1 00:00:00,000 --> 00:00:00,400 . 2 00:00:05,560 --> 00:00:12,440 Hello, and thank you all for coming. This is awesome. I did not imagine this awesome of a turnout, so thank you for being here. 3 00:00:12,660 --> 00:00:18,900 And as most of you probably saw, this is my first time speaking at DEF CON, so I'm super excited to be here. 4 00:00:19,140 --> 00:00:25,540 So you might notice this is a really, like, fun slide. I have this throwback title and these pastel colors. 5 00:00:25,540 --> 00:00:32,020 And part of that is because I am going to throw a lot at you in this talk, and we're going to try and keep it as fun as possible. 6 00:00:32,480 --> 00:00:41,340 So all of the information here is actually public information, so hopefully you'll be able to take some things you learn here and learn more outside if you want to. 7 00:00:41,940 --> 00:00:50,380 So this talk is actually going to focus more on cellular core networks than radio access networks, as much as is reasonable, just so you know what we're getting into here. 8 00:00:51,280 --> 00:00:55,520 So you might have seen, some of you, my schmoochie. 9 00:00:55,540 --> 00:01:00,440 This is the DEF CON talk, which is on a similar topic, but it does diverge in several ways. 10 00:01:00,700 --> 00:01:03,200 So you'll still get new content even if you've seen that. 11 00:01:05,040 --> 00:01:10,020 So who am I? Well, I'm Tracy, and I'm clearly very loud. Hold on. 12 00:01:10,960 --> 00:01:15,440 I'm a vulnerability researcher at Trenchant, formerly known as Azimuth Security. 13 00:01:16,060 --> 00:01:20,520 And I previously split my time doing reverse engineering and embedded development. 14 00:01:20,820 --> 00:01:23,380 Well, most of that was actually telco focused. 15 00:01:23,380 --> 00:01:25,700 And I have about 10 years of experience. 16 00:01:27,700 --> 00:01:31,020 So what are we going to cover here? What have you all signed up for? 17 00:01:31,340 --> 00:01:51,660 Well, just to lay out our plan here, I'm going to be talking about network architecture, mitigations, and public vulnerabilities or attacks for 2G in the form of GSM, GPRS, 3G in the form of UMTS, LTE. 18 00:01:51,940 --> 00:01:52,740 There we go. 19 00:01:56,700 --> 00:01:59,760 LTE, 4G, and 5G in the form of new radio. 20 00:02:01,480 --> 00:02:03,100 So let's look at this visually. 21 00:02:03,420 --> 00:02:07,320 Now, I stole this image directly from the Wikipedia page for cellular networks. 22 00:02:07,540 --> 00:02:08,240 It's wonderful. 23 00:02:08,720 --> 00:02:10,580 And it's a great Wikipedia page. 24 00:02:11,040 --> 00:02:15,960 But you'll see I've added our path forward here just so you can visualize where we are. 25 00:02:16,200 --> 00:02:18,480 Now, you see along the bottom, we have the year. 26 00:02:18,620 --> 00:02:20,960 And along the top, those are the different generations. 27 00:02:21,900 --> 00:02:23,360 Now, internally to the top, we have the year. 28 00:02:23,380 --> 00:02:25,540 And along the bottom of this graphic, you'll see different terms. 29 00:02:25,700 --> 00:02:29,480 And a lot of times, people will actually conflate those terms with the generation. 30 00:02:29,920 --> 00:02:34,100 But I'm actually going to try my best here to differentiate those two things. 31 00:02:34,320 --> 00:02:36,900 Because internally here, we have things like GSM. 32 00:02:37,140 --> 00:02:41,020 That's actually the implementation of the 2G cellular specification. 33 00:02:43,480 --> 00:02:47,140 So first, let's cover a few basic cellular concepts. 34 00:02:47,520 --> 00:02:51,280 So we have a PSTN, which is our public switched telephone network. 35 00:02:51,280 --> 00:02:52,700 And that's your landline. 36 00:02:52,760 --> 00:02:55,780 That is made up of copper telephone lines. 37 00:02:55,940 --> 00:02:58,280 And it's circuit switched initially analog. 38 00:02:58,760 --> 00:03:01,720 So when I say circuit switched, what do I mean? 39 00:03:01,840 --> 00:03:04,520 Well, for me, again, I'm a little bit visual. 40 00:03:04,580 --> 00:03:10,480 So having this beautiful picture of the marvelous Mrs. Maisel helps me think about the concept of circuit switched. 41 00:03:10,780 --> 00:03:13,560 It's end-to-end unbroken communication lines. 42 00:03:14,360 --> 00:03:17,420 And we have our public data network, our PDN. 43 00:03:17,560 --> 00:03:21,260 And that's going to come into play more later on. 44 00:03:21,260 --> 00:03:24,680 Once we have our IP network start adding to these telco networks. 45 00:03:27,000 --> 00:03:27,960 So let's jump in. 46 00:03:28,020 --> 00:03:30,160 Let's take a look at where we are in our timeline here. 47 00:03:30,260 --> 00:03:34,980 We're in the 90s with our implementation of GSM for 2G. 48 00:03:35,180 --> 00:03:42,340 And an interesting thing about this is that 1G actually wasn't dubbed 1G until after 2G started having a specification. 49 00:03:44,000 --> 00:03:46,820 So 2G in the form of GSM here. 50 00:03:46,960 --> 00:03:50,120 But 2G is where we get calls, SMS. 51 00:03:51,260 --> 00:03:52,040 Yeah, we have texting. 52 00:03:52,160 --> 00:03:52,820 No data yet. 53 00:03:53,000 --> 00:03:56,180 And we have Etsy and GSM standardization. 54 00:03:58,020 --> 00:04:00,380 And this is interesting and it's still relevant. 55 00:04:00,600 --> 00:04:06,360 So I did want to bring up that, for example, in the U.S., T-Mobile still uses 2G as their fallback. 56 00:04:06,500 --> 00:04:09,700 And it's still prominent all over Europe. 57 00:04:11,900 --> 00:04:14,100 So let's take a look at our network architecture. 58 00:04:14,980 --> 00:04:19,240 We have our mobile station, which is really just the device you speak into. 59 00:04:19,380 --> 00:04:20,940 It's any mobile device. 60 00:04:21,260 --> 00:04:23,280 With cellular functionality for 2G. 61 00:04:23,400 --> 00:04:25,960 And this is your device. 62 00:04:26,220 --> 00:04:30,200 And this is going to feed into our radio access network. 63 00:04:30,480 --> 00:04:36,820 Now, our radio access network is actually like what most people think about when they think about a cellular network. 64 00:04:37,180 --> 00:04:41,220 It has our antennas, our radios, our baseband units. 65 00:04:41,840 --> 00:04:46,660 And in GSM, it's actually the same as our base station subsystem. 66 00:04:49,100 --> 00:04:51,240 In our base station subsystem, we're going to have our radio. 67 00:04:51,260 --> 00:04:52,780 We're going to have our base transceiver station. 68 00:04:53,220 --> 00:04:57,540 And a lot of you have probably heard of base stations, right? 69 00:04:58,000 --> 00:05:03,440 Well, our base transceiver station communicates with our base station controller. 70 00:05:03,720 --> 00:05:05,840 Base station controller is a controller. 71 00:05:05,980 --> 00:05:08,800 It's going to communicate with one or more base transceiver stations. 72 00:05:11,000 --> 00:05:13,340 And that makes up our front part of our network. 73 00:05:15,960 --> 00:05:20,480 From there, it's going to hand things off from our radio access network into our core network. 74 00:05:22,720 --> 00:05:27,360 So we have our front part, which is our user endpoint, hands things off to our base transceiver station, 75 00:05:27,580 --> 00:05:33,040 hand things off to our base station controller, which then communicates on to our mobile switching center. 