Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1256 Thanks!
Very warm. Welcome, everybody.
It's my great pleasure to announce this
next talk, which is gonna be called sick
over an alpha were Chilean Park
and Munchausen.
I'm gonna be talking about signal
overshadowing a in LTE.
The two of them are researchers at the
UK ISP in Korea.
The Korean Advanced Institute of Science
and Technology.
And I'm really interested in
hearing about the experts these two
found. Please give them a huge
warm welcome with applause.
Thank you.
Thank you. Good afternoon.
Welcome to our talk.
The name is single over for us.
For while we were talking about this.
Very interesting.
We are Estee and our new author
in Haiti.
My name is Mitchell.
I'm a graduate student
at System Secretariat in Christ.
My research interest is in
several networks and comparison analysis.
Hi, my name is Torture and
I'm also Peachtree students in Security
Systems Degree Left in Christ.
My research a risk interest is also
stellar network system and mobile
secreting analysis
in this print nation.
Are we prepared?
A lot of interesting our tech
demo videos.
And Mitchell, we'll talk about the first
half of the plantation, about
some introductions on LTE network
and concepts on seek over attack
and broadcasting message injection using
seek over.
Then I will talk about the rest part
of the plantation, about
little more advanced tech.
OK, let's start, first
of all, what I'm going to talk about
this solo, that's all or
almost useless so far for
boys call playing games
or watching a video in anywhere
at any time.
And the mobile phone
has been developed from first generation
to first generation as shown in
the figure on the right.
And five fifth generation services
now started today.
We are going to talk about new
and powerful tech techniques that
can be used for texting 30.
Also, we'll explain some examples
of attacks and show demonstration
of them.
To understand the bank context,
we need a background for 80
30 system is largely composed
of QE, such as a smartphone
used by your user for LTE service
and our base station in charge of
transmitting and receiving radio
signals and
or corner talk for the mobility
management, authentication
and data servers of all user
for control messages such as
radio connection, the
you and base station use RSA
protocols.
Similarly, the UAE and a core
network sent and received
control messages with last protocols.
The main part of our talk are the
UAE and the base station.
If so, how does the UAE
established a radio connection
with the base station and used
30 service?
First, though, he has to decide
which base station to connect to
to do this newscast.
The relative frequency band and
select the most tower base
station by considering the
frequency of priority and
signal or strength of the base station.
After selecting one base station,
though, use third or techy procedure
with the space station.
First to you, you receive
your pieces and assess
the signal sent by the
space station in time,
MIB and XIV are
decoded.
All three messages are broadcast
messages sent by the space
station.
They are used to match time
synchronization to no
bandwidth or transmission scheme
and to no information about
space station after broadcast.
This is the
UAE establishes a radio
connection with the space station.
This process is done using the RISC
protocol messages after which
you will proceed with secret
setup for and that's protocol.
Throughout this process, the UAE
and the core network shared the key and
algorithm reason for encryption
and integrity check.
The security setup process is also
performed between the UAE
and the space station.
After this series of procedures,
the UAE can attach successfully
and use the 30 service.
And then what are tag as
possible against the UAE connected
to the network and using
the service.
The most widely used vessels so far
is to use the fake base station.
An attacker could use the fake base
station that behaves like
or as it made base station, causing
the victim to
disconnect from the rest, made the base
station and connect to the
fake base station.
This is possible because the UAE
preferentially tries to connect to
a strong base station.
Several texts using a Prius
have been introduced, including
many in the mineral to denial of
services, user identity,
fake emergency a lot.
And so.
As such, the effect base station attack
using the batteries sticks of
the radio communication is
actively used for research
or actual attack.
And there.
Here is the questions
is if we as low tech is
the only attack method using
the characteristics of
a radio connection?
Or should the victim use always be
connected to the areas for
wireless attacks?
The answer is no.
There is a more intuitive and
powerful auto muscle than
ever. Yes.
It is a signal overshadowing attack.
Why the previous previous slaughter
used the characteristic of
selecting a stronger signal base station.
The single word text uses
the characteristic of wireless
communication to decode
the stronger signal or when
different signals are transmitted.
Has the same frequency.
This is to illustrate by to figure
below the
normal base station continuously
transmit signals in time
and frequency.
The unit that saves and cause
is the signal.
