start	end	text
0	3080	I hope you are doing great and safe.
3660	12000	First of all, before starting my presentation, I would like to thank the organizers, sponsors,
12560	17840	Omar Santos and yet another security community, Yass, for their support.
19800	27300	This is my honor to speak at Defcon Writing Village, and I'm really excited about this.
27300	34300	So, this talk, I think, is really interesting because we are going to take a look at the
34300	41780	mobile network, which is used by mobile operators and many other entities all around the world.
41940	50160	This area of test contains many, many valuable information like user location, user unique
50160	56400	information and phone number related data.
56400	63120	The important thing in this talk is that we are going to review all possible bypassing methods
63120	70700	because I think you may hear much about Telecom and SS7 vulnerabilities and hacking.
71000	77560	So, the purposes of this talk are to address all those bypassing techniques from a Red Teamer
77560	82700	perspective. If you are ready, let's get started.
85410	95310	So, first I want to introduce myself. I'm Ali Abdullahi, a cybersecurity enthusiast with over
95310	102630	eight years of experience in a variety of fields trying to make the world a safer place.
102950	109610	I'm an instructor at Hacking9 and an active researcher and bug hunter. I'm a regular speaker
109610	117090	and trainer at famous cybersecurity and hacking global conferences like COCON, TyphoonCon,
117090	125330	Texas Cyber Summit, OAS, AppSec Days, Confidence, and this year proudly announced that I accept
125330	131070	Red Team Village. I'm a speaker and trainer at Aerospace and AppSec Villages.
135640	143040	As you can see, there are many security incidents and news about vulnerabilities and hacking
143040	150280	mobile infrastructures, including protocols, communications, and interconnections.
150280	160140	In the top left corner, there is news regarding attacking financial organizations and the ATM
160140	169980	infection by exploiting SS7 protocol. In this case, hackers tried to intercept authorized
169980	180540	payment phone SMS to exploit them. So, because one of the most usable attacks in SMS interception
180540	189180	and spoofing, in the lower left corner, you can see a news about abusing telecom protocol
189180	199300	to target UK Metrobank in 2019. In this scenario, hackers tracked and intercepted text messages
199300	208120	to gain unauthorized access to banking accounts. In the top right corner, you can find another
208120	215520	news regarding fixing SS7 and telecom vulnerabilities in US, which would be very helpful to secure
215520	223840	the communications and subscribers' private info. So, the last one is news about sending
223840	231700	tweets via SMS, which patched by Twitter to avoid unwanted and harmful tweets and combating
231700	243520	malicious actors. So, now the question is that what types of attacks and vulnerabilities
244340	251860	threaten mobile networks and subscribers and why they are important to red teamers?
251860	261060	So, the first possible attack category is subscriber data leakage. Actually, subscriber
261060	267680	data leakage is a vital part for red teamers to set up their next steps and scenarios.
267680	274220	In this part of the scenarios, they will retrieve subscribers in C number and other stuff.
274220	281300	Next one is network data leakage, which is very important for a teamer to understand
281300	290860	what's happening inside mobile core network and what kind of devices are in place there.
290860	299880	Finding mobile subscribers' location is one of the most critical issues. So, based on
299880	306300	this attack, criminals can retrieve subscribers' CGI or Cell Global Identifier and convert
306300	316120	it to MCC, Mobile Country Code, MNC, Mobile Network Code, and LAC or Lack Location Area
316120	324420	Code and Cell ID or CID to find the actual sector which the subscriber connected to.
325240	332460	Sniffing is the next scenario which points to voice and SMS interceptions. Spoofing is
332460	340780	another test case, which is very interesting because if you want to take advantage of it
340780	348000	as a red teamer, you may perform a call with fake caller ID or send a SMS via fake number.
348340	354380	The last attack category is fraud. Red teamers can perform malicious uses to requests, call
354380	361700	redirection, SIM card profile swapping, etc. to done fraud attack categories.
365610	372650	Now, we are starting our bypassing journey one by one. So, first of all, we are going
372650	377670	to talk about radio segment, which is the most accessible part of a mobile network.
