Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/697 Thanks!
In the past years, we've seen
a lot of talks about
how to lock devices that allow us
to authorize access
to a building, we've seen
how we say lock picking,
we've seen how to break into RFID
doors and
but we haven't seen how to break into
Entercom devices.
And Sebastian here today
will tell us more about that.
He's a security researcher and
he's really interested into radio.
So give him a big round of applause.
Thank you very much and
thank you for attending this
presentation, so we
will talk about Entercom hacking,
but let's chat about something.
I'm working for the selective company
Trust in your communication systems like
Wi-Fi, RFID exemptions on.
It's actively doing routine tests
awaiting test includes spearfishing
remote for your remote and physical
intrusions and speaking
about physical intrusion, why
we introduced into
a building it's tool to plug
a device or to dump a
computer memory, or also to
let malicious use the
keys in the into the building
to be less suspicious.
But the main problem when we
we want to enter to a building is we have
we always need a way to enter to
to this building.
So how to do it.
We know lockpick Interex, we know Şeref
attacks. We know social engineering
can do for you.
But what about how
intercoms,
routine tests with
with this person and
tricks are works sometimes,
but sometimes we get photos and
it could very interesting because
if we want to to be
to not be spotted
every time and want to
enter to a building at night,
we want to watch.
What we want is to enter the building
like a ninja so we can
maybe maybe hack this
kind of system to enter to it, which is
also intercoms can be we will
see that intercom's can be
used to spy on conversation
in the street. We see that we can make
money out of it.
Oh, it's a bit strange, but
ah you see it's very fun and
also have a lot of fun with
this kind of device.
Also, I
should warn you that this talk
is supplied on political attacks
on intercoms.
It's also it also includes other
devices which use the
same system, the same techniques as
new intercoms use today.
So intercoms
today provides a lot of feature
you have for passcode tag access.
You can also call a resident to open the
door.
But nowadays
we can see that some
residents can be
called on his mobile phone.
And when he's called on his
mobile phone, the intercom is using
a mobile prefix to call
the residence. That means that the
intercoms is is using
the mobile network to call the residence.
So by curiosity, we
were asking about we do
we would it be possible to play with
this kind of ithaka, with this kind
of device?
So we try to directly
call the intercom,
but nothing happens after
that. I thought about maybe we can
modify the flash, but just imagine
that we have to do it in front of
others in the street is
that you're not a ninja
thinks, oh,
we can use mortar attacks because the
intercom is using the mobile network.
And so I we
present now the intercom, the intercom do
for us intercom
call it as you want.
It's a voice communication device.
Within the building, the
term numeric refers to intercom that
use the mobile network for our case.
So they use the same SIM card
and it allows to call our resident to
open the door and different types
of intercom exist.
You have conversational simplify and
the main difference
just look at the rights is that
the numeric Doenitz,
it's a wire for each residence.
The main difference is that that is
only used two wires for
power, two hours for the system,
and after that, no wires for each
resident.
That's why they
are used, because it avoids a complicated
and cumbersome cables
and wires can be replaced by GSM,
3G, 4G or Wi-Fi.
For our case, we will only focus
on the GSM, 3G and
4G,
the simple, simplified
architecture of the numeric intercom.
They are true.
The this is the first.
The first, as you can
see in the circuitry of the
intercom, is connected to the mobile
network through the bits and
there are if a visitor want to open the
door. He called the residents
using the. On the intercom call, the
president on his phone after
that, the president's answer to the call
and open the door
and the visit of Senator
Anorectic. The truth is it's
quite, quite,
quite similar to to to the president.
But the only difference is
that if we want
to manage the intercom,
we use a centralized server,
because in the previous case,
if the residents want to manage the
intercom, he only use
his phone Central
Command and send commands to
modify or add a resident to the
intercom.
But he here in that architecture,
the one administrator can
use a website, for example, to
manage the intercom.
So that's that's the main difference with
the the the simple,
simple intercom and intercom that
use them to a machine to machine
architecture.
In France, we have
five drones that are very
well known. It's like a complete
turnover. Sit in and
capture the costs.
A lot of money.
It begins with two thousand euro and
after that, a more mobile phones,
more mobile than you
can chip more it costs.
For our first case, we
choose the IDP, GSM,
which is also commonly used in
private residence in Paris.
So we will focus
just for the first time overfocusing
at telecom. But after that,
during this presentation, I will we also
we will also focus on the 3G intercom,
which is used
in a lot of buildings
today.
