I hope you are doing great and safe.
First of all, before starting my presentation, I would like to thank the organizers, sponsors,
Omar Santos and yet another security community, Yass, for their support.
This is my honor to speak at Defcon Writing Village, and I'm really excited about this.
So, this talk, I think, is really interesting because we are going to take a look at the
mobile network, which is used by mobile operators and many other entities all around the world.
This area of test contains many, many valuable information like user location, user unique
information and phone number related data.
The important thing in this talk is that we are going to review all possible bypassing methods
because I think you may hear much about Telecom and SS7 vulnerabilities and hacking.
So, the purposes of this talk are to address all those bypassing techniques from a Red Teamer
perspective. If you are ready, let's get started.
So, first I want to introduce myself. I'm Ali Abdullahi, a cybersecurity enthusiast with over
eight years of experience in a variety of fields trying to make the world a safer place.
I'm an instructor at Hacking9 and an active researcher and bug hunter. I'm a regular speaker
and trainer at famous cybersecurity and hacking global conferences like COCON, TyphoonCon,
Texas Cyber Summit, OAS, AppSec Days, Confidence, and this year proudly announced that I accept
Red Team Village. I'm a speaker and trainer at Aerospace and AppSec Villages.
As you can see, there are many security incidents and news about vulnerabilities and hacking
mobile infrastructures, including protocols, communications, and interconnections.
In the top left corner, there is news regarding attacking financial organizations and the ATM
infection by exploiting SS7 protocol. In this case, hackers tried to intercept authorized
payment phone SMS to exploit them. So, because one of the most usable attacks in SMS interception
and spoofing, in the lower left corner, you can see a news about abusing telecom protocol
to target UK Metrobank in 2019. In this scenario, hackers tracked and intercepted text messages
to gain unauthorized access to banking accounts. In the top right corner, you can find another
news regarding fixing SS7 and telecom vulnerabilities in US, which would be very helpful to secure
the communications and subscribers' private info. So, the last one is news about sending
tweets via SMS, which patched by Twitter to avoid unwanted and harmful tweets and combating
malicious actors. So, now the question is that what types of attacks and vulnerabilities
threaten mobile networks and subscribers and why they are important to red teamers?
So, the first possible attack category is subscriber data leakage. Actually, subscriber
data leakage is a vital part for red teamers to set up their next steps and scenarios.
In this part of the scenarios, they will retrieve subscribers in C number and other stuff.
Next one is network data leakage, which is very important for a teamer to understand
what's happening inside mobile core network and what kind of devices are in place there.
Finding mobile subscribers' location is one of the most critical issues. So, based on
this attack, criminals can retrieve subscribers' CGI or Cell Global Identifier and convert
it to MCC, Mobile Country Code, MNC, Mobile Network Code, and LAC or Lack Location Area
Code and Cell ID or CID to find the actual sector which the subscriber connected to.
Sniffing is the next scenario which points to voice and SMS interceptions. Spoofing is
another test case, which is very interesting because if you want to take advantage of it
as a red teamer, you may perform a call with fake caller ID or send a SMS via fake number.
The last attack category is fraud. Red teamers can perform malicious uses to requests, call
redirection, SIM card profile swapping, etc. to done fraud attack categories.
Now, we are starting our bypassing journey one by one. So, first of all, we are going
to talk about radio segment, which is the most accessible part of a mobile network.
As you can see here, we have a big picture of radio access network or RAN in different
technologies. BTS in 2G or GSM, NodeB in 3G or UMTS technology, and eNodeB in 4G or LTE
networks. So, there is a connection between cell towers to the core networks and based
on your traffic type, means voice or data, the data passed through to CS core or circuit
switch network or packet switch network. In this picture, we have 5G architecture. Most
of elements are different, but from a red teamer point of view, security flaws and opportunities
in traditional technologies still available here. Please note that 5G has its own vulnerabilities
and because of IP backbone and software usage in this generation, many other doors open
to hackers. Now we are going to review all possible vectors for a red teamer when facing
with a mobile network. First is mobile RAN, radio access network, so red teamer needs
to be in radio field and needs to have some sort of tools like hardware and software.
Second is signaling network or CS. So to do this, red teamer needs to have access to
the signaling network. Red teamer can buy the access from dark web even or officially
from telco providers all around the world or based on the contract retrieved from the
network owner. Data network is more easier because most of attacks can perform from the
internet and some of them from a signaling point. Okay, now we are going to review security
mechanisms in radio access network or radio security. The first one is mobile device registration
using IMEI. Second is enabling ciphering algorithms to fight against interception and man-in-the-middle.
Third item is using only LTE or LTE advanced or some other advanced mobile technologies
instead of traditional mobile core networks in 2G and UMTS. So as you can see here, this
is the big picture of a radio access network and you can see it is in LTE generation, fourth
generation. Radio access network in this technology called EUTRAN or Evolve EUTRAN
and the inode beads are here. They are connected to each other using X2 interfaces and they
are connected to the core network using S1 interfaces. Okay, why using IMEI policies?
Actually to fight against phone smuggling, lawful and security monitoring, tracking stolen
devices and criminals are the most usage of mobile device registration or IMEI based policies.
Okay, now with the help of Motorola phone C115 and C118 and OSMOCOM BB software, we
can set an invalid or fake or even duplicate IMEI and set up a call to test network reactions.
