Advanced Network Security Mobile telephony Joeri de Ruiter
Agenda ● Introducton ● 2G / 3G / 4G Security ● Authentcaton – Cryptography – ● Eavesdropping ● Privacy Tracking ● A solutonn PPNSI ● 2
Telephony security Sourcen htpn/ /sites.psu.edu/thedeepweb/2015/09/17/captain-crunch-and-his-toy-whistle/ 3
Introducton Standards by ETSI and 3GPP ● 2Gn GSPN (Global System for PNobile Communicaton) ● 2.5Gn GPRS (General Packet Radio Service) ● 3Gn UPNTS (Universal PNobile Telecommunicatons System) ● 4Gn LTE (Long Term Evoluton) ● 5G ● About 8.5 billion connectons and 5 billion subscribers ● 4
2G (GSPN) 1G was analogue without any encrypton in place ● 2G deployed in 1990s ● 2G is digital and provides authentcaton and encrypton ● Stll relevant for ICS/SCADA systems (e.g. ERTPNS) ● 5
GSPN-R Part of ERTPNS (European Rail Trafc PNanagement System) ● Used for communicaton between personnel as well as trains and track-side ● equipment Used, for example, to grant trains permission to drive on parts of the tracks ● and to provide speed limits 6
Identiers IPNSI (Internatonal PNobile Subscriber Identty) ● Home country ● Home network ● User IPNEI (Internatonal PNobile Subscriber Identty) 7
2G - Architecture Core Network AuC (Authentcaton Center) Access Network MS (Mobile Staton) VLR (Visitor Locaton Register) BTS (Base Transceiver Staton) HLR (Home Locaton Register) SIPN (Subscriber Identty PNodule) Gateways PNSC BSC (PNobile Switching Center) (Base Staton Controller) PNE (PNobile Equipment) PSTN and Internet BTS (Base Transceiver Staton) 8
2G - Architecture Visitor Locaton Register (VLR) keeps track of phones present in its area ● PNapping between IPNSI and TPNSI ● Home Locaton Register (HLR) stores permanent informaton about ● subscribers Authentcaton Center (AuC) stores long-term shared secrets with SIPNs ● 9
2G - Authentcaton Authentcaton and Key Agreement (AKA) ● Shared symmetric key K between SIPN and home network ● Two algorithms, A3 and A8 ● Can be determined by the provider ● 10
2G - Authentcaton Identty request Identty response, IMSI IMSI Retrieve K for IPNSI RAND ← {0,1} 128 XRES ← A3(K, RAND) CK ← A8(K, RAND) RAND, XRES, CK Authenticton request, RAND SRES ← A3(K, RAND) CK ← A8(K, RAND) Authenticton response, SRES Verify XRES = SRES Dctc enirypted with CK 11
Roaming Phone can use a network diferent than its providers network ● Visited Network (VN) or Serving Network ● Home Network (HN) ● Visitng Network requests authentcaton informaton from Home Network ● Authentcaton informaton provided by Home Network ● Visited Network performs authentcaton ● Visited Network reports presence of phone ● Home Network informs previous network that phone lef ● Home Network keeps track of the current locaton of its subscribers ● Necessary for, e.g., incoming calls ● 12
2G - Encrypton algorithms A5/0 ● No encrypton ● A5/1 ● Proprietary stream cipher ● A5/2 ● Weaker cipher for export ● A5/3 ● KASUPNI, a block cipher based on PNISTY ● – Used with 64 bit keys 13
3G (UPNTS) 3G (UPNTS) introduced in 2001 ● Algorithms used for encrypton and PNACs ● KASUPNI (128 bit key) ● SNOW 3G, stream cipher by Lund University ● PNutual authentcaton ● 14
3G - Architecture Core Network AuC (Authentcaton Center) Access Network MS (Mobile Staton) VLR (Visitor Locaton Register) Node B HLR (Home Locaton Register) USIPN (Universal Subscriber Identty PNodule) Gateways PNSC RNC (PNobile Switching Center) (Radio Network Controller) PNE (PNobile Equipment) PSTN and Internet Node B 15
3G - Authentcaton Identty request Identty response, IMSI IMSI Retrieve K and SQN for IPNSI RAND ← {0,1} 128 PNAC ← f1(K,SQN,APNF,RAND) XRES ← f2(K,RAND) CK ← f3(K,RAND) IK ← f4(K,RAND) AK ← f5(K,RAND) AUTN ← (SQN XOR AK,APNF,PNAC) Update SQN ← SQN + 1 RAND, AUTN, XRES, CK, IK Authenticton request, RAND, AUTN AK ← f5(K,RAND) XSQN ← (SQN XOR AK) XOR AK XPNAC ← f1(K,XSQN,APNF,RAND) Verify XPNAC = PNAC Verify SQN <= XSQN <= SQN + range Update SQN ← XSQN SRES ← f2(K,RAND) CK ← f3(K,RAND) IK ← f4(K,RAND) Authenticton response, SRES Verify XRES = SRES Dctc enirypted with CK 16 cnd cuthenticted with IK
3G - Authentcaton Functons f1 to f5 not standardised ● Only used by SIPN card and provider’s authentcaton server ● Recommendaton for f1 to f5 is to use Rijndael ● 17
