Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/831 Thanks!
So our first speaker of today
is Dr. Zager Hold
Months.
She has an impressive amount of
publications, actually, ICE stopped
counting at the forty fifth on the list
was going on and on and on.
Pretty impressive.
She also was previously speaker
at many different and other conferences,
including the Black Hat Conference.
And today she's gonna speak about
the SS seven and dynamiter
and the security aspects of both
of these LTE protocols.
The title of her talk is Mobile Data
Interception from the Interconnection
Link.
Please welcome her with a lot of
applause.
Thanks a lot.
I said my dad was sick a whole month, I
work for Nokia but upsets the research
brand of Nokia on
been doing mobile security for 17
years. So everybody of you sitting
here has an LTE phone.
And he enabled phone, has a piece
of Samsung I designed in it.
It's quite nice feeling, actually.
This but this is not only my work.
It's also from my colleague Danny
Eckmann, who works
in our testing department, who sets up
test networks so that we don't crash
accidentally operators networks when we
make an update.
So and actually with
our competitor, CSL McDade from
Adaptive Mobile.
So we have been working closely together
on this one.
I would explain later how that has
happened.
So I will talk about mobile data
interception from the interconnection
link.
And, well, let's
let's start with the practicalities.
So this is something that's
not so visible in public.
Some of you might have been in 2014
here or 2008 meant to be an angle
or cost nor presented their A text.
So for those who have not been there, so
we are here in line to you
are connected now to Vodafone, Deutsche
Telekom or
Telefonica, and
meeting eternities here are
international.
So you will also have people from UK
connected from usually have a
subscription from three firm prongs
from Orange, from the
output from Poland, maybe from plus
or emptiest when they are coming from
Russia.
I'm from Finland.
Well, I live nowadays in Finland.
So my colleagues and families have Elysa
Tahlia, our DNA subscription.
And if there's
a big difference to credit card system,
what the credit card world is one big
mump sort of mother company.
But for telecommunication operators,
these are different legal entities
in different countries.
And still, you can just pop up in their
network, switch your phone on, and you
can get data or
make voice calls or estimates and you're
charged to your home, but it works.
So that's actually something to think
about because that's not happening
automatically.
And the reason why is, is this actually
working is because there's something
called interconnection link
or IP network.
It's not the Internet.
It has touching points with the Internet,
but it's a private, separate network
which enables mobile data, communication
or in general, more telecommunication.
So and actually why this
is such an important network, because
we are all connected to it.
Everybody here has switched on phone, is
connected to it, and not just your
phones.
It's also tablets, which when if they are
cell or enabled, for example, this tablet
with Android, it lets say to AT&T
in Anchorage, there's a connected scale,
let's say, to valorize on in U.S.
or there we have a car which can
connect a car which made from telephone
a car in South America.
And the button you see there, a gas
meter from British Telecom,
which is also Sarovar enabled.
Then we have their fire alarm
from Telstra.
I heard there might need to fire alarm in
case of a burning platform arrive there
at their Shores Hotel or something
like that has arrived. There
are industrial optimization
sort of assembly lines which might have
connectivity, Sello connectivity and,
of course, classical phones.
So you see there are all kinds of
different operating system, all kinds of
different hardware, and they are
connected to a local operator.
And while that they are connected to the
interconnection network so they can be
reached from the interconnection network
in case something arrives for them
to understand the security of
interconnection, we need to go back a
bit.
So 1981 Interconnection
Network was established between four
countries, Nordic countries.
And you see there a beautiful picture of
the Nordic mobile telephony of the Nordic
Nokia Walkman, as we FINSA used
to say. So
it's sort of this size and we wait about
five kg.
So I didn't bring it.
Very beautiful piece of hardware
and it was closed and private network.
So that was the main security feature of
that network. It was close and private
and nobody could get in.
Only the people that know each other.
It was running the signaling system
number seven protocol.
And that was a huge success.
And they extend it and extend it to more
or more operators, a joint lot ference
on Estonia.
And nowadays we have all kinds of
applications using it.
