Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/349 Thanks!
Thank you. Welcome to our talk.
So this is Alex on the elevator
and I'm lonely.
And, um, we are from, uh,
Puan Security presenting about,
uh, the mapping of S7.
So I guess most
of you have seen the talk from
two years earlier and,
uh, from, uh, several Couston.
So this project
is more going massive and,
um, with the different vulnerabilities
that were presented in the past,
including the vulnerabilities presented
today, uh, by Couston and obviously
getting a view of these vulnerabilities
worldwide on, um,
on all the countries and how to make
a map from this to see
what's the exposure worldwide on this
winnability.
So this is, um, appearance, security,
uh, research project.
Um,
and so as you saw the
talk maybe earlier, just to get a view,
who knows how mobile operators
worldwide are interconnected?
Who has an idea? Please raise your hands.
OK, not much, maybe five percent.
OK, so basically
these are two operators
and, um, two mobile operators
in the world. They are interconnected
together by, um,
providers called SICP providers.
And that's how
you are going to be able to make calls
between countries.
It's because they are interconnected.
And so this was proposed for a long time
to be a walled garden, um,
because it's a closed network.
So mobile operators are interconnected
workflows network.
But more and more, as we saw, uh,
many times in previous presentation, it's
not a walled garden anymore, um,
because more and more operators,
more and more third parties are connected
to the ACP providers.
And also some parties are connected
directly to, uh, to an operator,
for example, governance for legal
interception.
Um, operators also
also, uh, of course, connected to
Internet, to Jarek's,
uh, providers, uh, values,
Internet services provided by other
companies. And that is exposure on
the network.
So our
goal here is to make a map
of this world internal
private network like you
have had and, uh, mapping
on Internet here, it's a mapping on the
Seven Network.
So in order to do that, um,
we perform the, um,
we we created partnership with
the operators
in order for them to to help us making
this. So we do it by,
uh, having a
scan inside the network of,
uh, one partner operator.
And then we send
call flows towards other, uh,
operators, and we do that from multiple
operators. And so we get a
view, um, of the network.
What's important to to understand here is
that our, um, s7
map, uh, scan program
is inside the range of the operator,
but is not considered as trusted.
It's not in the roaming agreements lists.
So basically it should not get
answers because it's not a trusted node.
So what we wanted to show,
it's since
the attacks, face of operators are
increasing a lot, a lot of third parties
are interconnected on the operators.
We saw that the time to compromise
for an operator during our mission, it's
like we saw less than when our attempt
to compromise on from Internet
to the IP goal, which is the IP called
supporting the old telecom network.
So if you compromise things like it,
because the Peace Corps, in less than one
hour, you could get to the core network
directly right after.
So the goal is three to
two to show you that
compromising is a seven network.
Even if you don't have access and if
you don't have a collaboration with an
operator
to get seven access
for attackers, it's not
so hard to get one maliciously.
So we built a compromise chain
to show you first how
attackers could use existing assessments,
attacks on existing network elements.
To to be able to send messages
and this could come from Intel,
from William compromise
from a government
that can use also
is interconnected with network elements
for energy purposes.
And as Laura
said, operators,
when they want to interconnect with each
other, are roaming
roaming agreements on this roaming
agreements that define
the define every network elements
that they want to be in this room.
In agreement with
Jessamy, regs are 21
files which contain
all the network elements,
global title, which is IP of
network elements.
So it will be a phone number of
international phone number
that you will be able to on.
You will be able to access through this
global data.
But what is really interesting is this
file. We get it from the Internet, so
this should be completely private.
But on the Internet you can find
are 21 files
publicly available.
So you will find internal gytis
of operators directly accessible from the
Internet. So this is one of
our sources.
And you see also vendors uses
a network, Clokey network location,
networking equipment, location directly.
So it is already useful for
us. But you see also
Asgeirsson, which is on the
packet part of the network
you see is a public ipis
of the Asgeirsson.
So it's not really public, it's
in the ranges of public APIs, but there
are private for Jarek's network.
And this means that you could take this
IP and you could check on
the Internet if they are not reachable,
because normally they should not be
reachable because it's inside a private
network.
But if it's something
Michael figured you could access
a.
And on Sudan, you
can find a lot of Gessen's.
That should not be accessible on the
Internet directly on
this was only aquaria, Jason
on Trudel.
So now let's take a look on
what we can do on what
is inside an operator that
we can do.
So the first thing it's taking a look
to how its address
an operator.
So how is the address and operator?
Usually you will have it will define
a prefix.
So, for example,
on this operator, it will define
like ranges
range only for network elements.
It's always done because they wanted to
have all the network elements into only
one range,
but maybe since they are
adding more and more network elements
that will add all the ranges.