4G (LTE) 4G (LTE) introduced in 2010 ● Almost 90% coverage reported by Open Signal in February 2018 ● Algorithms used for encrypton and PNACs ● SNOW 3G ● AES ● Cell towers are assumed to be smarter ● Separaton between signal and data channel ● Signal channel encrypted between phone and core network ● Data channel encrypted between phone and cell tower ● Possible to perform handover directly between cell towers ● 18
4G - Authentcaton Authentcaton protocol the same as 3G ● PNore elaborate key hierarchy ● Reduce tmes necessary to execute (slow) AKA protocol ● Cell towers get their own keys ● PNechanisms to protect against compromise of cell towers ● 19
4G – Key hierarchy Home network K AKA CK, IK Visitnn network K ASPNE ID of Visitng Network Signal data keys Cell tower K eNB User data keys 20
4G - Handover Handover between cell towers can be done without interference of backend ● Key update mechanisms to provide forward and backward security ● Only involving cell towers provides backward security ● Involving backend also provides forward security ● SIPN and backend generate the Next-hop parameter (NH) ● Based on a shared secret and counter ● 21
4G – Key derivaton Cell info Cell info K ASPNE K eNB K eNB K eNB K eNB Cell info Cell info Cell info K eNB K eNB K eNB NCC = 1 NH Cell info Cell info Cell info K eNB K eNB K eNB NCC = 2 NH 22
Authentcaton comparison 23 Sourcen PNobile communicaton security, Fabian van den Broek, 2016
Eavesdropping Diferent approaches ● Passive ● Actve (i.e. with a man-in-the-middle) ● Works mainly well with 2G ● Only authentcaton of the phone ● Weak or no encrypton supported ● Ofen fallback to 2G is possible ● 24
Run your own network Possible using a Sofware Deined Radio (SDR) and open source sofware (e.g. ● OpenBTS) Pretend to be your victms network and get them to connect to you ● E.g. by jamming or providing a stronger signal ● 25
PNan-in-the-middle (2G) Identty request Identty response, IMSI Authenticton request, RAND SRES ← A3(K, RAND) CK ← A8(K, RAND) Authenticton response, SRES VoIP Unenirypted dctc Use A5/0 (no encrypton) ● Forward calls via VoIP ● No incoming calls ● 26
PNan-in-the-middle (2G) Identty request Identty request Identty response, IMSI Identty response, IMSI Authenticton request, RAND Authenticton request, RAND SRES ← A3(K, RAND) CK ← A8(K, RAND) Authenticton response, SRES Dummy dctc (A5/2) Retrieve key CK Authenticton response, SRES Dctc (A5/2) Dctc (A5/3) 27 Instant Ciphertext-Only Cryptanalysis of GSPN Encrypted Communicaton, Barkan et al., 2010
Eavesdropping Complete solutons available for governmental organisatons ● 28
Interceptng signals Again using Sofware Deined Radios (SDR) and open source sofware (e.g. ● AirProbe) 29
Interceptng signals Problemn channel hopping ● Solutonn multple or more powerful radios ● 30
Cracking A5/1 Weak algorithm ● First atack publicly described by Anderson in 1994 ● PNany more research since then ● A5/1 is a stream cipher, so if you have known plaintext you have part of the ● keystream 31
Cracking A5/1 Rainbow tables available to quickly retrieve used key ● Known as Berlin tables ● Released in 2010 ● Around 2TB ● Probabilistc ● Limited amount of known plaintext necessary ● Shortly aferwards the tool Kraken was released that could use these tables ● to crack GSPN trafc 32
Cracking A5/2 A5/2 was purposefully weak for export ● Can be cracked in seconds ● Barkan et al., 2010 ● No longer allowed in new phones since 2007 ● 33
Cracking A5/3 Atack published Dunkelman et al. in 2010 ● Theoretcal atack that might not be practcal ● KASUPNI weaker than PNISTY on which it is based ● 34
SS7 Signaling System 7 ● Used in the core network and to communicate between providers ● For example, used to exchange authentcaton requests, send locaton ● updates and deliver SPNS messages From an era where providers trusted each other... ● Originally when sending an SPNS ● Ask Home Network current network of phone (i.e. country and provider) ● Send SPNS directly to the phone’s current network ● Fixed when using Home Routng ● Home Network delivers the SPNS ● PNight enable interceptng for 3G ● 35
36
Privacy IPNSI catchers (a.k.a. StngRay) can be used to ● Track users ● PNonitor locatons ● Link identtes to devices ● Can pretend to be a base staton to get to ● phones to connect and learn the IPNSI Sourcen U.S. Patent and Trademark Ofce / AP Photo 37
Recommend
More recommend