You get your S. M. S reminder for your
dentist or whatever, sort of your banking
tons, whatever.
And now we move towards the LTE Diomedes
protocols.
And so just to
give you an idea, sort of that's how it
started. Probably Finland,
Sweden, Norway, Denmark.
That's how they started.
They probably went together in a sauna,
having some good beer and say, hey, let's
do it. And they managed to do it.
That's how it nowadays looks like.
Sort of more has grown a bit.
So we have.
That's two G and two and a half G.
Then we had 3G with
a 4G.
And now we have all the 5G.
So it has gotten a bit more complex.
So and it's a sort of organically grown
structures.
And the thing is, everything
is connected to everything else.
So you see GSM networks,
really old networks connect to LTE
networks. And the other way round.
So sometimes there are nodes in
the middle, sometimes not.
So it's it's very, very sort
of
in homogeneous to call it that way.
So.
So back to
security.
I mean, the main security feature
of this jungle was that it's closed and
private.
Now, let's revisit this assumption
sort of 35 years later and see what
has happened.
It's so close and private.
I am afraid to say no.
There are different angles
to close and private on the top.
You see, there are three.
I could have chosen any European operator
that's not particularly to three.
It's just in the European Union.
The European Union wanted to encourage
competition so that mobile
virtual network operator have very easy
to establish their business.
So, for example, supermarket
chains are now selling here
subscriptions, for example, in Germany.
So they rent their services
from an traditional
operator.
And all operators in the European
Union are forced to rent
out the services that they have, some
self, which includes roaming
to anybody who has basically come and
ask to and has a proper
business model.
That makes it also very.
All right. Makes it easier for nasty guys
to buy the interconnection access
in the middle.
Their cell phone reports,
cell phone interception.
This is us from the dark net
from a company called Interceptor.
But they have a horrible service,
so I wouldn't recommend that company.
They're not answering to emails or
anything, but they are claiming to rent
out these kind of services.
So the access can also
gain from the darknet by just rent buying
it here on the bottom.
We see screenshot from Shodan.
You see he has this g.g.
Yes. And you might not know which nodes
this is, but I can tell you a
g.g is and has no reason
to be on the Internet.
It shouldn't be there.
I don't know why it is here.
Maybe it's a honey pot, so I don't
suggest to hack that.
So you never know.
But come speck
then we have on the right hand side here.
A GP or s SL
SL is a big operate in India
and they seem to have a GP arrest notes
on the Internet.
The protocol here is s m
m p. That is simple network
management protocol and it's used
and above that you a turn at lock in.
My personal assumption is that somebody
who was on call duty to fix the
network and didn't want to go into
office. So we just set himself
up. This turn at accessibly could easily
configure the stuff from home.
But these things happen.
That's life.
But well, of course, turn that luck in
your throw on a sort of password, Krekar,
and see what you have admin admins or
it's worth a try.
Then there are this map.
It's a bit older.
That's from the WikiLeaks, from the
Snowden leaks.
And it's showing the
countries which the NSA says
they have access to the
phone network.
It's probably no longer up to date.
I think the situation in particular in
Europe has approved substantially since
then.
And on the top, there is an article
from The Intercept where the
DC HQ, basically a British
spy, hacked Belgacom,
but that was he depressed
transport protocol.
So I think it's fair to say that
there are points Veza network
is no longer that close and private.
So hackers
say May just ran to service the
hack their way in
having power in some countries.
The line between government
and telecommunication providers, not
so strict, let's call it that way.
And if the government wants to have
access to just get access.
Of course, there's a classical bribing of
an employee that always works, just
amount of cresson, probably amount of
money.
You can become an operator
or you can do social engineering.
That has also be seen.
But that's a quite rare case, actually.
Social engineering is not so common, but
the other ones are sort of.
More likely.
So let's do a brief recap.
As a seven, that's the old protocol.
And there were attacks.
These are the attacks that exist for the
old signaling system number seven, which
is still most commonly used on the
interconnection link.
We have their location tracking that was
published, I think, in 2008 very course.
Can our clarity by two be us?
