmark, they tried this out on my
2125210	2132070	behalf, and they found that this works. I approved it for them. I talked directly to Telia, they
2132070	2137390	fixed it, and they also ended up in the news saying that this is a big scandal, and it's not
2137390	2144580	just in Denmark, it also applies to other providers in Norway and in Sweden.
2148070	2155050	And kind of fascinating that version two even have an article saying that Telia is now considering
2156090	2161290	better voicemail security. So I'm sort of waiting to see what's going to happen there, but hopefully
2161290	2169710	it has already improved. Case number three is Tele2, which is the third provider that I found
2169710	2175850	vulnerable in this. Based in Sweden, they operate in eight different countries. I tested against
2175850	2182030	voicemail boxes of people in Sweden. I found them to be vulnerable. I got access to their voicemail.
2182470	2189350	I do not know about the, you know, hackability of Tele2 voicemail boxes in other countries where
2189350	2196270	they operate, because I didn't test, but Tele2 says, nope, they are not vulnerable. So hopefully
2197410	2206490	that's true. At least, again, this also led to media attention in Sweden. Again, back to, you
2206490	2213890	know, my fascination of the different ways of how this was handled, or wasn't handled at all
2213890	2219110	in the different countries. In Norway, there was a lot of media attention on this. Mainstream media
2219110	2224370	picked it up. There have been issued a fine. There have been issued a reprimand by the Data
2224370	2231050	Protection Agency of Norway. In Denmark, there have been a little bit of media attention, but
2231050	2236510	politicians have said, well, the problem is fixed, so there's nothing left for us to do, and we'll
2236510	2240090	just leave it to the telecom providers to, you know, they have to talk to each other and figure
2240090	2248790	out what to do. And that's it. And in Sweden, pretty much nothing has happened at all so far.
2249110	2255550	In fact, there were one or I think it was two or three articles in total about this,
2255550	2265030	and then it went completely quiet. But all in all, I found that several million people across Norway,
2265030	2273350	Sweden and Denmark were affected by this, and have most probably been affected for 13 years or more.
2273350	2279830	At the same time, the telecom providers, they have logs that maybe go back two, three or four
2279830	2287170	weeks in time. So proving or disproving that this hasn't been hacked and abused by anyone for the
2287170	2295170	past 13 years is completely impossible. So they have concluded that, well, since we haven't heard
2295170	2303330	anyone complain about it, nobody has probably been hacked. And there's nothing we can do about that.
2305530	2309870	So I just want to say that, you know, this is sort of still a work in progress,
2309870	2317210	but I would really, really, you know, recommend you to listen in on the talk from Kelly Robinson
2317210	2323870	on Sunday here at the Crypto and Privacy Village, where she will be talking about Stör shaken.
2323930	2328430	Not saying anything more than that, just listening to that talk. And by that,
2328430	2334390	we have reached the end. And I say, thank you. And I am ready for your questions now,
2334390	2342410	or you can contact me later. You have my cryptic contact details here on screen. Thank you.
2360940	2367420	Not saying anything more than that, just listening to that talk. And by that, we have reached the end
2367420	2373840	and I say, thank you. And I am ready for your questions now, or you can contact me later.
2373840	2380480	That was the talk, Hacking Like Paris Hilton 14 Years Later and Still Winning, by Pear.
2384570	2390770	We have them here for our live Q&A, so please put your questions in the Discord CPV Q&A channel.
2392150	2398530	So Pear, one of the first questions we have is, in the USA, many carriers use the phone number
2398530	2403350	as a default PIN. So if you spoof the number and call as voicemail, you can access it using
2403350	2407770	the phone number as the default PIN, if the user didn't change it, and a lot of people don't.
2407770	2414170	Is that the same outside the US of other carriers? Well, I can say for sure that at least that's not
2414170	2422010	what we have. That's not what we have here in Norway. I haven't seen this in Sweden or Denmark,
2422010	2426930	but I really can't answer for all telecom providers in all the countries
2427630	2435230	outside the US. That's impossible to do. But I do have my suspicions that you will find
2435510	2441590	a lot of bad security connected to both voicemail accounts, and also in general,
2441590	2447750	the accounts where you can log in on your telco homepage for, in any way,
2447750	2453550	administrating your subscription with that. Awesome. Thank you so much for that.
2454650	2458950	In your ideal world, what would you like to see exist in place of the current available
2458950	2467350	options that we do have? Well, there are many facets to this. And one of the things that I
2467350	2473990	pointed out early in my presentation is starting with whenever you go into a shop and say that you
2473990	2480270	want a new SIM card, or if you want a data SIM card, or a twin SIM card, if you want a new
2480270	2486330	subscription, if you want to change it, if you want to end it, to move it to another telco,
2486330	2494430	and then you have the issues of logging on to your telco provider to administer your subscription
2494430	2503230	there, like this SMS copy service, which is now, of course, turned off, and options like that.
