WEBVTT 00:00.000 --> 00:03.080 I hope you are doing great and safe. 00:03.660 --> 00:17.840 First of all, before starting my presentation, I would like to thank the organizers, sponsors, Omar Santos and yet another security community, Yass, for their support. 00:19.800 --> 00:27.300 This is my honor to speak at Defcon Writing Village, and I'm really excited about this. 00:27.300 --> 00:41.780 So, this talk, I think, is really interesting because we are going to take a look at the mobile network, which is used by mobile operators and many other entities all around the world. 00:41.940 --> 00:56.400 This area of test contains many, many valuable information like user location, user unique information and phone number related data. 00:56.400 --> 01:10.700 The important thing in this talk is that we are going to review all possible bypassing methods because I think you may hear much about Telecom and SS7 vulnerabilities and hacking. 01:11.000 --> 01:18.880 So, the purposes of this talk are to address all those bypassing techniques from a Red Teamer perspective. 01:19.160 --> 01:22.700 If you are ready, let's get started. 01:25.410 --> 01:29.370 So, first I want to introduce myself. 01:29.370 --> 01:42.630 I'm Ali Abdullahi, a cybersecurity enthusiast with over eight years of experience in a variety of fields trying to make the world a safer place. 01:42.950 --> 01:48.030 I'm an instructor at Hacking9 and an active researcher and bug hunter. 01:48.050 --> 02:06.830 I'm a regular speaker and trainer at famous cybersecurity and hacking global conferences like COCON, TyphoonCon, Texas Cyber Summit, OAS, AppSec Days, Confidence, and this year proudly announced that I accept Red Team Village. 02:06.830 --> 02:11.070 I'm a speaker and trainer at Aerospace and AppSec Villages. 02:15.640 --> 02:30.280 As you can see, there are many security incidents and news about vulnerabilities and hacking mobile infrastructures, including protocols, communications, and interconnections. 02:30.280 --> 02:44.440 In the top left corner, there is news regarding attacking financial organizations and the ATM infection by exploiting SS7 protocol. 02:45.900 --> 02:54.940 In this case, hackers tried to intercept authorized payment phone SMS to exploit them. 02:55.560 --> 03:13.540 So, because one of the most usable attacks in SMS interception and spoofing, in the lower left corner, you can see a news about abusing telecom protocol to target UK Metrobank in 2019. 03:14.340 --> 03:24.020 In this scenario, hackers tracked and intercepted text messages to gain unauthorized access to banking accounts. 03:24.020 --> 03:39.720 In the top right corner, you can find another news regarding fixing SS7 and telecom vulnerabilities in US, which would be very helpful to secure the communications and subscribers' private info. 03:40.340 --> 03:53.700 So, the last one is news about sending tweets via SMS, which patched by Twitter to avoid unwanted and harmful tweets and combating malicious actors. 03:56.480 --> 04:11.860 So, now the question is that what types of attacks and vulnerabilities threaten mobile networks and subscribers and why they are important to red teamers? 04:11.860 --> 04:18.440 So, the first possible attack category is subscriber data leakage. 04:19.500 --> 04:27.680 Actually, subscriber data leakage is a vital part for red teamers to set up their next steps and scenarios. 04:27.680 --> 04:34.220 In this part of the scenarios, they will retrieve subscribers in C number and other stuff. 04:34.220 --> 04:50.860 Next one is network data leakage, which is very important for a teamer to understand what's happening inside mobile core network and what kind of devices are in place there. 04:50.860 --> 04:56.580 Finding mobile subscribers' location is one of the most critical issues. 04:57.780 --> 05:24.420 So, based on this attack, criminals can retrieve subscribers' CGI or Cell Global Identifier and convert it to MCC, Mobile Country Code, MNC, Mobile Network Code, and LAC or Lack Location Area Code and Cell ID or CID to find the actual sector which the subscriber connected to. 05:25.240 --> 05:31.120 Sniffing is the next scenario which points to voice and SMS interceptions. 05:31.780 --> 05:48.000 Spoofing is another test case, which is very interesting because if you want to take advantage of it as a red teamer, you may perform a call with fake caller ID or send a SMS via fake number. 05:48.340 --> 05:50.780 The last attack category is fraud. 05:50.780 --> 05:58.040 Red teamers can perform malicious uses to requests, call redirection, SIM card profile swapping, etc. 05:58.100 --> 06:01.700 to done fraud attack categories. 06:05.610 --> 06:11.290 Now, we are starting our bypassing journey one by one. 06:11.290 --> 06:17.670 So, first of all, we are going to talk about radio segment, which is the most accessible part of a mobile network. 06:17.670 --> 06:27.150 As you can see here, we have a big picture of radio access network or RAN in different technologies. 06:27.150 --> 06:38.450 BTS in 2G or GSM, NodeB in 3G or UMTS technology, and eNodeB in 4G or LTE networks. 06:38.450 --> 06:54.950 So, there is a connection between cell towers to the core networks and based on your traffic type, means voice or data, the data passed through to CS core or circuit switch network or packet switch network. 07:00.810 --> 07:05.050 In this picture, we have 5G architecture. 