WEBVTT 00:01.440 --> 00:05.990 Hi, my name is Per Thorsen and I am the founder of Passwords.com. 00:06.190 --> 00:14.950 I'm really happy to be speaking once again at the Crypto & Privacy Village here, this time at the DEF CON Safe Mode 2020 edition. 00:15.750 --> 00:23.310 My talk is entitled Hacking Like Paris Hilton 14 Years Later and Still Winning. 00:23.630 --> 00:31.810 And this is a talk that has been in the making for quite a few years by me now. 00:31.810 --> 00:36.410 So I'm really, really happy to sort of tell the entire story on this one. 00:36.470 --> 00:40.150 First, a very quick introduction of myself. 00:40.150 --> 00:57.490 Here you have a tweet a couple of years ago when I said that I do have a certain interest in passwords and Cormac Hurley at Microsoft Research, he responds back saying that, confirm I have a healthy curiosity while Thorsen is pathologically obsessed with passwords and, 00:57.490 --> 00:58.950 well, digital authentication. 00:58.950 --> 01:02.270 So that's basically me in a nutshell . 01:02.810 --> 01:13.330 Now, I do say this because for this talk it's important for me to provide a bit of background and context to the stuff that I'm going to talk about. 01:13.330 --> 01:29.130 I'm going to talk about essentially two topics, hijacking of mobile phones in different ways and also voicemail hacking, getting access to your or somebody else's voicemail with the provider in question that you are using. 01:29.810 --> 01:31.970 And why am I talking about this? 01:31.970 --> 01:35.290 Well, my interest is in passwords and digital authentication. 01:35.710 --> 01:44.930 And in some cases, we have stuff like two-factor authentication, which is, you know, everybody is talking about now, you should be using two-factor authentication. 01:45.030 --> 01:46.310 I agree. 01:46.310 --> 01:52.650 But in a lot of cases, people are using their mobile phones to do exactly this. 01:52.770 --> 02:04.930 In fact, you know, you are using two-factor authentication using text messages, maybe email, which more and more people are probably using on their phones or iPads anyway. 02:05.290 --> 02:09.310 There can be also voice-based SMS two-factor authentication. 02:09.530 --> 02:17.930 You have in-app push messages, you have TOTP authenticator apps, Google Authenticator is probably the most common one. 02:17.930 --> 02:28.230 And of course, maybe you're using WebAuthn as well, either through a hardware key or maybe you have it integrated in your operating system like Android has today. 02:30.250 --> 02:45.680 And if I want to hack into your account somewhere and you are using two-factor authentication, two-factor authentication, well, it doesn't actually block me from hacking your account. 02:45.680 --> 02:47.860 It makes it more difficult. 02:47.920 --> 02:57.940 But the only thing that is certain in life are death and taxes and everything else can be hacked and probably will be sooner or later. 02:58.280 --> 03:11.340 So mobile hijacking, something that came up to me many, many years ago when we saw sort of like two-factor authentication by SMS coming in as a thing that some were using. 03:11.340 --> 03:14.900 And I got curious, well, how can I bypass this? 03:14.900 --> 03:16.360 How can I hack it? 03:16.360 --> 03:17.840 And so on. 03:18.880 --> 03:40.220 So seven years ago, actually, the Norwegian Government Agency for Financial Supervision and Regulation, they issued their annual report about the financial market in Norway with lots of interesting information to some nerds, including losses due to like skimming, 03:40.220 --> 03:46.400 fiscal card skimming, and also online banking attacks as an example. 03:46.940 --> 03:57.400 And they said, and this is 2013, they did say that they were expecting a rapid increase in mobile hacking. 03:57.400 --> 04:20.160 And they said that they were cautious and they were concerned about the fact that people were starting to have their entire digital life, including banks, including passport information, your money, and your digital life on your phone, and you would be carrying your phone with you all the time. 04:21.100 --> 04:36.280 And it was, you know, I'm sort of willing to say that they were basically ahead of their time, at least for Norway, where I live, because did we see any, you know, sudden increase in mobile hacking in 2013? 04:37.560 --> 04:38.700 Not really. 04:38.700 --> 04:42.680 And it also depends on what kind of mobile hacking are we talking about. 04:42.880 --> 04:47.120 Now, here's a typical example that you have probably seen. 04:47.120 --> 04:50.520 Now, the message here is a text message received in Norwegian. 04:50.760 --> 04:57.300 And the simple translation is, you know, we could not invoice your membership for this month. 04:57.300 --> 05:01.060 Try again or update your payment details in order to continue watching Netflix. 05:01.220 --> 05:05.280 And there's a totally legit link down below that you're supposed to click. 05:05.800 --> 05:16.340 Now, I was actually sitting on my couch in my living room and watching Netflix with a woman next to me on a Saturday evening. 05:16.800 --> 05:24.520 And, you know, we had turned down the... but I had turned down the lights and we had some... we had some chips and we had some food and we, you know, enjoying a good movie. 05:24.660 --> 05:27.520 And then suddenly it says ping in her phone. 05:27.520 --> 05:30.660 And politely, of course, I stop Netflix and I look away. 05:30.660 --> 05:34.440 And she's typing and she's typing and she's typing even more on her phone. 05:34.440 --> 05:38.520 And I'm, well, I'm sort of getting curious about, you know, what happened now. 05:38.860 --> 05:47.040 And then she suddenly asks me, is it common that Netflix asks for your social security number? 