Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/528 Thanks!
Apparently, it's becoming a tradition
that every year at Congress, we have
at least one talk that gives you
nightmares about your cell phone.
I think this is going to be this one.
So please welcome our speakers, Don Juan
and Gil.
Clearly, I only came from
South Korea.
I'm in South Korea that the earth
so so please,
please don't ask about our address.
I only know what you know about it.
And this is my first time attending C
three, and it's a great pleasure
to present our work for this
time.
And today, my colleague Don Lemon and
I will talk about dissecting
both
various vulnerabilities in a new
voice, technology and LTE networks.
We will show you how to split and 50
different abilities in operation
that to.
So you both are a graduate student in
systemd secret lab in KAIST,
so my main research interests are
on that truck system and mobile device
security and Internet of things.
So I'm currently working on the
security impact on Iot core components
against those attacks.
I'm talking high.
And I'm
interested in cyber fields of security
issues. And today,
this talk in this talk
will describe the basic concepts and
I will explain the details in the later
part.
So let's start.
OK, so
forth, which stands for Voice Over
LTE is a new voice technology
and LTE network.
So in case of traditional 3G and
3G networks to deliver
that tougher voice and there is implement
is are separated.
However, in LTE
it is implemented into the all IP
based network to provide
to provide a faster delivery.
Thus both the voice and there are in
LTE are deliver delivered as
a Theraflu.
So for voice implementation,
LTE has to replace
the previous 3G solution.
So for this LTE
adopted for your IP system, which
is widely used in our network.
So by adopting VoLTE LTE
for users, they can get
high voice quality faster, cross-sell
up time and they can say
device battery life
and also for operators that
can increase usability and that
can reduce operational costs.
And they can also provide rich
multimedia services that have not
been provided in 3G calls.
So let's see more detail about the 3G
and for the networks to understand how
the technology is changed
in case of 3G
to deliver that for voice and data
is separated into
two parts, the packet switching and
the circuit switching.
So that data is driven
by the packet switching core and
the voice is delivered by the circuit
switching core.
So when 3G user calls
or 3G call, when
3G 3G call,
then the ceiling goes to the telephone
network to through the circuit switching
core.
On the other hand, in Alti,
both the voice and their eyes implemented
into the package, searching for.
Therefore, it no longer utilizes
the circuit switching core for
those for your piece of
our implementation.
Most of the functionality is implemented
inside and IMS, which are sent
for IP multimedia subsystem.
So let's see more details about
how the services are delivered
in L.A..
So in L.A., all social
services such as data video
streaming are Tolliver's, as
there are channels called, which is
called Bearer's The
Perils of virtual connection between the
device and the core network to
support a specific cure's of each
service.
As you can see here,
3G Stenders specify several
bearer's based on the QCA
value from one to nine,
depending on the service
purpose of the service usages.
So each pair has
has different characteristics such
as guaranteed or guaranteed
bitrate and priority.
Picadilly and Piccolo's right.
So as you can see,
there are two barriers for Bolt,
and both of them had the highest
priority and the lowest Picadilly
and lowest Piccolo's rate for
better performance.
So back to the service delivery concept,
when relativize, turned on a certain
service default
peripeteia between the device and the
crown. That talk is established
with assigned a new IP address.
So generally it default bearer support
does not guarantee the payout rate,
but it supports capacity for delivery.
So when a service when the service
requires a specific cure's, then
the dedicated bearer is established
within a default bearer.
And this channel, it is dedicated
to bearer shares.
Same IP address with the default
bearer is tied to traffic
through the static catch.
The bearer does
is filtered by the protocol
or put number.
So interested in specific to bolt
to errors and lead it,
so one is a contract,
one is used for a contract plane and
the other one is used for Terraplane.
So when a user turns
on a Ford service.
Default bearer is established
between the device and the network,
and through this default parent or device
first authenticate itself
to the IMF by sending the SIPC
only messages.