07:05.050 --> 07:17.450 Most of elements are different, but from a red teamer point of view, security flaws and opportunities in traditional technologies still available here. 07:17.590 --> 07:30.150 Please note that 5G has its own vulnerabilities and because of IP backbone and software usage in this generation, many other doors open to hackers. 07:35.860 --> 07:43.580 Now we are going to review all possible vectors for a red teamer when facing with a mobile network. 07:43.700 --> 07:56.380 First is mobile RAN, radio access network, so red teamer needs to be in radio field and needs to have some sort of tools like hardware and software. 07:56.380 --> 08:00.000 Second is signaling network or CS. 08:00.500 --> 08:05.400 So to do this, red teamer needs to have access to the signaling network. 08:05.500 --> 08:20.260 Red teamer can buy the access from dark web even or officially from telco providers all around the world or based on the contract retrieved from the network owner. 08:20.600 --> 08:30.620 Data network is more easier because most of attacks can perform from the internet and some of them from a signaling point. 08:35.110 --> 08:45.850 Okay, now we are going to review security mechanisms in radio access network or radio security. 08:45.850 --> 08:51.470 The first one is mobile device registration using IMEI. 08:51.810 --> 08:58.490 Second is enabling ciphering algorithms to fight against interception and man-in-the-middle. 08:58.490 --> 09:12.750 Third item is using only LTE or LTE advanced or some other advanced mobile technologies instead of traditional mobile core networks in 2G and UMTS. 09:15.060 --> 09:29.340 So as you can see here, this is the big picture of a radio access network and you can see it is in LTE generation, fourth generation. 09:29.960 --> 09:40.860 Radio access network in this technology called EUTRAN or Evolve EUTRAN and the inode beads are here. 09:40.860 --> 09:50.180 They are connected to each other using X2 interfaces and they are connected to the core network using S1 interfaces. 09:54.060 --> 09:59.800 Okay, why using IMEI policies? 10:00.980 --> 10:20.300 Actually to fight against phone smuggling, lawful and security monitoring, tracking stolen devices and criminals are the most usage of mobile device registration or IMEI based policies. 10:22.620 --> 10:42.880 Okay, now with the help of Motorola phone C115 and C118 and OSMOCOM BB software, we can set an invalid or fake or even duplicate IMEI and set up a call to test network reactions. 10:42.880 --> 10:47.720 So this is the bypass, the first bypass in radio access network. 10:48.880 --> 10:57.080 According to the screenshot here, network sends identity request to my phone and the type of identity was IMEI. 11:00.130 --> 11:06.290 So I replied to it using an invalid IMEI set to all zero. 11:12.390 --> 11:19.550 So the network accepted my invalid IMEI because ciphering procedure is completed. 11:28.920 --> 11:50.180 So there are some types of ciphering keys like KC, SRS and random number in radio access network which harden the radio network to avoid active sniffing and they always store in HLR or HSS in core network. 11:50.480 --> 12:04.020 HLR or HSS as subscriber database has components called AUC or authentication center which responsible for ciphering and authentication procedures. 12:10.010 --> 12:21.770 To bypass and get these information, we are going to targeting AUC in HLR or HSS by abusing SS7 and signaling access as a Roman partner. 12:21.770 --> 12:42.590 As you can see, I sent a malicious SS7 map SAI or send authentication info to targeted core network from SS7 network to retrieve ciphering information and the network respond me via RAND, SRS and KC values in clear text. 12:49.720 --> 13:09.320 Another security mechanism is using advanced technologies to bring highest quality and performance, having more security and privacy in core and radio segments and other factors like voice over LTE, VoLTE, flexibility, etc. 13:15.190 --> 13:24.250 Okay, so let's review first round of bypassing method. 13:24.250 --> 13:33.630 Totally, there is a general way and it is downgrading subscribers to traditional technologies like 3G and 2G which are vulnerable. 13:33.630 --> 13:38.470 To perform downgrading, we need to use a signal jammer. 13:43.270 --> 13:45.990 Security in circuit-search network. 13:46.550 --> 13:57.950 There are two main security solutions in this segment of network and the first is using SMS home routing and the second one is signaling firewall. 14:01.380 --> 14:18.540 Home routing acts as a proxy and the definition of home router is to hiding subscriber EMC number which is very valuable information to perform other hacking scenarios from a red teamer perspective. 14:18.540 --> 14:30.180 As you can see, red teamer requests to receive EMC number from HLR HSS and the HSS responds with real value. 14:30.180 --> 14:34.380 However, home router changes the value with a fake one. 14:39.920 --> 14:46.040 So, the main issue is that how we can detect if home routing is enabled or not. 14:46.920 --> 14:56.340 Just need to send two or more malicious SS7 messages like send routing info for SM or SRI for SM. 14:56.480 --> 15:02.880 If you receive different responses, it means that SMS home routing is in place. 