Attacks you can't combat: vulnerabilities of most robust MNOs
- 1. Attacks you can’t combat: Vulnerabilities of most robust mobile operators Sergey Puzankov
- 2. About me 18+ years in telecom industry 7+ years in telecom security Research results & community contribution Knowledge sharing spuzankov@ptsecurity.com sergey_puzankov @xigins @
- 3. SS7 basics SS7 (Signaling System No. 7) is a set of telephony protocols used to set up and tear down telephone calls, send and receive SMS messages, provide subscriber mobility, and more. Fixed telephony 2G/3G mobile networks Interconnection with next- generation networks
- 4. Who are potential targets? © GSMA Intelligence 2018, Mobile connections by technology https://www.gsmaintelligence.com/research/2018/02/infographic-mobile-connections-by-technology/656/ 5
- 5. Now what can a Hacker do? Easily From anywhere Any mobile operator No special skills needed Get access to your email and social media Track location of VIPs and public figures Perform massive denial of service attacks Intercept private data, calls and SMS messages Steal money Take control of your digital identity
- 6. History of signaling security SS7 development Scope grows Not trusted anymore Trusted environment. No security mechanisms in the protocol stack. SIGTRAN (SS7 over IP) introduced. Security is still missing. Growing number of SS7 connections, increasing amount of SS7 traffic. No security policies or restrictions. Huge number of MNOs, MVNOs, and VAS providers. SS7 widely used, Diameter added and spreading. Still not enough security.
- 7. Mobile operators and SS7 security Security assessment Signaling IDSSMS Home Routing Security configuration SS7 firewall
- 8. Basic nodes and identifiers MSISDN — Mobile Subscriber Integrated Services Digital Number IMSI — International Mobile Subscriber Identity GT — Global Title, address of a core node element HLR — Home Location Register SMS-C — SMS Centre STP — Signaling Transfer Point MSC/VLR — Mobile Switching Center and Visited Location Register
- 9. SS7 protocol stack TCAP MAP SCCP Signaling Connection Control Part is responsible for the routing of a signaling message by Global Titles. Transaction Capabilities Application Part is responsible for transactions and dialogues processing. Mobile Application Part is payload that contains an operation code and appropriate parameters such as IMSI, profile information, and location data.
- 10. SS7 security means SS7 firewall is the most sophisticated signaling security tool that protects the network against a wide range of threats such as IMSI disclosure, location tracking, and traffic interception. SMS Home Routing is intended to prevent SMS fraud and hide IMSI identities. Signaling Transfer Point makes simple screening of signaling messages.
- 11. Signaling Transfer Point Signaling Transfer Point is a router that relays SS7 messages between signaling end-points and other signaling transfer points. Usually the STP is a border point in a signaling network. It is possible to use the STP for the screening of the ineligible signaling traffic. Screening rules of the most STPs are simple, for instance, blocking a signaling message by a source address or redirecting a signaling message by an operation code. The STP looks through a signaling message layer by layer and applies a rule as soon as the first appropriate pattern is triggered.
- 12. SMS delivery process SRI4SM — SendRoutingInfoForSM STP MSC 1. SRI4SM Request • MSISDN 1. SRI4SM Request • MSISDN 2. SRI4SM Response • IMSI • MSC Address 2. SRI4SM Response • IMSI • MSC Address 3. MT-SMS • IMSI • SMS Text 3. MT-SMS • IMSI • SMS Text HLR SMS-C
- 13. SRI4SM abuse by a malefactor STP MSC 1. SRI4SM Request • MSISDN 1. SRI4SM Request • MSISDN 2. SRI4SM Response • IMSI • MSC Address 2. SRI4SM Response • IMSI • MSC Address HLR
- 14. SMS Home Routing SMS RouterSTP HLR MSC 1. SRI4SM Request • MSISDN 1. SRI4SM Request • MSISDN 3. MT-SMS • Fake IMSI • SMS Text 3. MT-SMS • Fake IMSI • SMS Text 4. SRI4SM Request • MSISDN 6. MT-SMS • Real IMSI • SMS Text SMS-C 5. SRI4SM Response • Real IMSI • MSC Address 2. SRI4SM Response • Fake IMSI • SMS-R Address 2. SRI4SM Response • Fake IMSI • SMS-R Address
- 15. SMS Home Routing against malefactors SMS RouterSTP HLR MSC 1. SRI4SM Request • MSISDN 1. SRI4SM Request • MSISDN 2. SRI4SM Response • Fake IMSI • SMS-R Address 2. SRI4SM Response • Fake IMSI • SMS-R Address
- 16. SS7 firewall: typical deployment scheme HLRSTP 1. SS7 message 3. SS7 message 2. SS7 message