And after that, when a user makes
a call or gets an incoming call,
then a dedicated error is established
within a default bearer.
And through this dedicated barer
voice, there are between the caller and
cholera is transmitted and
it is usually encapsulated into
the art packet.
So since fault is a
totally new or totally a new
feature compared to the traditional
three sequels, adapting,
adopting, it makes a whole infrastructure
more complex.
It involves not only the implementation
of the antique war, but also
device mobile with Sopot device,
Hodor interface and even accounting
functions.
So if some of these implementations
are not carefully considered,
it may cause a severe security problems.
So we decided to check potential
defectors newly introduced in import.
And guess what, we found several
security issues in each component.
Oh, yeah, thank
you.
And these security issues are
calls from the two facts import
one is the fourth quarter accounting
and the phony solution in LTE
devices.
So I find the post accounting first
in case of 3G, the akonting
is depending on
how the service is delivered in the
network.
So since
the data is delivered by the packet
switching core, it is charged by
the usage and
voice is charged by the usage
of channel location time for cooling.
So similarly, LTE
as LTE is,
LTE has only the package
switching for both the voice
and data is delivered by the Pakistan
core, so it's natural to apply
the power usage for all services.
However, most operators still
suppressed accounting policy for pause,
for voice and data.
Therefore, in LTE,
operators still apply
the time usage contemptuously
for port, even if even
though the vote is delivered
by the PÃ©cas. Which ancora?
So this kind of implantation
may cause a complicated, very
complicated accounting function of Alti,
so we from this, we all may
ask to operators implement
this complicated accounting correctly.
And for a second and four second problem,
we need to know the anatomy of smartphone
so it's not really a smartphone has two
processors.
One is its application processor for one
in mobile with such as Android,
Iris and running user applications
on top of OS.
And the second one is the communication
processor for and it is
used for more than functionality.
And a specific jobs such
as handling digital signal processing.
So we first is planning the LTE
device solution in LTE capable devices.
I was playing the 3G
device solution first for comparison
in case of 3G devices.
The first call, the procedure is
done by hardware in C.p.
And also both top most information
about the CPS implementation
is is hidden
from the manufacturers such as
Samsung Home and Highway
34, even Amerasians AB,
which have reported on part,
cannot easily access to the safety
part to manipulate the posting procedure.
Also, any error
in AP have to use
the specified call API with
polyfoam permission to make a 3G call
while it means that on
Autechre in 3G phones
cannot and cannot easily analyze
the quality, pausing only
and post-implementation in both device
and the network.
However, in LTE devices,
the procedure is done by a
Dombi software, an app
which means unusual app can easily
accessed upwards a procedure
by utilizing that stock
for port.
So, for example, an Android system,
there are two that are interfaces
are unnatural and I'm the one.
And by simply checking the
running applications and listening
for it, we can infer that
our natural interface is used
for both service since
six or five or six.
So is port for
SIPC only.
And also from this, we
can infer we thought that
are.
An air can even
make a call without a call for
information it doesn't need an
Internet permission to utilize,
that was OK for port.
So we have to find things vault
first is the complex accounting
infrastructure, and the second is
delegating police procedure
to AP.
So to exploit this
problem, the fact
in that first we first analyzed
three people, Stenders Lightwater
fourth service, however,
these standards of detail implementations
to the entities for having implemented
such as operators, chipps offenders
and so on.
So we decided to make a checklist
of potential vulnerable points in the
fourth feature, and
it was about six six
tolerance for birth control and
Terraplane like this.
I with this report from the empirical
analysis in five major operational
alkane that serves this close
to US operators and three
South Korean operators.
And at this time we also consider
the operators in Europe.
But however, at that, at
the early 2015
are Europe.
The operators in Europe does not provide
full service.
But now I heard that some
operators in Germany provide
started to launch a phone service.
So if you
are, I wonder how secure
the German operators for service
are is.
Then please contact us and
let's look into it together with your
smartphones.