15:03.520 --> 15:24.780 As you can see here, red teamer or our tester sends two different messages or the same message two times and responses are different as you can see. 15:24.780 --> 15:38.980 And the main issue is SMS router here because in both cases, HLR HSS responds with a real number. 15:38.980 --> 15:43.640 However, SMS router changes the actual value. 15:47.800 --> 15:55.860 In telecommunications, we have three types of GTs or global title which act as IP address. 15:56.080 --> 16:03.000 MSISTN consists of MCC or Mobile Country Code, NDC and SN. 16:03.220 --> 16:09.900 EMC consists of MCC, MNC or Mobile Network Code and MSIN. 16:09.900 --> 16:14.260 MGT consists of MCC, NDC and MSIN. 16:14.260 --> 16:27.600 As you can see, red teamer can use MGT number and a valid random EMC number to request other information regarding the targeted mobile number and it's really easy. 16:33.890 --> 16:35.510 Signaling firewall. 16:35.970 --> 16:43.390 Mobile operators use signaling firewall to protect their signaling infrastructure. 16:43.390 --> 16:48.410 Signal packet inspection, filtering, white and blacklisting. 16:57.080 --> 17:00.280 Bypassing signaling firewall. 17:00.280 --> 17:06.360 So to bypass these kind of firewalls, we need just to play with TCAP. 17:08.280 --> 17:10.120 What is TCAP? 17:10.120 --> 17:15.900 TCAP is a SS7 sub-protocol and it's like TCP. 17:15.940 --> 17:32.080 TCAP enables the deployment of advanced intelligent network services by supporting non-circuit related information exchange between signaling points using the SSCP connectionless service. 17:32.280 --> 18:00.600 TCAP provides the framework to retrieve information or invoke remote operations that offers the means for end users in the SS7 network to query another end office and act as the software interface between an SS7 point and database services in order to obtain data from the SS7 network. 18:10.900 --> 18:21.900 To perform bypassing, we need to remove application context name from TCAP or sending double operation message. 18:22.960 --> 18:33.020 The application context name or ACN is used for all supported ITU TCAP messages except abort message. 18:33.020 --> 18:37.720 No attempt to retrieve the ACN is made for abort messages. 18:37.720 --> 18:52.400 All other supported messages may have a dialogue portion containing dialogue request, unidirectional dialogue, and dialogue response PDU from which the ACN is retrieved. 18:52.460 --> 18:59.900 If no dialogue portion is detected, then the ACN is assumed to be none. 18:59.900 --> 19:09.320 The TCAP opcode based routing feature attempts to find the opcode in all supported TCAP messages except abort. 19:11.680 --> 19:24.900 These messages must contain invoke or return result, stand for last or not last as the first component. 19:24.900 --> 19:28.300 If not, the opcode is assumed to be none. 19:29.500 --> 19:38.060 So, removing application context name from TCAP message. 19:38.060 --> 19:49.200 To start the procedure, we need to remove dialogue request section from all malicious SS7 messages. 19:50.320 --> 20:01.380 Then, there will not be application context name to point to malicious SS7 map message or mobile application part message. 20:07.190 --> 20:13.810 So, this is the second bypassing method, sending double operation message. 20:15.940 --> 20:20.180 Actually, most of signaling firewall block or accept 20:24.290 --> 20:27.050 a message based on message type. 20:27.470 --> 20:33.330 So, each signaling message has its own opcode and it's a vital number. 20:43.190 --> 20:51.510 According to the picture, Red Team is trying to put a legitimate SS7 map message opcode in the first step. 20:52.470 --> 20:55.730 So, it seems a legitimate one. 20:55.870 --> 20:59.830 And then, put a malicious SS7 map message. 21:02.320 --> 21:10.240 So, signaling firewall check just the first operation code which is pointing to a legitimate operation. 21:15.520 --> 21:33.200 After that, the component inside the core network reply to signaling firewall or actually our Red Teamer here in this scenario and trying to keep session which is legitimate and valid. 21:33.580 --> 21:38.820 And ask to send the message again. 21:38.920 --> 21:46.560 So, our Red Teamer says thanks and this is what he wants. 21:47.400 --> 21:54.080 And still, the whole session is still available and legitimate as well. 21:54.080 --> 22:11.670 So, HL or HSS or signaling point inside our core network will respond with real subscriber EMSI number and network information. 22:11.670 --> 22:16.890 And this is what actually our Red Teamer wants. 22:19.400 --> 22:34.660 As I mentioned, in past several years, mobile network operator and telecom providers turn against telecom and especially SS7 attacks and enable many security mechanisms. 22:35.400 --> 22:43.840 In this talk, I tried to explain all possible bypassing techniques in all network segments in telecom infrastructures. 22:44.060 --> 22:53.500 We must consider that Red Teaming is very important because in these networks, we are dealing with millions of user private data. 22:54.020 --> 23:03.160 Be careful that blind hardening and buying security appliances or software because they are not fair enough. 23:03.160 --> 23:08.940 We must have behavior analysis and continuous monitoring as complementary solutions. 23:10.640 --> 23:13.480 Thank you very much for your attention. 23:13.480 --> 23:17.200 I'm still available for any questions. 23:17.680 --> 23:21.980 I hope you enjoyed this talk and please in touch with me.