Then we have eavesdropping, fraud,
denial of service on the user,
our network credential theft
that are the cryptographic keys that
are stored also on your SIM card that are
used for confidentiality at
authentication
data session hijacking.
But that's not S7.
That's actually GTP protocol
unblocking of stolen phones.
That is an implementation specific
attack. Not from our notes.
I'm happy to say
as a mass interception,
basically, that's pretty risky because
of all the one time password theft,
because nowadays many
password reset systems sent you a one
time code and the attacker
could actually trigger the sending of the
one time code.
So
depending on the.
On the system used, it's more
or less vulnerable to it.
So there are even
on YouTube videos how that works.
So this is basically a situation
for us. A seven just
tax were sort of done by P1
positive technologies
cost nor to be a single.
And these are source of some.
I'm focusing more on
on diameters security.
So that's basically the S7, the old
protocol.
And that's the status of the security
for the IPCC network.
So, yes, the seven are still most
commonly used, but things slowly move
forward.
The communication is sometimes
direct, sometimes intermediate
nodes involve depending.
For example, we are here now in Germany.
I don't think the access to specific
cable from Germany, let's say to Tuvalu.
The Pacific Island.
I think two thousand people living there,
something like that, so but
they have their own operator.
So I don't think they exist.
Explicit cable from here to to
there. So there is probably
some intermediate nodes
involved. If you make a phone call to
Tuvalu.
But some operators also have direct
personal pipes with their most common
partners, for example, in Frankfurt.
Such a big hub.
Also, nowadays, some deploy as a seven
firewalls. I think that was a big
achievement of the presentation done here
in 2014 that really something happened
afterwards.
The first firewall product came up and
auto operators started to deploy it.
So not all have them,
but it's better now.
And but there's no form of transport
security, no IP sex, no tearless,
no details, no MUP security,
no false authentication on containers,
confidentiality, protection and no
integrity.
That's how it is.
No fun, but that's it.
So I meet her new Fonte,
new rule, new protocol,
new game. Everything is better.
Let's see.
Yeah.
All will be better with LTE and diameter.
I've heard that from.
One company I'm not going to say which
company that was, and I say,
well, all
will be different.
We have a different protocol, but it's
doing roughly the same things
as the user. You still move from A
to place B.
You move from one antenna to the next
antenna.
So the logic for hand over
and subscriber profile management
and things like that, they are pretty
similar. They're not exactly the same.
They're pretty similar.
So it's possible that some things
are just sort of converted, let's call it
that way.
ATEX to reality.
I've seen myself some ATEX
quite manically.
I've been doing
Trace's analysis, looking at the traces
and trying to figure out what the heck is
that.
And there's one important question one
needs to sort of why should a check
us top just because we have a different
protocol?
Come on. They make money with it.
That or they are governments,
intelligence communities.
They still have our limits of all.
You can eat data.
Give me all your data.
They track VIPs.
I don't know. And they are these kind of
service companies.
Basically, you have to know that some
governments have their own agencies which
do stuff.
And other governments, they just hire
service companies because it's cheaper,
because the service companies sell to
several governments.
It means I can offer per government the
things cheaper.
Also, governments have budgets.
So there is this kind of service
companies, although they
are just
entities which make money from it.
Fraud and
also military uses a mobile
network data for target localization.
For example, in The Intercept,
it was published that
I think they called it drones papers at
about 70 percent of the
data for target localization
for the drones where they use their drone
strikes comes from mobile telephone
networks, which sort
of I find pretty coming from
telco industry, sort of bit pretty.
This
makes me a bit upset because they weren't
designed for it.
They were designed for user mobility and
making phone calls.
I mean, they're not not a military
weapon, but they are used for it.
Yeah. Even the German Bundeswehr
was observed doing
something with the Afghan phone app.
So.
Attacks are moving forward.
Let's see how this touches this with
diameter.
I'm from research, and when
I started looking into interconnection
attacks, my manager said
S7 is old stuff.
Don't look at it.
Look for what?
Market research.
I look forward.