So it's
in the ranges are
so large that if we are not doing
this smart approach
of trying to understand how
it is, build the addressing space
of an operator, you will not be able to
find this network.
So just just to give a little
view on this, the numbers here are global
titles. That's how network elements
on the seven are addressed.
So, um, the address space is
much larger than IP for for example.
So you can just scan sequentially.
You have to find tricks like on IPV six.
So, um, basically that's why we are
going to explain the different terrorist
bases.
And when you take a look to network
elements in this other space,
you will have the HLR, which is the main
database, Moundsville, are
handling the
switching where
users attach I.
N so intelligent network for postpaid
prepaid options
testbed.
Again, the message and all of this
network elements, usually
they are well separated and they are
packed. So if you find one,
if you start to go incremental, you will
find others.
OK, but did you
see any problem on this slide?
I see one. I see a test bed
which is directly on the on the
projection ranges of the
operator on this.
It's often the case because they wanted
to keep always all this network,
the network elements inside the same
Renji range.
So that but also
the test bed into the
gitti live ranges.
So but the test bed
usually is accessible for testing it.
It's accessible for developing new
features for new
people inside the company.
So it's way more accessible than
the life network.
So the thing is, if you are able
to get into the test bed, you will be as
the network able also to send
S7 messages.
So it's it could be one
way so that it can
get the entry point.
And what's funny that sometimes that has
been it's the the reverse.
It's more secure than prediction.
We've seen that also.
So it's full of oddities.
The the Seven Network, it's really
strange and sometimes it's more secure
because in production they take the
test, but they validate and they then
they needed to be more maintainable
quickly because they wanted to work.
So they removed some security features.
So it's really valuable.
It's special.
And if you take a look to the addressing
evolution, so at the beginning of the
networks, they are like small
ranges, so small numbers
and they increase the length
of the digits.
So every time they increase the length
of the digit, sometimes
you will find all network elements
in smaller ranges, even if subscriber's
have been merged into new ranges,
the network and sometimes they are in
smaller in
smaller global titles or smaller
prefixes
for for old technologies.
So this one is how
the Indian network is built,
so we removed that is that
the Indian network was built in
circles, that that means
that every region of India has its
own S7 network
and that we're all interconnected
each other.
So this it's a good
point to know, because you will know that
all the network elements are not
sequentially in one on
one sequence of digits,
but there will be
one sequence for every region.
So you will try to find this sequence for
all the regions of India.
So it's really interesting to try to
understand how the
network is built for the country
to be able to to
to understand it.
So another thing is
when someone buys another
one of those telecom operator buys
another one, it will add more
network elements into his
pool of network.
And so.
And you would think that it's always a
good thing, a good thing to take a look
to all, for example, for
all the major ones that will have
operators in all the
European countries, for example.
So it's it's interesting to take a look
to because sometimes,
for example, one country will be more
vulnerable that than another.
But since it's a huge company,
that will be directly interconnected.
So if you are into
this into
the country, less secure, but you
have a direct connection to a more secure
country, it it's not secure anymore.
Telecom regulators,
this is because, for example, for France,
we are three three six four mobile
phone mobiles and now we have three three
seven. But since three to seven, it's a
new one.
Don't even take a look because there will
not be any network element
inside this Frenchy's.
OK, it's new ringy, so no network
elements.
Something funny on this one,
during our scans, we
we remarked that when we
were trying to send when
we were sending seven messages to
Costa Rica subscribers, HLR
from Spain was responding to us.
So this means that
the operator
from Costa Rica had
the part of his network still in
Costa Rica, but the HLR was Hispan.
So maybe focus on optimization.
To get all the subscriber in to only
one, it should also yeah.
So now what? What we want to do is
send the messages because we want to be
able to send messages.
And the first thing that we want is
to try to scan the network so
we can do it in two
phases.
The first one, we will
try to get directly to the operator
and to get to each of the HLR.
You have a lot of messages that
as input you have only to put
to two to give a
subscriber number.
OK, subscriber, my suggestion.
So this note, this message, you
give them a subscriber messaging,
you send them to the services
of a network and in the rooting
of the network, the
router. This is a router
system and a router will know that, OK,
it's one of my subscribers who I give it
to to the HLR.
So they will respond to us, even if it's
written about it will respond
to us. So it's still interesting to know.
And the second case is to use, as
we saw before I r21
the you, but even your
Esmie SBC public gitti
this one, you have it on your SIM card,
right. You will find them
on the Internet, the public services.
And usually, since all the network
elements are close together,
if you if you take the jobs WWC,
maybe by incrementing, you will find the
other ones, it will not be so
complicated.
So maybe not.
Maybe yes. So it's already a good
start because it's your first
Gytis that you will love.
So this one, it's
a tick up, tick up scanner.