So this is the bypass, the first bypass in radio access network. According to the screenshot
here, network sends identity request to my phone and the type of identity was IMEI. So
I replied to it using an invalid IMEI set to all zero. So the network accepted my invalid
IMEI because ciphering procedure is completed. So there are some types of ciphering keys
like KC, SRS and random number in radio access network which harden the radio network to
avoid active sniffing and they always store in HLR or HSS in core network. HLR or HSS
as subscriber database has components called AUC or authentication center which responsible
for ciphering and authentication procedures. To bypass and get these information, we are
going to targeting AUC in HLR or HSS by abusing SS7 and signaling access as a Roman partner.
As you can see, I sent a malicious SS7 map SAI or send authentication info to targeted
core network from SS7 network to retrieve ciphering information and the network respond
me via RAND, SRS and KC values in clear text. Another security mechanism is using advanced
technologies to bring highest quality and performance, having more security and privacy
in core and radio segments and other factors like voice over LTE, VoLTE, flexibility, etc.
Okay, so let's review first round of bypassing method. Totally, there is a general way and
it is downgrading subscribers to traditional technologies like 3G and 2G which are vulnerable.
To perform downgrading, we need to use a signal jammer. Security in circuit-search network.
There are two main security solutions in this segment of network and the first is using
SMS home routing and the second one is signaling firewall. Home routing acts as a proxy and
the definition of home router is to hiding subscriber EMC number which is very valuable
information to perform other hacking scenarios from a red teamer perspective. As you can
see, red teamer requests to receive EMC number from HLR HSS and the HSS responds with real
value. However, home router changes the value with a fake one. So, the main issue is that
how we can detect if home routing is enabled or not. Just need to send two or more malicious
SS7 messages like send routing info for SM or SRI for SM. If you receive different responses,
it means that SMS home routing is in place. As you can see here, red teamer or our tester
sends two different messages or the same message two times and responses are different as you
can see. And the main issue is SMS router here because in both cases, HLR HSS responds
with a real number. However, SMS router changes the actual value. In telecommunications, we
have three types of GTs or global title which act as IP address. MSISTN consists of MCC or
Mobile Country Code, NDC and SN. EMC consists of MCC, MNC or Mobile Network Code and MSIN.
MGT consists of MCC, NDC and MSIN. As you can see, red teamer can use MGT number and a valid
random EMC number to request other information regarding the targeted mobile number and it's
really easy. Signaling firewall. Mobile operators use signaling firewall to protect their
signaling infrastructure. Signal packet inspection, filtering, white and blacklisting.
Bypassing signaling firewall. So to bypass these kind of firewalls, we need just to play with TCAP.
What is TCAP? TCAP is a SS7 sub-protocol and it's like TCP. TCAP enables the deployment of advanced
intelligent network services by supporting non-circuit related information exchange between signaling
points using the SSCP connectionless service. TCAP provides the framework to retrieve information or
invoke remote operations that offers the means for end users in the SS7 network to query another end
office and act as the software interface between an SS7 point and database services in order to
obtain data from the SS7 network. To perform bypassing, we need to remove application context name
from TCAP or sending double operation message. The application context name or ACN is used for all
supported ITU TCAP messages except abort message. No attempt to retrieve the ACN is made for abort
messages. All other supported messages may have a dialogue portion containing dialogue request,
unidirectional dialogue, and dialogue response PDU from which the ACN is retrieved. If no dialogue
portion is detected, then the ACN is assumed to be none. The TCAP opcode based routing feature
attempts to find the opcode in all supported TCAP messages except abort. These messages must contain
invoke or return result, stand for last or not last as the first component. If not, the opcode is assumed
to be none. So, removing application context name from TCAP message. To start the procedure, we need to
remove dialogue request section from all malicious SS7 messages. Then, there will not be application context
name to point to malicious SS7 map message or mobile application part message. So, this is the second
bypassing method, sending double operation message. Actually, most of signaling firewall block or accept
a message based on message type. So, each signaling message has its own opcode and it's a vital number. According to
the picture, Red Team is trying to put a legitimate SS7 map message opcode in the first step. So, it seems a
legitimate one. And then, put a malicious SS7 map message. So, signaling firewall check just the first
operation code which is pointing to a legitimate operation. After that, the component inside the core network
reply to signaling firewall or actually our Red Teamer here in this scenario and trying to keep session which is
legitimate and valid. And ask to send the message again. So, our Red Teamer says thanks and this is what he wants.
And still, the whole session is still available and legitimate as well. So, HL or HSS or signaling point inside
our core network will respond with real subscriber EMSI number and network information. And this is what actually
our Red Teamer wants. As I mentioned, in past several years, mobile network operator and telecom providers turn
against telecom and especially SS7 attacks and enable many security mechanisms. In this talk, I tried to explain
all possible bypassing techniques in all network segments in telecom infrastructures. We must consider that
Red Teaming is very important because in these networks, we are dealing with millions of user private data. Be careful
that blind hardening and buying security appliances or software because they are not fair enough. We must have
behavior analysis and continuous monitoring as complementary solutions. Thank you very much for your attention.
I'm still available for any questions. I hope you enjoyed this talk and please in touch with me.