If the attacker can match the time
and frequency.
Exactly.
With the normal signature and transmit
a stronger signal than low.
My signal.
Though you were called
the stronger signal.
This is the signal also during attack
that overweight diet is similar.
If the single overall attack is possible,
then what message can be used to
override?
The message is we can all right.
Or does it?
Those security protection.
First, there is the broadcast
message.
The broadcast messages of base stations
sent signal for all users
with no consideration for
encryption and integrity checks
in the right specification.
Second, there is
a message that can be used for
an attack because it
is unprotected among messages
transmitted only to a specific
user that a broadcast message.
One reason that is not protected
is a bug in the implementation.
The other is that there are
several messages in the specification
that are low plain messages before
performing security settle.
The details of the single one attack will
be discussed one by one.
First, I will explain
what you saw in order to perform
those single attack
and how the seeing overall attack is
different from the existing obviously
attack and what kinds of attacks
are possible using broadcast messages
and see over.
Lastly, Churchill will explain
attacks using unique messages
and then discuss something like
countermeasure and future ops.
So first, there are some challenges
and questions for single world.
First, we should consider
which part of the signal we override.
If too many signals are overwritten,
though, you will loudly say no more
signals causing only
those effects such as jamming.
On the contrary, if too few signals
are covered.
The difficulty of the auto increases
and you may not be
able to decode properly.
The second challenge is how to
synchronize time and frequency.
This is the most important challenge
in a single vortex where the attack
signal must be appropriately over
right on the signal.
The normal way station.
Finally, how much error
is OK even
if the signal is transmitted like on
normal base station?
There may be a slight error in time
or frequency.
Therefore, it is necessary to know
how much pressure is
required for the UAE to properly
decode the signal.
I will explain the details of this rule,
challenges and questions
to answer about the first patient.
Let's look at the LTE frame structure.
First already frame
consists of multiple cell frames
and also frame has multiple symbols
and a message is included in our
suffering.
Meaning that there are various
options to be overshadowed.
Symbol or shadowing requires
precise synchronization.
So success rate is hard to
guarantee.
On the other end frame, labor
overshadowing requires to rewrite
multiple sell frames or multiple
messages.
It can also affect other normal
messages, so it
is quite natural to overshadow
in the soft frame labor.
Next, let us look at times equalization
first along synchronization issues.
Attackers so frame and as it mates
offering most arrive to
use a rotating theory
in order to overwrite or particular
offering or territory.
For simplicity,
let's assume there is no propagation
delay. For now,
the attacker utilizes synchronization,
signature code pierces
and assesses together, create
a time synchronization as they
are sent periodically
from the receipt mate base station,
both concurrently first.
The attacker is to be assessed as
assessed to cap.
Timing of ready made base station,
meaning that the attacker can identify
the frame timing to zero T1
and T2.
Second, once the attacker
allows the timing, she can predict
the timing of the target suffering.
Since each so frame has fixed
size, which is one
millisecond.
For example, if the attacker overshadows
the console frame of 566,
then she can transmit the malicious
software at T2 plus
one millisecond.
Now the attackers signal arrives
at use simultaneously,
since we assume that there
is no propagation delay.
However, in real life
there is propagation delay depending on
the location, meaning that
the zero will be delayed due to
the propagation delay or pierces
and assesses.
Also, if the attacker is located
far from do you see
more delay would be added.
The delay could be compensated if to
take her. Precisely.
Okay. The U.S.
and the space station.
But it is not real
estate in the wild.
The delay is up to some mess, but you
value because they are located
within range of the base station.
So in practice, there is
a delay that cannot be compensated.
So so frames cannot be aligned.
Exactly.
So then
we can't count on the earth.
EU treaty is designed
to be reliable.
Especially in outer environment.
In outer you we can
move with using porn or so
there is still a flux effect because
all buildings.
So we expected that the U.S.
would compensate such small
errors if the SO frame is somewhat
synchronized. It but not exactly.
So the question is how much
can we tolerate
this DeLay era
since it is chipset dependent?
We measure the Max DeLay tolerance
of two cuts smartphones
and larger is around to serve
and eleven microsecond
each and both resort
excess Max DeLay of the
urban base station, which is around
a microsecond.
So this means
that the attack can succeed recoveries
of occasional base station
and the victim notice.