So we can incrementally,
as it is for the SSN,
which is like the support
for HLR.
And when we got in about.
You have two kids, all you single.
OK, Rachel, I respond to me
on the second one is OK, it
is the Nexus seven firewall
blocked me on.
You sent me an upvote.
So you are two
cases, but at least usually
when it's when it's a firewall,
it will get will as
a source your own Gitti.
So all the messages that
you inserted as this nation.
So you will know that it's the
firewall if you have a different
gitti which is responding to you.
You have more chance that it will be a
real networking event, so Rachel.
So as we see, all this
network is full of oddities, um,
one network can behave in a way and
you will, uh, scan another one,
it will behave completely differently.
Maybe the HLR will not be responding and
it will be some firewall in the middle
that will, uh, not even put it.
So, um, from all
of these behaviors, uh, we
built, uh, scan engine, um,
and taking taking some,
uh, public data sources as input as well
as private data sources in order
to build, um, kind of,
uh, mobile operator database.
And then the goal was to check
the reality of all this data with the
network.
So we take data from, uh, from
Internet, from, uh, species
ASPCA from a to you from
some a21 or so can be good.
Uh, good start also from,
uh, attack reports from, uh, from
operators in order to to put,
um, some risk already
at the beginning inside the enslaver
ratings or this, we give it to a
scan engine that will, uh, render the
um, send the messages on the axis
of a network.
And from this we are going
to generate, um, mainly,
uh, these four items.
So the seven websites that
we are going to to release now,
uh, ratings per country and
then, um, some
that are private, um,
operator security details.
So we plan to release this
publicly in the future.
So maybe six months that was planned
and also a threat intelligence, um,
on the Seven Network, because we want to
give operators a chance to first,
uh, contact us
and we will send them directly,
uh, privately the status of
the operator.
So we won't we don't want to give
it directly, publicly, but first
give a chance to operators to ask us
and we will send them directly.
This data.
So it will be released today is only, um,
the, uh, the country, uh,
level of security from the
seven remaining infrastucture.
So in order to make this map,
we need to send a lot of data and so
in order to then, uh, start to
visualize it, see what what message
work, what doesn't.
Um, we we
took, uh, we generate some graphs.
We try to understand the networks.
So, for example, here, um,
we send different type of messages that
what you see, um, at the, uh, at
the bottom. So no one wants
a Soraya's MSRA, um,
also interrogators PSA that are less
common and we see how the network
behaves.
So here I
started to we started to list different
kind of errors.
But there are many, many kind of errors.
And it's those oddities that will, uh,
that will actually give us more
insight on how to to map the network.
So on this one,
um,
what we see mainly is that.
Many countries, many operators
are answering actually to the requests
that we send them.
So it's
there are four lines each time
the first one is positive and
then you have no answer.
And then you have two type of errors,
different type of errors.
This is for Etai.
This is a Saroyan PSA.
So you see that on this line,
one that is drawn every time.
Um, it matches.
It means if I have one that here, it
means that, uh, and so I had a positive
answer.
So very often the balance
of positive answer are quite, uh,
quite dense and, um,
even unnecessary.
And messages that were discussed
by, uh, Tobias Angaston earlier.
You see that.
Yeah. The they are very much answers,
even if they should not be allowed in at
zero. That is the um, I Nathuram
in international basically for an
operator.
And at the at the beginning we
should not even have any answer for any
of these messages because the guy from
where we scan was not in the room
in Listing's.
So once and some
more oddities of a seven.
This is the delay, um, depending
on the message that we send.
Those are the different colors and the
type of results that we get.
So you see that, for example, uh,
sometimes we get until 10 minutes after
the, uh, we send the message to an IP.
You would not even think about that.
How can, uh, machine and certainly
not after we see some of this.
Um, sometimes.
So this this was
a special case.
But you see that even
if the majority of messages are very fast
to be answered, there is still a big,
big part here
that take between 10 seconds and one
minute to get answers.
And this depends on the countries.
Um, so this is also the delay
time, uh, way to
to fingerprint the network and try to
understand it and to map it,
to see the different behavior and see,
OK, this country is behaving like
another one. Why?
Maybe they share some specificities.
Maybe it's a vendor related,
maybe it's something else.
Maybe there is a problem.
So from all this data, um,
then we build algorithms
in order to extract
the ratings and then ranking
for countries and then map.
So, um, basically we split
our ratings into two main
parts.
So network exposure, which is operator
related, uh, it's about
the exposure of
the network itself and also prevents
leaks from it's
related to the customer, meaning all
of us.
So it's, um, it means
if, uh, that's my
my country or my operator really
protecting my private data private, that
I can mean, um, location.