76 00:05:33,700 --> 00:05:38,320 Our mobile switching center is going to handle most of the, well, I'd say most of the functionality. 77 00:05:38,840 --> 00:05:40,960 Most of the mobility functionality. 78 00:05:41,540 --> 00:05:43,880 It contains a bunch of other acronyms. 79 00:05:43,960 --> 00:05:50,880 And before I show them on the screen, because it's a little bit much, really the best way to think about it is a bunch of databases that contain information 80 00:05:50,880 --> 00:05:51,980 about users. 81 00:05:52,900 --> 00:05:55,000 Things like our home location register. 82 00:05:55,360 --> 00:06:00,880 And this is just a database of information about a local user, meaning a non-roaming user. 83 00:06:01,260 --> 00:06:05,300 This is going to be things like their activity status, location, et cetera. 84 00:06:05,800 --> 00:06:12,240 So it makes sense that if we have this for our home location register, we're going to have a visitor location register, right? 85 00:06:12,340 --> 00:06:14,700 We need the same information for visiting users. 86 00:06:14,900 --> 00:06:16,240 But this is a little bit more temporary. 87 00:06:17,960 --> 00:06:20,380 And then we have our authentication center. 88 00:06:21,120 --> 00:06:26,280 And our authentication center has things like secret keys for your SIM, your PID, your PUKE, et cetera. 89 00:06:26,840 --> 00:06:30,000 We're going to have our EIR, our equipment identity register. 90 00:06:30,280 --> 00:06:35,100 And really what this does is says this is a list of valid equipment that can be on this network. 91 00:06:36,220 --> 00:06:49,040 So when a device goes from one mobile switching center's territory to another, there's obviously going to be a lot of communication between especially your visitor location register and your home location register, right? 92 00:06:49,060 --> 00:06:50,500 Your roaming and your non-roaming users. 93 00:06:55,040 --> 00:06:57,180 So let's take a look at it all together. 94 00:06:57,720 --> 00:06:58,080 Oh. 95 00:07:01,100 --> 00:07:01,700 Whatever. 96 00:07:01,880 --> 00:07:02,200 We're rolling. 97 00:07:02,520 --> 00:07:06,020 So the user speaks into their 2G capable device. 98 00:07:06,260 --> 00:07:08,620 And that comprises our mobile station. 99 00:07:08,980 --> 00:07:17,420 The mobile station then sends the signal on to our base transceiver station, which then is handled properly by the base station controller. 100 00:07:17,800 --> 00:07:20,860 That portion of our network makes up our radio access network. 101 00:07:20,860 --> 00:07:28,920 Next it's going to hand things off to our core network in the form of our mobile switching center, which has all of these different registers. 102 00:07:29,300 --> 00:07:36,840 And then our global or gateway mobile switching center, which then reaches out to general external networks, things like our PSTN. 103 00:07:38,700 --> 00:07:40,580 So let's talk about some fun things. 104 00:07:40,720 --> 00:07:42,420 Now we have the basics established. 105 00:07:42,800 --> 00:07:43,920 Let's talk about attacks. 106 00:07:47,600 --> 00:07:48,080 So. 107 00:07:50,340 --> 00:07:52,760 GSM does not have mutual authentication. 108 00:07:54,100 --> 00:07:57,920 And you probably have heard of things like IMSI catchers, right? 109 00:07:58,100 --> 00:08:01,140 So there are lots of things you can do with IMSI catchers. 110 00:08:01,200 --> 00:08:05,360 One most important is to understand that you can do a full person in the middle attack. 111 00:08:07,340 --> 00:08:10,720 And this is done by means of a rogue base transceiver station. 112 00:08:11,020 --> 00:08:12,760 And that is going to keep coming up. 113 00:08:13,440 --> 00:08:18,060 So a fun fact about the base transceiver station is it actually is the entity that runs the base transceiver station. 114 00:08:18,060 --> 00:08:19,360 It determines the encryption scheme. 115 00:08:19,520 --> 00:08:22,600 So it can totally be like JK don't use any encryption. 116 00:08:23,380 --> 00:08:29,520 And fun fact, everything beyond the base transceiver station is actually sent in clear text anyway. 117 00:08:30,380 --> 00:08:41,160 There are also things that you can do like jamming using a signal generator or a specific frequency to interfere with either the user endpoint or your base transceiver station. 118 00:08:42,980 --> 00:08:45,320 As well as known weak encryption schemes. 119 00:08:46,300 --> 00:08:48,360 So let's move on just to GPRS. 120 00:08:49,140 --> 00:08:49,980 Might be my favorite. 121 00:08:50,140 --> 00:08:50,480 Who knows. 122 00:08:50,620 --> 00:08:52,320 Now, GPRS is great. 123 00:08:52,440 --> 00:08:55,060 You see how it doesn't really neatly fit into the timeline. 124 00:08:55,240 --> 00:08:56,420 It's got that weird cutout. 125 00:08:57,220 --> 00:09:00,260 Well, that's because it's really like 2.5G. 126 00:09:00,740 --> 00:09:04,800 And this is interesting because it is general packet radio service. 127 00:09:05,080 --> 00:09:10,500 This is where we take our GSM, our circuit switched functionality, and add IP functionality. 128 00:09:11,100 --> 00:09:15,300 We get things like multimedia messages, push to talk over cellular networks. 129 00:09:15,320 --> 00:09:19,380 We have these two network architectures essentially living in the same network. 130 00:09:20,800 --> 00:09:22,760 So let's take a look at what that looks like. 131 00:09:23,360 --> 00:09:27,520 We still have our mobile station. 132 00:09:28,080 --> 00:09:29,180 You know, the same thing. 133 00:09:29,960 --> 00:09:32,000 Sometimes there are different terms applied to it. 134 00:09:32,040 --> 00:09:33,060 But we'll stick with mobile station. 135 00:09:35,700 --> 00:09:38,180 There's our BSS, our base station subsystem. 136 00:09:38,380 --> 00:09:42,520 That's going to remain the same with our base transceiver station and our base station controller. 137 00:09:43,540 --> 00:09:45,160 And then we have our MSC. 138 00:09:45,320 --> 00:09:48,580 And this functionality is pretty much the same as before. 139 00:09:48,780 --> 00:09:49,120 Wonderful. 140 00:09:49,480 --> 00:09:52,240 It still feeds into our gateway MSC. 141 00:09:53,320 --> 00:09:55,360 So this looks pretty familiar, right? 142 00:09:56,920 --> 00:09:58,840 Well, let's take a look at the new part. 143 00:09:59,060 --> 00:09:59,920 What's new for this? 144 00:10:00,800 --> 00:10:04,920 So we start adding our shiny packet switch features and the whole front end stays the same. 145 00:10:05,040 --> 00:10:08,180 But now we get GPRS support nodes. 146 00:10:08,440 --> 00:10:09,300 And these are pretty neat. 147 00:10:09,380 --> 00:10:15,240 We have things like our serving GPRS support node, which has location, security, access control. 148 00:10:15,320 --> 00:10:20,400 Packet routing and transfer, mobility management, authentication, handle signaling packets. 149 00:10:20,860 --> 00:10:24,140 And it's doing a lot of heavy lifting here. 150 00:10:25,180 --> 00:10:35,060 And it communicates with other serving GPRS support nodes or equivalent in the same network and reaches out to our gateway GPRS support node. 151 00:10:35,240 --> 00:10:43,460 Now, this is a GGSN, so lots of people, including myself, say things like GPRS gateway support node or gateway GPRS support node. 152 00:10:43,580 --> 00:10:44,520 I'll try and be consistent. 