Scribd Logo
Upload

Welcome to Scribd!

  • 23 views

    Lin Huan - UE Security

    Uploaded by

    Fizz Fizz
    The document discusses security testing of cellular networks using open source projects. It introduces the speakers and their background in wireless security research. It then provides an overview of open source projects for 2G, 3G and 4G networks and terminals that are used for security testing, including OpenBTS, OsmocomBB and OAI. Specific exploits demonstrated include GPS spoofing, fake base stations, and redirection attacks on 4G networks. The document also outlines vulnerabilities found in the LTE specification and implementations, such as in network authentication procedures, encryption, and configuration issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Lin Huan - UE Security

    Uploaded by

    Fizz Fizz
    23 views36 pages
    The document discusses security testing of cellular networks using open source projects. It introduces the speakers and their background in wireless security research. It then provides an overview of open source projects for 2G, 3G and 4G networks and terminals that are used for security testing, including OpenBTS, OsmocomBB and OAI. Specific exploits demonstrated include GPS spoofing, fake base stations, and redirection attacks on 4G networks. The document also outlines vulnerabilities found in the LTE specification and implementations, such as in network authentication procedures, encryption, and configuration issues.

    Original Description:

    Hacking

    Original Title

    Lin_Huan_-_UE_Security

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses security testing of cellular networks using open source projects. It introduces the speakers and their background in wireless security research. It then provides an overview of open source projects for 2G, 3G and 4G networks and terminals that are used for security testing, including OpenBTS, OsmocomBB and OAI. Specific exploits demonstrated include GPS spoofing, fake base stations, and redirection attacks on 4G networks. The document also outlines vulnerabilities found in the LTE specification and implementations, such as in network authentication procedures, encryption, and configuration issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    23 views36 pages

    Lin Huan - UE Security

    Uploaded by

    Fizz Fizz
    The document discusses security testing of cellular networks using open source projects. It introduces the speakers and their background in wireless security research. It then provides an overview of open source projects for 2G, 3G and 4G networks and terminals that are used for security testing, including OpenBTS, OsmocomBB and OAI. Specific exploits demonstrated include GPS spoofing, fake base stations, and redirection attacks on 4G networks. The document also outlines vulnerabilities found in the LTE specification and implementations, such as in network authentication procedures, encryption, and configuration issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 36

    Hacking Cellular Networks

    Security Research with Open Source


    Cellular Network Projects

    HUANG Lin ZOU Xiaodong

    Qihoo 360 Hiteam


    Agenda
    • Who we are & why we are giving this talk

    • Security testing of LTE


    – Specification vulnerabilities
    – Implementation flaws: network & terminals
    – Testing setup
    Who we are
    • Huang Lin
    – Wireless security researcher from Qihoo 360
    – Worded in Orange from 2005~2014
    – SDR expert, use OAI since 2011

    • Zou Xiaodong (aka Seeker)


    – Founder & CEO, HiTeam Group, a higher education +
    IT company
    – 30+ year coding & hacking
    – Angel investor & entrepreneurship mentor
    Hackers – A Big Group of SDR Users
    Using wideband SDR tools to analyze
    many kinds of wireless systems
     Short distance: Bluetooth, RFID, NFC
     Wifi, Zigbee, 315/433MHz AD936x
     Cellular: 2G/3G/4G 60MHz ~ 6GHz
     Satellite system: GPS, GlobalStar, DVB-S
     Private protocol: private network, links of drones
     Industry control system

    LMS600x/700x
    100KHz ~ 3.8GHz

    $4000 $750 $300 ￥100

    4
    Video Demo: GPS Spoofing
    Fake GSM Base Station in China
    • Resulting in a wide range of hazards
    – Send spam SMS
    – Phishing fraud
    When Bike-sharing Meets Fake BS
    • For IoT devices
    – Lose network
    connection
    – Data link hijack
    Most Fake BS Based on OpenBTS
    • OpenBTS Project
    – Developed since 2009
    – First software based cellular base station
    – Had some real deployments
    St. Pierre and Miquelon is a self-
    governing territorial overseas
    collective of France (COM) situated
    near Newfoundland, Canada.
    An entrepreneur,GlobalTel, applied
    for wireless spectrum and deployed
    seven base stations, now actively
    serving a population of 6,000.
    GSM Terminal Side: OsmocomBB
    • OsmocomBB
    – GSM sniffer: OsmocomBB
    + C118
    – GSM man-in-the-middle
    attack: OsmocomBB +
    C118 + OpenBSC

    Multiple C118s listening the GSM


    channels simultaneously.
    3G Base Station:
    Osmocom Accelerate3g5 Project
    • Femtocell + Open source CN
    – Femto: nano3G
    – CN: HNB-GW, SGSN, GGSN, VLR, HLR, PGW
    4G Security Research
    • Related works
    – Ravishankar Borgaonkar, Altaf Shaik, et.al., LTE and IMSI
    Catcher Myths, BlackHat Europe, 2015 (OpenLTE)
    – Roger Piqueras Jover, LTE Security and Protocol Exploits,
    ShmooCon 2016
    – Lin Huang, Forcing Targeted LTE Cellphone into Unsafe
    Network, HITB AMS Security Conference, 2016. (OpenLTE)
    – Xiaodong Zou, Advanced Fake Base Station Exploitations,
    KCon Hacking Conference, August 2016. (OAI)
    – Stig F. Mjølsnes, Ruxandra F. Olimid, Easy 4G/LTE IMSI
    Catchers for Non-Programmers, Feb. 2017. (OAI)
    4G Exploitations
    IMSI Catcher DoS Attack