It can mean also authentication
vectors. Because if they are uh,
if they can be, uh, obtained by
someone else, then this someone
else can impersonate the network for
example, and then intercept, uh,
intercept your calls and decrypt them
like uh like Tobias um,
like Guston presented.
And so these ratings, OK, they are
complicated. We will post, um,
we will have Blockbuster for those that
are interested, uh, link it to the
website with explanation's deeper on
this.
So, OK, now let's take a look to
to the website.
Um so
OK.
So this is this is
a website which will be relay's
really soon.
So what you have, you have a global
risk, which is
a gulf between
the previous leak and the next network
exposure. So first, I will show you
on the side.
So when we take a look to the
previous tab.
What we see it again
is first there is there
is there is some countries
in blank.
This means that we do not have yet datas
and since it's an in progress
project, we will improve
it and we will add more and more details
during after that talk.
So in the next month or so, for
example, if we take a look to the
United States, because there have been
like in the center of all the
discussions about
intercepting calls
and all this talk
we are giving.
Page. So this one will be directly
accessible and will be directly public
because it's for the country and not for
specific operators.
So we will we
will give
on the operators that we have
the data that.
That we have been able to to
to so, for example, for the presidency,
what we are testing is we are testing,
for example, if there is some message, is
disclosing the precise location
of the user.
So the first one will be disclosing
messages which are like
less accurate.
And the second one, which is this one,
will be disclosing selectees
coordinates for PSAT, PSL
messages
and so on.
You have also all the other messages.
So, for example, the authentication keys
for SETI, you have prepaid
postpaid subscriber status for
interrogators and
other will be added.
So, for example, the voting on watching
bypass will be will be added soon
because we are still processing a lot of
data that we have.
And the goal really is to give
an overview of the vulnerabilities that
we will be able to find
in the operator of this country
and to to really
try to get a good
vision of the security
of the country.
So, yeah, United States are taking
everywhere, everyone, but still
not securing so much as a network.
So how we did it for privacy,
so for the privacy
part, first
we took messages such
as references Azariah, Terrorism,
HCI and sending this
one only the
only took input, the Malaysian,
which is a subscriber number.
So what we did is we did were scrambling
to get a lot of at the end.
So I don't remember the number of
messages that we got, but thousand
of them. Thousands.
Yeah, exactly. And so
the number is we get all
the messages on first.
We sent the
mathematicians for all this
for all these messages.
The only ones that need another entry,
it's the psoriasis which needs
the jemal.
This one should be private.
But sometimes you are able to get
it because you
can. You can or
sometimes it's not
filtered properly. So that will not
filter on the GMC Gitti.
So we saw that on some on some
some countries that are like giving
directly the incident
on the mercy of
SARS. Yes, but OK,
so this message is what they will give in
in output will be the emcee, the
MSE JLR on message
on the HLA fingerprint.
We have been able to get to fingerprint
Etchells through this
bite by really
analyzing a lot of data, as we have been
able to, to directly
fingerprint Etchells, to be
able to say, OK, this HLR it from
Ericsson, this brand, it's like
we are being able to identify there is
a brand of HLR, not exactly
the vision, but at least
a brand remotely,
directly, remotely
so after.
So we get on the message
out where the subscriber is attach.
So now we can send another type
of messages, which
are the interrogator says
the cell phone, send
it on vacation info for the
authentication of the subscriber.
So this will give you the
cryptographic key of the subscriber,
the TSL on the side.
So the PEIRSOL will give you directly the
coordinates of this subscriber
on the PSA will give you, as
the said. But if you are selected,
you will be able to get the GPS
coordinates also.
So this is really interesting.
And this is basically a progress
map, how can you from only a few
informations get to the idea
to give a picture of what's actually
inside the scan engine, that
we have a part of it?
So, yeah, only from
the end getting all this information.
So this is a
little recap of all the messages
that we have been with that we sent
on the network, and as
we can see, like atypia,
say, on Peirsol, are the more
and more impact because they are looking
directly to the locations, the precise
location of subscribers.
So this is really interesting for us.
And also a surprise.
Sometimes you have also slightly, but
it's not so often so.
Oh, we took an example also for
my PTA, for example,
if we take a look to the specifications
or CGP specification,
we see that only
the location management function should
be able to send.
My picture is to the HLR.
This is a local node.
OK, so only the local node,
the management function, local node
should be able to send my pages
to switch it up.
So this is for 2G and 3G usage, but
for 4G is
something else.
So the HSF, which is,
which is replacing the HLR for
4G. So the database for 4G.
Is can be can also
send Matt here is to the.
Always internal that.
And this HCI, as
we say, is giving
at the edge of
the location and the
subscriber's state.
And what we saw by analyzing all the
data that we got is that
on the map, HCI, only
29 percent of the
of the networks of the
requests that we sent were responding
correctly to the map with the slides
with a real slightly.