So in summary,
this is the summary of our results
we found for free.
There are channels which are very close
from the complicated accounting function.
And if I have security issues,
so for it's issues
like collecting money, it is plain that.
Hi again, I'm Tongon, Kim,
and so let me
take over from this part and
so start let's start from the
free data centers using full protocol
first.
To utilize such three data centers,
first, we need to understand how actually
it works.
So when Caller
makes a call to colleague, Colar
sends an invite message like this
and this invite message
contains the phone numbers of color
and Anchalee and it is just
looked like this,
you know, to keep my privacy, I
removed some of my private information.
But as I noticed, this
packet is just like HTP
and the methyl section Furkat or
post is changed to invite like
this.
And, you know, there are there
are many methods in
asifa messages here like here
and also phone numbers
of color and Coulier here.
So when color receives this
invite message, then the phone starts
to ring.
And when the user answered
the phone by touching the call button,
then the Kohli's one sends
a message to the caller
and the dedicated bearer
for voice data transmission is
established between them and
voice data is transferred through this
channer as RTP packets.
So how can utilize this for
free data centers.
It's really simple.
You can just put data into the
head or body of the invite message
and we note that we
replaced the OK message to decline
message to receiving
messages over and over.
Also, you can think of
data into the RTP payload like this,
just like normal voice data.
And we actually
implemented both tonguing methods.
But some of you might think that
the concept is too simple, but
the actual implementation was not.
So let me explain the details to
left part of the caller's phone and
the right part is actually spun.
So we actually implemented the data.
There are two sensors and receivers for
each tunneling method and
when colors start to start to
send data, SICP
or RTP packets are transferred
through IMS and
ESSI packets are received
in maybe in the color coleus part,
but RTP packets are not.
This is because this is the
difficult part.
So because the RTV
packets are firstly processed in S.P.
and only audio data is passed to
AP, which means you cannot get
the output packets in AP with GCP
dump.
So Ferdman,
this audio data the size of this audio
data is too small, so we
cannot utilize the full bandwidth.
So we need to find another way.
While searching by Googling,
we found there is a diet comment
and so what,
Steilacoom and.
Actually, dagga is a proprietary
protocol by Qualcomm and also introduced
by a little at 20 C.C.C.
and you know, Diag Command
provides several functionalities such as
memory, read, write or SMS
rate. Right. Were signaling dump
and the signal
dump. It's one of the main
functionalities of diag
because you can dump any signals
between your phone and the cell tower.
So this is usually used by
the operators for performance
testing, so called field test.
You can see the right figure, and that's
one example of the diagnostic
protocol tool, and
to you, you know that the software
is on the laptop and to utilize
that software, you need a key stored
in the USB.
And can you imagine
the price of this software?
It's really expensive.
It's over sixteen thousand dollars.
So because we are students,
we don't have enough money, so we cannot
buy that one.
So we need to reverse engineer the Digg
protocol itself.
And we found the server operation that
colters has left table.
And actually we found
a hundred comments, but we only
put a part of them here.
And there is a low comment here.
So by using that low comment,
we could directly catch RTP packets
in IP through diag
device driver in the Linux conure.
You can just open the target device
driver and send that comment.
Then you can read our packets directly
so we can get the packets
and our ticket packets without any loss
so we can utilize both tonguing method
with this.
In case of direct communication,
it is much simple,
you can just open the socket with the
IP address, four volt interface
and send send data to
the Internet like this or
other IP addresses for a Volt interface
like this.
You can also think of not only free
data centers, you can also think of
overfilling other people.
So send utilize
your Volt interface, send data to
the others data interface like this.
But actually, we didn't test this.
And another guy who
flew on another team who are working,
also working on the Volt for Europe.
They tested this, but we didn't actually
tested this. So maybe you can try
this one.
So we tested free data centers
for five operators,
two in the U.S.
and three in South Korea,
and note that the implementation
was different on depending on the
operators policy.