So also
I talk about the mobile
or the numeric intercom, but how to
recognize it, maybe spot
in your nice screen or new Steelcase,
but sometimes you can get
very lucky and see that there is a 3G
module, which is
sometimes outdoor or indoor,
and this 3G module as like
three or four LEDs, indicating the level
the quality of the the
reception of the mobile
network.
So with that with
that, I think we can see that
it's maybe using the mobile
network and it's it's
likely it's a good,
um, it's good to know because
maybe we can do some attacks on it.
Also why I'm doing this presentation,
because many publications about Entercom
are nearly non-existent.
But as we know, they use the mobile
network to communicate to
to communicate with the residents and to
allow the president to open the door.
So that's where we can,
for example, use the previous single
application on the GSM, 3G and 4G
and also the tools
that are very affordable, affordable.
Today, for example, the Blade Şeref
that costs only three hundred
seventy euro
and the software is free.
You can you can you can get
it for free, for free and
start your own road by station,
as you probably know.
So we
have that tools.
We are able to build our work
bus station, our GSM in
station.
And in an
interesting sorry fact is that
Gissen in GSM and GPS,
you have a weakness. The weakness, as
you probably know, is the because
there is no altercation between the
mobile and the network, the mobile
network. So only
the network is aware about if
the mobile phone is legit or not.
But the mobile phone is not able to check
if the the mobile network is
a legit one or by rogue
base station
of a good thing is the end of it for
an attacker, because stronger
the signal is with the
station and a much likely way
we are able to trap
the door mobile the intercom
into our station.
So, for example,
if the the mobile phone is always looking
for those fingers here.
So if a mobile phone see that's when
the station is sending you a stronger
than the other one.
It got there directly to the new space
station.
So to summarize, there's no
justification, Jason, and
we can also use a lot of attacks
on if one extra
channel is not encrypted,
so interception is possible in just
years, but to overcome
that, 3G and 4G
are more secure because we
use modification.
They use reality TV with the better
encryption.
So if I'm doing a regular
station in passengers
and or if I want you to
install radio station in 3G
or 4G,
if the intercom is running, is using the
3G or 4G, I'm screwed because
they are the mobile phone will
try to to to do
the modification and you will see that
my station is not a legit
one, much
to overcome to this problem that we can
use. The only way that to do that,
we can see if we can
perform some protocol attacks.
But it is very difficult because we have
always, through the protocol attacks
and sometimes only focus on
what's one piece of specific Baydon and
one specific versions.
And it takes a lot of time.
So in general,
if we we don't know what the
base bonds are with the best condition
and so on, the better ways
to to do gymnastics
attacks. And the attack is very simple
because just a simple gusanos
in targeted channels.
For example, at
the left, we can see that there
is a GSM channel,
the beginning of a GSM channel
that mobile phone is supposed to
pursue.
And after the jamming, we see that this
channel is clouded by the random
noise. And that means that the mobile
phone doesn't it doesn't
see anymore the channel.
That means that it cannot reach it.
And if for if,
for example, the channel is
3G, channel it.
And it's the only one
of the the mobile phone is supposed
to fall back to the
dog reedited
and intercoms, it's likely
to be like four mobile phones because
if we we found
public documents, documentation that.
Not if the 3G
network is not reachable,
the intercom will use the 2G instead.
So it's good for us because if we
don't get it done, great attack from
3G to 2G and
and emulator to
create a radio station with a very
strong signal, we are likely
to disrupt the
targeted intercom
to Germany traditional.
We can, for example, by Ajamu
in Internet. You have a lot of attorneys
general you can find on eBay and Alibaba
and so on.
You can after that.
It is about the 2G to allow
the station to
transmit signal.
Or you can use some tricks
like like I do is
to enumerate the list of
you have seen close to the
new interceptor.
After that, you
you translated this weekend
into central frequencies and
sends a gusanos into each
detector channels.
But if you want to enumerate
her, you have seen
so people in Jassam, for example,
for Iveson, use the small committee, for
example. But,
you know, a small committee for that
case, because it's Fiji,
for example, cannot
work because I smoke, maybe only works
for GSM.
So to do that, you can
nasals solution.
You can use, for example, not
respond. That's use that has
got data and use
the provided interface which is
exposed
and use the government tool to
to to after that, capture
all the messages and
capture the error messages
to get your
reaction, which means the nodes,
the you have sent the index
which is used for downloading
in that way.
If you if you use that,
that you have sent and
fluid's with
this channel, the
mobile phone will not see the channel
anymore for
the best burnwell like Qualcomm, you have
sometimes also of interfaces.
But if you have
a very, very new device like
Samsung's, Samsung's out
of a need to have a universal
method to
to list to to get a list
of your Ephesian.