But if we take a look to map Malaysia,
which now it's not
so well known, then
Malaysia, because Guston and
Tobias speak about HIV, which
is not well known on all the German
or the German menus, are blocking it.
But if you take a look to PSA,
you have 82 percent of
the requests that we send,
which were responded correctly
with a slide into the PSA.
So this means that, OK, is
it picture? It's not working anymore.
Let's go to PSA and it's always
like that. You will always find new
vulnerabilities on the Seven
Network to get information
from it.
So really, our goal was to get
an overview statistics because
vulnerabilities we have been
exposed them for years.
And it's we wanted
to really get an overview,
a worldwide overview
to see that, OK, my PCI.
It's responding, but not so much, but OK,
let's use maps.
By the way, this one, it shows us
some mentality of the operators is that
it has been discussed much earlier.
So now they are looking it's like,
OK, this message is bad.
We just block it. And sadly,
many did not think wider
and think, OK, maybe we should
take this seriously and see what
are the impact of all the messages and,
um, work together with people doing
research in the domain in order to really
have a clean, uh, filtering
on the perimeter boundaries.
So the evolution is that
maybe, uh, ten years ago, AJ
was answering everywhere.
Now it's much reduced.
But PSA that has been less discussed.
Uh, operators are
still widely, uh, vulnerable.
And, um, so basically,
this is A.T.M., 82
percent of the, um,
the operators worldwide answering,
to be exact. So it's pretty well.
So one of the recommendations that we
give to operators, it's OK, you should
block it from NATO, that
it's pretty
clear now, but you have to type
of defense, you have the first step
of defense which will be blocking it on
your router.
But the second one will be defense in
depth by blocking it directly on your
HLR, because, for example, maybe
you will deploy another FCP with
and you will forget to
put these rules or maybe the
routine will go will come from a
national interconnection and you don't
have this a filtering rule through
it.
So always the best,
not only on the edge of the network to
put your filtering, but also
to put filtering in depth directly
on your HLR.
Because you can bypass filtering
at the edges if it's not well done,
but the
filtering indef, it will be harder to do
it.
And one really interesting things to
do is since we have
ideas, he's also on telecom operators.
We are monitoring Muppet's here is coming
from the international.
And this is really interesting because my
picture is I should never come
from international.
So if you if you see them,
it's like, OK, maybe it's compromise.
Maybe it's coming
from a film that wants to locate
users. So monitoring
my page is really good.
So now
let's take a look.
To the network exposure.
When we take a look to the privacy part.
OK, it's look pretty yellow, but
when we go to network exposure, but.
It's a bit more complicated for four
operators and why,
for example, if we take again the United
States.
Why it's worse than
on network esposa than on
previous rigs.
It's because at the beginning,
a lot of small operators
built the network OK,
but after time.
After time.
One operator bought another and
they grew up like that, but
they like they built a network by buying
other operator in the region
of the United States, but
it's other to to try
to build security when you are
buying new operators than
when you are building your own network
directly.
So it's one reason why
the United States, if you
should take a look to the network
exposure level, you will have
a larger attack surface than
on the previous level.
So and
this it's like you will be able to
directly target network elements.
On the Seven Network
of United States, for example, so
the the idea of this, this
data is for both operators
to see, OK, what's
at first countries to see what the level
of security and also for users
to see, um, for countries
and operators. OK.
Actually, uh, my country is not
my operator is not taking seriously
the um uh
the the notifications from the uh, the
security community saying there are
problems.
And I said seven, you should take this
seriously because it has impacts on our
privacy. People can track us.
And so it's also in order to
to push this, of course, some operators,
they they have done a great job,
um, at filtering, uh, these messages.
And, uh, they have great internal teams
that understand really all these
problems. But sadly, they are still
majority. So that's why we are still
here.
And doing this can to to bring visibility
on this, uh, on this domain, because
on Internet, when you want to see, for
example, um, you have an
IP, you want to see where,
for example, you had an attack from an IP
and you want to know where is it located.
You can wonder who is, uh, you have,
uh, many buttons underneath that are
scanning and that are reporting, okay,
this is part of this and it has been
a signal for these problems and these
problems are unnecessary and you don't
have that. So what we want is to make the
cartography of the Seven
Network in order to bring visibility
to operators to be able to to react
actually when there is a problem.
So that's another goal of, uh, of this
project.
So now on network exposure,
we have less messages, but
we are still like a large part of
my messages.
So as a result, yes,
as a referendum here,
this four messages
that will give us.
The messenger
of your logic is so
interesting to know, because you will
have already a real
justice, real justice
inside the ranges of the production
network.
You have my office, send it
on vacation for Winmar, send it on
vacation in full because.