2503230	2510170	Then you also have the stuff like doing the voicemail hacking using spoofed numbers. Now,
2510170	2521090	some of the issues are specific to each telco provider, like the absence of two-factor
2521090	2526310	authentication for administrating your account. And then you have the security awareness training
2526310	2532370	for staff on help desk, online chat, and in stores. But there are also problems with the
2532370	2540750	basic telco networks worldwide for mobile communication using the SS7 protocol and
2540750	2547010	stuff like that. And that is, I'm not going to say it's an unsolvable problem, but it's not up
2547010	2555050	to a single telco provider to fix it. It's not up to a single country to fix it. And basically,
2555050	2562010	if you are to fix the fundamental security issues that we have in the GSM networks today,
2562010	2567510	all providers and makers of phones, of networking equipment, all the telcos,
2567510	2573350	they have to come up with solutions. And you have to replace all the handsets in the world.
2573410	2579010	And we can't do that. That's just impossible to expect that to basically ever happen.
2579090	2583970	So one of the things that are coming now, which is very interesting, of course, as I said,
2583970	2589890	Kelly Robinson will be talking about stir shaking. So I'm not going to spoil that anymore,
2589890	2595950	but that's a talk that I really hope people will listen to. And one of the things that I'm doing
2595950	2602930	as well is trying to, to the extent I can, I'm trying to pressure the Norwegian government and
2602930	2608670	also the governments in Sweden and Denmark as well, together with other people, to ask the
2608670	2614310	telcos to at least look into stir shaking, and eventually also consider, can it be implemented?
2614490	2621230	And how can we make the rest of the world implement it as well? So long answer to a short question.
2621970	2626250	Wow, that was a really great, thorough answer. Thank you so much. So another question we have
2626250	2632330	is, should we just disable our voicemails then at that point? Oh, yeah. Oh, yeah. Disable voicemail
2632330	2638910	now. I mean, there's absolutely no point... I can't really understand why people are using
2638910	2649570	voicemail at all. And I was in Czech Republic last year, I think. And I was surprised to hear
2649570	2656850	from friends in the Czech Republic that voicemail, nah, no, they don't have that with their
2656850	2662470	phone subscriptions. And I asked around, and they couldn't think of any friends or family
2662470	2669430	who had voicemail. In Norway, we have three companies that are providing a physical
2669430	2676530	infrastructure for mobile communications. And then we have lots of virtual operators as well.
2676530	2683790	And all of them, absolutely all of them, by default, provide voicemail as a part of the service.
2683790	2689930	And there actually is no option to say, I don't want voicemail, but they do have options to turn
2689930	2696190	it off. So one of the things I would like to see is that, you know, well, I just don't need
2696670	2706930	voicemail at all. And I actually... I just don't pay for it either, because I can turn it off,
2706930	2717530	but I'm sort of still paying for it. Yeah, that's actually really... huh, I did not realize
2717530	2721630	that was an option in other places like that. Thank you. You kind of answered some of this
2721630	2727910	question already, but someone asked, as a regular user, what can I do to protect myself, if anything,
2727910	2734850	or is it completely out of my hands? Well, to protect yourself, you know, I'm working as a
2734850	2740970	security officer for a large hotel chain. And of course, I've been asking my colleagues and
2740970	2747190	friends about this as well, you know, what do you think about this? And of course, I can say,
2747190	2753010	I have truly scared a lot of people by being able to sort of hack into their voicemail using a
2753010	2758910	spoofed phone call, and also making phone calls that appears to be coming from your mom, or your
2758910	2764090	dad, or your brother, or whoever it is. And they are really surprised to see that I can do that.
2764090	2770590	So there are some things you can do. And the very simple thing that you can do is that whatever text
2770590	2777090	message you are receiving, or the phone number, or the name that you see in the display on your phone
2777090	2785650	when somebody is calling you, do not trust it. Because it is exceptionally easy to spoof.
2786670	2793770	And I don't know how, you know, I don't know, you know, you're in the US, so I don't know
2793770	2798910	how much people in the US in general know about phone spoofing, you know, number spoofing,
2798910	2805770	and text message spoofing. But to people here in Norway, the vast majority of people in the
2805770	2811910	IT security industry were absolutely clueless about this existing at all, when I started
2811910	2816630	working with this. And when I did my initial presentations last year, people were shocked
2816630	2823530	that this was possible. So as an end user, first and foremost, do not trust that the number you
2823530	2831370	or the name you see in your display are correct. No matter who calls or texts you, do not trust it.
2833760	2837920	As a millennial who does not pick up any phone calls at all, that's really fascinating to know
2837920	2845440	about. Oh, yeah, you youngsters. Yeah, well, yeah. I mean, you have a completely different
2845440	2851360	sort of way to protect yourself in this area. But I know, again, robocalls, as far as I know,
2851360	2860420	is a very big problem in the US. It almost doesn't exist over here yet. Except for the
2860420	2865480	operation on Microsoft is calling you to say you have a computer virus on your system. That's
2865480	2873900	the only robocalls we get. And when I got one last year, I was like, yes, finally. So there you go.
2874160	2878740	That is a very different reaction that I have, I think, along with other people.
2878740	2883720	Oh, gosh. With that said, thank you so much again, Pear, for all of your answers to this Q&A
2883720	2888340	and for your talk today. Please take care and enjoy the rest of your DEF CON.
2888500	2891120	I hope you have fun. Thank you so much again.