So as I Peatling immediately were
available for all the operators
and that communication
was somewhat different depending on
operators policy.
And no,
not that the care one is the best
operator that you can utilize for
free data centers.
So I guess
some of you might wonder
using Caixa one later
if you travel to Korea.
But actually after we
reported this Furneaux ability to the
operators, they are Pecha like this.
So don't be disappointed.
And we didn't get any
follow ups from the two US operators.
And because we are Korean
students, we couldn't actually
test those again in the U.S.
because it takes too much money for
us.
So if
chances chances, if
we have some chances, we can test later.
So, yeah, we measure
the throughput for the direct
communication and it was quite high.
And as you described
in the previous slides, this data,
our VoLTE interface has higher
priority than normal data interface.
So it is more useful.
Thanks.
And we also measure the throughput for
the media polling, but it was quite small
because it is limited by the operators,
the operators are limiting the bandwidth
for media talking because they think
it's enough to provide high
quality voice service.
But later this day, a little more
bandwidth then because we can fully
utilize the bandwidth, I think
the performance will be increased to
and we in case of SIOP
tolling, we didn't actually measure the
performance because it can cause a severe
problem to the core network, which means
a denial of service attack on the core
network. So I
will explain this in the later slides.
But actually
when we tested, we tested on one Korean
operator.
I sent about a thousand invite messages
within a second and
two or three up.
Three hours later, we got a call from
that operator, so.
So we got in trouble, but we
it worked out well, we discussed and
we patched together, so
it was OK.
So I introduced for free data tenners,
and now I will explain the five
security issues, first
of all,
all your voice packets are not encrypted.
So only one U.S.
operator was encrypting
your voice, signaling packets,
and even in that operator,
the voice data was not encrypted,
which means all your voice data
can be wiretapped.
In that U.S. operator, they are
using IP sac to encrypt the voice,
signaling packets like this, I removed
the IP addresses for that operator
and the other operators were just using
Tsipi or Euterpe without encryption.
So your voice data is free.
So some of you might wonder if
wiretapping is really possible,
but one example is
this you can think of femto cells.
There are a lot of cells worldwide
and almost all operators
are providing femto cells.
And if this femtocell is
compromised, all phones connected
to that femtocell
can be affected by different
ability.
And even more, some operators
are providing Wi-Fi calling.
And if you utilize this Wi-Fi
calling, all your voice packets are
transferred through a wireless app,
through the Internet to the core network.
And, you know, compromising
wireless access point is much easier than
compromising femtocell.
So in this scenario, all your voice
data is also wiretapped.
So come back to the first to slide,
even though in this situation,
the operators are only focusing on
encrypting the voice signaling packets,
not the voice data.
So we suggest that the operators should
also focus on encrypting the
voice data.
The next problem is that
even though the S&P
servers say names should authenticate
users and manage the
sessions correctly, they there
was no authentication and no system
management.
So you can make a call with
fake phone number or you
or you can send multiple messages
at the same time to several users.
Then several concessions
can be established.
You know, in a normal call, only one
user can call to name one person.
But because of this vulnerability, you
can you can call
to anyone at the same time.
So one sender can deplete
lots of barer resources in the core
network.
So compared to previous
denial of service attacks on the core
network, we only
need a small number of devices to
kill the core network.
So that's the reason why the operator
called us.
Actually, we prepared the demo for the
colors.
So this is normal call Benkler
Cortically.
Then the Autechre calls to the calls
to collate using the caller's phone
number, so let's say the demo.
The right party is normal, Koehler and
Collie.
And we used our photo.
This is O'Neill and this is me.
This is just normal call, and they
communicate and hang up the phone call.
Now, the attacker is connected with ATV
just for convenience, and we all know the
code to the attackers phone and call
to Calais using Kohler's
phone number.
Scott.
So, you know, the Kohli's
from the Autechre to the Karley
and Kalar didn't know
even he was his phone number
is used and in this demo
we utilize the famous Korean
song Gangnam Style.