It's one of those with the
most like you
get you get one of the messages
where you get the most of
the
most responses.
So you are almost sure that
when you send a essay, you
will get Rachel LGT back.
OK, and the last one is
the CAT scan.
So this one, it's we
we develop it ourselves.
It's sending specifically
crafted to get messages to be
able to to scan
GYTIS in large ranges
by incrementing on the Gytis, but
also on the essence because it
sends are like teapots
and for example, folds, which allows us
to send the number six for VLA
on Mzee seven and eight.
So every network element will have
its own SSN. So if you want to discover
all, then it is a seven network.
You will have to to to start doing
things like that and you
will have two responses on the CAT scan
or to get a boat or nothing
to get about, which means usually that
there is something behind the.
So a little recap also
on the on the network
exposure, where we got
the most responses that she kept
scanning because it's
like we can go for large ranges,
really useful.
And now.
Erico Bond is
I'm sorry.
So, um, as
we, uh, as we discussed, there has
been, um, I mean,
it's a seven is, uh, is is
being looked at for many years, uh,
since 2007.
Um, one of the first public presentation
up to now, 2014, there
has been a more and more presentation
because this year it's a presentation
on the subject and um
and it's the twenty years of technology.
So, um,
the the actually the
division on this network is coming now,
but it's really an old network.
Um, and what is happening, for
example, we scatter before.
It will be foreshortening with Tillicum
because it's an upscale network,
but more and more people are discovering
it. So.
So we make a quick recap of the of
the various presentation, um,
and from all the on the
net were able to together statistics,
um, for
worldwide exposure of operators
to be able to see, for example,
the location of a subscriber worldwide,
uh, how many percent of operators of
mineable and, uh, for the
call interception.
Um, also how many operators
are able to see how much work
needs to be done still.
And uh, thanks to
all this, can we are able to
to see this and to see the evolution.
Um, so from now on we have a base
of results.
And with, uh,
with running the scan continuously, we'll
be able to see what's the evolution
of all the, um, the the roaming
infrastructure ecosystem.
And this is really huge because
you see that 72
percent of operators that we scale, that
we scan, they were vulnerable
to precise location.
So it's getting the same idea or getting
rid of a subscriber.
So this means that there
is a lot of companies doing, um,
doing tracking.
But if you get any, uh,
S7 access, even with an interest,
not in a R21
ranges, you will be able also
to do precise location of subscriber
on seventy two percent
of operators.
OK. And for the good interception,
like 66 percent of the operators,
it's huge because it means that from
the international you will be able to
intercept records of anyone.
So from our point of view, it's good
because we see that actually security is
bad, that from the perspective of the
operator, it's good also because it can
see the explosion change in
the time and see publicly that,
OK, people see that actually things are
moving on and things are changing for our
security.
And that sort of changes don't go
then go unnoticed.
So this project is still
in the research phase.
So we really a website with only
countries.
There are things that we are going to to
improve, um, like
ratings and
also mapping more kind of abilities.
We saw that on the map.
Some are to be announced, for example,
and also giving a vision on the evolution
on, uh, of the security of these
networks.
And of course, also what will be very
interesting is to develop partnership
with the operators in order to get more
different vision on the network,
because as we saw, the network is very
diverse. There are many oddities.
So the more, um, point
of views we have on the network,
the more vision and the
more quality result will be able to to
give back then to operators in order to
to better describe this network,
basically, because, uh, now
it's very upscale for
them.
And we have like three interconnections
through different operate.
Also, it's really interesting already
for us to to get the differences between
the, uh, the three interconnections,
but with more interconnections, we will
get more results since we
maybe don't get all the responses
because we don't have all the roaming
agreements with a good
operator also.
Yet we are open to partnership with
new operators.
And, uh, then, of course,
so we talked about the seven uh,
now operators are interconnecting
Falchi using, um,
using diameter.
So the next
step is, of course, a diameter map that
will be mapping the roaming
infrastructure, but not just a seven one,
but the LTE one
and LTE.
LTE is it.
It's a bit better
than a seven, but still there is a lot of
beaches that have been pushed from seven
to eight, and
this work, it's still, uh,
it's still in progress for us.
And we are doing a lot of, uh,
a lot of work on algae.
So we will we will announce
during this hearing you use things on
algae because, uh,
one thing that we see on that,
all the people that learned from all
these roaming, uh, kind
of culture, uh, in the operators,
sometimes they are not put in the new
Romine, uh, teams
that are handling the, uh, the
operational, uh, side of the
the Altiero so that
it's more IP guys that are put with the
diameter protocols.
OK, but, uh, the guys that learned
a lot from excessive and roaming, they
are not, uh, transferring the knowledge
to the diameter to the guys that
will handle the emitter then.