377670	385970	As you can see here, we have a big picture of radio access network or RAN in different
386330	397230	technologies. BTS in 2G or GSM, NodeB in 3G or UMTS technology, and eNodeB in 4G or LTE
397230	403870	networks. So, there is a connection between cell towers to the core networks and based
403870	411210	on your traffic type, means voice or data, the data passed through to CS core or circuit
411210	425450	switch network or packet switch network. In this picture, we have 5G architecture. Most
425450	433590	of elements are different, but from a red teamer point of view, security flaws and opportunities
433590	441490	in traditional technologies still available here. Please note that 5G has its own vulnerabilities
441490	448830	and because of IP backbone and software usage in this generation, many other doors open
448830	461440	to hackers. Now we are going to review all possible vectors for a red teamer when facing
461440	468380	with a mobile network. First is mobile RAN, radio access network, so red teamer needs
468380	476380	to be in radio field and needs to have some sort of tools like hardware and software.
476380	483520	Second is signaling network or CS. So to do this, red teamer needs to have access to
483520	492700	the signaling network. Red teamer can buy the access from dark web even or officially
492980	498760	from telco providers all around the world or based on the contract retrieved from the
498760	505840	network owner. Data network is more easier because most of attacks can perform from the
505840	521950	internet and some of them from a signaling point. Okay, now we are going to review security
521950	528890	mechanisms in radio access network or radio security. The first one is mobile device registration
528890	538490	using IMEI. Second is enabling ciphering algorithms to fight against interception and man-in-the-middle.
538490	546290	Third item is using only LTE or LTE advanced or some other advanced mobile technologies
547290	557980	instead of traditional mobile core networks in 2G and UMTS. So as you can see here, this
557980	567720	is the big picture of a radio access network and you can see it is in LTE generation, fourth
567720	577780	generation. Radio access network in this technology called EUTRAN or Evolve EUTRAN
577780	585640	and the inode beads are here. They are connected to each other using X2 interfaces and they
585640	599800	are connected to the core network using S1 interfaces. Okay, why using IMEI policies?
600980	608720	Actually to fight against phone smuggling, lawful and security monitoring, tracking stolen
608720	620300	devices and criminals are the most usage of mobile device registration or IMEI based policies.
622620	633100	Okay, now with the help of Motorola phone C115 and C118 and OSMOCOM BB software, we
633100	642880	can set an invalid or fake or even duplicate IMEI and set up a call to test network reactions.
642880	650380	So this is the bypass, the first bypass in radio access network. According to the screenshot
650380	660970	here, network sends identity request to my phone and the type of identity was IMEI. So
660970	675170	I replied to it using an invalid IMEI set to all zero. So the network accepted my invalid
675170	692220	IMEI because ciphering procedure is completed. So there are some types of ciphering keys
692220	703540	like KC, SRS and random number in radio access network which harden the radio network to
703540	712120	avoid active sniffing and they always store in HLR or HSS in core network. HLR or HSS
712120	720420	as subscriber database has components called AUC or authentication center which responsible
720420	732910	for ciphering and authentication procedures. To bypass and get these information, we are
732910	741770	going to targeting AUC in HLR or HSS by abusing SS7 and signaling access as a Roman partner.
741770	751170	As you can see, I sent a malicious SS7 map SAI or send authentication info to targeted
751170	757470	core network from SS7 network to retrieve ciphering information and the network respond
757470	774640	me via RAND, SRS and KC values in clear text. Another security mechanism is using advanced
774640	781000	technologies to bring highest quality and performance, having more security and privacy
781000	789320	in core and radio segments and other factors like voice over LTE, VoLTE, flexibility, etc.
795190	807290	Okay, so let's review first round of bypassing method. Totally, there is a general way and
807910	813630	it is downgrading subscribers to traditional technologies like 3G and 2G which are vulnerable.
813630	825990	To perform downgrading, we need to use a signal jammer. Security in circuit-search network.
826550	834270	There are two main security solutions in this segment of network and the first is using
834270	843960	SMS home routing and the second one is signaling firewall. Home routing acts as a proxy and
843960	850640	the definition of home router is to hiding subscriber EMC number which is very valuable
850640	859600	information to perform other hacking scenarios from a red teamer perspective. As you can
859600	868980	see, red teamer requests to receive EMC number from HLR HSS and the HSS responds with real
868980	881460	value. However, home router changes the value with a fake one. So, the main issue is that
881460	889940	how we can detect if home routing is enabled or not. Just need to send two or more malicious
889940	899200	SS7 messages like send routing info for SM or SRI for SM. If you receive different responses,
899200	909360	it means that SMS home routing is in place. As you can see here, red teamer or our tester
909360	923520	sends two different messages or the same message two times and responses are different as you
923520	935880	can see. And the main issue is SMS router here because in both cases, HLR HSS responds
936520	950460	with a real number. However, SMS router changes the actual value. In telecommunications, we
950460	958560	have three types of GTs or global title which act as IP address. MSISTN consists of MCC or
958560	969900	Mobile Country Code, NDC and SN. EMC consists of MCC, MNC or Mobile Network Code and MSIN.