153 00:10:44,520 --> 00:10:45,440 I make no promises. 154 00:10:46,740 --> 00:10:53,040 And it is like a router, firewall, gateway, all in one, usually just viewed as a router. 155 00:10:53,240 --> 00:10:56,040 And it's our last hop before our public data network. 156 00:10:56,380 --> 00:11:00,220 It assigns IP addresses for devices internal to that core network. 157 00:11:03,480 --> 00:11:05,140 So let's see it all together, right? 158 00:11:05,160 --> 00:11:07,240 That top part is going to look the same as before. 159 00:11:08,580 --> 00:11:10,000 We have our mobile station. 160 00:11:10,540 --> 00:11:13,640 Our radio access network, which has our base transceiver station. 161 00:11:13,840 --> 00:11:14,480 Base data. 162 00:11:14,520 --> 00:11:15,040 Station controller. 163 00:11:15,440 --> 00:11:21,900 And then it hands things off to our circuit switched portion still in our mobile switching center and our global mobile switching center. 164 00:11:22,060 --> 00:11:24,340 Now, you notice something here that's slightly different, though. 165 00:11:24,480 --> 00:11:26,740 It's those registers we talked about, right? 166 00:11:26,940 --> 00:11:32,020 Well, now our circuit switched and our packet switched portions both need to consult those registers. 167 00:11:32,360 --> 00:11:37,760 So they're shared between the mobile switching center and the serving GPRS support node. 168 00:11:38,640 --> 00:11:44,500 And in our packet switched portion, we have our serving GPRS support node and our gateway GPRS support node. 169 00:11:44,500 --> 00:11:48,140 And that makes up our core network. 170 00:11:49,140 --> 00:11:53,140 So clearly there should be some lessons learned from 2G GSM. 171 00:11:53,380 --> 00:11:54,280 Let's take a look at those. 172 00:11:55,280 --> 00:11:59,960 We have some mutual authentication, but only for the packet switched portion. 173 00:12:01,340 --> 00:12:05,060 We have authentication between the mobile station and the SGSN. 174 00:12:05,240 --> 00:12:07,680 So you can see on the network diagram where that lives. 175 00:12:08,340 --> 00:12:13,460 Some level of ciphering and some amount of identity verification. 176 00:12:13,460 --> 00:12:17,000 You know, there's small amounts of improvements here. 177 00:12:17,080 --> 00:12:18,200 Bit by bit, we're getting better. 178 00:12:24,000 --> 00:12:24,800 There we go. 179 00:12:25,440 --> 00:12:27,800 And now let's talk about some fun attack vectors. 180 00:12:28,000 --> 00:12:29,100 Now, look. 181 00:12:29,280 --> 00:12:32,180 We still have that same rogue BTS problem. 182 00:12:33,220 --> 00:12:37,180 And then there's this company called P1 Security who I adore. 183 00:12:37,400 --> 00:12:40,360 And they've done some really neat research on telco networks. 184 00:12:41,040 --> 00:12:43,440 And one of the things that they have found is actually, 185 00:12:43,460 --> 00:12:49,140 there are actual implementations of GPRS out in the wild with zero encryption anywhere in the network, 186 00:12:49,320 --> 00:12:51,660 most notably in Italy and Denmark. 187 00:12:53,740 --> 00:12:57,620 And there's a Nokia GGSN attack that was actually pretty slick. 188 00:12:57,840 --> 00:13:01,780 It was able to be taken down or restarted, you know, 189 00:13:01,800 --> 00:13:06,500 which disrupted the GPRS network connectivity for a whole area of users. 190 00:13:06,800 --> 00:13:09,860 So remember where our GGSN sits, right? 191 00:13:09,960 --> 00:13:11,660 It's our gateway support node. 192 00:13:11,840 --> 00:13:13,440 So it sits right on the edge of this point. 193 00:13:13,460 --> 00:13:14,820 It's our core network and reaches out to the Internet. 194 00:13:15,160 --> 00:13:19,580 So this was done by sending non-standard IP options in a packet. 195 00:13:19,980 --> 00:13:24,100 And it happened by just sending this packet from the Internet. 196 00:13:24,280 --> 00:13:26,080 It took down this whole area of users. 197 00:13:29,700 --> 00:13:31,620 And I will, okay. 198 00:13:31,780 --> 00:13:34,160 So I'm not picking on Cisco, I swear. 199 00:13:34,360 --> 00:13:38,880 But their threat bulletins were actually excellent in trying to find some of this information. 200 00:13:39,160 --> 00:13:41,980 A lot of core network features are not, you know, 201 00:13:41,980 --> 00:13:43,000 it's core infrastructure. 202 00:13:43,320 --> 00:13:44,480 They don't want to release things. 203 00:13:44,660 --> 00:13:46,040 But Cisco actually did a lot. 204 00:13:49,720 --> 00:13:55,420 So this gateway GPRS support node of the ASR 5000 series 205 00:13:55,980 --> 00:14:00,340 doesn't actually handle wireless session protocol packets correctly. 206 00:14:00,600 --> 00:14:05,600 So an attacker could craft a packet such that they could bypass a portal page, 207 00:14:05,820 --> 00:14:09,820 which means that they wouldn't have to pay to use this carrier. 208 00:14:12,600 --> 00:14:18,100 On the same device, it also does not verify or validate, I should say, 209 00:14:18,220 --> 00:14:22,340 HTTP traffic properly if there is one or more packets 210 00:14:22,340 --> 00:14:24,400 with additional bytes at the end of the packet. 211 00:14:24,600 --> 00:14:27,940 If you have specific padding, it just doesn't verify 212 00:14:27,940 --> 00:14:30,480 and it can go straight through the GGSN. 213 00:14:33,920 --> 00:14:34,700 All right. 214 00:14:34,740 --> 00:14:36,840 So let's talk about 3G. 215 00:14:37,700 --> 00:14:39,780 We start getting things like video chat. 216 00:14:40,040 --> 00:14:41,880 We're moving on to, 217 00:14:41,980 --> 00:14:43,160 to a new signaling method, 218 00:14:43,340 --> 00:14:44,880 and there's much more Internet functionality. 219 00:14:47,860 --> 00:14:50,580 Visually, it's kind of weird here, right? 220 00:14:50,740 --> 00:14:55,020 Our UMTS implementation is around the same time as GPRS is going on. 221 00:14:55,160 --> 00:14:57,040 So they're a little bit in tandem. 222 00:14:57,180 --> 00:14:58,960 And here is where I'll mention the fact that 223 00:14:59,560 --> 00:15:03,460 none of these actual generations are standalone, right? 224 00:15:03,580 --> 00:15:06,900 All of these things are being used mostly at the same time. 225 00:15:07,120 --> 00:15:08,760 All of these things are still relevant. 226 00:15:11,140 --> 00:15:13,840 So let's look at a UMTS network diagram. 227 00:15:15,340 --> 00:15:17,880 And we're going to keep most of 2.5G. 228 00:15:18,280 --> 00:15:21,420 We still have those registers, our mobile switching centers, 229 00:15:21,560 --> 00:15:23,200 and the GPRS support nodes. 230 00:15:23,820 --> 00:15:26,280 We still need our base station subsystem, 231 00:15:26,440 --> 00:15:28,660 but now our mobile station, 232 00:15:28,780 --> 00:15:32,240 it's going to get a little bit rebranded to our user endpoint. 233 00:15:32,660 --> 00:15:34,460 This is actually the term that I prefer, 234 00:15:34,540 --> 00:15:36,760 so I will continue to use user endpoint here. 235 00:15:36,760 --> 00:15:40,360 But it is effectively the same thing as your mobile station. 236 00:15:41,560 --> 00:15:43,240 Our RAN, okay, cool. 237 00:15:43,420 --> 00:15:45,800 Well, you know, UMTS has to be special, 238 00:15:45,980 --> 00:15:47,300 so they're going to apply this term, 239 00:15:48,080 --> 00:15:49,440 UMTS terrestrial RAN. 240 00:15:49,560 --> 00:15:51,000 It can't just be like every other RAN. 241 00:15:52,620 --> 00:15:55,660 And that's also known as our radio network subsystem. 