In summary, the attacker can be
anywhere within the range
of the base station.
To succeed the attacker,
the last one to solve is frequency
synchronization.
O2 Standard specifies
the minimum frequency of crucially that
LTE base stations must have as
50 people.
So for four precise
synchronization, the attacker needs to
use a sufficiently
agreed frequency after
the residual frequency
error can be confronted by
CFO.
Correction. I will listen.
Since the civil war was wrong
on our typical esoteric kit
we're on.
Okay, two years later we
adopt faith to you to improve
its frequency crochet.
Jeff is still guarantees
25 across
you without G.P.S.
antenna and one PPE with
G.P.S. Santa.
Lastly, we can compensate residual
frequency error by Pearce's
assessors based Save for correction.
Here's the summary of the
main questions and answers
we overshadows.
So frame units using
PCs as a set for times
synchronization and using give
it to you and save for correction
for frequency synchronization.
Finally called Stewie
is generous enough to cover the entire
range of the over on
base station insured.
I'll take her located on all range
of the base station can overshadow
broadcast messages to
any victim within the base
station coverage
next.
Before examining the difference between
C Grover and F, yes,
I will explain the process of C overall
take.
First, the article collects necessary
variables by listening to the
broadcast message of the normal way
station.
This process is necessary
because information about base
station is required to
disguise the outer core signal
as that of a normal base station.
Next take or create or so
free that contains the message
to use for the attack.
Now the attack begins first.
The attacker is of pierces
and assesses signals of the
normal base station and synchronize its
time with the base station,
then send the bodies of suffering
that she may at the
precise timing.
Finally, the you receiving
the signal receives or malicious
message by decoding the author
crystal frame stronger than
the signal of the normal base station.
Here's our test environment to verify
to see over.
We implement a single word by using
open source. It is there and
we used surface series for
radio transmission.
We also suggest
iPhone Access or Galaxy S 9
to verify this
or take in the remainder
of this store.
I would talk about performance of C
over and attack that can be arranged
using C over
ok.
So far I have shown
that single vote can be used in projects,
but both a fierce
and single work can inject but just
broadcast messages to the US.
So what is the difference between
C over and a fifth?
Or what is the advantage of C
over?
The Bayesian advantage of single work
compared with fake base station
comes from the fact that
the C Grover does not need
connection and establishment to inject
the message.
This has multiple implications.
Another advantage is power efficiency.
Segawa does not require such strong
power because the
attack signature only needs to be higher
enough to cover the original signal
cord capture.
It shows 98 percent success
rate on three TV higher power.
Then there is intimate space station.
However, the Prius
requires much stronger power than
those single over.
This is because the first is to
break the current connection
between the victim.
We underestimate base station.
Next, I'll talk about what we can do
with SIEGEL over and broadcast
messages.
I will explain that there is no
connection between the victim knew and
single attacker.
It means that the UAE keeps
communicating with or as intimate base
station or network during
the attack.
For example, the signal over
can inject a malicious message.
Why would the UAE in some form?
However, though, we cannot communicate
with the network after attaching to the
office.
So the UAE might
fall in the denial of services.
Let me show you some possible texts using
a single word but
not feasible. Using a previous
first one is signaling storm
water in general.
Signaling a storm, of course, throw upon
them.
But the single war cannot last the attack
without using the bonding.
The single will exploit our broadcast
message called a cyberwar, especially
the tracking area code
by changing the tracking your a
quote new one.
The attacker can trigger tracking or area
update procedure of
depicting team which
is sent to the core network
always in the attack range
may continuously receive fake
a saving one which calls
tracking aerial updates strong to
the core network.
A fierce can do the same,
but as respected,
though, Resentment Network would be safe
from this attack because
the West is not connected to
the rest made corner store.
This is the demonstration of single
long stone.
The program in this screen shows similar
messages of QE.
First, the attacker injectable on has
paging message.
This might just page message is required
for the viewer to receive a new
save you want.
Then the article or shadow of resistance
every one message.
Then you regenerate, signaling
to the network.
We violated and break vacation
pattern of signal in stone.
In normal situation, you send about
45 sophistry CAS method
corresponding to over 600
signaling messages per hour.
So you gonna stop using SIG over
can generate around 10
to 1000 tracking aerial data
request corresponding to around
400000 thousand signaling messages
per hour.
