Sergey Puzankov Mobile operators vs. Hackers: new security measures for new bypassing techniques ptsecurity.com
SS7 in the 20 th century SCP STP STP SSP SCP STP STP PSTN SSP SSP SS7 – Signaling System #7, a set of telephony protocols , which is used to set up and tear down telephone calls, send and receive SMS, provide subscriber mobility, and other service
SS7 nowadays SIGTRAN – Signaling Transport, an extension of the SS7 protocol family that uses IP as a transport
Why SS7 is not secure LTE SIGTRAN SIGTRAN Diameter STP IWF/DEA SIGTRAN SS7 STP STP
Mass media highlights the SS7 security problem
Governments and global organizations' concern on SS7 security
Mobile operators and SS7 security SMS Home Routing Security configuration Security assessment Security monitoring SS7 firewall
Research and publications 2014 – Signaling System 7 (SS7) security report 2014 – Vulnerabilities of mobile Internet (GPRS) 2016 – Primary security threats for SS7 cellular networks 2017 – Next-generation networks, next-level cybersecurity problems (Diameter vulnerabilities) 2017 – Threats to packet core security of 4G network 2018 – SS7 vulnerabilities and attack exposure report
Network vulnerability statistics: SMS Home Routing Possibility of exploitation of some threats in networks with SMS Home Routing installed is greater than in networks without protection 67% of installed SMS Home Routing systems have been bypassed
Network vulnerability statistics: SS7 firewall Penetration level of SS7 firewalls on mobile networks: 2015 — 0% 2016 — 7% 2017 — 33% Filtering system alone cannot protect the network thoroughly
Basic nodes and identifiers MSISDN — Mobile Subscriber HLR — Home Location Register Integrated Services Digital Number GT — Global Title, address of a core node element MSC/VLR — Mobile Switching Center alongside with Visited IMSI — International Mobile Location Register Subscriber Identity STP — Signaling Transfer Point SMS-C — SMS Center
SS7 messages for IMSI retrieving SendRoutingInfo Should be blocked on the border SendIMSI May be blocked on the HLR SendRoutingInfoForLCS – SMS Home Routing as a protection tool SendRoutingInfoForSM
SMS Home Routing bypass No. 1
SMS Delivery with no SMS Home Routing in place SRI4SM — SendRoutingInfoForSM HLR 1. SRI4SM Request 1. SRI4SM Request SMS-C STP • MSISDN • MSISDN 2. SRI4SM Response 2. SRI4SM Response • IMSI • IMSI • MSC Address • MSC Address 3. MT-SMS 3. MT-SMS MSC • IMSI • IMSI • SMS Text • SMS Text
SRI4SM abuse by a malefactor HLR 1. SRI4SM Request 1. SRI4SM Request STP • MSISDN • MSISDN 2. SRI4SM Response 2. SRI4SM Response • IMSI • IMSI • MSC Address • MSC Address MSC
SMS Home Routing HLR 1. SRI4SM Request 4. SRI4SM Request 1. SRI4SM Request SMS Router SMS-C STP • MSISDN • MSISDN • MSISDN 2. SRI4SM Response 5. SRI4SM Response 2. SRI4SM Response • Fake IMSI • Fake IMSI • Real IMSI • SMS-R Address • MSC Address • SMS-R Address 3. MT-SMS 3. MT-SMS 6. MT-SMS MSC • Fake IMSI • Fake IMSI • Real IMSI • SMS Text • SMS Text • SMS Text
SMS Home Routing against malefactors HLR 1. SRI4SM Request 1. SRI4SM Request SMS Router STP • MSISDN • MSISDN 2. SRI4SM Response 2. SRI4SM Response • Fake IMSI • Fake IMSI • SMS-R Address • SMS-R Address MSC
Numbering plans E.164 MSISDN and GT 33 854 1231237 Country Code Network Destination Code E.212 IMSI 208 80 4564567894 Mobile Country Code Mobile Network Code E.214 Mobile GT 33 854 4564567894 Rule of GT Translation Operator HLR
STP routing table STP HLR 1 SS7 Message STP Routing Table … Numbering Plan = E.214 … OpCode = SRI4SM … HLR 2 SMS Router
STP routing table STP HLR 1 SS7 Message STP Routing Table … E.214 Global Title Numbering Plan = E.214 Translation Table … MCC + MNC + 00xxxxxxxx MCC + MNC + 20xxxxxxxx OpCode = SRI4SM … HLR 2 SMS Router
STP routing table STP HLR 1 SS7 Message STP Routing Table … E.214 Global Title Numbering Plan = E.214 Translation Table … MCC + MNC + 00xxxxxxxx MCC + MNC + 20xxxxxxxx OpCode = SRI4SM … HLR 2 SMS Router
STP routing table STP HLR 1 SS7 Message STP Routing Table … E.214 Global Title Numbering Plan = E.214 Translation Table … MCC + MNC + 00xxxxxxxx MCC + MNC + 20xxxxxxxx OpCode = SRI4SM … HLR 2 SMS Router