But actually we can send any audio data
so we can change the phone number and
send any audio data.
So this can be used for
voice phishing or for
for example, you can you can
earn some money from your friend by using
this vulnerability.
And next problem is that, as I mentioned
before, there is no rule at the gateways.
So in a normal
situation, all voice packets should
bite, should pass through
IMS, but we found
that we can directly send those packets
to other phone.
So there is no authentication and no
system management. Again, so
spoofing again.
Another interesting problem is that there
is a problem problem on the Android
system, so
in previously
all applications should have
code phone permission to make a call.
But as faulty as newly
adopted, the calling
this code call procedure
is moved from SEPI to AP.
So there was a problem on the
Android permission model system
so we can make a call only with the
Internet permission.
You know, the Internet permission is very
basic permission and
almost all application installed
on your phone has that permission
so that almost
all apps can perform
this kind of text so
they can log your calls or
make a call, make an expensive
video, calls to the others to
give you expensive bills.
And we are so prepared demos for
the dinner service, phone calls.
So not that the
malicious application is running in the
background of the victims phone
and it does not leave any trace.
The victim cannot recognize
if he is calling.
So the app makes a
call to the attacker and it blocks the
callers Norma
call. And when
they are on the phone, in a normal case,
the app can cut off this call.
So let's say the demo.
This is called blocking demo.
See the background there, of course, to
the article.
Yes, this is the
is message in Korean
so he can block any coal.
And this is cut off demo.
They're on the phone.
This is normal call and
malicious app on the victim's phone can
cut off this call.
By calling to the ticker.
So the ad
only with the Internet permission can
completely block victims from
calling.
To summarize, we found these kind of
vulnerabilities and for free
trade agendas and we
also saw that several medications for
that. So because
they are not encrypting the voice
packets, they should encrypt those
packets. For example, they can encrypt
voice signaling packets with IP
Seigler tearless or
they can encrypt their voice data with
SRP.
And the problem problem of
authentication comes from
the operators because they
only authenticate users with the
SIOP Heather.
So which Richman's because as
IP packets are just
application layer protocol so anyone
can manipulate those packets.
So we suggest to
prevent such vulnerable it is.
As I mentioned before, every bolt
interface has its own
IP address so the core network
can recognize the
origin of the packet, so they can check
the source IP, address it, as well as
the site beheaders like this
and proper social management.
And they should set up rules
at the gateways and to to
prevent permission of the mismatch
problem.
Mobile developers should
strictly bind the
the sockets to the data interface,
not to use the bolt interface.
The problem in the Android system
is that if
an application openness SOCAP
and you set the destination
IP address to the SRP server
in the IMS, then
the Android system automatically robs
packets through the VoLTE interface.
So that was the problem.
And actually we we
reported to Google and they patched like
this in the in the olio of
this November.
So they set off some flag
for the immense capability flag
for Imus. And
and they check that if
an application without system permission
makes a cold and they blocked
that application.
So it is patched.
And to prevent SIOP immediately, you
can perform Dipak an inspection.
But bedeviling
is not easy to resolve because
you can encode your data just
like voice data and put that into
RTP payload.
So it's not easy to solve that
byte usage.
Accounting might be one solution, but
I think the operators will not
follow this because they are
very sensitive, sensitive to their
profit.
And currently they're using time-based
accounting because it's much more
expensive than the day by day usage
accounting. So it depends on the
operators policy to
choose.
And while doing this research,
we found that the specifications
has problem.
So the specification
work was too abstract
and they left the details
to the operators.
So the operators misunderstood and
mis implemented the the details.
And also there are
the the important security features
in the specifications
were just recommendation and
not requirements.
So the operators not follow
those security features.
We reported these Bernauer abilities
to US and Care Certs and
Google in May and Google
replied moderate and
old to us operators were just
act.
And we didn't get any follow ups.
And only two among free Korean operators
were partnering with us
and one Korean operator even
didn't give us back EC,
so.