05:47.300 --> 05:53.700 And that's the moment when I turn on the lights and turn off the TV and said, hey, love's gotta wait. 05:53.700 --> 05:56.520 We do have a security problem at hand. 05:56.520 --> 05:57.940 Give me your phone. 05:59.040 --> 05:59.720 And I got it. 05:59.720 --> 06:03.700 And this is, this is the text message that I saw on screen. 06:03.700 --> 06:08.040 And I say, well, you have probably already given away your username and your password. 06:08.040 --> 06:11.380 So now we have to change that for Netflix. 06:11.520 --> 06:12.600 Simple scam. 06:12.600 --> 06:16.240 A lot of people, lots of people fall victim to this one. 06:16.280 --> 06:18.040 But it's the big thing. 06:18.520 --> 06:21.140 Well, monetary wise, I don't know. 06:21.140 --> 06:23.500 Is it a threat to society? 06:24.160 --> 06:25.940 No, not really. 06:27.000 --> 06:32.040 But we have also had other and more, should I say, interesting cases in here in Norway. 06:32.040 --> 06:43.220 As an example, we had a minister in the government who actually went on a holiday trip to Iran with his new Iranian girlfriend. 06:43.580 --> 06:50.400 And when you are a minister, you know, you should be sort of careful of that, at least in the current political climate. 06:50.660 --> 06:54.440 And he did travel and he did not tell the secret police. 06:54.440 --> 06:57.840 He didn't tell any intelligence services or lifeguards. 06:57.840 --> 07:00.340 He didn't tell the prime minister or anyone else. 07:00.340 --> 07:02.700 He just went for it. 07:02.780 --> 07:04.560 And that's a big no-no. 07:04.740 --> 07:10.760 And when he came back, back, one of the statements that he issued was pretty amazing. 07:10.760 --> 07:14.240 He said that, you know, he had been, you know, traveling before. 07:14.240 --> 07:16.980 He knew his stuff when it comes to security. 07:16.980 --> 07:26.760 So he said that his phone was secure because most of the time it was turned off and was just left in the hotel room in Iran. 07:27.200 --> 07:37.540 Now, this and a lot more about, you know, this person and in this case led to the simple fact he was forced to resign from his position. 07:39.830 --> 07:50.410 Now, for mobile hijacking, I will be talking about port-out attacks, which I have chosen to call them, and to differentiate that a little bit from sim-swap attacks. 07:50.490 --> 08:03.750 And I will also talk about spoofing, the sort of the thing of, you know, what can you do when you are trying to pretend to be somebody else, or if you actually succeed in becoming somebody else. 08:03.970 --> 08:13.990 There is also traditional fraud involved in mobile hijacking as something as simple as having an insider issuing a sim card for you in the wrong name and so on. 08:13.990 --> 08:16.030 I will not be talking about that. 08:17.870 --> 08:24.110 Port-out attacks are the simple process of transferring a phone number to another operator. 08:24.110 --> 08:27.150 That is one of the things you can do in Norway. 08:27.150 --> 08:32.030 You don't have to change your number, you can transfer it freely to any operator you want to. 08:32.850 --> 08:51.730 And when I started working for my current employer three years ago, I came to, you know, for my first workday on August 1st, and I have been a customer of one telecom provider, Telenor, since basically the dawn of time, more or less. 08:52.310 --> 09:05.710 And my employer said, you know, just give us your name and your phone number, and, you know, we'll take care of porting it to the new provider that we are using, we will be paying for your phone subscription, period. 09:06.210 --> 09:10.950 And I was like, you just need my name and my phone number? 09:10.950 --> 09:12.250 Yeah, that's it. 09:12.250 --> 09:17.550 So I said, well, it's Peter Horsheim, and my phone number is da-da-da-da-da. 09:17.550 --> 09:33.750 And by the way, phone numbers are by default public available to anyone in Norway, unless you specifically say, I do not want my number listed, or eventually also I want a secret phone number, there's a difference there. 09:36.650 --> 09:57.170 And my employer just sent an email to their telco saying that we want to transfer the subscription for Pears phone, current phone, this is the name, this is the phone number, and we want to port that out and over to your service, and we want it done as soon as possible, 09:57.170 --> 09:58.550 by email. 09:58.910 --> 10:11.490 And I got handed a new SIM card and envelope at work, and then I was told that, and this was on a Tuesday, and I was told that the port out will happen on Friday, midday noon. 10:12.470 --> 10:20.710 The porting actually happened on Thursday, 124 hours before it was supposed to happen, it happened at 12 o'clock. 10:20.810 --> 10:30.610 So suddenly my phone stopped working, and I had to take out the current SIM card and insert a new card from the new provider I had been given at work. 10:30.610 --> 10:49.470 And this means that there was a time window of approximately 48 hours, maybe even less, where I would have to sort of detect that something is wrong, understand what is actually happening right now, and then act before it would be too late. 10:50.430 --> 11:09.510 And not only that, I have also been told, without being told the exact time frames, I have been told that you can ask these telecom operators as well to do a very quick port of your number, and then it will probably happen in a few hours. 11:11.670 --> 11:34.250 And not only was this process going faster than expected, it happened in 48 hours or less, but for me to be able to understand, you know, if somebody initiated that without asking me or telling me at all, these are the two text messages that I would have to understand and react upon before it was too late. 11:34.270 --> 11:39.470 The first text message came from my current provider, which was Telenor. 