And to do that, you use the service mode
with a special court for Samsung, for
your Samsung version.
And with that, you can see
look at that.
Saddam have seen our
present in Lockharts like taping
with EDB.
They come and look at you can see that
in the when you are in the service
mode and whenever you are trying to
register to an operator, you see
all the you have seen that
the mobile phone try to reach.
And with that you get the
list of Sien and you are able
after that to to know which
analogy you want to jump.
Exactly.
And to do that, let's see a little demo
with simple like Şeref.
So up
to.
That's
OK.
So I don't know if anybody can
see, but here I'm calling
the answering machine and
at the top and the right
you see a 3G icon,
which means that I'm calling in 3G.
And where is my A.F.?
And if that's accurate, if I use
the agile
up to
send noise.
So the A.F.
now is is
is trying to sanction Gushin
random casinos to some
targeted channels to targeted the
channels. And as you can see,
the icon, the icon disappeared.
So that means that now when I'm
calling, I'm calling Chuji, and
as it's possible to do that,
I can come with a station
with a stronger singer and
the Jumeau by will end over
to my Rober station.
So now
let's let's set up our lab,
our lab consists of Gladia,
yet Bethia software,
and what I want is to trap
the intercom into the
that that is for the station.
And it only costs
500 to 400
people with all the antennas and
so on.
Also, let's set up our intercom using
the best of
the committee and also
question about the security.
And we can see that there is three ways
to configure
an intercom like programing to interface
with the manager,
with a SIM card reader and programing
or with SMS messages.
So that means that maybe
if we know the
number two to contact, maybe
it's possible to send commands through
to edit, to modify or
add a number.
But after that, in the documentation
is precise that if we want to
administrate the intercom
with a SMS is first,
one number has to be set up.
So our first
impression is that we have if
we want to send the comments to the
interphone, we have to impersonate a
number or find a way to bypass it.
Or after that,
when it's so we we can
impersonate a number, we can open the
doors and come on and so on.
And a good indicator when
you send commands to the intercom is that
you have an acknowledgment, like, for
example, if you want to write or update
the number of the resident one with
the come on the right between one and the
number of the other is then to
to associate with
you get an acknowledgment like write a
bit on one. OK, that means that the
command was successful.
And you are you are you were able to
modify or updates to update or
add a number.
So our first deposes,
let's do some hypotheses.
We don't know, we don't know the mobile
operator, we don't know the intercoms
number. The commands,
for instance, can be found.
We a public documentation or lykketoft
documentation or piffling performing
a fiber analysis on
it.
So as an attack, our steps are
to recognize the intercom operator, to
try like our guest number, to impersonate
reduced our phone as
the recorder is the number itself
and open the door and to drop
the intercom, we can brute force
the phone, for example, in France, the
four a.m. and see it takes like five
minutes each with a strong signal.
And by pushing the button
in the intercom, if
we see that
the call was intercepted, it will.
It is a success.
So when activating the GSM type
and seeing the message in Wireshark,
we can see they are when pushing
the button, when after the trouping, the
intercom that's
call set up message was
sent out. And
in this setup message, you see
a field that contains the number of the
residents you you were trying to
to to call.
So after that you can associate
associates. We are this present
number to you, I must say.
I mean, your SIM card or your SIM card,
and after that you are able to open the
door. What's next?
If you are about to click the
number, you can
for example,
you can send commands, but
if you cannot, you can try to
find other ways like
trigger an alarm or
maybe do some social engineering
tricks.
But if you are able to far to find
that number and impersonating,
you can send commands like read, write,
collated.
And to come on are very
interesting because one is that we
we already saw this on.
But the overcomers is quality.
And why it's interesting because it
interacts directly with the
baseband so we can, for example, such
as SMS messages.
But I try that with the
link ADP, I get one semester
and after that the the the intercom
was completely not working.
So it was a bit strange,
but it works like a leader.
You can also spy on or do
on building the conversation, sending
an X zero
to one number.
That means the auto on feature,
which is useful, for example,
if enabling
this feature, if I'm calling
the intercom, I am able to.
The intercom will ring
just once, and after that I'm able
to listen to the conversation
of what happened in the
around the intercom
and so on.
So there is plenty of features
in it.
And let's do some demo
right now after dropping the
intercom.
OK, so as you can see,
there is my JSEM lab here, you
see the intercom, we see also
here the
attackers phone and here's
the blade there.
So what I'm doing here, I'm dropping the
intercom.
After that, I'm able to
intercept all the communication.
So I'm pushing the button of
the resident one.
Exactly.