In summary, single instant can
generate six hundred forty times
more signal messages.
Possibly.
The second is a sedative toss
or take using as like two
inside two.
There is a failed to prevent excess
of the UAE for effective data
service in a disaster
situation.
If we wait for it to defeat,
we can prevent us from
sending service case to the base station.
Of course, we can also adjust
to buying time.
Furthermore, in the recent specification,
barring service is not only divided
into signaling and data,
but also divided into details
such as Voice Corps
video.
And as a mess,
therefore selective with those is
possible.
For example, all other
services or Passover pork only
voiced obvious is not available
to selective. Those attack was verified
by Galaxy S 9 and
succeed.
This tag is also
only possible with are over
even if the you connects to the app first
and received the wrong side too.
The FSA cannot make this all day
because the normal is
over too is received.
Okay when the EU is connected
to the normal base station.
Okay.
This is the demonstration.
It will be nice to show off video
of selective tones, but not ready.
So this video is auto, so tech using
excess value, the U.S.
can use normal data services
and also voice calls.
OK, after
the single attack, I tell
you.
We team is to receive malicious
paging and has type 2 messages
and, uh, you
know, my services now well
over.
Even after the attack, tackle programs
terminate the normal service is now
available to.
OK.
The following is an attack using
indicating in the figure on
the left, you see that
is normally attach it is released into
either state by releasing radio
conditional when not using LTE
data at this time.
If there is a service request for the
view from the networks, the base
stations, central broadcast message
pacing to inform the
way the identifier used
at this time is the temporal reality
of the user called Cootie.
However, if paging is sent
using the unique idea of tell you
called M.S.
that you you will disconnect.
And we attach according to the behavior
defined in the standard this
a load of those auto on the
unit that is using the.
It is obvious.
This is indicating paging thermal.
This is our test bed settle.
There is not a course.
And yes, surface.
Victim We received
the boys call.
Your our injector paging messes
with the victim's M.S..
Due to the paging,
the voice calls disconnected.
The final thing I will introduce
is a fake emergency.
A lot of these low tech
uses SIEV Twelve, which is used
for a lot systems in normal
networks. The process of using Samus
is as follows three
messages.
Say we want a software and
pacing are involved in
seamless process.
Based on this process, the attacker
overshadows the as well
as software and patient messages.
For the victim force
connected to Torres, it made space
station and other car
synchronized this time
and frequency with Rosita Mate
Base Station.
This is fake emergency.
To sum up briefly, we have
designed and implemented a signal
one settlement water using the
fundamental weakness of a wireless
communication.
The single voting is more powerful
than diet, heaviest slaughter in
terms of power, efficiency
and the connection between the UAE
and the normal base station campaign.
Far more. Various attacks.
Here's an example. I showed
demonstrations of four attacks
there.
What can you do it?
A unique case injection.
I'll take the answer of this question
will be explained in detail by torture.
Hi again and thank you, Winchell.
So as Mitchell said, what
else can we do with the unique has
Sig over it? Injection attack.
So when we go back to the fake
base station attack, there have been
various attacks using fake base station
as an example of an existing
B.S. attack made in the middle
attack can be used for injecting,
sealing or eavesdropping victims
information if
they face station is not on LTE
base station, but a 3G
or 2G base station,
it I'll take her can cause a greater
damage to the victim's privacy,
but actually diesel texts are quite
limited to use.
These attacks all assume that
the victim is already connected to
the base station.
But in a static situation,
in order for you to pass over
to the fake base station,
they'll fake these stations.
Signal must be about 40 DP
or ten thousand times larger
than the commercial one.
This is because the fake base station
need to break the current connection
between victim Yui and legit
to me to base station
operating fake base station wedo strong
signal requires a lots of
resources and increases the chance
to be detected.
However, single work can solve
these limitations
by injecting unique voice message.
Attacker can force the victim to attach
to them though they face station.
So won't a unique CAS message
DRC connection release?
Message is message delivered
by the base station to the UAE.
It is used to command the release
of an RC connection.
So when the UAE receives
this message, it will disconnect
from the existing connection.
And plus, Unix messages can
have additional fields.
One of the additional oil fields that
redirected carrying full field is
used to indicate the next frequency.