11:39.570 --> 11:55.390 In Norwegian it says, you know, thank you for being a customer with us, sorry to see you go, and here's a questionnaire with an HTTP link, unencrypted link, where they just want to ask me a single question about, you know, why did I leave or would I like to come back again. 11:55.690 --> 12:03.070 And from my new phone provider, selected by my employer, I also got a text message. 12:03.090 --> 12:15.110 Interesting fact number one, the sender number is an invalid phone number, it's not possible to respond back to the number 470-5050, as you can see on the slide. 12:15.370 --> 12:23.290 And it says, welcome to Telia, which is the name of the operator, and your phone number is now transferred to us, have a nice day, best regards, Telia. 12:23.290 --> 12:24.170 That's it. 12:24.750 --> 12:35.550 And I'm just imagining my own mother receiving these two text messages, and I am very certain that she would not really understand what's happening here. 12:35.690 --> 12:45.530 And I'm not sure if she would actually call either of these two operators in time to understand what just happened. 12:48.730 --> 13:09.590 And one of the things that I did as part of this, because I've been working for several years looking into, you know, this issue of sort of like being able to hijack somebody's phone number through social engineering and so on, and I talked to the largest financial newspaper in Norway, 13:09.590 --> 13:25.230 dug a snag sleeve about this when I was sort of ready and said, I have some theories, I have some facts, but I need to be careful not to step over, you know, the red line on what is legal and what is illegal to do. 13:25.230 --> 13:36.750 But you are a newspaper, so you can sort of defend doing things that might be considered shady, because you are sort of working for the public and you should look into this. 13:36.750 --> 13:38.010 So they did. 13:38.090 --> 13:49.150 And they actually made an agreement with one of the most famous bloggers that we have in Norway, Sofie Elisa, and they asked her, would it be okay for us to try to sort of hijack your phone number? 13:49.150 --> 13:50.870 And she agreed to that. 13:50.970 --> 13:55.250 And the newspaper actually has a video online that you can watch for free. 13:55.250 --> 14:15.310 It's like three minutes long, where a female reporter from the newspaper that looks nothing like this blogger she goes out on the street to a couple of sales people from a phone company, and she hands over a business card that is fake. 14:15.310 --> 14:18.410 Obviously, she printed it on her own printer. 14:18.410 --> 14:24.630 And she says, I'm Sofie Elisa and I would like to port my number over to you. 14:24.630 --> 14:32.190 And with the fake business card only, they accept that as a valid ID and initiates the process. 14:32.490 --> 14:37.870 And the newspaper and of course, Sofie Elisa, they were shocked that, is it that easy? 14:38.310 --> 14:41.010 You know, you can affect business cards really. 14:42.210 --> 14:45.290 This was scary and was scary to me, was scary to the newspaper. 14:45.290 --> 14:50.270 It was very scary to everyone to be precise. 14:51.790 --> 14:58.550 Now for SimSwap, I know that SimSwap is the standard term to use, especially in the US on these things. 14:58.590 --> 15:06.430 And I wanted to make a difference between what I call mobile hijacking and SimSwap attacks or port out and SimSwap attacks here. 15:06.810 --> 15:16.810 SimSwap to me is the same as in the US, you will get new SIM cards for a specific subscription for a specific phone number. 15:17.310 --> 15:19.490 I don't know if you can do this in the US. 15:19.490 --> 15:22.510 I don't know if you can do this in Sweden or for that matter. 15:22.570 --> 15:31.270 But at least in Norway, as part of your current service with your phone company, you can get the new SIM card and you don't need any sort of valid reason. 15:31.270 --> 15:34.370 You can just say, I want a new SIM card and you will get one. 15:34.430 --> 15:36.730 You can also get the twin SIM card. 15:36.730 --> 15:40.090 So you can have two phones that are essentially the same. 15:40.090 --> 15:43.570 So if somebody calls you, it will ring in both phones. 15:43.730 --> 15:55.750 And you can also get a data SIM card that, you know, given the name, you can not use it for making or accepting phone calls in or out, but you can use it for data traffic only. 15:55.750 --> 16:04.690 And you can get a specific data SIM card for your existing service subscription with all the operators, to the best of my knowledge. 16:06.330 --> 16:08.710 And the same thing applies here. 16:08.710 --> 16:26.210 Fake ID will probably get you one of these SIM cards that will also, given the circumstances, you will also be able to do sort of full or at least limited sort of surveillance of whatever victim you are targeting. 16:27.970 --> 16:35.070 So it became very obvious to us that we have a problem with identifying people. 16:35.070 --> 16:40.910 And we also have a problem in a business to business relationship and in general with authorization. 16:41.410 --> 16:57.290 If you are not ordering or changing a phone subscription for yourself, but for somebody else, how do we identify and how do we find out whether you're authorized to make those changes on behalf of another person? 16:57.330 --> 17:00.310 Obviously, there was a problem with this. 17:00.670 --> 17:15.410 One of the revelations made by the newspaper was that the telecom operator Telia, which is working out of many different countries, it's home base is in Sweden. 17:16.130 --> 17:37.290 They found out that in Sweden, the government requires Telia to ask for proper ID when you are setting up, terminating or changing or moving a phone subscription, like passport or something, digital ID, which is government approved. 