969900	979240	MGT consists of MCC, NDC and MSIN. As you can see, red teamer can use MGT number and a valid
979240	985960	random EMC number to request other information regarding the targeted mobile number and it's
985960	1001350	really easy. Signaling firewall. Mobile operators use signaling firewall to protect their
1001350	1008410	signaling infrastructure. Signal packet inspection, filtering, white and blacklisting.
1017080	1026360	Bypassing signaling firewall. So to bypass these kind of firewalls, we need just to play with TCAP.
1028280	1038400	What is TCAP? TCAP is a SS7 sub-protocol and it's like TCP. TCAP enables the deployment of advanced
1038400	1047340	intelligent network services by supporting non-circuit related information exchange between signaling
1047340	1055400	points using the SSCP connectionless service. TCAP provides the framework to retrieve information or
1055400	1065380	invoke remote operations that offers the means for end users in the SS7 network to query another end
1065380	1076500	office and act as the software interface between an SS7 point and database services in order to
1076500	1096480	obtain data from the SS7 network. To perform bypassing, we need to remove application context name
1096480	1107600	from TCAP or sending double operation message. The application context name or ACN is used for all
1107600	1116620	supported ITU TCAP messages except abort message. No attempt to retrieve the ACN is made for abort
1116620	1124240	messages. All other supported messages may have a dialogue portion containing dialogue request,
1124240	1133320	unidirectional dialogue, and dialogue response PDU from which the ACN is retrieved. If no dialogue
1133320	1142700	portion is detected, then the ACN is assumed to be none. The TCAP opcode based routing feature
1142700	1153620	attempts to find the opcode in all supported TCAP messages except abort. These messages must contain
1155060	1166840	invoke or return result, stand for last or not last as the first component. If not, the opcode is assumed
1166840	1182220	to be none. So, removing application context name from TCAP message. To start the procedure, we need to
1183240	1194920	remove dialogue request section from all malicious SS7 messages. Then, there will not be application context
1194920	1209410	name to point to malicious SS7 map message or mobile application part message. So, this is the second
1209410	1220180	bypassing method, sending double operation message. Actually, most of signaling firewall block or accept
1224290	1243790	a message based on message type. So, each signaling message has its own opcode and it's a vital number. According to
1243790	1254150	the picture, Red Team is trying to put a legitimate SS7 map message opcode in the first step. So, it seems a
1254150	1264540	legitimate one. And then, put a malicious SS7 map message. So, signaling firewall check just the first
1264540	1279140	operation code which is pointing to a legitimate operation. After that, the component inside the core network
1279990	1290460	reply to signaling firewall or actually our Red Teamer here in this scenario and trying to keep session which is
1290460	1306560	legitimate and valid. And ask to send the message again. So, our Red Teamer says thanks and this is what he wants.
1307400	1323230	And still, the whole session is still available and legitimate as well. So, HL or HSS or signaling point inside
1323230	1334770	our core network will respond with real subscriber EMSI number and network information. And this is what actually
1334770	1346140	our Red Teamer wants. As I mentioned, in past several years, mobile network operator and telecom providers turn
1346140	1357080	against telecom and especially SS7 attacks and enable many security mechanisms. In this talk, I tried to explain
1357080	1366080	all possible bypassing techniques in all network segments in telecom infrastructures. We must consider that
1366080	1374280	Red Teaming is very important because in these networks, we are dealing with millions of user private data. Be careful
1374280	1383880	that blind hardening and buying security appliances or software because they are not fair enough. We must have
1383880	1393480	behavior analysis and continuous monitoring as complementary solutions. Thank you very much for your attention.
1393480	1401980	I'm still available for any questions. I hope you enjoyed this talk and please in touch with me.