242 00:15:56,100 --> 00:15:59,820 We also have our radio network controller. 243 00:16:00,060 --> 00:16:03,780 And this is in charge of all of our node Bs connected to it. 244 00:16:04,560 --> 00:16:05,040 And... 245 00:16:06,840 --> 00:16:08,880 it handles mobility management, 246 00:16:09,280 --> 00:16:10,460 radio management, 247 00:16:11,620 --> 00:16:13,260 and adds some encryption. 248 00:16:13,580 --> 00:16:17,320 It honestly looks a lot like our base station controller from before, right? 249 00:16:19,160 --> 00:16:21,020 And our mobile switching center stays. 250 00:16:21,180 --> 00:16:22,780 It changes functionality slightly, 251 00:16:23,040 --> 00:16:24,820 but we're going to sort of gloss over that 252 00:16:24,820 --> 00:16:26,820 until we get to something further on. 253 00:16:27,240 --> 00:16:29,080 So we have our mobile station, 254 00:16:29,220 --> 00:16:30,460 which now is our user endpoint. 255 00:16:30,720 --> 00:16:32,640 We have our base transceiver station, 256 00:16:32,920 --> 00:16:35,880 and this has been now rebranded to our node B. 257 00:16:36,760 --> 00:16:39,280 Our node B then communicates with our radio network controller, 258 00:16:39,560 --> 00:16:42,900 which then hands things on to our core network, 259 00:16:43,060 --> 00:16:44,840 which looks pretty much the same. 260 00:16:46,800 --> 00:16:49,100 This is our radio access network portion, 261 00:16:49,320 --> 00:16:51,580 the previously circuit-switched portion, 262 00:16:51,720 --> 00:16:52,840 and our packet-switched portion. 263 00:16:53,480 --> 00:16:54,860 So what are some mitigations? 264 00:16:55,490 --> 00:16:59,000 Well, technically, we now have true mutual authentication. 265 00:16:59,660 --> 00:17:02,160 So this is mostly an attempt at 266 00:17:02,780 --> 00:17:03,900 IMSI catcher mitigation. 267 00:17:04,600 --> 00:17:05,760 There's literal guidance. 268 00:17:05,760 --> 00:17:06,520 I love this. 269 00:17:07,020 --> 00:17:09,300 Not to keep the same temporary identifier 270 00:17:09,300 --> 00:17:10,980 for long periods of time, 271 00:17:11,060 --> 00:17:12,060 but there's not actually, like, 272 00:17:12,120 --> 00:17:12,880 in the specification, 273 00:17:13,140 --> 00:17:14,340 a definition for that. 274 00:17:15,140 --> 00:17:17,820 There's a lot more confidentiality expected 275 00:17:17,820 --> 00:17:19,500 in our radio access link portion. 276 00:17:21,940 --> 00:17:25,060 And some signaling plane and user plane confidentiality. 277 00:17:27,220 --> 00:17:29,540 And security now gets to be shown to the user. 278 00:17:29,700 --> 00:17:33,560 So if I am in 3G and go down to 2G, 279 00:17:33,700 --> 00:17:35,180 I should now see that on my phone, 280 00:17:35,180 --> 00:17:37,000 usually in, like, a little icon or something, right? 281 00:17:42,100 --> 00:17:42,540 Sorry. 282 00:17:42,760 --> 00:17:43,700 I have beautiful nails, 283 00:17:43,760 --> 00:17:44,860 but they're totally impractical. 284 00:17:45,220 --> 00:17:49,680 So looking at this attack vectors for 3G 285 00:17:49,680 --> 00:17:50,780 in the form of UMTS. 286 00:17:51,280 --> 00:17:54,160 Well, we still have this rogue node B, 287 00:17:54,280 --> 00:17:56,200 formerly our base transceiver station. 288 00:17:56,560 --> 00:17:57,620 That still happens. 289 00:17:57,720 --> 00:17:59,260 It's getting a little bit harder, right? 290 00:17:59,300 --> 00:18:01,020 It has to be a little bit more targeted now. 291 00:18:01,500 --> 00:18:03,300 And there are downgrade attacks. 292 00:18:03,580 --> 00:18:04,780 And this downgrade attacks 293 00:18:04,780 --> 00:18:06,100 are still pretty relevant, 294 00:18:06,260 --> 00:18:07,720 and they are going to continue to be relevant. 295 00:18:08,060 --> 00:18:10,920 And this is when a rogue node B forces a device 296 00:18:10,920 --> 00:18:13,880 to temporarily downgrade its communication standard 297 00:18:13,880 --> 00:18:15,120 to a previous generation. 298 00:18:16,200 --> 00:18:18,920 So my example of 3G to 2G earlier 299 00:18:18,920 --> 00:18:20,200 could have been that, right? 300 00:18:20,820 --> 00:18:24,500 We have remote IMSI attacks as well. 301 00:18:24,700 --> 00:18:28,040 And this happens because there are integrity keys 302 00:18:28,040 --> 00:18:31,260 between our user endpoint and our radio network controller. 303 00:18:31,540 --> 00:18:34,700 But those are actually generated in the core network. 304 00:18:34,700 --> 00:18:37,880 So the core network generates these keys 305 00:18:37,880 --> 00:18:39,000 and then hands them off 306 00:18:39,000 --> 00:18:41,300 to our radio network controllers unencrypted. 307 00:18:41,780 --> 00:18:44,360 And sometimes radio network controllers 308 00:18:44,360 --> 00:18:46,540 communicate this unencrypted as well. 309 00:18:49,000 --> 00:18:51,580 There's also HLR overloading. 310 00:18:51,680 --> 00:18:52,700 This is a neat one. 311 00:18:56,180 --> 00:18:58,800 There is a resynchronization that happens 312 00:18:58,800 --> 00:19:02,920 between your user endpoint and your HLR, 313 00:19:03,020 --> 00:19:04,200 this home location register. 314 00:19:04,700 --> 00:19:08,960 And remember that to get to that HLR, 315 00:19:09,120 --> 00:19:11,220 you have to go through these other devices as well. 316 00:19:11,380 --> 00:19:13,140 And those devices do some heavy lifting. 317 00:19:13,440 --> 00:19:15,120 So what an attacker can do 318 00:19:15,120 --> 00:19:17,640 is repeatedly send this sequence value 319 00:19:17,640 --> 00:19:18,880 for resynchronization, 320 00:19:19,200 --> 00:19:22,160 and in doing so, tie up the SGSN. 321 00:19:26,140 --> 00:19:28,800 So another thing that an attacker can do 322 00:19:28,800 --> 00:19:31,820 with this specific attack is a variant 323 00:19:31,820 --> 00:19:33,780 where they get a list of IMSIs 324 00:19:33,780 --> 00:19:36,000 for a particular mobile network operator 325 00:19:36,000 --> 00:19:38,300 from a particular carrier. 326 00:19:39,020 --> 00:19:42,620 And then an attacker generates 327 00:19:42,620 --> 00:19:45,280 this radio resource control connection request. 328 00:19:45,680 --> 00:19:47,800 And that's for each IMSI on this list 329 00:19:47,800 --> 00:19:50,220 of valid IMSIs for the specific carrier. 330 00:19:50,380 --> 00:19:50,640 Cool. 331 00:19:50,840 --> 00:19:53,200 And each request, the HLR, 332 00:19:53,320 --> 00:19:54,880 the home location register is going to say, 333 00:19:54,960 --> 00:19:55,820 okay, that's valid. 334 00:19:56,080 --> 00:19:58,840 So it starts computing some authentication vectors, 335 00:19:58,940 --> 00:20:01,280 which really is a pretty heavy process for it. 336 00:20:01,380 --> 00:20:03,680 That means that nothing that's actually 337 00:20:03,780 --> 00:20:06,120 valid can get through to that HLR, 338 00:20:06,340 --> 00:20:07,720 and it takes down the functionality 339 00:20:07,720 --> 00:20:10,100 for legitimate equipment to reach out to it. 340 00:20:12,120 --> 00:20:15,480 Again, there's a Cisco SGSN, 341 00:20:15,600 --> 00:20:18,320 actually GGSN in this case, 342 00:20:18,380 --> 00:20:20,120 the ASR 5000 series, 343 00:20:20,380 --> 00:20:23,540 and it doesn't properly handle TCP packets. 