We don't know about that crane operator,
even though we are Corian.
And by doing
this, we was quite impressed
by the US service in
their way handling the vulnerabilities,
they actually set up the vulnerability,
vulnerability notes, and
they report we
when we sent our report to US
Certs, they
they sent our report to all
the US operators, as well as Google
and Apple.
And Apple replied that
the iPhone is not vulnerable to this
vulnerability. So
I guess I guess they are just
strictly binding sockets to the data
interface so that.
So that's why the iPhone is not
verbal and we got
to say we are so
and so
even though we are young students,
even even though the level is moderate,
it's just third level.
But, you know, it's a starting
point. So we think it's
the problem is still interesting.
Thanks and.
Do you think for your AP system is still
secure,
right,
because some
some people might think that your
system is secure enough because
we have the security of Europe
have been studied for several years.
Right. But actually,
we tested on one
of his system and it was furnivall like
this.
So we think that
if we built a system is interconnected
with VoIP system, then this
would be another interesting issue.
So to summarize,
because of the two findings
from the vote interface
we found for free data tenor's
and five security problems, and I
think these
problems are related to all the
parties such as Stratifications
or telecom companies and so on.
And, you know, every
new system has vulnerability.
And so
we, as multiuse, newly adopted,
retargeted Volt to analyze
its security and.
As more and more systems are adopting
cellular technology before, it's why
deploy
villages and the Volt should be applied.
So thank you for listening and I
take any question.
OK, we have a very
large amount of time for Q&A now, so
please line up at the microphones.
If you feel the sudden urge to leave this
room, please either suppress
it or leave very quietly
because it gets very noisy in here if
lots of people talk and then run away.
OK, microphone number two,
please.
OK, this was very interesting.
I have a few questions
about the spoofing attack.
Basically, what you're doing there,
you're sending packets
direct of telephone, right?
Right.
Are.
So the network has now
filtering whatsoever, like the first for
the Internet. They have no filtering
whatsoever.
There is no filter.
You can just changed your
phone number to Target's phone number.
Then you can perform the colors
if you tried spoofing
your also your IP address on that
interface.
Is that possible?
You know, you mean IP spoofing?
Yes. No, we didn't try to IP
spoofing, but when we tested
it on a few months ago
on the Korean operators and US operators
were not very open to IP spoofing
attacks.
Thank you.
Oh, just another quick reminder, if you
on the stream right now, you can use AC
or Twitter to ask questions.
We have a human computer interface here
just for your convenience.
Microphone number three, please.
Hi. My question is, does
the operator have any incentive to
block media timing?
Like, is it not more expensive to
download data through
the, uh,
to interface than just use
the data services?
OK, so
for now, since we are totally
independent of the media, tunneling is
very low, so we can
we think that the operator does
not provide that attack,
but actually
so maybe operators
in the future may
increase the bandwidth that
that bearer's the bandwidth
because they will
start another services
that requires more
bandwidth.
So in that case, they were
private the
tolling, but it can
and cannot be simple,
private to meet the tolling method.
Microphone number four, please.
I congrats on your findings.
I'm guessing that you've looked quite
some time into the diag interface of
Qualcomm.
So basically what you show is
there's just a command that you can read
and write to any memory
address and just do whatever
you want. So basically that gives you
Arcy and it's
just possible in any Qualcomm
baseband.
And the answer is
no, because to
to send dial commands directly,
your phones should be connected with your
laptop or your computer.
So you cannot perform any
RCL text. But if you if
there is a vulnerability on that system,
then you can locally exploit
that.
But what I mean is like
suppose you you have root permissions
on your Android phone, you've routed it
and you want to go deeper
into the basement.
You can just send Diyab commands to it
and you could just read and write from an
email.
Yeah. So we actually we tried, but
some of the documents were blocked
so we couldn't actually change
the memory addresses.
But there is operational
code, but didacticism
in the ZIPPI is currently
blocking those commands.