Where do you shell connect to
you? He uses this information
to sell left to an acceptable base
station to camp on.
Also, the redirected frequency can
be not only for LTE base stations,
but also for 3G or a 2G
base station, which is more for local
and the on other additional fields
is idle mode mobility control in full
field.
This field is used to
provide dedicate to sell selection routes
election priorities.
When do you researchers for the space
station?
It does not check all the frequencies.
Instead, it checks only selected
frequencies based on frequency
previously collected or frequency
received from the network.
So we noticed that
when the UAE is redirected to
a non searching frequency,
we did not redirected to that
frequency.
However, when a non
non searching frequency was included
in the IDE remote mobility controlling
fulfilled Yui was redirected.
Well, even though it was a new frequency,
the figure actually shows that
the UAE is redirected to another
base station after receiving on
our C connection release message with
a redacted carrying fulfilled and idle
mode mobility controlling fulfilled.
You can see that the Radio Frequency
Channel number representing the
communication frequency of the base
station has changed from one
hundred to twenty six hundred.
So if attacker can
inject this message to the victim, we
attack on attacker can force
victim Dewey to move to the fifth base
station
in order to inject this artsy
connection release message injected.
Messages should be decoded on
duty to do this.
More efforts are required than
when injecting a broadcast message.
Firstly, when injecting broadcast
message, attacker only had
to consider base stations configuration
to inject a message,
but to inject a unique voice
message.
I'll take or also have to consider
on the additional informations like
US I.D.
our A.I., which is a temporarily
identifier sequence number,
message format and so on.
Moreover, the message must be
set correctly in the right place.
Yui does not decode the messages
over the air, but
only because what it needs to decode
the location of the broadcast message
is common space.
And every year we have to decode the
message on the common space.
But the location of the unique text
message is a very specific
space and
it is mind.
According to the R.A.
AI.
So the message should
be decoded at the specific
space.
With these extra efforts, unique
messages can also be injected.
Fear seek over.
Now I will introduce a tax scenarios
using our C connection released message
injection in this attack.
The attacker is assumed to know the
MDC or are A.I.
of the victim.
We also assume that an attacker is
located where he can hear signals
from legitimate base station
such as victim Yui
attack scenarios can be divided into two.
First situation is when there is
a vulnerability on the device.
In this case, I'll take her needs to
know MDC or R.A.
ie if the victim
Yui has the vulnerability that
accepts security unprotected
message even after these secret
activation I'll take her can
easily inject a unique message.
We could found this verbal ability while
developing methods to test
devices for all. If you like to.
Second situation is when there is no
vulnerability on the device.
In this case, attacker needs
to know the MDC.
Then I'll take her niece to inject
message 540 secret
activation for this
attack.
There need additional technical
implementations.
Actually, this implementation is in
progress.
Now, the first scenario
is when we see a vulnerability
in the UAE.
This UAE has a vulnerability
that receives unprotected messages
even in the presence of a security
context.
The victim, UAE, is now connected
to the legitimate network
and has finished the security process.
So the victim knew he has
a security context and it
is using normal cellular service.
Then the attacker injects
on unprotected RC connection release
message on the Yui
due to the vulnerability.
Do you accept secretly
unprotected RC collection release?
Message then do you
eat disconnect the existing connection
and is redirected to the attackers.
They face station and request
for the connection.
The second scenario is when there
is no vulnerability on the UAE,
the victim, UAE, is now connected to
the legitimate network and
has finished this security process.
So the victim, he has a security
context and it only accepts
security protected messages.
Thus attacker cannot inject
messages. For now.
So attacker must delete
the user you see created
context in order for the victim
to receive on our attackers
unprotected messages.
To do this, the attacker injects
a India paging message
according to the 3G PPC specification.
When you receive the EMG patient
message, it should immediately
terminate all service stations
deletes Paul matters, including security
key.
So by injecting MJ paging
message or ticker can delete
the security context
of the victim.
After you terminated the existing
connection, it starts over at
the attach procedure with deep base
station
before the victim usually finishes the
security procedure.
The attacker injects on our C connection
release message when there
is no secreted context.
Yui is allowed to receive D
they create t unprotected RC
connection release message.
Therefore, the Yui possesses
the attackers message and sends
a connection request to the attackers.
They face station.
So far we have introduced
a tax that brings targeted victims to
the faith base stations.