I study first. Kay Hull with us is the
seven work. And then I look forward
and particularly I looked at the diameter
protocol as the successor of S7
and then
he's looked at sort of where are the
similarities for a text?
And we started basically with
location tracking.
And that's sort of relatively easily
done.
Then you have downgrading a text that
basically because, as I said, they are
old networks and new networks and they
have to talk to each other.
So basically, the attack comes just
to, hey, I'm an old network.
I only speak as a seven.
Can you please translate the stuff for
me? And actually, then there are
translation boxes which translate
the whole the tech enjoys a new protocol.
Very convenient for an attack.
So the attacker doesn't even have to
learn the new protocol.
It just can.
It's very nice if you have a translator.
I hope I don't speak too fast for the
translators.
Then we have denial of service attacks
and fraud, denial of service attacks also
in that sense. Very easy, because
denial of service attack, the attacker
can just push.
The attack to its networks,
and he doesn't care if the answer message
is correctly, wrote it so he can spoof
the origin, he can use the origin
of a partner because he can just push
the message and doesn't care and just
cease, OK, things go down.
What?
So a denial of service attacks are very
easy in that sense that you can spoof
these sources as a mess.
And one time password interception
is very sad because of
this kind of password usage.
And some mess was just a few bit bits
of space in the protocol that way.
So somebody said, OK, let's use it for
texting.
And it was never designed for security.
And yeah, well, there we go.
And then we have subscriber profile
modifications.
So the subscriber profile is basically
an entry in a database in the main
database of the operator, which says
if you have prepaid postpaid,
if you press, if you're allowed to roam,
what's your phone number?
What's your identity? And so on.
So that if you meddle with that, you can
imagine that it can cost quite some
hiccup.
Then there was by positive
technology
on denial-of-service and easy retrieval
and also at the Black Hat.
Hendrickx and Danielle presented
Denial-of-service. I think it had
Donya present because Hendrickx etiquette
in a car accident.
But he's OK.
And now we are presenting basically data
interception for G.P.S.
and ETTY. Just as a reminder,
there are usually some restrictions when
things work and when they not work.
So.
So that's important, not all the networks
are vulnerable. It's very important to
understand. So
to the talk now to data interception,
and I'm afraid I have to give you a very
tiny crash course
for LTE networks, but I keep it really to
a sort of
acceptable level that causes me.
So the background, as I said, this first
time together with one of our
competitors, Adaptive Mobile
and the GSM AC operator
organization, which enables basically
roaming.
Well, we also have a security group that
we discuss the security and what we
can do to improve it and so on.
And adoptive mother reported on AGP
arrest, traffic interception, a text that
I saw in Life Network.
And then I was at the same time I
was working with some colleagues on
subscriber profile modification using
the diameter protocol.
And let me discuss it.
I was thinking, hey, we could combine
those text the ideas of those texts.
And so
and get the potential data interception
for LTE. So we but we weren't hundred
percent sure about the constraints,
but was clear for us from the beginning
that there are probably some constraints,
that it only works in some
configurations.
So what I did then I called my colleague
Jenny because we have a test
network as a big network or
never a company.
We roll out updates for the
operators and
as updates have a tendency sometimes
to screw up things.
We have a test network where we basically
copy the exact network of the operator,
where we go to roll out the software
and we also copy the configurations.
So Yenny knew the configurations.
So what are typical configurations and so
on.
And then we also tested those
attacks.
So and there we sort of figured out what
are the constraints so that these attacks
could work.
So.
GPA, is that basically
how it worked?
That's the attacker was modifying
in the Astreus in the
law saying sort of to the home network,
please check if there's a new
access point network.
And when the user then requests a
session, what then happens?
Said This gray cloud there
connects to the attacker and asks for the
access point.
It gets us back and then the user
connects to the access point provided.
So that's the basic idea.
You don't need to understand all the
detailed command codes.
But that's what's the idea.
So now the crash course in
mobile networks.
So that's you?
Well, you are behind that phone, but
somewhere there you connect to an
operator on Tanah Radio Access
Network.
OK. You.
You have friends and you have gadgets.