- 17. SS7 firewall: blocking rules Firewall rules Category 1 Block a message by an operation code SS7 Message HLR MSC Category 2 Block a message by an operation code and correlation of a source address and subscriber identity Category 3 Block a message by an operation code and subscriber’s real location SCCP Source / Destination TCAP Application Context MAP OpCode, IMSI, … SS7 firewall
- 18. SS7 attacks and vulnerabilities IMSI disclosure Location tracking Voice call interception (MiTM)via a malformed Application Context Name (ACN) parameter via Operation Code Tag substitution via a Double MAP vulnerability
- 20. TCAP protocol TCAP Message Type — mandatory Transaction IDs — mandatory Dialogue Portion — optional Component Portion — optional
- 21. Changing ACN 0 – CCITT 4 – Identified Organization 0 – ETSI 0 – Mobile Domain 1 – GSM/UMTS Network 0 – Application Context ID 20 – ShortMsgGateway 3 – Version 3 0 – CCITT 4 – Identified Organization 4 – Unknown 0 – Mobile Domain 1 – GSM/UMTS Network 0 – Application Context ID 20 – ShortMsgGateway 3 – Version 3
- 22. IMSI disclosure via malformed ACN TCAP Malformed ACN HLR1. SRI4SM Request: MSISDN Malformed ACN 1. SRI4SM Request: MSISDN Malformed ACN STP SMS Router Malformed ACN SCCP Destination HLR MAP OpCode, param
- 23. IMSI disclosure via malformed ACN HLR1. SRI4SM Request: MSISDN Malformed ACN 1. SRI4SM Request: MSISDN Malformed ACN STP SMS Router SMS Router bypassed 2. SRI4SM Response: IMSI, MSC 2. SRI4SM Response: IMSI, MSC
- 24. IMSI disclosure via malformed ACN HLR1. SRI4SM Request: MSISDN Malformed ACN 1. SRI4SM Request: MSISDN Malformed ACN STP SMS Router 2. SRI4SM Response: IMSI, MSC 2. SRI4SM Response: IMSI, MSC Equal IMSIs mean the SMS Home Routing solution is absent or not involved.
- 25. Location tracking Substitution of Operation Code Tag
- 26. Numbering plans Mobile Network Operator Country Code (China) Network Destination Code Mobile Country Code (China) Mobile Network Code E.164 MSISDN and GT 86 854 1231237 E.212 IMSI 460 80 4564567894
- 27. Blocking rule: category 2 Source address Subscriber identity Operation code Switzerland ≠ China Category 2 Block a message by an operation code and correlation of a source address and subscriber identity
- 28. ITU-T Q.773 Recommendation = 2 = 6 ITU-T Q.773 – Transaction capabilities formats and encoding
- 29. Location tracking via Global OpCode 1. PSI with Global OpCode tag 2. PSI with Global OpCode tag The SS7 FW is looking for a Local OpCode. Global OpCodes are ignored. 3. PSI with Global OpCode tag STP MSC/VLR
- 30. Location tracking via Global OpCode STP 4. PSI Response: Cell ID 4. PSI Response: Cell ID MSC/VLR 1. PSI with Global OpCode tag 2. PSI with Global OpCode tag 3. PSI with Global OpCode tag The VLR replies with the Local OpCode and a requested cell identity. Equipment of four vendors replies to signaling messages with the Global OpCode.
- 31. Voiace call interception (MiTM) Exploitation of a Double MAP vulnerability
- 32. Voice call interception (MiTM) 1. InsertSubscriberData Request: IMSI Spoofed billing platform address 1. InsertSubscriberData Request: IMSI Spoofed billing platform address STP MSC/VLR
- 33. Voice call interception (MiTM) 1. InsertSubscriberData Request: IMSI Spoofed billing platform address 1. InsertSubscriberData Request: IMSI Spoofed billing platform address STP 2. InsertSubscriberData Response 2. InsertSubscriberData Response MSC/VLR 3. TCAP End 3. TCAP End
- 34. Voice call interception (MiTM) 1. InitialDP: IMSI, A-Num, B-Num 1. InitialDP: IMSI, A-Num, B-Num STP MSC/VLR
- 35. Voice call interception (MiTM) 1. InitialDP: IMSI, A-Num, B-Num 1. InitialDP: IMSI, A-Num, B-Num STP 2. Connect :PBX-Num 2. Connect :PBX-Num MSC/VLR
- 36. Voice call interception (MiTM) 1. InitialDP: IMSI, A-Num, B-Num 1. InitialDP: IMSI, A-Num, B-Num STP 2. Connect :PBX-Num 2. Connect :PBX-Num 3. IAM: A-Num, B-Num 3. IAM: A-Num, B-Num
- 37. SS7 FW against MiTM attack 1. InsertSubscriberData Request: IMSI, Spoofed billing platform address STP 2. InsertSubscriberData Request: IMSI, Spoofed billing platform address The SS7 FW correlates the IMSI and source address and blocks the InsertSubscriberData message. Switzerland ≠ China
- 38. TCAP protocol TCAP Message Type — mandatory Transaction IDs — mandatory Dialogue Portion — optional Component Portion — optional
- 39. Double MAP component TCAP Message Type — mandatory Transaction IDs — mandatory Dialogue Portion — optional Component Portion — optional Component 1 Component 2 The SS7 FW checks a subscriber’s ID in the first component considering the other data as a long payload not meant to be inspected.