17:37.970 --> 17:43.590 Now, Telia also operates in Norway, and we also have digital identities in Norway called Bank ID. 17:44.190 --> 17:49.690 And in Sweden, they are using Bank ID to identify their customers. 17:49.750 --> 17:51.910 So it was a pretty easy question. 17:51.910 --> 17:56.650 Are you using Bank ID or something similar in Norway as well? 17:56.650 --> 17:59.970 And Telia, they responded, no, we don't do that. 18:00.270 --> 18:04.010 And when the question came up, why don't you do that? 18:04.010 --> 18:11.910 The answer to the question was saying that we do as we are required to do by the government in Norway. 18:12.290 --> 18:30.350 And the answer to that, again, is the government in Norway didn't require the telephone operators to ask for any kind of solid ID, being it on paper, like passport or driver's license, or a digital version of a digital ID. 18:30.770 --> 18:32.990 Again, a big surprise. 18:33.730 --> 18:48.050 So I looked to the Federal Trade Commission in the US, more specifically to Lori Cranor, who is normally a professor at Carnegie Mellon University, and she wrote several articles on the Federal Trade Commission website. 18:48.130 --> 18:54.650 One where she talks about how she got her phone hijacked through a SimSwap attack. 18:54.790 --> 18:57.930 It's an interesting article, it's definitely worth reading. 18:57.930 --> 19:07.810 And one of the things she did was to ask all the major mobile carriers in the US what consumers could do to protect themselves from a mobile account takeover. 19:08.330 --> 19:16.670 One of the most important steps you can take is to establish a password or PIN that is required before making changes to your mobile account. 19:16.670 --> 19:22.570 Each of the carriers offers this feature to the customers in a slightly different way. 19:23.270 --> 19:39.190 And this was sort of good, I mean, social engineering, PIN guessing, and so on, can probably still get past this, but at least it's one more speed bump for the bad actors to try to hijack your number and do a SimSwap attack. 19:39.350 --> 19:46.970 But interestingly, none of the providers in Norway had any feature like this at all in place. 19:47.130 --> 19:53.130 And to the best of my knowledge, they are still working on figuring out how to do this in Norway. 19:54.670 --> 20:13.230 So as a result of this, or one of many results out of this process, which, you know, culminated in the spring of 2019, that means last year, is our Minister of Digitalization at the time, Nikolai Astrup, he instructed the Norwegian Communications Authority, 20:13.230 --> 20:22.230 NKOM, to implement security functions in order to prevent mobile hijacking in cooperation with the telecom sector. 20:22.230 --> 20:31.010 That is a pretty serious move to do when you instruct them to work on this immediately. 20:32.150 --> 20:53.690 And not only that, but also in September 2019, the government also released a hearing named Actions to Prevent Mobile Hijacking, as a direct consequence of the stories made by Dagens Næringsliv and by me earlier in the spring. 20:53.690 --> 21:08.930 This came out and there was a hearing process until December 2019, where, you know, everybody, government organizations and private people, could then give their input on the proposal for changing changes to the existing law. 21:09.050 --> 21:18.610 Now, this hasn't passed into law yet, but we are sort of waiting for the results from the hearings to see what's going to happen next. 21:21.790 --> 21:38.470 And also, while working with this on my own, and together with Dagens Næringsliv, I was not aware that a news website for the IT and security industry in Denmark, were also looking into the same thing, more or less, in Denmark with different providers. 21:38.490 --> 21:46.590 Simply, social engineering into stores selling SIM cards, making replacement SIM cards, and so on. 21:47.310 --> 21:51.450 And they succeeded many, many times. 21:51.590 --> 22:06.370 And, you know, they posted this article, among many others, saying that after multiple failures, telcos are actually considering to completely stop handing out SIM cards in physical stores. 22:07.070 --> 22:11.950 Now, Norway is next to Sweden, next to Denmark, and next to Finland. 22:11.950 --> 22:12.770 They are neighbours. 22:12.770 --> 22:18.670 And we are very much alike in society, in law, in language, and so on. 22:19.170 --> 22:38.270 But one of the things that has been fascinating to me is to see the different reactions from the telcos, from newspapers, from, you know, normal people like you and me on the streets, and from politicians, on how they have reacted to these stories in the media. 22:38.510 --> 22:50.790 Because stopping completely to hand out SIM cards in physical stores, haven't even been mentioned by anyone in Norway or in Sweden at all. 22:51.150 --> 22:57.790 But it is pretty much the same operators working in these three countries. 22:57.790 --> 23:04.270 So it's kind of like, are you people not even talking to each other internally in the same company? 23:04.270 --> 23:06.430 Or what is happening here? 23:09.030 --> 23:20.310 So to sort of more better and better exemplify the problem of spoofing, I say, what if I could be you as a bad actor? 23:20.310 --> 23:22.270 Now, this is Crypto and Privacy Village. 23:22.270 --> 23:25.010 You know, we have had lots of talks on this. 23:25.030 --> 23:29.610 You are most probably watching EFF closely. 23:29.610 --> 23:34.750 You are watching what is happening in your country right now in terms of privacy. 23:34.750 --> 23:38.250 It doesn't look good in quite a few places all over the world. 23:38.630 --> 23:53.390 Now, in Norway, we do consider ourselves, you know, a very safe, solid, democratic country with a government that, you know, well, we trust our government, believe it or not. 23:53.890 --> 23:58.310 But still, there are cases where things are happening. 