These are your friends and gadgets.
OK, you move from,
let's say, to from one antenna area
to another antenna area.
So you need somebody to takes care of
your mobility.
You don't need to remember the whole
abbreviation. Just remember.
And like mobility.
So this guy is basically taking care that
you're tracking your mobility where you
move. And so on.
So it's a mobility management entity.
Then we have a database
where it's
stored pre-paid postpaid, all the
digital details and the application
server, the application server you need
when you want to make voice over LTE
calls.
And he has a database where your
subscriber, DHS.
S I put their DHS
s because if that thing is down, then
the whole network is down.
That's the most important box in an
operating network.
The enemy, they are several of them, and
they are so for regional level.
So if an amendment goes down, some region
is affected. But if the H.
S goes down, the whole network is dead.
Meaning that the operator has no income
and he's pretty upset.
Yet the network has a edge.
That s diameter.
Note Lucy used them also.
And then the other operator said, look,
basically the same.
So we make his's assumption that we have
to LTE networks talking to each other.
We are not going on all the inter working
cases with Jeffs.
It is a man whatsoever.
So let's keep it easy.
That's the easy Worsham, believe me.
So as I
explained with the two value exampled,
those two network might have a direct
cable, let's say, if they are sort of
sitting very close to each other.
But there might also be one or
more of the interconnection providers
sitting in between.
So now we have all the hardware together.
And then their interfaces,
as they're called.
So we have the most important and most
busy interfaces, the S6 interface.
That's between the mobility and the
database, because
the mobility node needs to know what
law to grant to you, what kind of
network connectivity you're allowed.
Are you allowed to use LTE?
You're not allowed to use LTE.
What are your constraints?
What are your credentials?
And so on. So that's a lot of data
traffic on that one.
And then there are C.
S H interface, which is usually internal.
But I come to that.
And of course, you also have that
enrollment case, so when you are, let's
say, here now and have
subscription from.
If you have a subscription, let's say
from Germany
and you are then connected to an MMD,
let's say in France,
then the SSX A will be used, for
example, to fetch your cryptographic
credentials to provide you
confidentiality.
Also, while you are traveling in France
somewhere, the French network needs to
get your cryptographic keys so that they
can protect your communication on the
interface, the
S.H. interface in some scenarios,
some configuration scenarios.
It might also go over the interconnection
link and I would come back with it.
So.
Country generation vulnerabilities,
settings that are not uncommon
and have been observed.
The price pressure on the mobile network
markets, it's pretty tough.
And so what they do.
Operators which make they use
equipment for different purposes
and the opening up interface and
so on. And one typical scenario is if you
have a big operator which has
subsidiaries in many countries,
they buy first one box.
They place it in one country
and then they use it from all countries.
Just to see if the service flies, if they
use a lot likes it and so on,
and then if it's running well, it's sort
of also deployed in us on networks.
Makes sense business wise.
That makes perfect sense.
If it doesn't fly, he can just swap one
server and the investment was not so big.
So. But that also means that
they open up the link to the server
over the interconnection link.
That has been seen for application
servers.
And similar, there's the problem
of the DNS resolution.
Of course, it's cheaper to have one box
instead of two boxes.
So we have internal traffic, which is for
the core network internal.
And when we have external traffic like
Internet traffic, DNS resolution,
and some operators just put it on the
same note because it's cheaper.
Yeah.
Also, actually, that's not the
configuration venerability.
But I thought
I mentioned that anyway.
There's the assumption that the attackers
are able to set up any IPCA
IPN. So that's more an assumption.
The attacker.
The attacks that I'm going to present has
several steps.
Step one, classical data acquisition.
This can be quite sort of done
well before it can be done half a year
before you don't need to do it directly
beforehand.
So you can do it just before.
Can do it now and then
do it. And the attack half a year later
is the easy.
You know each other by phone numbers.
But the emcee is he
is a subs bribe identity
that's used by the telephone network.
So the phone network usually doesn't use
you emphasized in your phone number.
You seem easy for the messages,
certain techniques, easy to get
things running.
