Outstanding Communications Solutions Root Canal A new class of SS7 vulnerabilities
Agenda • SS7 – Vulnerable by design • Acknowledged signalling vulnerabilities • The root problem • Mitigation – The signaling band-aid • A new class of SS7 vulnerabilities • Malformed Packets • Prerequisites • Attacking and Tunneling • Multi stage exploit • Proposed mitigation and limits 2
Introduction • Presenter – Fredrik Söderlund • Symsoft – Software and Systems Security Advisor • Background in • Reverse engineering • Debug tools development • Telecom security • Security researcher and contributor to the GSMA CVD program • Worked on multiple SS7 firewall designs both for SMS and full spectrum SS7 3
Introduction • Symsoft – CLX Communications • Communications Solutions for Operators • 75+ Mobile Operator Customers • 1000+ Enterprise Customers • IoT and MVNO Platforms • Fraud & Security • Real-Time BSS • Value Added Services 4
SS7 – Vulnerable by design Signaling Vulnerabilities 5
Acknowledged vulnerabilities • Signaling based attacks • Location tracking – ATI, PSI • Spying on subscribers or VIPs • Profile manipulation – ISD, registerSS • Fraud, call redirection or denial of service • Subscriber hijacking, DoS – UL, DSD • Eavesdropping, fraud or denial of service 6
Acknowledged vulnerabilities • Yes they are dangerous, costly and indicates the network is vulnerable • But they are also perfectly normal and the expected functionality of an SS7 network • The network is doing exactly what is intended • Attacks or misuse? These attacks have been known for a long time and were easy to predict. 7
Acknowledged vulnerabilities • The root problem is always the same… • Subscriber tracking • Lack of authentication (who is reading?) • Profile manipulation • Lack of authentication (who is writing?) • Location update • Lack of authentication (who is moving?) 8
The root problem • Everyone trusts everyone • If you’re on the network you’re a friend • Anyone can impersonate anyone • If you’re on the network we assume you are who you say you are 9
Mitigation - The signaling band-aid • The obvious answer to signaling problems: • Introduce authentication! • Let’s not do that… • Instead we will: • Cat 1 - Filter network edge for unexpected or unwanted operations • Cat 2 - Verify fields across stack layers without 1:1 match of components (CC+NNGT : MCC+MNC) • Cat 3 - Verify subscriber location by last known location or plausibility of movement 10
Mitigation - The signaling band-aid • In addition to filtering we can also configure our networks better • Whitelist roaming partners, known nodes/peers • Introduce home routing • Whitelist exceptions based on origin and opcode • The result is a reasonably secure network • The Signaling band-aid works pretty good 11
Mitigation - The signaling band-aid • So what is the problem? 12
A new class of SS7 vulnerabilities Malformed Packets 13
Well formed Packet 14
Malformed Packet 15
Malformed Packets Non signaling based attacks in malformed packets • Routable attacks using malformed ASN.1 or SCCP layer data • Crafted payloads targeting known firmware vulnerable to encoding based attacks • Sophisticated attacks most likely using hijacked infrastructure • Potential attackers include APTs such as nation states or criminal networks 16
Malformed Packets ▪ Denial of Service Aim is to crash the targeted network element either to influence network performance or steer traffic to alternative links where attacker may have better visibility • Methods include for example: buffer overflows, null pointers, stack depletion, memory corruption, infinite nesting ▪ Remote Code Execution Aims to take control of the targeted network element in order to exfiltrate data, scan network, generate traffic, commit fraud or eavesdrop on network traffic or subscribers • Methods include the same as Denial of Service attacks but with the goal of executing code via controllable crash. • Once code execution has been achieved the attacker is likely to proceed with privilege escalation and full compromise of the network element 17
Malformed Packets • Compare a normal packet to a letter • A letter flows by country, city, street and finally reaches a person • In a malformed packet the attacker attempts to interrupt this flow or even trap it in an infinite loop & ultimately crash the application 18
Malformed Packets • Malformed data can also point to sections of code or data outside the actual packet • Such pointers can redirect the flow and introduce a predictable and reproduceable crash of the application 19