23:58.310 --> 24:06.990 Now, this one is an article or series of articles that were released in the fall of 2019, Chasing Max. 24:07.330 --> 24:12.650 And this is about a guy that has been caught by the police. 24:12.650 --> 24:32.870 And he is charged for hacking the accounts of approximately 50 different random women around the country, extracting pictures, videos, contact details, harvesting usernames and passwords, gaining access to Instagram, Facebook, and so on. 24:32.870 --> 24:37.150 50 women randomly all over Norway. 24:37.950 --> 24:41.550 And the newspaper told us a story about Nina. 24:42.470 --> 24:43.730 Nina was smart. 24:43.730 --> 24:58.170 Nina was using two-factor authentication, SMS-based two-factor authentication for her phone account, for Facebook, for Google, for Apple, and so on. 24:58.170 --> 25:14.110 And she woke up one morning with a picture like this, where she had received authorization codes from different services, like Microsoft, like Google, like Apple, in order to do a password reset. 25:14.710 --> 25:19.270 And she had lost access to a lot of her accounts. 25:19.370 --> 25:25.370 And she really couldn't understand how did this happen, because I was using two-factor authentication. 25:26.210 --> 25:30.550 And lots of people say that, well, if you have two-factor authentication, you're secure, right? 25:30.770 --> 25:31.850 Wrong. 25:33.290 --> 25:47.850 What they actually found out in this particular case is that Nina was using Telia, one of the telecom providers in Norway, and they had a service called SMS Copy. 25:48.390 --> 26:12.450 You could log on to their web page, like, you know, my page, and you could configure the SMS Copy service, which is essentially a message service, so that if you receive a text message to your phone, Telia will also silently forward that text message either to another phone number or send it to an email address. 26:12.590 --> 26:15.870 You know, what could possibly go wrong with this? 26:17.650 --> 26:31.210 And in order to get access to the my page at Telia, you needed a username and a password, and they did not offer any kind of two-factor authentication at all. 26:31.650 --> 26:42.950 So what this bad guy did, who is now being prosecuted by the police, he went to that page and tried to log in with a lot of different usernames and passwords. 26:42.950 --> 26:45.850 And as we know, people are reusing passwords. 26:45.850 --> 26:52.310 And I suspect that he got in through credential stuffing or online password spraying. 26:53.130 --> 27:09.830 And by getting in there, he could configure the SMS Copy service, he could order a password reset from different services, and although Nina received the messages, she received them in the middle of the night when she was sleeping, and he was up and he received the same messages, 27:09.830 --> 27:14.430 and by that he gained access to all the accounts of these women. 27:17.590 --> 27:35.890 And that, I think, serves as a really hard and scary example of what the possible consequences can be if you don't have secured your entire chain with two-factor authentication or something else. 27:36.890 --> 27:44.720 Two-factor authentication can be bypassed in so many different settings and scenarios. 27:46.490 --> 27:53.310 Now, this was about hijacking your phone number and receiving your text messages and so on. 27:54.310 --> 27:58.090 But I've also been looking into voicemail hacking. 27:58.090 --> 28:22.310 And this goes back again to the title of Paris Hilton, because all the way back in 2006, there was a lot of articles around the world saying that Paris Hilton and Lindsay Lohan had got into a sort of a disagreement, and they were trying to hack each other's phone numbers, 28:22.310 --> 28:27.530 spread them online, and also gain access to each other's voicemail boxes. 28:27.790 --> 28:34.190 And the story is, to the best of my knowledge, is that Paris Hilton gained access to the voicemail box of Lindsay Lohan. 28:34.630 --> 28:41.410 And in even mainstream Norwegian media, this was mentioned on August 27, 2006. 28:41.510 --> 28:52.610 And not only did they mention this happening, they also actually mentioned the specific service that Paris Hilton had been using to do this. 28:53.830 --> 28:59.950 Now, if you Google voicemail hacking, you will find interesting results. 28:59.950 --> 29:15.530 One of them is a talk that has been presented at DEF CON before, that also includes a tool that you can use for some services with voicemail, where you can try to basically brute force the PIN code to get into the voicemail boxes. 29:15.530 --> 29:25.310 Some voicemail boxes will have a four-digit PIN, three digits, five, six digits that are randomly selected and provided by the telco to the user. 29:25.570 --> 29:31.610 Other telecom providers may allow you to select your own PIN. 29:31.710 --> 29:45.330 One of the things we know from PIN code research is that as soon as you allow users to select their own PIN code, those PIN codes are not going to be any good at all, in pretty much all cases. 29:46.630 --> 30:08.190 And there was also, back in 10 years ago, there was also a large scandal with News of the World in the UK, where the British royal family got their phones and their voicemail hacked by reporters that were able to extract messages that were, you know, most definitely not meant for the public to listen into. 30:08.590 --> 30:19.850 This was a big scandal, and also in this case, the suspicion was targeted against the same service as Paris Hilton had been using several years earlier. 30:21.830 --> 30:25.770 Now, this is probably a picture that you have seen before. 30:25.950 --> 30:30.770 In order to do a password reset at Microsoft, you have several different options. 