So be focus
on the SAHD, the face.
There's something called user data
request that you ask, gives
you a profile back and the profile
contains Amesys Impey, the whole
subscriber profile, all the details the
attacker needs.
Easy.
It's a standard feature.
It just requires a T.
The attacker impersonates
an application and that's hardly how it
looks like on Wireshark.
So just for information,
I'm not going through the details of the
Wireshark kadota in case
the
the S.H.
interface not open, because also you'll
see a sexy interface,
but not many operates actually using that
one either. So the attacker has a choice
of of
attack possibilities.
And actually, this attack works the same
way for us as seven.
So the attacker might also do basically
the same stuff in
an S7.
So I presented this the detail of
that in Paris.
Some then may.
And also the attacker could do other
things as six a.
But they also already need the easy
it can make an update location request.
This is a most common message
in the over the interconnection
that you basically
put synchronization purposes.
You impersonate an enemy and say, please
let me subscribe profile.
I need an update.
Well, the network is so nice
and this is all possible because there's
no source of education.
Other way to get to Amesys than this
is a mess.
ATEC is, for example, that you
set up a false base station or a
wireless LAN access point and one aim.
Okay, I need to speed up a bit.
Sorry.
So HPN placing
the tech works at your place and
subscriber profile your
fake bad IP it HPN.
And then the user connects to it.
That's the basic idea.
So how to get the API in
there. One way is again
using S.H. interface profile
update request system network nodes
synchronize which each other.
And there is a message called profit
update request.
And with that you can update
the API. And in that case.
So because you know from the previous
step how the subscriber profile looks
like that, you can update it because you
know how. Looks like you just changed
some values.
Tiny B Billu
API details.
Let me say you can change the
AP ns for GP arrest or
all four of packet core UPC.
That's how this kind of
update looks like in Wireshark.
And also, you can you'll see a
a interface which is a bit bothersome
because you cannot stop the S.H.
interface.
But a six eight interface,
you can that's a soft little
trick.
If the edges s has reset,
then.
To avoid that, somebody needs to manually
all update all access points network
after a process, reset
it. Basically the m m e
Kent's updated
the HPN data
so that they should only do that after a
reset. So there's a logic behind
that, how you could detect this kind of
attack.
So this is all too possible.
So the attack is actually a set of
possibilities.
And also, you can update the subscriber
profile in DMM, either to mobility
note.
So there are several points where you
can update the profile and then the user
connects.
So how does that happen?
So user
connects, that's a new easier to use
equipment. The three P terminal G.
It attaches to the HS.
S update location and
then we fall without synchronization that
has the attacker basically try and area.
You don't know an.
Then if he has update, basically just
as the Emmy.
What happens then that the
M.E. connects the user
to the fake HPN?
And this only works for
one? Does the constraints I extend
before and
actually you say, hey, I have an AP
insetting on my phone.
Why is not that not used?
Well, that comes from the old times when
you still had to configure your HPN
settings manually.
So the MMD just assumes you made a typo
and you are wrong.
These are the legacy stuff.
So it sometimes pops up.
So as industrial research,
I cannot just complain.
This is bad.
I also have to fix it.
You from the I.T. community, most of your
letters. Hey, let's easy let's use IP
second. We have source authentication.
Everybody's happy.
Well, we sure would be so easy.
Be seconds. Even standardized for
diameter.
But
it's not all IP.
We have human who are members is a Sir
Transport Protocol SICP.
Yeah. We still have it living there.
And as a political question, we talk
about an international network
all across the world who would be
trustworthy enough to host a root
certificate.
And the key generation worldwide.
I know who Bank of Artecoll
it.
I mean, you name one country, I name you
another country that says no, no, no, no,
no, no. So no way we are going to have
maybe we get something on a regional
level one day that that's possible.
And then there are operators that just
don't have the money or exercise.
And to value it, which I mentioned
before, they have something 47 employees.
They don't have a security expert.
I'm pretty sure.
Maybe they have one. I don't know.
Also still,
it's no protection against sort of got
some governments or
renting out the service companies or heck
notes or things like that.