And, uh, all the logical aspects
of a seven are kind of transfer
to diameter. So the attacks logically
are the many attacks are
logically the same.
So that's one
bad point that we know
that it's another subject.
OK, thank you for your attention.
Uh, so this map is online,
uh, right now at this.
ULLE And if you have questions, we have,
um, mailing list, um,
also available
access, but.
If you have any questions, please do line
up at the four microphones that we have
here.
What I know for sure, we have at
least one question from our signal in
relaying questions from Iasi Signal
Angel, please.
Microphone. Yeah. OK, so, um,
we have one questions.
Last remark from the Arazi right now.
First I say it's very good work.
You mentioned earlier that your probe,
um, was in partnership with an operator.
Um, what are your strategies for opening
new or expanding existing partnerships?
So we can you can you repeat, please,
if you leaving right now, please do
so quietly.
Yeah. First they said that
you did really good work.
Um, thanks. Then they ask, um,
you did your probes in cooperation
with some operator and if
you have any plans or strategies for
getting new partnerships, are
extending your collaboration
to expand our collaboration is the best
way to do it.
It's like operators.
They want to be more secure on what we
what we are offering to them.
It's to to work with them
in a real partnership to allow
them to get more secure and,
uh, by by
helping us to scan the
network, we help them also
by, like, giving
them the information that we get from the
scan to improve their security,
for example, when they have an issue
and they have one that they don't find
as a source of an attack, um,
we can come and help and see
can we find this in the
in this in the scans.
And then we develop uh, we discuss
with us and we react on this.
And also then if they are
OK to partnership with, uh,
with us, we go and validate all
this probe that is sending messages
with them and we show how it works and
how it will improve their vision
on their own network and on the
network worldwide, because usually it's
already a huge step for them.
When we give them
a map of their own network,
they're like, oh, my networks look like
that. Um, OK.
They are managing the network, but they
don't even know how it looks
like on a real map
there because there are no tools.
It's not like IP, uh, like you
can run and mapping the network
here. You need to have some tools because
the protocols, everything is custom.
So it's really uh, it's really
some stuff that we, we uh
we we give
we provide to operators.
OK, thank you for your very detailed
answer.
Microphone number four, please.
Uh, hello.
Uh, you said about the Jarek's Network
that, uh, you can find,
um, IP ranges in the public
Internet, so, uh, then you
can scan them and maybe find some
vulnerabilities.
Uh, when I work for
a telco, in our case, this range was
used for 3G customers and,
uh, renge it was the
same as for the Jarek's.
So it was like grouted, different
thing. So even if you scan this
Durex, you know,
Jarek's network, you are just scanning
our customers and you're not
getting any real, uh, vulnerability
data.
So just to notice and
we decided maybe it's a better idea to
to not not to use this range
for our customers.
And, uh, are you providing
the data from your scan for free
to the telcos?
Ah, to the telcos?
We are giving, uh, statistics
on their own network, but not through
data. We can discuss about that with
them directly to to to
give to give them more details.
No problem about that.
But through to for your remark,
for example, uh, when you see
the KPN talk, I keep
the books I sell them this year
they disclosed, uh, scanning
of the Jarek's Network and they found
like thousands of, uh,
of IP ports
open like a major,
uh, DNS
servers, IP
of this Jarek's public.
Uh, yeah. It's a generic public APIs.
So maybe your network, your doing
you are doing it properly, but
a lot of networks are not doing it
properly.
Uh, one one last question.
Do you know about malicious gytis
already like the malicious sources
of this scanning?
Uh, yes, we are.
Uh, so this is mainly from, uh,
feedback from operators, because when you
can actively you won't see
it is that are attacking because it's,
uh, it's an active scan.
So this data, the.
It's from attack reports from abroad.
So this is different from a sense of
humor.
Thank you. And we have also and I guess,
uh, Entercom running, which
is giving us, uh, feedback,
like, for example, attacks coming from
international.
So this will be more fitted.
But this is not for this one.
The direction of, uh, of
it is that our malicious
microphone number two, please.
Yeah, just a short one.
Do you have the German data set with you?
Could you could you give us a sneak
preview maybe or something.
But yours is quite interesting,
but I'm more interested in actually a
European country or something.
Of course.
Thank you.
So for Germany,
for example, we
got four Brito's.
So this is the coverage that
we have. Sometimes we don't scan all the
operators of the of the country
here. We have all of them.
So for the privacy part,
it was pretty good.
But the network exposure,
it was it is there is still
improvement to do so.
Privacy bugs are blocking a lot of, uh,
a lot of messages.
So, for example, I said Guston
and and Antonia's.
But all the messages are not working then
and yet that,
uh, it's important to keep in mind that
it's still in progress, uh,
in progress. Um, uh, project.