30:30.770 --> 30:41.090 You can have an email sent to you with a link that you need to click to gain access, or you can also ask to use an authentication app if you have a TOTP app installed. 30:41.170 --> 30:44.050 And you can also have an SMS sent to you. 30:44.050 --> 30:50.230 So there, you know, with SMS, you already see one problem with the SMS copy service. 30:50.590 --> 31:05.050 But there are also services where, you know, to do a password reset and so on, you can also ask the service provider to give you a robot call and to read the PIN code for you out loud. 31:05.470 --> 31:26.210 So one of the things I was curious about is, hmm, can I initiate a password reset for someone online and ask that service to make a phone call and just, well, go directly to voicemail and enter that PIN code into the voicemail box, so I can get access afterwards, 31:26.210 --> 31:29.470 listen to the code and use it to get access to an account. 31:29.470 --> 31:30.950 Interesting experiment. 31:31.770 --> 31:34.550 So, you know, let's hack. 31:35.010 --> 31:41.510 And what I did, I used the same service as Paris Hilton from 2006, which is called Spoof Card. 31:41.510 --> 31:47.630 They are still operational today, and they are still doing their fancy little tricks today. 31:47.630 --> 31:51.990 But of course, they do say that this service is to protect your privacy. 31:51.990 --> 31:56.430 And you should, of course, not use this for any kind of legal purposes. 31:57.130 --> 31:58.410 So I did. 31:59.010 --> 32:03.270 And the case number one was Telenor, the biggest telco in Norway. 32:03.630 --> 32:07.670 I managed to get access to people's voicemail. 32:07.670 --> 32:10.570 Of course, I did this under a responsible disclosure. 32:10.610 --> 32:18.230 And I also talked to my potential victims, friends, family and others, co-workers, and asked them, can I try this? 32:18.230 --> 32:20.550 And if you want to listen in, you can do that. 32:20.550 --> 32:32.490 I showed them how I could very easily use Spoof Card to get access to their voicemail, listen to the messages, delete them, and also change the welcoming message for the voicemail. 32:32.770 --> 32:38.250 I told Telenor about this on a Tuesday and on the Thursday they had fixed it. 32:38.250 --> 32:42.270 So in less than 48 hours, which is really, really good. 32:43.830 --> 33:06.130 They also, of course, after, you know, fixing this, there was a media article and they said that they were sorry for this and they acknowledged that this vulnerability had probably been available for use and abuse for 13 years or more, you know, dating all the way back to the Paris Hilton incident. 33:06.550 --> 33:08.510 13 years. 33:09.170 --> 33:21.810 An interesting thing is, this specific service, Spoof Card, was mentioned all the way back in 2006 in Norwegian mainstream media. 33:21.810 --> 33:31.570 But when Telenor was informed about this in November 2019, they said, never heard of it. 33:31.570 --> 33:37.650 Which is, well, I mean, you don't have to read mainstream media, do you? 33:37.650 --> 33:44.090 But in this case, I was a bit, well, surprised. 33:45.390 --> 34:10.770 And as a consequence of my findings in this, the Norwegian government agency that are overseeing the telecom industry in Norway, they chose to issue a fine of 1.5 million Norwegian kroner, that is equivalent of 165,000 US dollars today, as a fine because they didn't have sufficient security for the voicemail system. 34:10.950 --> 34:20.090 And depending on the country you're in, if you're in the US, I would guess a fine of 165,000 US dollars doesn't sound much. 34:20.090 --> 34:26.070 In Norway, to the company, it's pocket change, not even that. 34:26.070 --> 34:34.290 But it is very, very rare that any company is being given any fine at all by this government agency. 34:34.290 --> 34:40.230 So that sort of underlines the seriousness of this security breach. 34:40.230 --> 34:55.850 And also our Norwegian data protection agency, they also issued a reprimand to Telenor saying that this is really not good, and you have basically violated two different GDPR articles on this. 34:55.850 --> 35:02.810 But since you have already been fined once, we are not going to slap another fine on top of that. 35:02.810 --> 35:06.590 That's usually not how it's being done here in Norway. 35:07.970 --> 35:14.970 And there's case number two, because I asked friends in other countries as well, can I try to hack your voicemail box? 35:15.110 --> 35:28.530 So with Telia in Denmark, the version two news website in Denmark, they tried this out on my behalf, and they found that this works. 35:28.530 --> 35:30.090 I approved it for them. 35:30.090 --> 35:44.580 I talked directly to Telia, they fixed it, and they also ended up in the news saying that this is a big scandal, and it's not just in Denmark, it also applies to other providers in Norway and in Sweden. 35:48.070 --> 35:57.990 And kind of fascinating that version two even have an article saying that Telia is now considering better voicemail security. 35:57.990 --> 36:03.610 So I'm sort of waiting to see what's going to happen there, but hopefully it has already improved. 36:04.550 --> 36:11.150 Case number three is Tele2, which is the third provider that I found vulnerable in this. 36:11.150 --> 36:14.730 Based in Sweden, they operate in eight different countries. 36:14.730 --> 36:18.370 I tested against voicemail boxes of people in Sweden. 36:18.370 --> 36:19.810 I found them to be vulnerable. 36:19.810 --> 36:22.030 I got access to their voicemail. 36:22.470 --> 36:35.550 I do not know about the, you know, hackability of Tele2 voicemail boxes in other countries where they operate, because I didn't test, but Tele2 says, nope, they are not vulnerable. 36:35.550 --> 36:39.070 So hopefully that's true. 36:40.110 --> 36:45.350 At least, again, this also led to media attention in Sweden. 