But I tech would still be a good idea if
there's not already a secure pipe in
place.
But it's also important that the partners
have a similar understanding on hardening
and so on.
So that's also.
For this specific attack,
the S.H. interface, it's an internal
network interface, it shouldn't put it
open it up on the interconnection
at it nodes in between.
You can also filter out as h traffic
if you really need to do it, secure it
properly.
DNS proper internal external resolution
and for the update location stuff, the
S6, a potentially block
or velocity check.
So how fast to use a control.
I'm nearly done.
Countermeasures on general level
monitor what's going on.
Pend tests the network.
It's not very common that mobile
phone networks are panties tested,
tenant monitoring.
What are those mobile virtual operators
really doing in your network?
Do you really know? Do they stick to the
service? Look, you know, it's like this.
I accept.
And then you just hope they do what
they're supposed to do.
Share your experiences.
That's a bit critical because network
operators are always afraid that they
might get into trouble with their
license.
So when they disclose they have been sort
of somehow hacked, they're always a bit,
Fred. Sort of. Okay.
But does that mean for my license next
year and so on,
some things can already be done with
business rules. So if you have partners,
which sent you a lot of bad messages,
you might want to increase the
fees for those partners.
So some stuff can be done with business
rules.
Filter, filter, filter on the network
side, signaling follow
estimates, home routing.
Not everybody is doing that.
I hope the operator knows which one.
I mean, very
specifically one there in mind.
Then we have the GSM documents which
describe explicitly what you can
do.
And layered security from user level.
So
don't necessarily assume that the pipe is
secure, if you can, at some
security on top of it, do it.
I mean, if you have a best security, even
if it's not good, it might help somewhat.
And note, hardening procedures exist.
So let's use them.
Summary.
All networks are affected by ever
so, but not all are equally vulnerable,
some are a bit more, some a bit less
detect a reality, but still mostly
S7, but diameters sort of popping
up slowly.
It's independent of phone platform.
The interception detected a presenter
depend strongly on how what actually
is really configured in the network and
how it works.
But there are networks that are
vulnerable on the
general question to the diameters.
Better or worse than S7
if nothing is done.
Well, it's bad, but think I think we have
now a unique opportunity to do things
better. And I think now it's actually on
the on the right track.
So so I know that last week
several operators called the IP X
provider and asking, do you filter SAHD
traffic?
So this conference here really did
some improvement with the security.
So to all of you and also to
the people here and to that
all this guys working here.
So thank you a lot.
This really sort of kicked off something
in the operator community.
So.
So basically discretion's.
Thank you for the very nice talk.
I think we can actually get that.
Thank you. Back with some more Plous.
Thanks a lot.
Or I'd be off lots of time for questions,
please. Liable to microphones if you have
a question.
Microphone number one.
Other than the other legitimate uses
of remotivate, it just US profiles,
like, I guess it's like, you know,
something called bearing and call waiting
options. But yeah.
Other like, legitimate options.
What a better use for them
from hearing partners in
these subscriber profiles.
Everything relates to your subscription.
There is also
there's called burying.
There is special services
which you're allowed to use.
If you have postpaid if you're prepaid,
your phone number is there.
If you have proximity, security,
which bureaus you are used, allowed to
use. So it's all kind of technical
details in there.
So but basically, you can do easy
denial of service.
You can do fraught with meddling there.
So so the subscriber profile
offers a lot of opportunities.
Let's call it that way for all four
attackers.
So basically, basically,
the question is, is
it legitimate uses for you
for visiting networks to update your
profile at home?
Of course. Of course.
I mean, if you, for example, R&D
for a network and want to change your
subscription or your location,
update it, also change your subscriber
profile. So but actually
not the visited network doesn't
need your whole subscriber program.
That's the point.
At least it shouldn't change your APM,
for example.
Yeah. Might be that you want to have
local connectivity because that might be
then that better.
So there might be a good reason for
giving you this new AP and
so that you don't need to your traffic
doesn't need to read altered over the
ocean and back. So.
So there are good reasons for doing it.