OK, thank you.
Number two, please.
Hi.
I did some previous security research
on voice over IP
and much of the vulnerability
here described also apply
on traditional voice over IP
networks for
voice over IP.
There are security standards.
It seems to me the providers
in Korea and America
doesn't have the security
guidelines in place to
prevent these attacks.
Is that correct?
Um, actually, because we are not
the operator person,
so we don't know the exact thing,
but when we tested
their version of it, he was there, so
I'm not sure.
So after our responsibilities,
closure, they are trying to.
Yeah, they're after we reported
there, they are partnering with us and
they are currently making those
guidelines.
Yeah, OK, thank you.
No one plays.
Yes, I was wondering about
session management and how resource
intensive it can be on the server
side, has there any
been any considerations how to solve
it?
You mean to solve the social
management on the server side,
on the server side, but
I think it's quite simple because
if any user makes
a call, then the ASAP
message is you should send the message
to the ISP server.
Right. So the SRP server
knows which user is now calling.
So if if you check
if this the state of the user,
then you can just log other
invite messages after the first invite
message, then I think that will
resolve the problem.
Yes, I was just wondering about the
resource intensive and then
this is going to be for the operator
handling so many sessions at the same
time. But thank you.
Number three, please.
My other question is, you mentioned
you had some
efforts on reverse engineering the
protocol, uh, were you able
to open source your efforts
and if yes,
where can we find it?
But actually, you know, there are several
documents already in the Google,
actually, we we we
got the operation that caused by Googling
and we reverse
engineer the USPI protocol
by just
snipping all the USB packets.
So later,
leave later if we
fully analyze the systems and we can
disclose those.
Signal angel, please.
Thank you. Is it possible to not
use the operators arms at all?
Um, so can you configure your own
voice over IP network and
talk with friends by using direct IP?
Can you can you repeat one more time?
Sure. Is it possible to
not use the operators Amscot
at all, just to set up your own voice
over IP application and talk to friends?
Um, yes.
You can utilize your own Veev
for your IP system, but
the fact the operators are providing
for you all this time is that they should
they they want to provide more
like higher priority services,
Dromard, because you're if
you utilize your own VOIP
system, then
you use the data interface.
But the data, as I mentioned
before, for your interface, has a higher
priority than the data interface.
So there is no,
no, don't cure us on
the data interface.
So.
That's why the operators are providing
those four utility features, No.
So the answer is you can you can
implement your own system, but
you cannot get guarantee or
bandwidth for that kind of things.
Number four, please, I
I'm interested in the kind
of arguments that you presented
to the operators, so they
fixed it because when we report
those kind of abilities in VoIP
and Walti networks
to telcos, they just don't
care because they will
the time that they will spend
implementing a Third-Party
or authentication, it's
to consider it an advantage that they
will lose regarding their
concurrent.
And do you think that going through
a certain kind of forced them
to act upon the vulnerabilities
that you reported?
I'm not sure if if there is a
legal issues that
starts can force the operators to
apply those security mechanisms, but
the fact that Korean operators are
pitching that, that firstly
because
there are a Korean system
so be reported to the
news and because
because there is were citizens who
claim the operators.
So they patched that festively so
that the power of citizen
maybe help.
OK, thank you.
Internet, please.
Thank you question if you spoof your
number, but it also set the
password identity had a field
over that be overridden.
The asserted identity had field.
Don't shoot the messenger.
I don't know what it is.
Can you repeat one more time?
So sorry.
If you spoof your number
with your application,
will it also set the P asserted
identity header field?
But will this be overwritten,
the PS 35 and 50
field?
Yes, I'm not sure,
but OK, yeah, because
there is only four numbers in the S&P.
Either you can just change your phone
number to other is fun and you can
also change your IP address to others.
Then you can just do colors.
Do we have any more questions?
There's also microphones back there, I
don't know if you noticed, but you have
them on top, too, so.
OK, in that case, please, once again,
thank us because.