SendRoutingInfoForSM message Called Party Address = MSISDN
SMS Home Routing bypass attack STP HLR 1 STP Routing Table 1. SRI4SM Request … • E.214 / Random IMSI E.214 Global Title • MSISDN Numbering Plan = E.214 Translation Table … MCC + MNC + 00xxxxxxxx 2. SRI4SM Request MCC + MNC + 20xxxxxxxx OpCode = SRI4SM • E.214 / Random IMSI • MSISDN … 3. SRI4SM Response HLR 2 • IMSI • MSC address SMS Router The malefactor needs to guess any IMSI from a HLR serving the target subscriber SMS Router is aside
SMS Home Routing bypass No. 2
SMS Home Routing definition STP HLR 1. SRI4SM Request: MSISDN SMS Router
SMS Home Routing definition STP HLR 1. SRI4SM Request: MSISDN 1. SRI4SM Request: MSISDN SMS Router
SMS Home Routing definition STP HLR 1. SRI4SM Request: MSISDN 2. SRI4SM Request: MSISDN SMS Router 3. SRI4SM Response: Fake IMSI, SMS-R address
SMS Home Routing definition STP HLR 1. SRI4SM Request: MSISDN 2. SRI4SM Request: MSISDN SMS Router 3. SRI4SM Response: Fake IMSI, SMS-R address Different IMSIs mean SMS Home Routing procedure is involved
TCAP Protocol TCAP – Transaction Capabilities Application Part TCAP Message Type Begin, Continue, End, Abort Transaction IDs Source and/or Designation IDs Dialogue Portion Application Context Name (ACN) ACN Version Component Portion Operation Code Payload Application Context Name corresponds to a respective Operation Code
Application Context Name
Application Context Name change
SMS Home Routing bypass with malformed ACN 1. SRI4SM Request: MSISDN 1. SRI4SM Request: MSISDN STP HLR Malformed ACN Malformed ACN SMS Router Malformed ACN
SMS Home Routing bypass with malformed ACN 1. SRI4SM Request: MSISDN 1. SRI4SM Request: MSISDN STP HLR Malformed ACN Malformed ACN 2. SRI4SM Response: IMSI, MSC 2. SRI4SM Response: IMSI, MSC SMS Router SMS Router is aside
SMS Home Routing bypass with malformed ACN 1. SRI4SM Request: MSISDN 1. SRI4SM Request: MSISDN STP HLR Malformed ACN Malformed ACN 2. SRI4SM Response: IMSI, MSC 2. SRI4SM Response: IMSI, MSC SMS Router Equal IMSIs means the SMS Home Routing solution is absent or not involved
SS7 firewall bypass
SS7 firewall typical deployment scheme STP HLR 1. SS7 message 3. SS7 message 2. SS7 message SS7 firewall
SS7 firewall typical deployment scheme SRI – SendRoutingInfo STP HLR 1. SRI Request: MSISDN 2. SRI Request: MSISDN SS7 firewall The message is blocked
Application Context Name change
SS7 firewall bypass with malformed ACN STP HLR 2. SRI Request: MSISDN 1. SRI Request: MSISDN Malformed ACN Malformed ACN SS7 firewall Malformed ACN
SS7 firewall bypass with malformed ACN STP HLR 2. SRI Request: MSISDN 1. SRI Request: MSISDN Malformed ACN Malformed ACN 3. SRI Response: IMSI, … 3. SRI Response: IMSI, … SS7 firewall SS7 firewall is aside
Positioning enhancement
Positioning attack idea
Positioning attack idea
Positioning attack idea
How we discovered
How we discovered
Recreating the position refinement attack MSC/VLR
Recreating the position refinement attack CID 0DFB ProvideSubscriberInfo MSC/VLR 1 CID: 0DFB
Recreating the position refinement attack CID 0DFB ProvideSubscriberInfo MSC/VLR 1 CID: 0DFB UnstructuredSS-Notify 2
Recreating the position refinement attack CID 0DFB 3 ProvideSubscriberInfo MSC/VLR 1 Paging CID: 0DFB UnstructuredSS-Notify 2
Recreating the position refinement attack CID 0DFB 3 ProvideSubscriberInfo MSC/VLR 1 Paging CID: 0DFB UnstructuredSS-Notify 2
Recreating the position refinement attack CID 0191 CID 0DFB 3 ProvideSubscriberInfo MSC/VLR 1 Paging CID: 0DFB Paging UnstructuredSS-Notify Response 2
Recreating the position refinement attack CID 0191 CID 0DFB 3 ProvideSubscriberInfo MSC/VLR 1 Paging CID: 0DFB Paging UnstructuredSS-Notify Response 2 . . . returnError
Recreating the position refinement attack CID 0191 CID 0DFB 3 ProvideSubscriberInfo MSC/VLR 1 Paging CID: 0DFB Paging UnstructuredSS-Notify Response 2 . . . returnError returnError
Recreating the position refinement attack CID 0191 CID 0DFB 3 ProvideSubscriberInfo MSC/VLR 1 Paging CID: 0DFB Paging UnstructuredSS-Notify Response 2 . . . returnError returnError ProvideSubscriberInfo 4 CID: 0191
On the map
Main problems in SS7 security SS7 architecture flaws Configuration mistakes Software bugs
Recommend
More recommend