But you might want to keep control sort
of who is doing what on your network.
All right. Thank you.
My phone number to your question.
Hey, there's a bit of a gap
in public knowledge about
SS seven attacks in the wild.
Can you just talk about
how frequently you see
these attacks and in what part
of the what possible world?
They are everywhere in the world.
So we are we are doing as a company world
to do sort of assessments of network
and we see operate all
the world under attack.
It's not bound to a good geographical
region. Some regions have this type of
attack a bit more.
Some others have a bit other types of
attack it more. But they all
somewhat commonly observed.
Attack is usually location tracking,
followed by credential theft.
So these are everywhere in the world,
but not assets.
We see them at the board of the network
and they're filter them out.
So not all of those attacks will really
be when people monitor it.
They also filter in the same go so
and so.
You see them all of the world.
So, so.
And every every operator has some chunk
of the tech traffic.
But I've been me noted directly that
operators that deploy signaling firewalls
have much less
malicious traffic.
For example, an operator that just look
the first time into their traffic, let's
call it that way. So, so, so
also tech seem to sort of more or less.
I wouldn't say give up, but.
Well.
So, so flattering really helps on several
levels. So.
And there's one question from the.
Yes, thank you.
The IOC wants to know, how many years
do you expect will be needed to prevent
these attacks?
Well, the Internet's not safe today or
I think mobile networks is going
through the same evolution process as the
Internet went.
So, I mean I mean, beginning with the
Internet, Rossie ARPANET, where you have
username, password, I knew that you were
in. And I think this network is basically
rushing through the same steps, so.
Hard to say.
I mean, I just do what I can and
it's also an investment question.
I mean, security costs money
and it's
I mean, obviously everybody expects
security to come for free.
Also users.
So there has to be a balance
somewhere.
So I think don't think, for example, that
these 2000 people in Tuvalu
are willing to pay, let's say, 50 bucks
more for their subscription per months.
That's that's just not feasible.
So and still, people
there want to be able to call out.
So we must find solution old for these
kind of cases.
So it's been pretty hard.
So if you face reality in that sense,
that you have to have to think about
budgets and so on.
So I don't think we will ever have
hundred percent secure networks
as we don't have hundred percent secure
Internet, even with Heg Pierce and
whatever. We have IP second.
Microphone number six.
What's your question?
I see that there's a big problem of
backward compatibility.
Do you have a sketch tune when you will
turn off GSM infrastructure
like 2G or doesn't
it exist?
Well,
mobile network note, for example, from
countries which are more progressive,
which roll out newest technologies,
these notes are sometimes not scrapped.
So those radio towers that you see on the
roofs, they are sometimes sold,
for example, to Africa, second hand
equipment. There's a big second hand
equipment market.
And because there
look at how much an African subscriber
can pay for their subscription per
month. So the infrastructure is just not
allowed to cost much money.
So these GSM will live for a while.
It will continue for a while.
Also, there are operators which see GSM
as a very cheap way to offer IATSE
I.T. connectivity.
Because if you have to pay as
much for a subscription for
you. Let's say your tablet, your
your skill, your car and so on, you don't
want to pay for everything of that, let's
say, 30 bucks per month.
So these should have a cheaper
subscription. But how can you offer us an
operator, a cheaper subscription, which
basically means you reused your old
stuff.
So especially if it's not time critical
communication, so you recycle
your GSM return of investment as
much as possible.
That's just business logic on both
sides.
So I suppose we will live with just empl
while.
Mike, from number four, what's a
Christian?
Are there practical Dr.
Urman, documented mentioner and
configuration examples for smaller
providers who might not have the
resources that you have and which
are publicly accessible?
We discuss in just a how to do things
for them and one that the IPCC
provides might take more responsibility
because very often those very
tiny, tiny islands are so they're
connected to one satellite operator
and then it basically goes into the IP
network.
And basically, if you just
have this link, then from this IP
provide on the IP X provider, that takes
care of the security security as a
service, basically like
you.
They see no
one else lined up anymore.
So thanks for answering all the
questions.
I'm thankful for it.