344 00:20:23,840 --> 00:20:27,500 So an attacker could reboot the session management 345 00:20:27,500 --> 00:20:31,080 on this device, on the GPRS gateway support node, 346 00:20:31,180 --> 00:20:32,700 causing a denial of service 347 00:20:32,700 --> 00:20:36,340 for all communications with this gateway device, right? 348 00:20:36,380 --> 00:20:38,260 Remember that this is the last hop 349 00:20:38,260 --> 00:20:41,100 between this core network and the wild internet. 350 00:20:43,440 --> 00:20:45,140 So let's move on to LTE, 351 00:20:45,340 --> 00:20:46,640 long-term evolution, 352 00:20:46,780 --> 00:20:48,720 and this is in the late aughts. 353 00:20:51,080 --> 00:20:52,540 So this is fun. 354 00:20:53,460 --> 00:20:56,800 I'm going to refer to it kind of as 3.95G 355 00:20:58,160 --> 00:21:01,320 because initially the, you know, 356 00:21:03,200 --> 00:21:05,400 these standard committees were like, 357 00:21:05,520 --> 00:21:08,020 no, this is not officially 4G. 358 00:21:08,240 --> 00:21:10,140 It doesn't meet RHEL 8 or RHEL 9. 359 00:21:10,360 --> 00:21:12,740 But then after some careful marketing, 360 00:21:12,920 --> 00:21:13,720 they were like, okay, fine, 361 00:21:13,860 --> 00:21:15,740 like we'll consider it 4G. 362 00:21:15,840 --> 00:21:17,620 It'll just be like 4G LTE. 363 00:21:18,580 --> 00:21:22,060 So now 4G, but then sometimes things are called 364 00:21:22,060 --> 00:21:25,560 real 4G, 4G advanced, things like that. 365 00:21:26,300 --> 00:21:29,600 But this is where we get the evolved packet core 366 00:21:29,600 --> 00:21:31,240 or system architecture. 367 00:21:31,320 --> 00:21:31,740 Evolution. 368 00:21:32,700 --> 00:21:35,660 This E in LTE is going to be everywhere. 369 00:21:35,900 --> 00:21:37,280 They're very into evolution. 370 00:21:38,680 --> 00:21:41,260 And we get fully IP-based. 371 00:21:41,440 --> 00:21:43,740 So there's no more separation between our 372 00:21:43,740 --> 00:21:46,600 circuit switch portion and our IP portion. 373 00:21:47,620 --> 00:21:50,340 So let's take a look at what that actually looks like. 374 00:21:50,680 --> 00:21:51,940 We have our user endpoint. 375 00:21:52,660 --> 00:21:55,100 We have our E node B now, right? 376 00:21:55,160 --> 00:21:55,540 It's evolved. 377 00:21:56,100 --> 00:21:59,240 And our node B pretty much did the same thing. 378 00:21:59,480 --> 00:22:01,180 We have our mobility management 379 00:22:01,320 --> 00:22:06,120 entity, which is a lot like our radio network controller, 380 00:22:06,400 --> 00:22:06,720 actually. 381 00:22:06,860 --> 00:22:08,920 It does bearer activation and deactivation, 382 00:22:09,060 --> 00:22:11,480 paging, authentication with your user endpoint, 383 00:22:11,740 --> 00:22:14,240 and directs things to the appropriate other devices. 384 00:22:15,200 --> 00:22:17,220 Now we have this HSS. 385 00:22:18,320 --> 00:22:19,760 I tried to make it legible. 386 00:22:20,000 --> 00:22:20,820 That's what happens. 387 00:22:21,000 --> 00:22:23,700 Well, we have our HSS, our home subscriber server. 388 00:22:24,020 --> 00:22:26,360 And this is taking that home location register 389 00:22:26,360 --> 00:22:29,180 and our authentication register piece 390 00:22:29,180 --> 00:22:30,320 and putting them together. 391 00:22:31,760 --> 00:22:35,540 We also have our signal gateway, our SGW. 392 00:22:35,760 --> 00:22:38,140 And this, you'll notice in the network architecture, 393 00:22:38,480 --> 00:22:41,340 it looks a lot like our SGSN did, right? 394 00:22:41,400 --> 00:22:42,980 Our serving GPRS support node. 395 00:22:43,180 --> 00:22:45,260 It routes and forwards data packets. 396 00:22:46,520 --> 00:22:49,160 We also have our PDN gateway now, 397 00:22:49,320 --> 00:22:51,580 our public data network gateway. 398 00:22:52,100 --> 00:22:56,160 And again, you'll notice that it looks a lot like our GGSN. 399 00:22:56,360 --> 00:22:59,240 It's the exit for outgoing and entry into 400 00:22:59,240 --> 00:23:01,080 the cellular network from the outside. 401 00:23:01,320 --> 00:23:03,900 It does our policy enforcement, our LI, 402 00:23:04,100 --> 00:23:06,320 packet filtering, charging support, et cetera. 403 00:23:06,520 --> 00:23:07,680 And then right above it, 404 00:23:08,460 --> 00:23:11,740 we have this policy and charging rules function. 405 00:23:12,320 --> 00:23:13,860 I'm only going to briefly mention it 406 00:23:13,860 --> 00:23:16,160 because it really usually is part of that PGW, 407 00:23:16,300 --> 00:23:17,360 that PDN gateway. 408 00:23:19,080 --> 00:23:22,060 So what are some lessons learned from before 409 00:23:22,060 --> 00:23:23,060 that we can apply? 410 00:23:23,300 --> 00:23:26,940 Well, still trying at eNodeB security here. 411 00:23:27,580 --> 00:23:28,980 There's now some configuration 412 00:23:28,980 --> 00:23:31,300 that has to be authenticated 413 00:23:31,320 --> 00:23:34,280 and authorized to radio access elements. 414 00:23:34,900 --> 00:23:38,800 The IMEI, your mobile equipment identifier, 415 00:23:39,040 --> 00:23:40,840 is not sent to the eNodeB 416 00:23:40,840 --> 00:23:44,120 until there is some level of security established now, 417 00:23:44,280 --> 00:23:45,560 which is actually a big improvement. 418 00:23:48,080 --> 00:23:50,260 There is now mobility management 419 00:23:51,100 --> 00:23:53,020 split apart in its own entity. 420 00:23:53,320 --> 00:23:54,960 And this is interesting, and you'll see this 421 00:23:54,960 --> 00:23:56,780 through all of the network diagrams I'm showing. 422 00:23:56,940 --> 00:24:00,300 A lot of times, things just end up being the same functions 423 00:24:00,300 --> 00:24:01,300 and getting reforged. 424 00:24:01,300 --> 00:24:04,480 We're taking things like our HLR and our AAC 425 00:24:04,480 --> 00:24:06,180 and combining them and taking other things 426 00:24:06,180 --> 00:24:07,000 and splitting them apart. 427 00:24:09,100 --> 00:24:11,000 So what are some attack vectors? 428 00:24:12,860 --> 00:24:14,700 Okay, there's this super cool paper 429 00:24:15,250 --> 00:24:16,400 called LTE Inspector. 430 00:24:17,020 --> 00:24:19,540 And I put this here for LTE instead of 4G 431 00:24:19,540 --> 00:24:20,640 for obvious reasons. 432 00:24:21,500 --> 00:24:24,180 And they detail a lot of attacks. 433 00:24:24,540 --> 00:24:25,720 It's a very good paper. 434 00:24:26,200 --> 00:24:29,040 One of which is an authentication relay attack 435 00:24:29,040 --> 00:24:29,760 wherein 436 00:24:29,760 --> 00:24:33,040 someone can impersonate a victim cellular device 437 00:24:33,040 --> 00:24:35,620 and reach the core network without possessing 438 00:24:35,620 --> 00:24:37,320 any legitimate creds. 439 00:24:38,720 --> 00:24:41,340 There's also paging channel hijacking attack. 440 00:24:41,600 --> 00:24:43,680 Now, paging channel is probably going to come up 441 00:24:43,680 --> 00:24:44,380 a few times here. 442 00:24:44,480 --> 00:24:45,900 It's a very interesting attack vector. 443 00:24:46,120 --> 00:24:48,600 I'm happy to talk about this after, I swear. 444 00:24:49,220 --> 00:24:52,460 And what happens here is we use our all-time favorite 445 00:24:52,460 --> 00:24:54,660 eNodeB that is malicious, right? 446 00:24:54,800 --> 00:24:57,880 This malicious eNodeB utilizes the same frequency 447 00:24:57,880 --> 00:24:59,740 as our legitimate eNodeB. 448 00:24:59,760 --> 00:25:04,000 And then broadcasts out these fake or empty paging messages. 