    Redirection Attack

    These exploitations are all


    related to 4G fake base station.
    There may be quite a lot IMSI
    catcher based on OAI.
    Video Demo: Redirection Attack
    Cellular Projects Summary
    2G 3G 4G
    Network OpenBTS OpenBTS-UMTS OAI
    side OpenBSC Osmocom OpenLTE/srsLT
    Accelerate3g5 E

    Terminal OsmocomBB N/A OAI UE


    side srsUE
    Expectation to 5G: Security Response Capability

    • In IT/Internet area
    – Not every vulnerability needs to be fixed
    – Once exploitation appears, and widely known,
    the patch will be applied immediatly

    • In mobile communication
    – Network side
    • Operators: update network equipment needs
    long tim
    • Vendors: Some old hardware cannot be updated.
    – Terminal side
    • Cellphone firmware is rarely updated
    • It’s difficult to patch IoT devices.
    Programmable, Configurable and Patchable

    • Network equipment becomes softer


    – Soft-CN: NFV, SDN etc, more mature
    – Soft-RAN: developing

    • Terminal chipset becomes softer too


    – Programmable, especially for higher layers
    – Fix vulnerability and add new feature by
    updating firmware

    FCC DA 16-1282 NOI document, mentions one


    requirement to 5G security: patch management
    Security Testing of LTE/LTE-A
    • Specification vulnerabilities
    • UE implementation flaws
    • Network:
    – Implementation flaws
    – Configuration issues
    Specification Vulnerabilities
    • RRC redirection
    • RLF report
    UE Implementation Flaws
    • Network authentication
    • Data encryption
    • Security procedure of baseband OTA
    • Robustness of baseband
    • SMS sender spoofing
    • VoLTE
    Network Authentication
    • AUTN
    • AS EIA0
    • NAS EIA0
    • MAC null
    • Bypass?
    Data Encryption
    • AS EEA0
    • NAS EEA0
    • Unencryption?
    Security Algorithms

    UE eNodeB MME HSS


    1a. Authentication and Key Agreement 1b. Authentication
    Information Request
    2. NAS Security Mode Command (EEAX, EIAX)

    3. AS Security Mode
    Encoding Integrity Ciphering Algorithm
    Command (EEAX, EIAX)
    X000X000 EIA0 EEA0 NULL
    X001X001 128-EIA1 128-EEA1 SNOW3G
    Security algorithms are X010X010 128-EIA2 128-EEA2 AES
    selected by the provider X011X011 128-EIA3 128-EEA3 ZUC
    Security Procedure
    UE HSS
    eNodeB MME
    K K

    Attach Request
    (IMSI)

    1. Authentication and Key Agreement 1. Authentication Information Request


    (IMSI)
    3. Authentication Request 2. Authentication Information Answer
    (RAND, XRES, AUTN, KAMSE)
    (RAND, AUTN)
    a) Check AUTN
    b) Compute RES
    c) Compute K AMSE
    4.Authentication Response
    (RES)
    Check RES == XRES

    2. NAS Security Mode Command


    1. NAS Security Mode Command
    (EIA, EEA, MAC(EIA,EEA))

    2. NAS Security Mode Complete


    MAC()

    3. RRC Security Mode Command


    1. Initial Context Setup
    2. RRC Security Mode Command (KeNodeB)
    (EIA, EEA, MAC(EIA,EEA))
    3. RRC Security Mode Complete
    MAC()

    Attach Accept
    Attach Complete
    Network Configuration Issues
    • Visibility of the back-end from UE
    • Visibility of other UEs
    • GTP over GTP?
    • Ability to attack MME (signalling)
    Network Implementation Flaws
    • Robustness of stacks (eg SCTP)
    – Fuzzing
    – Sequence number generation
    • Management interfaces
    – Web UI
    – SSH consoles
    – Proprietary protocols
    Key Protocols
    S1AP Protocol
    • By default no authentication to the service
    • Contains eNodeB data and UE Signalling
    • UE Signalling can make use of encryption
    and integrity checking
    • If no UE encryption is used, attacks against
    connected handsets become possible

    40
    Key Protocols
    S1AP and Signalling

    S1AP NAS

    NAS

    UE eNB MME
    Key Protocols
    S1AP and Signalling

    Compromised Spoofed
    UE eNB

    MME

    UE eNB
    Key Protocols
    S1AP and Signalling

    S1 Setup

    S1 Setup Response

    Attach Request
    eNB MME
    Authentication Request
    Authentication Response

    Security Mode
    Key Protocols
    GTP Protocol
    • Gateway can handle multiple
    encapsulations
    • It uses UDP so easy to have fun with
    • The gateway needs to enforce a number of
    controls that stop attacks
    Key Protocols
    GTP and User Data

    GTP IP

    IP IP

    UE eNB SGw Internet


    Key Protocols

    GTP and User Data


    IP
    GTP
    UE
    UDP
    IP
    GTP
    eNodeB UDP
    IP

    11/09/2012 32
    Key Protocols
    GTP and User Data

    GTP IP GTP

    IP GTP IP GTP

    UE eNB SGw Internet


    Key Protocols

    GTP and User Data Destination IP


    Address (IP)
    GTP Tunnel
    Source IP Invalid IP ID (GTP)
    Address (IP) Protocols (IP)
    Source IP
    Address (GTP)

    UE eNB SGw PGw

    11/09/2012 34
    Testing Setup (Phase 1)
    • EPC: Gigabyte Brix i7-5500, 16G RAM
    • eNodeB/RRU:
    – UP Board + USRP B210/B200mini
    – ThinkPad T440s + bladeRF/LimeSDR
    • UE: Samsung, iPhone, OnePlus, ZTE, etc.
    Resource list

    Thank you!

    Xiaodong Zou
    Wechat: 70772177
    Twitter: @xdzou
    Email: [email protected]

    You might also like