But existing base station
attack can bring all these unspecified
us to it
from on the FESA attackers point
of view.
It may be easier and better
to attach all the Yui around.
Then we need to know if
DC over attack can do the same thing
in this attack.
The attacker constantly monitors
downlink messages from the commercial
base station to acquire
RTI from RC connection setup
message.
Once the attacker gets the R.A., I
will take our injects the RC connection
release message.
Attacker can repeat the entire process
until he brings these all the use
around.
To verify this attack, we used
Galaxy S4, the
Galaxy S4 is the one of the or notable
device that receives on unprotected
message even in the process of
a security context.
This vulnerability was discovered while
studying measures to test devices
where no ability
in this case we could inject
on our sequential release message to
the UAE without deleting the
security context
to inject the RSA question release
message.
We used free open source LTE software,
SRS, LTE and SRP
x three hundred ten
when the UAE is normally connected
to the cellular network.
We injected crafted message to retract
the victim you eat to the attackers
state base stations frequency 3 6
3.
The injected message contains the
redacted Kerry info field and idle
mode mobility control info field
did redacted Kerry in full field
is set to the LTE frequency
type and contains 3
6 3.
The frequency of fake station,
the idol, more mobility controlling field
contains a list of normal base
stations frequency and on
all tech course frequency.
At this time, the priority
of Texas frequency is set
to the highest to ensure that
the victim definitely passes over
the fake base station.
Here is a demonstration of the attack.
So at the first time,
the victim's phone is connected
to the legit to make base station
one hundred and I'll take care
of this operating fake base station
3 6, 3.
Then I'll take her, inject the message.
And as you can, you could see at
the monitor the signal was injected
and the injected message has
the contents of as follows.
And this is same with what I said before.
And then, as you can see at the stations
monitor, the victim's phone is connected
to the fake base station.
And if you see these packets
during the attack,
you.
That one is the injected message
after the victim's phone makes
a new connection with the fake base
station.
So it moved from one hundred to
these three, six, three.
So after this attack, we could do
anything like mean the middle attack
and so on.
So in the preview, previous demo
day victim, we was connected to
a commercial space station and then
moved to a fake base station that
had never been connected.
That's some of the fake base station
attack using seek over
first. This attack requires
much less power and it's easier
than the traditional fake base
station attacks.
As a result, the chance to be detected
decreases and the effective
attack range increases.
Second, the attacker can choose
victim to move to D.
They face station since
the attacker injects a unique voice
message.
Only the targeted Yui is affected.
Therefore, the chance to be detected also
reduced.
And it blows.
I'll take her to definitely first the
target to attach to a fake
base station.
Finally, I'll take cross faith.
Faith Station can be not only LTE
base station, but also a
3G or 2G base station,
SD 3G or 2G base stations
or more vulnerable.
Altucher can perform more severe
attacks.
And now I'm going to talk about some
countermeasures, discussion, conclusion
and future works for
future works.
To make this time possible for older
you is actually additional
implementations are needed.
First issue to be implemented
to find out the R.A.
of the victim using on
an attacker can do this by monitoring
the RSA connection setup message
after sending the MDG paging.
Actually, it is already possible,
but it must be optimized with injecting
techniques in real time.
Second, it should be in May
implemented to inject message
before these security process ends.
To do this, there is so little time
to inject messages.
As you can see at the feeder hardware
optimizations are necessary.
Although there are some things that need
to be implemented, we expect
that this attack will be possible
on every Yui.
If the hardware is fully optimized
and for the countermeasures for
this attack, the secure
solution against sequel over attack on
the message is to use digital
signature.
Currently, only a single
injected message can cause a long
term denial of service.
Once the message it is protected with
a digital signal signature
it more, it can prevent these attacks
introduced so far.
Plus the attack cost would be increased.
This is because the attacker have to
inject the wrong message continuously
to cause denial of service in the
process of the digital signature.
Moreover, it becomes possible
to detect the process of the attack.
Actually, this is possible because
from the G operators,
public key will be stored in the
using.
In fact, 3G PDP is recently
studying DFS problem and
let go integrate key protection of
broadcasting information.
And since whole first published to seek
over attack on broadcast message in
last August, we have received
many requests to request a release.
The Cole attack called as an open source.
However, we have some reasons that we
can't.