So we will improve our scanner
on all hours.
Canonge. So the goal is to bypass
all the protections also because we learn
every time how they protect the network.
So we try to bypass it to get
vulnerabilities on the networks
on. Yep.
So we here quickly here, the number two,
for example, it means two different
messages.
We are allowing an
attacker to to get subscriber
location.
So this means that in Germany, um,
their operators there is a mean of
two messages that allows someone
to to get the location of,
uh, of the subscribers of the operators.
So that's not good.
That's why it's in red.
So we have a color, uh,
clause on this.
So when it's ready, it means pretty bad.
When it's, uh, yellow, it means
it's bad, but, uh,
it's not uh.
So of course, the ratings are
relative to other operators.
We could not put everyone in, uh,
in red, which is bad.
So it's kind of adaptive.
And we are waiting also for feedback.
But I trust
the data that that you're here.
We can discuss it if you're, uh,
if you have also
microphone number four, please.
Hello. Um, uh, you talked
about, uh, exposure of subscriber
data, but
it's also, uh, exposure
of network data, like, could
you, um, count
the number of subscribers?
Uh.
So there is exposure of, uh,
network topology that
so, uh, when
we when I talk to about the
ratings, I talk to about two main
categories, privacy level that
is here and network exposure level
that is here.
So those are the two main categories.
And then you have scores
so far, network exposure level.
We have the SICP
attack phase, which is, um,
which is the, um, basically
the number of network elements that we
are able to discover
and then the fact that whether we
were able to fingerprint it or not.
So that's the second one.
And then we have potential change
of, uh, prepaid postpaid status.
That means that.
And here it's, uh, it's quite low.
So it's good this these
rates, the fact that someone can
modify data, uh,
on the on the infrastructure,
on the subscriber plan directly.
So passing from example from, uh,
from prepaid to postpaid.
So this is a vulnerability for the
network, of course.
But, um, in the protocol there
aren't any extensions for um
um.
Oh.
To see aren't
attached that offer um
to get the routing or something like they
are uh they are extensions uh
for protocols uh for the seven
protocols like map extensions
and um this data we
still do not have it processed
in a normalized in a way that we can
display its core because there is much
steps before getting this call from the
raw data of this kind.
So this is coming.
This is the the, uh, the work in progress
that we are doing.
But for now, that's what we get, uh, we
can present for our country because
we are sure of the data and we clean or
everything what which was suspicious.
So there was a
yeah.
The goal was to give a good overview on
a view which was,
uh, not not with
with good data or it's.
So we still are missing also some
countries, for example, but
this will come and there are countries
where we have, uh,
less, uh, less answers.
So there are countries where we are more
confident this this will,
uh, move on and will, uh,
we get a full map with a full view on
this network and then in six
months will be after discussions
with operators will be able to to release
appropriate rating.
Do we have any more questions?
There's one on microphone
number two, please.
I suppose I have
a Dutch subscription
and I'm in Germany right now.
How do I interpret your your
risks and abilities,
your funds? I assume that the worst
of both will apply to me tomorrow.
So I go back to the Germany
country.
So this means that, um.
So you are a subscriber, so you take a
look on me on the privacy,
the what will affect directly
the subscriber which we which will be
will be the prejudicially clever
mainly.
And OK, you can see that
locating you is possible
because, uh, German
operators are not predicting,
for example, uh, for one
of the messages that
is giving the location, uh,
with, uh, like a street level
accuracy so slightly.
Um, but still
you can we can locate you in the region
point of view, because the two
so the first line, this one is
for a region point point of view.
And, uh, so even
if they are not the worst ones,
uh, we will be able to to
locate you, to get,
uh, to get your statuses
on postpaid, uh, postpaid
prepaid, uh, and maybe to change you
up, your subscriber plan, things
like that. So this will like changing the
subscriber plan will lead to fraud.
And actually that's, uh, what, uh,
Tobias Shodan, uh, his presentation,
uh, like he was tracking, uh,
someone around, uh, around the world.
And the guy came to Germany and
it was, uh, I mean, he's, uh, his
messages were working.
Yeah. I assume there's also any
film ability's in the Dutch telecom
system that I'm a customer with
still. Yeah, yeah.
That's that's a good question.
So this when,
uh, when we are speaking about Germany,
this applies to customers
of German operators, not to visitors.
Uh, visitors. It will be, uh.
So when we'll have more, uh, more
statistics on,
um, on the security
of visited country, uh,
we show it, but for now it's for home
network, meaning if I'm, uh,
French in a French country, then
the security of related to my,
um, my sim will
be the one for France.
Thank you.
Any more questions?
No, please give a warm round of applause
to Alexandra Lau.
Thank you.