And we have Wireshark.
I'm just reaching for the call set of
message, which contains the original
number I want to lick.
And if that's what I'm doing,
I will associate
my SIM card
of the single of the attackers
phone with that
Likit number.
With this, a small Python script.
The Python script is
is coming in, it's coming Katine
in 10 minutes to
get to
also refresh your configuration
after the after the modification
in the configuration and after
that for now,
when I'm pushing the button, the
intercom will try not to join
the president, but geotech
of phone.
And since we just have
one, no, let's
suppose it's there, I mean, no, I'm able
to send commands, send
to come on and so on.
But also if I have an enemy number,
if I can impersonate a number,
we can replace the number with
a red number like Alapatt
and so on, though could be
an interesting thing if we want to earn
money.
Now let's do some attacks with
intercoms using the AmCham
Entercom, using M2M
architecture are
using Chipotles SIM
cards that
that are legit for
legit, that have more than
10 years subscription.
So
the mobile, the mobile network is the
mobile operator, for example, T-Mobile,
T-Mobile, Rangel and so on.
For the manufacturer provides a virtual
network to manage the intercoms.
That means that the that's the there's
this intercoms
connected all together in
the a virtual network.
And also
this are Entercom use the Internet
to be reachable.
So we know that this
is well managed by centralized server.
So that means that it introduce
new vectors of attack.
We saw already the 3G downgrade
and GSM interception that it introduced.
Also this the
inability that can be found
while using the SIM SIM
card provided with the intercom, but
also the vulnerabilities in services
like a Web site, services
and so on.
So let's talk now
about the website, which is in website.
We we we
have to note that websites are the
central server is used to manage
not just one, but multiple
Entercom that are connected
in the network, individual network
and some
because it's a web, something that can
be found and we can find a lot of
Cunxin plus
brute force notification bypasses
as as as CUAL
injections, LFR and so on.
So we
try with one product on
various projects in Paris.
It's a 3G intercom that is provided
with insurance call and
let's call it A because I
don't know if the
other thing is I'll fix it also.
But the first winnability was
the authentication.
No, sorry, the inductively the ID
because a website doesn't
enforce a password to manage the
intercom. That means that if I know
the number of the intercom, I can
manage it with the with
that website.
But also we have through
you know, a valid number is not
a problem because if we try to
to do some animation with
a very dirty script,
we were able through
to enumerate 90 numbers
in less than three hours
on the specific prefix.
And with that, we are able to manage not
just one, but multiple Entercom, with
that, we can earn more money than
a simple Entercom, for example.
So that means that we can change the
resident numbers to prevent
to premiere premium rates numbers
for Entercom.
And after that get which
also we can also
open the door. But to open the door, we
have to know the location, to know the
location. OK, it's
it may be hard or easy.
Depends if the engineer or if
people are there at are
they. There are no
first or in the list.
And with that number
you can use a reverse lookup directory
and get the address.
And after that you go to the address and
open the door and after that
do what you want to plug your device
and so on.
OK, we saw that
now speak about
a virtual network as a secondary attack
vector.
We we said that's the if
we use the SIM card or you SIM card, we
can we we are able to
to reach the virtual network which is
provided by the by
the operative words
in a SIM card are
protected by Pincus.
But Pincus, you know, if you have
a trace, is not very
good medication because
you can use the same trace as a proxy
between the SIM card and the intercom.
And after that catch the
the pin, which is typed by the intercom
with Will
thanks to to the scene trace get
the pin code. And after that used
the SIM card into your phone
optionally change your IMEI
set up the right EPN.
So also the commentated
for operators. If you use for example, if
the operator is orange,
you can document it yourself.
Use the DPN, which is provided
by orange and after that have
a free Internet Internet
connection. But if you want to,
to find the name which is in the
individual network, which is
provided for the intercom,
you can also do some guessing.
And sometimes manufacturers use their
name on the Appian
so you can get so that it's very
easy. But also if you enable
the future and
track the intercom in your
station, you see that
the intercom we try to join a specific
EPN at one time.
So you can also do that tricks to
to to to have all the EPN
after that, you out the communication,
using your computer, do some traceroute.
After that you can see what
is on the on or on
on the network scan.
The Vitron. It was such
a venerable device,
an explosive device at
the planet and so on.
Also
we were interesting about the SERP
as an attack surface because
we know that a as a mobile application
to provide video course, but
do of course, to to use that application
that we have to pay.
OK, we we don't want to pay because we
already paid for for the intercom.
So we we try to
analyze the this application and we
follow. OK, so some very
bad news is a check.
OK, that's cool.