Malformed Packets • Most dangerous is Remote Code Execution • The predictable crash is exploited to run code • The code installs a Command & Control server • Attacker can scan and control the network • Worst case - The attack is totally transparent 20
A new class of SS7 vulnerabilities Prerequisites 21
Prerequisites • What we need to launch this attack • A vulnerable ASN.1 parser in the target node • Some type of UE registered in the target network • To act as a known recipient in the target network • The ability to send a routable SCCP packet carrying a 500 byte payload 22
Prerequisites • A vulnerable ASN.1 parser, does it exist? 23
Prerequisites • Get a handset into the target network should be doable 24
Prerequisites • Sending a 500 byte payload over SS7 • Over M3UA it seems that most nodes accept payloads above 500 byte size without question • Over MTP3 there is a physical limit of 272 bytes • This limitation may carry over to M2PA • This could be a bottleneck... 25
Prerequisites • Full length or concatenated SMS are larger than 272 bytes • They usually consist of an empty TCAP Begin followed by the payload in a TCAP Continue • Payloads larger than 272 bytes can be sent divided into multiple parts • This means that also SS7 has ways of passing larger packets to the application layer 26
Prerequisites • SCCP UDT (Unitdata) has a size limitation (still however well above what an attacker needs) • If a packet however exceeds the size limit of 272 bytes it may be transported over XUDT to accommodate the legacy size limit • SCCP XUDT (Extended Unitdata) offers fragmentation and can therefore encapsulate larger packets also over MTP3 and M2PA • Fragmented packets are reassembled on arrival and passed in original form to the application 27
Prerequisites • We have a method of delivery • Regular SCCP UDT over M3UA appears to be widely accepted with larger packets sizes • XUDT over MTP3/M2PA offers a fragmented alternative to overcome physical barrier of legacy technology 28
A new class of SS7 vulnerabilities Attacking and Tunneling 29
Attacking and Tunneling • Crafting the attack • We are still subject to some limits with regards to size of the attacks. No hard cap, but an attacker needs to limit size of initial infection for better chance of success • This means crafting a multi stage attack • Characteristics of the ideal MAP operation for initial infection: • Spoofable (we don’t need the returnResult) • Variable size • Optional parameters 30
Attacking and Tunneling • MAP reset – Fits the description • Spoofable and contains a variable size hlr-List of IMSI:s as optional parameter… 31
Multi stage exploit • Primary infection: 500 bytes carried in the optional list parameter of MAP reset • Trigger vulnerability, start execution • Allocate space for hook procedures • Adjust memory protection of 1 page of code • Patch recv function and install hook 1 • Hook 1 filters all incoming SMS traffic towards the attacker UE registered in the target network • Chunks of executable code are delivered and assembled into second stage of infection • When all chunks have been delivered, hook 1 is replaced by hook 2 32
Multi stage exploit • Secondary infection: 2000 bytes of PoC code • Does not need to connect back to original attacker GT - The Primary infection may be spoofed • Offers the ability to execute commands on target • Has the ability to report back to attacker • Data is tunneled to target using MT SMS • Data is tunneled from target using MO SMS • Infection is transparent to target node and leaves no stains on the file system. 33
Call Flow • Multiple stage attack using MAP reset and MT SMS • Delivers exploit, installs Command & Control (C2) • Attacker can proceed to control network remotely • Scan, cross infect, commit fraud, deny service 34
Call Flow • First stage attacks encoding at ASN.1 or SCCP • Crashes the MSC in a predictable way • Installs hook procedure to filter incoming MT SMS • Returns control to application and starts filtering 35
Call Flow • Second Stage is built using MT SMS • MT SMS contain code for C2 in TPDU User-Data • Hook detects incoming MT SMS by known UE IMSI • Reassembles MT SMS chunks to build C2 server 36
Call Flow • C2 server acts as attacker inside network • Attacker send commands using MT SMS • C2 executes attacker commands • C2 functionality can be extended if required • 37
Recommend
More recommend