36:45.390 --> 36:55.270 Again, back to, you know, my fascination of the different ways of how this was handled, or wasn't handled at all in the different countries. 36:55.270 --> 36:58.450 In Norway, there was a lot of media attention on this. 36:58.450 --> 37:00.270 Mainstream media picked it up. 37:00.270 --> 37:01.650 There have been issued a fine. 37:01.650 --> 37:06.290 There have been issued a reprimand by the Data Protection Agency of Norway. 37:06.610 --> 37:20.870 In Denmark, there have been a little bit of media attention, but politicians have said, well, the problem is fixed, so there's nothing left for us to do, and we'll just leave it to the telecom providers to, you know, they have to talk to each other and figure out what to do. 37:20.870 --> 37:22.170 And that's it. 37:23.170 --> 37:28.790 And in Sweden, pretty much nothing has happened at all so far. 37:29.110 --> 37:38.490 In fact, there were one or I think it was two or three articles in total about this, and then it went completely quiet. 37:39.030 --> 37:53.350 But all in all, I found that several million people across Norway, Sweden and Denmark were affected by this, and have most probably been affected for 13 years or more. 37:53.350 --> 38:01.070 At the same time, the telecom providers, they have logs that maybe go back two, three or four weeks in time. 38:01.090 --> 38:10.950 So proving or disproving that this hasn't been hacked and abused by anyone for the past 13 years is completely impossible. 38:11.350 --> 38:19.830 So they have concluded that, well, since we haven't heard anyone complain about it, nobody has probably been hacked. 38:20.090 --> 38:23.330 And there's nothing we can do about that. 38:25.530 --> 38:43.870 So I just want to say that, you know, this is sort of still a work in progress, but I would really, really, you know, recommend you to listen in on the talk from Kelly Robinson on Sunday here at the Crypto and Privacy Village, where she will be talking about Stör shaken. 38:43.930 --> 38:47.230 Not saying anything more than that, just listening to that talk. 38:47.230 --> 38:50.110 And by that, we have reached the end. 38:50.110 --> 38:51.390 And I say, thank you. 38:51.390 --> 38:56.230 And I am ready for your questions now, or you can contact me later. 38:56.230 --> 39:00.730 You have my cryptic contact details here on screen. 39:00.790 --> 39:02.410 Thank you. 39:20.940 --> 39:24.540 Not saying anything more than that, just listening to that talk. 39:24.800 --> 39:29.020 And by that, we have reached the end and I say, thank you. 39:29.020 --> 39:33.840 And I am ready for your questions now, or you can contact me later. 39:33.840 --> 39:40.480 That was the talk, Hacking Like Paris Hilton 14 Years Later and Still Winning, by Pear. 39:44.570 --> 39:50.770 We have them here for our live Q&A, so please put your questions in the Discord CPV Q&A channel. 39:52.150 --> 40:00.090 So Pear, one of the first questions we have is, in the USA, many carriers use the phone number as a default PIN. 40:00.090 --> 40:07.770 So if you spoof the number and call as voicemail, you can access it using the phone number as the default PIN, if the user didn't change it, and a lot of people don't. 40:07.770 --> 40:10.330 Is that the same outside the US of other carriers? 40:10.670 --> 40:15.670 Well, I can say for sure that at least that's not what we have. 40:17.190 --> 40:19.110 That's not what we have here in Norway. 40:19.110 --> 40:29.090 I haven't seen this in Sweden or Denmark, but I really can't answer for all telecom providers in all the countries outside the US. 40:29.090 --> 40:30.890 That's impossible to do. 40:30.890 --> 40:50.250 But I do have my suspicions that you will find a lot of bad security connected to both voicemail accounts, and also in general, the accounts where you can log in on your telco homepage for, in any way, administrating your subscription with that. 40:51.410 --> 40:52.090 Awesome. 40:52.090 --> 40:53.550 Thank you so much for that. 40:54.650 --> 41:00.710 In your ideal world, what would you like to see exist in place of the current available options that we do have? 41:01.450 --> 41:06.190 Well, there are many facets to this. 41:06.190 --> 41:22.410 And one of the things that I pointed out early in my presentation is starting with whenever you go into a shop and say that you want a new SIM card, or if you want a data SIM card, or a twin SIM card, if you want a new subscription, if you want to change it, 41:22.410 --> 41:43.230 if you want to end it, to move it to another telco, and then you have the issues of logging on to your telco provider to administer your subscription there, like this SMS copy service, which is now, of course, turned off, and options like that. 41:43.230 --> 41:49.470 Then you also have the stuff like doing the voicemail hacking using spoofed numbers. 41:49.470 --> 42:04.550 Now, some of the issues are specific to each telco provider, like the absence of two-factor authentication for administrating your account. 42:04.550 --> 42:10.270 And then you have the security awareness training for staff on help desk, online chat, and in stores. 42:10.270 --> 42:22.110 But there are also problems with the basic telco networks worldwide for mobile communication using the SS7 protocol and stuff like that. 42:22.110 --> 42:29.430 And that is, I'm not going to say it's an unsolvable problem, but it's not up to a single telco provider to fix it. 42:29.510 --> 42:32.810 It's not up to a single country to fix it. 42:32.850 --> 42:50.130 And basically, if you are to fix the fundamental security issues that we have in the GSM networks today, all providers and makers of phones, of networking equipment, all the telcos, they have to come up with solutions. 42:50.170 --> 42:53.350 And you have to replace all the handsets in the world. 