But the, the, the the most interesting
thing is that the Seip
credential, I'll call
it in the application.
So if we use for example, this
credential, maybe we can connect to the
server, maybe try to call
someone over intercom.
So first things we register
with these credentials, which will
register to the to the same server.
But badly,
the results are not satisfying because we
only are able to contact the simple
user like user or route that we
are. And it's impossible for us
to reach an extension or an
external extension or an internal
extension. We don't know why.
Maybe because it's the number needs to be
reached as
premium extension.
So kind of mystery maybe we have finally
to to to take the premium
to the premium option to
to have some more information on that.
But I have to a question for for
you and you can answer after
that of you
if someone. No, if it's possible to
find a valid extension without having
to to float in step with.
I did invite request.
It'd be very interesting.
So it'd be very interesting for me
because I'm trying to
I want to if if it's possible.
Interesting, interesting.
OK, so
now the part of recommendation,
so we went to a network on
Fox being called a SIM card, like
a whitelist, embrace
of the tent, protest regularly, the
management website and the other
services.
Ristic action on and request
on ESPN's Fyodorovitch on network
and do some segmentation
of the ritual network against the network
attacks. Monitor and also blog you
cards that have suspicious behavior,
which is not the case with project.
Because I was able to have a
free internet access, I was able to scan
to do some end up.
So for me it's a
little suspicious behavior
because in these networks
we just have to call someone or
maybe send commands to to
to the intercom.
So as the conclusion with GSM
intercom, we can open the door.
No spy on conversation,
the intercom use of the same
floor as the mobile phone of
of a device also affected
by this kind of attack, not only the
mobile. That's why I was
saying before.
And the intercom introduced new
attack of Victo, because we expose a lot
of services.
And also in this subject there
is a lot of data to
to do.
And we have also works like phones,
a solution for the cyber
problem.
We have also to start attacking
Entercom, lazybones, because it's also
interesting, interesting subject
and also reduce our love to
a small ajoy with a small
oldroyd device or another
alternative.
But from the moment
we have a lot of work to do on the
server on that subject.
So thank you for your attention.
And if you have any question,
please ask.
The English with.
So just line up in front
of the microphones.
In the meantime, for those of you who are
leaving, there was a bottle concert all
over the talk.
If you could just take your trash with
you when you leave or if you don't have
trash, just pick the one that's next to
your place.
In the meantime, please go.
Sorry.
Regarding the attack vector of
downgrading the connectivity of the
intercom, you
you tried with the
various radio attacks, have you
considered just using a plane
attacked by covering the intercom
in the metal box to block
all communications except
your mobile?
It's possible. So to cover it with a
metal door like a sugar
metal cover.
But what we wanted to do
is also to to use the
the state of the art, you
know, attacks to
to do that with jamming, for example.
But it is possible to use, uh, metal
blocks and the radio could be possible.
But I don't know exactly what the shape
of the, uh, how to to say
that.
Oh, sorry.
The materials.
Although I
think it is. Yeah.
How thick, how thick the box
has to be to to be
to
to isolate
the intercom from the network.
So there's some experimentation to do is
to also about
um please leave quietly.
Uh, I'm interested
in the downgrade attack of
UMTS because I was under the impression
of UMTS using CDMA, which should be
pretty hard to jam with, just
using random noise.
So my question is, if you use any
kind of special magic there or
there's no special magic, what
I'm doing is that I'm listening to all
the FCC and with that list, I have
the central frequency I have.
I want to talk to Jam.
And what I did with
the Curve is to
weave that list just like
not randomly, but
following the lists.
And for some segments
on each, you have ten.
But also it's
it's also if you do a list
of Ephesian allows
in that case, I have I had
only like four.
We have Santa to jump.
But so we've we've that's
that list. It's possible.
But if the list is very large,
I admit that to be very hard
to to jump.
So I want to ask whether
the picture of
an intercom in one of the management
screen shots you had was it's a picture
of a product a
oh yeah.
It was the picture of political,
you think.
There is one from the Internet, which
is the guy there.
Oh, OK, Internet wants
to know if when you did
Supertech are numeration,
did you can you sorry.
Can you repeat? Because I.
Yeah. When you did the sip information.
Yeah. Uh, did you consider using
options or register or other safe
methods.
No, no. No.
You need two stars in order
to have one jamming and the other one
acting as the bass station, or would you
be able to deal with, say, one blade RF
one brother F is not enough, because
if we if you want a stable
station, you won't
have to do that completely.
So to to do attack
just the ability to do
that.
Cool. OK, uh,
thank you. Thank you very much for your.