CIS 6930 - Cellular and Mobile Network Security: Classical Telephony Security Professor Patrick Traynor 10/30/18 Florida Institute for Cybersecurity (FICS) Research
Ah, the Classics... Florida Institute for Cybersecurity (FICS) Research 2
Well Placed Nostalga? The general feeling is that the Internet and its openness brought about • significant insecurity. If only, some lamented, we could go back to a more closed and controlled • environment like telecommunications networks, security would no longer be such an issue. Is such an assertion well founded? • How secure are telecommunications • networks in reality? Florida Institute for Cybersecurity (FICS) Research 3
Setting Expectations This lecture is designed to kick off the final portion of the semester and give us • context to our security discussions. Just how good were the “good old days”? • We will introduce classes of vulnerabilities today. • We will spend the rest of the semester studying many of them in great detail. • Many of the lectures moving ahead rely on • the understanding of the architecture of the networks you have spent so much time learning. Florida Institute for Cybersecurity (FICS) Research 4
Weak Cryptography The algorithms underlying these operations are also insecure. • Rumor has it that was is partially intentional. • COMP-128 (used as A3) can expose K i . • 2 19 queries to the SIM card allow attacker to recover K i . • A5/1 and A5/2 (used as A5) are also weak. • Golic (1997) and Biryukov (2000) created known-plaintext attacks • possible in 2 40 operations or with 300 GB of space. Multiple recent efforts use rainbow tables and GPUs to rapidly crack • keys. Florida Institute for Cybersecurity (FICS) Research 5
Vulnerabilities in the Network Core In-band Signaling • “Captain Crunch” attacks • Unauthenticated signaling in the SS7 core. • MAPSec standard created, never used in reality outside of one unfortunate and • informative instance. How “walled” are these gardens in reality? • ASN.1 compiler/parser buffer overflows • Nearly every core node vulnerable. • Florida Institute for Cybersecurity (FICS) Research 6
Eavesdropping AMPS had no encryption. • Device cloning attacks by capturing the ESN. • Networks can specify A5/0 mode during Cipher Mode “negotiation”. • A5/0 is mandated in France to allow easy over-the-air lawful • interception. Crypto ends at the BS. • Microwave backhauls to the network make interception easy. • Florida Institute for Cybersecurity (FICS) Research 7
Jamming A number of companies sell “personal jamming” devices. • You can buy them in street markets in many major cities. • Many public places (e.g., theaters, churches, etc) have considered purchasing • slightly higher-grade products. This is HIGHLY illegal in the US, but not so in other countries. • AMPS and GSM are relatively easy to jam directly. • CDMA should make this much hard. • Why do you think jamming is still possible? • Florida Institute for Cybersecurity (FICS) Research 8
Tracking, Privacy and CALEA Lawful intercept of personal communications has a deep legal history in this • country. In general, your calls can not be listened in upon without the approval of a • judge. Significant infrastructure exists to support lawful interception. • Recent history provides examples of “less-lawful” interception. • Location of specific individuals, email sent over cellular networks and text • messages are very much in a grey area. US DoJ is arguing against the need for warrants • here. Implications? Florida Institute for Cybersecurity (FICS) Research 9
Overload and DoS Networks are designed and provisioned based on certain assumptions • about traffic load. Voice traffic is much easier to predict than data. • Connecting telephony to the much less regulated, less predictable Internet • creates opportunities to violate the above assumptions. Understanding the architecture can make these attacks targeted and • efficient. Brute-force DoS is largely uninteresting... • Florida Institute for Cybersecurity (FICS) Research 10
Malware and Mobile Phones Up to this point, most malware in this space has been fairly basic and • uninteresting from an analysis perspective. The vast majority rely on social engineering. • Mobile AV products exist, but how many people do you know that • actually run them? New exploits are becoming increasingly sophisticated. • PDF vulnerabilities, Heap spraying • What are applications secretly leaking about you? • What can be done in this space given the constraints? • Florida Institute for Cybersecurity (FICS) Research 11
Recommend
More recommend