449 00:25:04,820 --> 00:25:07,200 And this has to be done at the same paging cycle 450 00:25:07,200 --> 00:25:09,640 as our user endpoint and at a high frequency. 451 00:25:09,880 --> 00:25:12,380 But that's still not, like, too bad for an attack vector, right? 452 00:25:12,920 --> 00:25:16,260 So then a user endpoint, fun fact, 453 00:25:16,520 --> 00:25:20,620 only responds to the first message it's received here. 454 00:25:21,320 --> 00:25:24,740 So what happens is if we have that malicious eNodeB 455 00:25:24,740 --> 00:25:27,260 broadcasting out these fake or empty paging messages, 456 00:25:27,440 --> 00:25:29,720 a user endpoint can't receive any value. 457 00:25:29,760 --> 00:25:30,080 So they're going to have to get the valid ones 458 00:25:30,080 --> 00:25:32,660 from the mobility management entity paging. 459 00:25:34,680 --> 00:25:37,860 And from that, let me explain what that means, actually. 460 00:25:37,900 --> 00:25:39,020 Let me take you along with this. 461 00:25:39,120 --> 00:25:41,180 So what that means is they would stop getting 462 00:25:41,180 --> 00:25:46,340 any notification of calls or SMS and fabricated messages 463 00:25:46,340 --> 00:25:47,120 could be injected. 464 00:25:48,080 --> 00:25:50,940 So the next attack is sort of based on that 465 00:25:50,940 --> 00:25:52,340 with this panic attack. 466 00:25:52,600 --> 00:25:54,700 So paging messages are pretty important. 467 00:25:55,080 --> 00:25:57,600 When there's something important that happens in an area, 468 00:25:57,600 --> 00:26:01,580 area, your phone will reach out and be like, okay, like tornado warning, amber alert, things 469 00:26:01,580 --> 00:26:07,420 like that. Legitimate reasons why your phone would alert you, right? Well, an attacker can 470 00:26:07,420 --> 00:26:13,480 inject fake paging messages to arbitrary neighboring user endpoints using these and cause 471 00:26:13,480 --> 00:26:27,580 a psychological attack, cause panic in a specific area through these paging channels. There 472 00:26:27,580 --> 00:26:33,700 are some identifiers. I think I mentioned your IMEI. There are some identifiers that a lot of 473 00:26:33,700 --> 00:26:38,560 people in this room are probably familiar with, your IMEI. Well, internal to the core network, 474 00:26:38,820 --> 00:26:43,840 there are a lot of other temporary identifiers that get passed around as well. One of those for 475 00:26:43,840 --> 00:26:51,040 LTE is your GUTI, your globally unique temporary identifier. There was an interesting talk at 476 00:26:51,040 --> 00:26:57,260 network and distributed system security symposium in 2018 where implementation errors 477 00:26:57,260 --> 00:27:05,760 actually led to this supposedly temporary identifier being permanent. So this would allow an 478 00:27:05,760 --> 00:27:10,040 attacker to determine other identifiers, there's some great info leaks from this, and whether a 479 00:27:10,040 --> 00:27:20,280 target user is actually nearby. There is also another Cisco device, I swear, not picking on 480 00:27:20,280 --> 00:27:27,240 them. So there's this Cisco public data network gateway, 2200 series, and there happened to be 481 00:27:27,260 --> 00:27:33,080 maybe some issues here. Let's look at those issues. Well, there's an issue processing now formed 482 00:27:33,080 --> 00:27:39,680 header info. Okay. Like SIP headers, general headers. Well, there's a problem parsing overlong 483 00:27:39,680 --> 00:27:46,620 messages. Okay. Well, there's actually a problem processing SIP test request messages. Well, maybe 484 00:27:46,620 --> 00:27:54,520 that's okay in a real network. They also have a problem handling session attributes and SIP packets 485 00:27:54,520 --> 00:27:57,240 in general. And MGC. 486 00:27:57,260 --> 00:28:04,920 And MGC packets. So using any or all of these means, what an attacker can do is deny service for the 487 00:28:04,920 --> 00:28:12,100 PGW. So what that happens through these means would be that this PDN, this public data network gateway, 488 00:28:12,240 --> 00:28:19,480 actually wouldn't establish any new TCP connections and will stop receiving TCP connections. On top of 489 00:28:19,480 --> 00:28:26,600 that, no new SIP connections will occur. Though current calls won't drop. So a user wouldn't actually 490 00:28:26,600 --> 00:28:33,740 necessarily know this until further on. It also fails to connect to other services, things like SSH or 491 00:28:33,740 --> 00:28:44,560 HTTP or Telnet, which is often a type of service that would be used to service this device. So let's move 492 00:28:44,560 --> 00:28:51,800 on. Let's cut that device a break and move on to 20 teens. It's finally time for 4G, for, like, real 4G. 493 00:28:58,220 --> 00:29:05,020 So we have a new device. We get IPv6 expansions, adaptive modulation, time varying channels, Volte and 494 00:29:05,320 --> 00:29:13,520 something you might have heard of, this IP multimedia subsystem. Let's look at the network architecture 495 00:29:13,520 --> 00:29:23,720 and it looks the same, right? We have the same from LTE. We have our user endpoint, our eNodeB, our mobility 496 00:29:23,720 --> 00:29:29,700 management entity, our home subscriber server, our signaling gateway, our public data network 497 00:29:29,700 --> 00:29:37,380 gateway, and our policy and charging rules function. So let's move on to some mitigations. 498 00:29:37,700 --> 00:29:43,880 Clearly we've had some lessons learned from all of these things, right? Well, now all radio 499 00:29:43,880 --> 00:29:50,660 interface data shall be encrypted. Previously, the specification said that it should be. 500 00:29:51,740 --> 00:29:57,560 Now it must be. There's also this AKA procedure. This is an authentication and keying 501 00:29:57,560 --> 00:30:03,060 procedure. And this happens in order to have that mutual authentication between our user 502 00:30:03,060 --> 00:30:11,420 endpoint and our evolved packet core. There are different session keys between things. There are 503 00:30:12,410 --> 00:30:17,880 additional mitigations that your mobile network operator may implement or should implement 504 00:30:17,880 --> 00:30:18,820 based on the standard. 505 00:30:20,660 --> 00:30:32,520 So some attack vectors. Look, we still have this risk of IMSI catchers. And this Cisco ASR 5000 PDN 506 00:30:32,520 --> 00:30:39,660 gateway. Now, there is a pre-auth remote attack that can stop ICMP traffic because of vector packet 507 00:30:39,660 --> 00:30:47,540 processing. What an attacker can do is send a malformed encapsulating security payload packet and 508 00:30:48,020 --> 00:30:50,280 stop all of ICMP over IPsec. 509 00:30:51,280 --> 00:31:00,360 It also handles GTP headers improperly. So GTP, I love. But it's this GPRS tunneling protocol. 