First reason is that according to the
GSA, me on Organization
for Cellular Carriers said
that yes, I may have no objection
to any security research being
open sourced where there
is a clear security benefit
and there is no risk posed
to innocent users.
Releasing this code clearly has
some security benefits.
However, unfortunately,
the proposed attack can affect a large
number of innocent users around,
so it might be hard to release
the attack code.
And another reason is the quality of the
code.
Thank you.
As currently
too cold we made is not well organized
to make it open source.
In conclusion, we presented seek
over attack, physically overwriting
specific cell frames,
seek over is a new exploit on UN
patched and insecure channel on
LTE network.
Comparing two attacks using fake face
stations seek over is
way cheaper and healthier.
Also, we found new attacks on
physical channel by
injecting broadcast messages,
we could cause denial of service
access, boring signal storm
and fake emergency alert.
And by injecting unique cast message,
we could force targeted victim to
move to a deep faith base station.
Finally, I expect
this single attack will be used in
the wild.
Therefore, not only cellular networks,
but older systems based on the cellular
networks such as equal
to everything can be affected
in the future.
Mobile communication technologies such as
5G and 60 are developed,
so more secure systems
should be made by considering the
security of the physical layer,
which was not considered before.
Therefore, I strongly suggest 3G
BP to used digital signatures
for physical channel.
Despite its difficulty.
Thank you.
And for the lawsuits, we have responsibly
disclosed these attacks to the GSA,
me and Qualcomm.
Thank you for listening.
And if you're having any questions,
please let us know.
And if you're having any of our long
questions, please e-mail us through
these e-mails on this flight.
And the photo is
our left's photo.
And my supervisor is young.
That came.
Maybe some of you would have heard
about him because he's doing a lot of
research is about security.
So, anyway, thank you.
All right. Thanks, you too, so far.
We have about 10 minutes for questions,
so if you have questions for the
speakers, please go to one of the room
mikes and we'll, uh,
for that.
You ask your question,
do we already have people lined up?
Let's start with a question from the
signal angel.
There there's one question.
Are these methods similar or the
same used by law enforcement?
And the user mentioned a
stingray, for example.
Pollen, please.
Where are you? Can you raise your hands?
I can ask.
Hi.
Can you can you see the question from the
Internet? So, yeah.
Are these methods similar or the same
used by the law enforcement,
law enforcement, police?
Yeah.
Maybe
it might be possible, but actually it is,
as I know, using the
frequency that legitimate bases
stations is already like
illegal to use.
So I think that cannot
be the solution.
All right. I actually don't see anybody.
There is one.
Make three, please.
Yes. So you're so sub
frame. Why do you replace it?
Why it got to your hash?
The value for integrity.
So the replacements would be kind of hard
to do.
Maybe that also
can be a problem and
solution. But using
hash, right?
That's a problem.
So just to joke some helpful frame.
Yeah. So you can replace a soft frame
that hasn't been valued.
Yeah, but that can be a solution.
But I think we have to think about
how to connect
as a secure connection at the first time.
If we don't have anything between like
you, we and that work,
maybe sending some hash also
will be challenged. Maybe.
Is that can be a solution
to your question?
Oh, yes.
I'm not saying if I understood it.
So, you know, that that could have, let's
say, 10 frames and you replaced
some frame. All right.
Yep.
Yes. So if all the ten
frames will be has
your replacement will be detected?
Is it possible on LDL love?
I don't understand
that. I have some catching go on
integrity.
Yeah, maybe that will be possible.
But I think we
need another way to
transfer the hash value to
check the connection.
But I think that can also be another
solution.
All right.
Let's go to make one then
I would like to know if use of
what your personal opinion and feeling
is, if this will
be mitigated by the vendors
and to standard bodies.
I mean, will they fix it
in the future, right?
Of course, in the future they cannot fix
it in the past, right?
Yeah.
So maybe
ah, as I said before, I like
Jeremy is already considering these
attacks and they have some regular
meetings.
Maybe the last meeting was in Nevada
in November and maybe
in the future if they will, but
not for now. So
maybe we have to ask if there is any
person from 350.
Okay.
Okay. All right. Thanks.
Uh, does the signal angel have any other
questions? No.
Then I think this concludes the questions
answer section.
Thanks again. Thank you.