42:53.410 --> 42:55.030 And we can't do that. 42:55.030 --> 42:59.010 That's just impossible to expect that to basically ever happen. 42:59.090 --> 43:07.550 So one of the things that are coming now, which is very interesting, of course, as I said, Kelly Robinson will be talking about stir shaking. 43:07.810 --> 43:14.350 So I'm not going to spoil that anymore, but that's a talk that I really hope people will listen to. 43:14.530 --> 43:31.470 And one of the things that I'm doing as well is trying to, to the extent I can, I'm trying to pressure the Norwegian government and also the governments in Sweden and Denmark as well, together with other people, to ask the telcos to at least look into stir shaking, 43:31.470 --> 43:34.310 and eventually also consider, can it be implemented? 43:34.490 --> 43:38.450 And how can we make the rest of the world implement it as well? 43:39.210 --> 43:41.230 So long answer to a short question. 43:41.970 --> 43:43.830 Wow, that was a really great, thorough answer. 43:43.830 --> 43:44.850 Thank you so much. 43:45.010 --> 43:49.190 So another question we have is, should we just disable our voicemails then at that point? 43:49.850 --> 43:50.490 Oh, yeah. 43:50.490 --> 43:51.270 Oh, yeah. 43:51.310 --> 43:53.430 Disable voicemail now. 43:53.690 --> 44:00.710 I mean, there's absolutely no point... I can't really understand why people are using voicemail at all. 44:00.730 --> 44:07.330 And I was in Czech Republic last year, I think. 44:07.330 --> 44:18.330 And I was surprised to hear from friends in the Czech Republic that voicemail, nah, no, they don't have that with their phone subscriptions. 44:18.330 --> 44:24.110 And I asked around, and they couldn't think of any friends or family who had voicemail. 44:24.110 --> 44:32.610 In Norway, we have three companies that are providing a physical infrastructure for mobile communications. 44:32.930 --> 44:36.530 And then we have lots of virtual operators as well. 44:36.530 --> 44:43.790 And all of them, absolutely all of them, by default, provide voicemail as a part of the service. 44:43.790 --> 44:50.790 And there actually is no option to say, I don't want voicemail, but they do have options to turn it off. 44:51.150 --> 44:58.010 So one of the things I would like to see is that, you know, well, I just don't need voicemail at all. 44:58.010 --> 45:09.470 And I actually... I just don't pay for it either, because I can turn it off, but I'm sort of still paying for it. 45:14.090 --> 45:18.990 Yeah, that's actually really... huh, I did not realize that was an option in other places like that. 45:18.990 --> 45:19.810 Thank you. 45:20.270 --> 45:30.090 You kind of answered some of this question already, but someone asked, as a regular user, what can I do to protect myself, if anything, or is it completely out of my hands? 45:31.350 --> 45:37.250 Well, to protect yourself, you know, I'm working as a security officer for a large hotel chain. 45:37.250 --> 45:43.910 And of course, I've been asking my colleagues and friends about this as well, you know, what do you think about this? 45:43.910 --> 46:01.030 And of course, I can say, I have truly scared a lot of people by being able to sort of hack into their voicemail using a spoofed phone call, and also making phone calls that appears to be coming from your mom, or your dad, or your brother, or whoever it is. 46:01.610 --> 46:04.090 And they are really surprised to see that I can do that. 46:04.090 --> 46:06.090 So there are some things you can do. 46:06.090 --> 46:21.530 And the very simple thing that you can do is that whatever text message you are receiving, or the phone number, or the name that you see in the display on your phone when somebody is calling you, do not trust it. 46:21.570 --> 46:25.650 Because it is exceptionally easy to spoof. 46:26.670 --> 46:41.010 And I don't know how, you know, I don't know, you know, you're in the US, so I don't know how much people in the US in general know about phone spoofing, you know, number spoofing, and text message spoofing. 46:41.010 --> 46:52.890 But to people here in Norway, the vast majority of people in the IT security industry were absolutely clueless about this existing at all, when I started working with this. 46:52.890 --> 46:58.430 And when I did my initial presentations last year, people were shocked that this was possible. 46:58.570 --> 47:07.370 So as an end user, first and foremost, do not trust that the number you or the name you see in your display are correct. 47:07.370 --> 47:11.370 No matter who calls or texts you, do not trust it. 47:13.760 --> 47:18.660 As a millennial who does not pick up any phone calls at all, that's really fascinating to know about. 47:19.780 --> 47:21.720 Oh, yeah, you youngsters. 47:21.800 --> 47:23.640 Yeah, well, yeah. 47:23.640 --> 47:27.860 I mean, you have a completely different sort of way to protect yourself in this area. 47:27.860 --> 47:33.920 But I know, again, robocalls, as far as I know, is a very big problem in the US. 47:34.480 --> 47:38.800 It almost doesn't exist over here yet. 47:39.720 --> 47:45.200 Except for the operation on Microsoft is calling you to say you have a computer virus on your system. 47:45.200 --> 47:47.680 That's the only robocalls we get. 47:47.680 --> 47:52.080 And when I got one last year, I was like, yes, finally. 47:52.080 --> 47:53.900 So there you go. 47:54.160 --> 47:58.740 That is a very different reaction that I have, I think, along with other people. 47:58.740 --> 47:59.760 Oh, gosh. 47:59.860 --> 48:05.280 With that said, thank you so much again, Pear, for all of your answers to this Q&A and for your talk today. 48:05.580 --> 48:08.340 Please take care and enjoy the rest of your DEF CON. 48:08.500 --> 48:09.780 I hope you have fun. 48:10.120 --> 48:11.120 Thank you so much again.