510 00:31:00,660 --> 00:31:06,700 It's pretty key to a lot of the internal communications of that core network. And this PDN 511 00:31:06,700 --> 00:31:14,640 gateway doesn't actually validate it properly. So sending a crafted GTP packet to this Cisco PGW 512 00:31:15,410 --> 00:31:20,640 will target the session manager and the session manager can get restarted. And that's the way a call 513 00:31:20,640 --> 00:31:28,620 unexpectedly and deny service to a bunch of users. And again, I'm going to shout out to 514 00:31:28,620 --> 00:31:35,040 P1 security. They gave a talk at hack the box and noted that some vendor that they won't 515 00:31:35,040 --> 00:31:43,680 disclose has MME keys that are just hard coded and they don't change regardless. They also 516 00:31:43,680 --> 00:31:49,260 found that there is an MML interface on a PDN gateway. So again, our last hop before the 517 00:31:49,260 --> 00:31:55,440 wild internet. That is just totally exposed to the wired internet, this whole MML 518 00:31:55,440 --> 00:32:03,940 interface. Highly recommend reading their research. It's very cool. So let's move on to 5G. 519 00:32:04,120 --> 00:32:11,440 Right? Like, this is now. It matters. Everyone is interested. Let's chat about the change. This 520 00:32:11,440 --> 00:32:16,400 is where our network architecture is going to change significantly. A lot of times up until 521 00:32:16,400 --> 00:32:19,240 now, we've seen things get shifted around but mostly one way or another, it is actually 522 00:32:19,260 --> 00:32:23,080 mostly does the same functionality. This is where things change because we get network 523 00:32:23,080 --> 00:32:27,960 function virtualization. And that happens because a lot of these functions are running on 524 00:32:27,960 --> 00:32:35,340 COTS servers. So we also have this management and orchestration that is needed in the core 525 00:32:35,340 --> 00:32:39,840 network. So it's officially part of our core network. And this happens because we have all 526 00:32:39,840 --> 00:32:43,480 these things virtualized. We're just sending API calls and we need some kind of driver and 527 00:32:43,480 --> 00:32:49,160 that's this orchestration piece. We also have the concept of network slicing. And this is 528 00:32:49,160 --> 00:32:54,920 just creating logical networks over the same physical infrastructure. So a lot of that 529 00:32:54,920 --> 00:33:02,260 arises from the need that in 5G we no longer expect everything to be IP based. So we have 530 00:33:02,260 --> 00:33:08,300 different types of devices all converging in the same network. So we need different quality of 531 00:33:08,300 --> 00:33:13,320 service for these different devices. So network slicing allows us to have things like your 532 00:33:13,320 --> 00:33:18,300 smart meter, your car, your voice call, which all have different user expectations and 533 00:33:18,300 --> 00:33:19,020 network demands. 534 00:33:19,020 --> 00:33:28,680 To be able to have those. Oh, P.S., also, our A node B becomes our G node B. So here is 535 00:33:28,680 --> 00:33:38,680 where we are in our timeline again. Shiny new radio. Let's take a look at this network 536 00:33:38,680 --> 00:33:44,340 architecture. Well, first, let me explain. There's a lot of new acronyms. We mostly have 537 00:33:44,340 --> 00:33:49,000 that. E node B becoming our G node B. We also have. And we have a lot of new acronyms that 538 00:33:49,000 --> 00:33:49,860 we use. So we have our access. And we have a little bit of a problem here. So we have access 539 00:33:49,860 --> 00:33:54,960 and mobility management function. Our AMF. And this is similar to our mobility management 540 00:33:54,960 --> 00:34:01,940 entity, does subscriber mobility registration some security. We have our SMF, our session 541 00:34:01,940 --> 00:34:08,140 management function. And this does session management. We have data network profiles, user 542 00:34:08,140 --> 00:34:16,000 plane function selection. If it is IP based, it will determine its IP. Our user plane function. 543 00:34:16,000 --> 00:34:19,920 and this also would have been part of our MME our mobility management entity 544 00:34:19,920 --> 00:34:26,000 and it is our anchor point for NG RAM which is this version of RAM it's just 545 00:34:26,000 --> 00:34:35,540 the same radio access network with a new label we have our UDM our unified data 546 00:34:35,540 --> 00:34:39,520 management this is going to do a lot of that orchestration that I mentioned it 547 00:34:39,520 --> 00:34:43,860 has access authorization registration mobility management some data network 548 00:34:43,860 --> 00:34:48,260 profiles as well and it mostly communicates with AMF access and 549 00:34:48,260 --> 00:34:53,300 mobility management function and our SMF our session management function to 550 00:34:53,300 --> 00:35:01,300 determine what users can do or access we also have our policy control function 551 00:35:01,300 --> 00:35:06,200 how this is slightly different than our PCRkeit before this does dynamic policy 552 00:35:06,200 --> 00:35:12,400 decisions and conditions. it's like are there things in the network that affects 553 00:35:12,400 --> 00:35:13,840 the user, conditions in就 product are, is it a solution or not? 554 00:35:13,840 --> 00:35:21,540 the network or what can the user do? So visually, let's step through this because some parts of 555 00:35:21,540 --> 00:35:27,680 this are still the same. We still have our user endpoint and now we have our G node B but it's 556 00:35:27,680 --> 00:35:34,240 still, you know, receiving that signal from the phone. We have our user plane function at the end 557 00:35:34,240 --> 00:35:40,240 of that row. We have mobility and quality of service flow, policy enforcement. Above that we 558 00:35:40,240 --> 00:35:49,660 have our AMF, our access and mobility management function. We have our SMF. We have our SMF doing 559 00:35:49,660 --> 00:35:56,140 session management, communicating with that AMF. We also have our PCF, our policy control 560 00:35:56,140 --> 00:36:01,640 function. And above that we have our UDM, our unified data management. And you'll see that it 561 00:36:01,640 --> 00:36:07,420 communicates below with our AMF and our SMF, our access and mobility management function and our 562 00:36:07,420 --> 00:36:10,060 session management function. So it communicates a lot. 563 00:36:13,120 --> 00:36:20,320 Also, our public data network is now often just referred to as our data network. And sometimes 564 00:36:20,320 --> 00:36:23,800 our radio access network is also just referred to as our access network. 565 00:36:26,280 --> 00:36:31,660 What are some mitigations? 5G obviously has had a lot of eyes on it and a lot of folks even 566 00:36:31,660 --> 00:36:39,800 considering security. Upfront I should say. So instead of just our MZ, now for 5G we have our 567 00:36:39,800 --> 00:36:40,220 Suki, and the Suki ISK. We have the cable for charging. We have the cable for charging. We have 568 00:36:40,220 --> 00:36:46,580 and our supi. Our supi is our subscription permanent identifier. Another 15 decimal string. 