- 40. Double MAP in MiTM attack STP SS7 FW TCAP Begin DeleteSubscriberData_REQ InsertSubscriberData_REQ MSC/VLR Inspect the first component only and forward the message to the network PBXSend the message to the SS7 FW for inspection
- 41. Double MAP in MiTM attack STP SS7 FW TCAP Continue ReturnError MSC/VLR TCAP Begin DeleteSubscriberData_REQ InsertSubscriberData_REQ PBX
- 42. Double MAP in MiTM attack STP SS7 FW TCAP Continue ReturnError TCAP Continue InsertSubscriberData_REQ InsertSubscriberData_REQ MSC/VLR TCAP Begin DeleteSubscriberData_REQ InsertSubscriberData_REQ Inspect the first component only and forward the message to the network. PBX
- 43. Double MAP in MiTM attack STP SS7 FW TCAP Continue ReturnError TCAP Continue ReturnResultLast MSC/VLR TCAP Continue InsertSubscriberData_REQ InsertSubscriberData_REQ TCAP Begin DeleteSubscriberData_REQ InsertSubscriberData_REQ PBX
- 44. Double MAP in MiTM attack STP SS7 FW TCAP Continue ReturnResultLast TCAP Continue ReturnError TCAP Continue ReturnResultLast MSC/VLR TCAP Continue InsertSubscriberData_REQ InsertSubscriberData_REQ TCAP Begin DeleteSubscriberData_REQ InsertSubscriberData_REQ PBX
- 45. Double MAP in MiTM attack STP SS7 FW TCAP Continue ReturnError TCAP End TCAP Continue InsertSubscriberData_REQ InsertSubscriberData_REQ TCAP Begin DeleteSubscriberData_REQ InsertSubscriberData_REQ PBX TCAP Continue ReturnResultLast TCAP Continue ReturnResultLast MSC/VLR
- 46. Double MAP in MiTM attack STP SS7 FW TCAP Continue ReturnError TCAP End MSC/VLR TCAP Continue InsertSubscriberData_REQ InsertSubscriberData_REQ TCAP Begin DeleteSubscriberData_REQ InsertSubscriberData_REQ PBX TCAP Continue ReturnResultLast TCAP Continue ReturnResultLast
- 47. Double MAP in MiTM attack STP SS7 FW TCAP Continue ReturnError MSC/VLR TCAP End TCAP Continue InsertSubscriberData_REQ InsertSubscriberData_REQ TCAP Begin DeleteSubscriberData_REQ InsertSubscriberData_REQ PBX TCAP Continue ReturnResultLast TCAP Continue ReturnResultLast
- 48. Double MAP in MiTM attack STP SS7 FW MSC/VLR TCAP Continue ReturnError TCAP End TCAP Continue InsertSubscriberData_REQ InsertSubscriberData_REQ TCAP Begin DeleteSubscriberData_REQ InsertSubscriberData_REQ PBX TCAP Continue ReturnResultLast TCAP Continue ReturnResultLast
- 49. Main issues in SS7 security SS7 architecture flaws Configuration mistakes Software bugs
- 50. Conclusion Check if your security tools are effective against new vulnerabilities. Use an intrusion detection solution along with an SS7 firewall in order to detect threats promptly and block a hostile source. Configure your STP and SS7 firewall carefully. Do not forget about malformed Application Context Name and Global OpCodes. Block TCAP Begin messages with double MAP components. We observed only one legal pair: BeginSubscriberActivity + ProcessUnstructuredSS-Data. 1 2 3 4