569 00:36:46,880 --> 00:36:54,820 We have our suki, our subscriber concealed identifier. So these two identifiers combined are 570 00:36:54,820 --> 00:37:00,500 what get partially what get handed around through the network. But this was a means to defeat 571 00:37:00,500 --> 00:37:05,960 IMSI catchers and not just rely on that one identifier being compromised. There's security 572 00:37:05,960 --> 00:37:12,640 and mobility separated in the core network. Larger keys. There are additional means to 573 00:37:12,640 --> 00:37:19,540 protect user messages. There is a counter to mitigate replay attacks. And there's this 574 00:37:19,540 --> 00:37:25,440 security anchor function. Now, I didn't put that in the diagram because it's often actually 575 00:37:25,440 --> 00:37:31,920 co‑located with your access and mobility management function. But it also allows for 576 00:37:31,920 --> 00:37:35,940 devices to move between different networks without having to have access and mobility 577 00:37:35,960 --> 00:37:41,400 to renegotiate the full AKA, that full authentication and keying procedure. Now, I know that sounds 578 00:37:41,400 --> 00:37:46,580 like maybe that's not the best idea. But part of this came about if you think about our HLO 579 00:37:47,280 --> 00:37:51,940 overloading where we could have that start creating these authentication vectors and that 580 00:37:51,940 --> 00:37:56,580 would tie up a whole device. This was actually a mitigation to help prevent things like that. 581 00:37:58,620 --> 00:38:04,860 So some fun attack vectors. No key is head of product management security. Patrick Rude. 582 00:38:05,960 --> 00:38:11,060 Actually said at a talk that because there are so many different types of devices connected to 5G 583 00:38:11,060 --> 00:38:20,840 networks, there are 200 times more attack vectors in 4G. I think we're going to find out. So let's 584 00:38:20,840 --> 00:38:26,300 talk about this specific attack. And I have so, so many references. And I realize that these 585 00:38:26,300 --> 00:38:34,400 slides are being released, I swear. There is this very interesting attack where an attacker can sniff 586 00:38:35,960 --> 00:38:43,020 this AKA procedure. So this authentication and keying protocol, it's actually transmitted in plain 587 00:38:43,020 --> 00:38:47,940 text over the air. So this can be used by an attacker to determine the target subscriber's 588 00:38:47,940 --> 00:38:55,380 presence in a specific cell. How that happens is there is you place a sniffing tool and monitor for 589 00:38:55,380 --> 00:39:02,640 an authorization request. From that, there's a response with this rand and an odd. These two values. 590 00:39:02,640 --> 00:39:09,500 From that value, an attacker can craft a message, putting those together, broadcast that out. 591 00:39:10,220 --> 00:39:16,980 And what happens is it's going to broadcast that out to a whole area. When it's not the target user 592 00:39:16,980 --> 00:39:23,440 endpoint, it's going to fail some MAC checks, makes sense. What happens when it actually hits the 593 00:39:23,880 --> 00:39:31,180 target victim's user endpoint is it'll pass that MAC check, and it'll fail a sequence number. So it 594 00:39:31,180 --> 00:39:32,620 doesn't sound very sexy. We're going to tell you what. So we're just going to go ahead and store the thing. This 595 00:39:32,640 --> 00:39:36,440 what you get from that is knowing whether a specific user is actually in a specific cell. 596 00:39:41,140 --> 00:39:48,640 Some more fun attacks. There is attach request injection. It's not ‑‑ there are these 597 00:39:48,640 --> 00:39:53,040 attach requests that are sent unencrypted to the network. It's not integrity protected 598 00:39:53,880 --> 00:39:58,820 and there's a point in the registration process that can be tampered with because registration 599 00:39:58,820 --> 00:40:03,040 process is actually not stopped if there is a failure, if there's an integrity verification 600 00:40:03,460 --> 00:40:11,520 failure. So the attach request can pretty easily be modified along the way. There's a battery 601 00:40:11,520 --> 00:40:17,520 draining attack and this is ‑‑ I believe this is also a paging channel. So there are 602 00:40:18,260 --> 00:40:23,340 power saving mode, like messages that can be sent from your mobility management entity, 603 00:40:23,460 --> 00:40:28,400 which here is our AMF, our access and mobility management function. So that would be a 604 00:40:28,400 --> 00:40:28,800 valid use case. If you're using a mobile phone, you're going to want to make sure that you're 605 00:40:28,800 --> 00:40:32,640 using a mobile phone. What an attacker can do is actually turn that option off and say that 606 00:40:32,640 --> 00:40:37,100 that can't go through. So then your mobility management entity, here our access and mobility 607 00:40:37,100 --> 00:40:41,860 management function, can't send through a message that says turn power saving mode on, 608 00:40:42,080 --> 00:40:47,220 which means that the battery then drains five times faster. It's being used for things like 609 00:40:47,840 --> 00:40:53,240 signaling measurements and other modem activity. Yes, sending malformed packets 610 00:40:53,240 --> 00:40:58,160 can still trigger crashes in the core. There are some fun stream reuse attacks 611 00:40:58,160 --> 00:41:05,080 where an attacker can masquerade as a valid network function, send multiple TCP streams and 612 00:41:05,080 --> 00:41:12,580 lead to stream ID exhaustion. Can also send a malicious stream close identifier in that same 613 00:41:12,580 --> 00:41:21,880 connection and cause a server crash still. And this is a fun one. It is documented pretty 614 00:41:21,880 --> 00:41:27,340 heavily in a paper I have in my references. There was this paper that did a bunch of processing of 615 00:41:27,340 --> 00:41:32,900 standard specification documentation with machine learning to find an end to end vulnerabilities. 616 00:41:33,300 --> 00:41:37,820 And they found some very interesting things. One thing was some issues with paging, this 617 00:41:37,820 --> 00:41:45,060 attached procedure and some service requests. And what they found was that there were some issues 618 00:41:45,060 --> 00:41:50,440 with this mobility management entity, those specific messages. And there was a confirmation 619 00:41:51,480 --> 00:41:57,000 by China Unicom that this has, this is a real concern. It's not just theoretical. 620 00:41:57,340 --> 00:42:03,620 It's a real issue. Maybe it definitely happened. This was documented on CNVD and CNNVD at some point 621 00:42:03,620 --> 00:42:10,260 apparently. But it's very hard to find. So I encourage you to go find more. There's also some 622 00:42:10,260 --> 00:42:14,560 interesting recommended reading on this with piercer and torpedo if you're interested. 623 00:42:15,600 --> 00:42:21,660 So I know. That was a whole lot. We have covered far and wide a lot of cellular technology. 624 00:42:22,120 --> 00:42:26,240 There are a lot of acronyms and I tried my best to break this down for you. 625 00:42:27,340 --> 00:42:34,780 It's a lot. There's no way around it. We've covered 2G in the form of GSM. We covered GPRS. 626 00:42:35,180 --> 00:42:43,060 3G in the form of UMTS. LTE. We covered 4G. We covered 5G in the form of new radio. We 627 00:42:43,060 --> 00:42:47,800 have done a lot here. And I recognize that. So please, if you guys want to have any 628 00:42:48,380 --> 00:42:51,820 future conversations with me, I highly recommend it. These slides will be out there. 629 00:42:52,160 --> 00:42:57,040 I do happen to have a 65 minute version of this talk that I also will probably be 630 00:42:57,040 --> 00:43:00,780 putting out there if you're interested, which will have a little bit more on the radio access 631 00:43:00,780 --> 00:43:11,460 network portion. Yeah. Here are some references. I don't actually, no, I, yeah. I'm about to get 632 00:43:11,460 --> 00:43:17,320 the hook. So I don't think we have time for questions. But I appreciate your time. Yeah. 633 00:43:27,040 --> 00:43:27,620 Thank you so much for having me.