SlideShare a Scribd company logo

Hacking Telco equipment: The HLR/HSS, by Laurent Ghigonis

P
P1Security

The document discusses vulnerabilities in mobile network operators' core systems, specifically focusing on HLR/HSS (Home Location Register/Home Subscriber Server) used in 2G, 3G, and 4G networks. It highlights the critical importance of HLR/HSS in maintaining network operations and outlines methods for security assessments, including network fuzzing and virtualization. The document also delves into the implications of security breaches, including denial of service attacks that can render entire national networks inoperative.

TechnologyNews & Politics
1 of 59
1
2
3
4
5
6
7
8
Most read
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
Most read
56
57
58
Most read
59
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Hacking Telco equipment The HLR/HSS Laurent Ghigonis Security researcher at P1 Security
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security What are we talking about ? A mobile network operator Core Network Network passive capture showing Global Titles
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Mobile Operators • Conveys the majority of voice communications worldwide • Conveys our data • Conveys growing M2M traffic • Emergency systems notifications uses it => We now rely on it and we have some security expectations
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Mobile Operators and governance • In Europe
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Mobile Operators and governance • In France Lets check the reality …
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HSS Front End HLR Front End AuC HSM Provisioning DSA 3 Back Ends Provisioning Gateway Install Server Admin Routing DSA The Witness : An HLR/HSS Typical HLR/HSS in use in operator Core Network
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS in Mobile Core Network A mobile network operator Core Network Network passive capture showing Global Titles
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS in Mobile Core Network
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS in Mobile Core Network
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS in Mobile Core Network • HLR is used in all 2G Operator Network • HSS is used in all 3G/4G Operator Network • Stores customer data – Subscriber identifier (IMSI) – Subscriber encryption keys – Subscriber approximate location – Subscriber SIM plan options • Critical to the operator – HLR down == Network down, no calls possible
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS in Mobile Core Network HLR/HSS receiving subscriber location update from the operator SS7/Diameter signaling links
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Lets make it talk …
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Plan HLR/HSS Robustness assessment • Virtualization – Virtualization and instrumentation • System Analysis – Localroot, Framework complexity • Network Fuzzing – SS7 Protocols • Binaries Reverse – More vulns
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS Virtualization No, it’s not ATCA / NFV
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security An HLR/HSS is an ecosystem
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security An HLR/HSS is an ecosystem • HLR + HSS Front-end • HLR Administration server • Application/Database routing servers • HLR Backend/Database (multiple) • HSM (Hardware Security Module) for keys
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS is never alone
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Where to start • Most exposed from the outside => HLR/HSS Front-end – Receives SS7/Diameter traffic • Telecom network stacks – Receives provisioning requests – Connected to the HSM
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HSS Front End HLR Front End AuC HSM Provisioning DSA 3 Back Ends Provisioning Gateway Install Server Admin Routing DSA Where to start Typical HLR/HSS in use in operator Core Network
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Virtualization of HLR/HSS Frontend
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Original Equipment Manufacturer • Specs of the real equipment – i386 / x64 / Sparc – Solaris / CentOS – 32 GB of RAM – CPU 16 Cores – TB hard drive + External SAN
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Qemu/KVM • Faster than VirtualBox • More flexible • Tweak code to add more network interfaces • VDE Switch for networking
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Qemu/KVM qemu-system-x86_64 -machine type=pc,accel=kvm:tcg -pidfile ./myhlr.pid -m 7.2g -smp 4 -drive file=/dev/mapper/lvm-vm--myhlr,cache=none -vnc 127.0.0.1:2,password,tls,lossy -display curses -rtc base=localtime,driftfix=slew -net vde,vlan=1,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=1,macaddr=52:54:00:00:10:01 -net vde,vlan=2,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=2,macaddr=52:54:00:00:10:02 -net vde,vlan=3,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=3,macaddr=52:54:00:00:10:02 -net vde,vlan=4, sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=4,macaddr=52:54:00:00:10:02 -net vde,vlan=5,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=5,macaddr=52:54:00:00:10:02 -net vde,vlan=6,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=6,macaddr=52:54:00:00:10:02 -net vde,vlan=7,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=7,macaddr=52:54:00:00:10:02 -net vde,vlan=8,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=8,macaddr=52:54:00:00:10:02 -net vde,vlan=9,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=9,macaddr=52:54:00:00:10:02 -net vde,vlan=10,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=10,macaddr=52:54:00:00:10:02 -net vde,vlan=11,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=11,macaddr=52:54:00:00:10:02 -net vde,vlan=12,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=12,macaddr=52:54:00:00:10:02 • Physical partition for disk – Do not use disk file on host btrfs • super slow • ext4 is ok – http://www.linux-kvm.org/page/Tuning_KVM • Curses output • Improvements: serial terminal
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Qemu/KVM • Solaris 10 – Qemu/KVM ok for x64 – Fails for SPARC • Stock kernel – /kernel – /usr/kernel • Custom kernel modules – For Telecom Signaling [Signalware] • Uses grub • Failsafe mode
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Inside the machine • ZFS filesystem • Solaris 10 • Everything is installed via packages • Multiple Oracle databases – Even on HLR/HSS Front-end only • A lot of Middleware framework to start the actual network stacks / applications • Telco stacks: based on Ulticom Signalware • The OS expects its precious network cards
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security System Analysis
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security The filesystem • ZFS = Filesystem + Volume manager • ZFS pool (often mirrored) – ZFS root pool • 100-200GB usually enough • Prepare free space for system/processes dump – ZFS Dump pool • Should be more than size of your RAM – ZFS SWAP pool • Should be more that size of your RAM
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security The filesystem • ZFS offers good resilience against data corruption, and is very picky when there is too much corruption – You can’t recover when filesystem is too much broken – You can try $ zdb -e -p /dev/dsk/c0t3d0p0 -F -X -AAA -dd rpool 1 $ zpool import -f -F -X 19485729304958623456 mypool $ zpool import -o readonly=on -o autoreplace=on -o failmode-continue -m -N -f -F -X 19485729304958623456 mypool • If it fails – Code your own tool by modifying ZOL http://zfsonlinux.org/
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Filesystem /advdata/ autoinstmnt/ bin@ boot/ cust_data/ dump@ environment.txt* etc/ export/ false/ global@ home/ installmnt/ kernel/ lib/ mnt/ net/ nsr/ opt/ patchmnt/ platform/ root/ rpool/ rtp_environ.txt sbin/ tftpboot/ ti_var/ tmp/ TspAcc@ TspAccBackup@ TspCore@ tspinst/ TspTickets@ updateSW/ usr/ var/ vol/ Grub/platform + failsafe Applications data Kernel Telco specific apps Home + Applications data + Telco specific apps Crashdumps from Telco specific apps
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Some packages installed application SMAWrtp Telecommunication Service Platform (TSP) Base Package application OMNI Signalware System application S6U-4 Signalware System application OMNI-C7X Signalware C7 Extensions application INTPahacu AC Utimaco HSM
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Low hanging fruits • SUID executables – SUID Total: 162 (155 binaries, 7 scripts) – SUID Root: 142 (137 binaries, 5 scripts) • Signalware Boot process “becoming root” by Design
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Local roots • Of course, we often find multiple local roots • Some are really too easy (one command):
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Example of Telco network stack: NSN TSP / RTP + Ulticom Signalware • TSP + RTP framework are found on NSN NT- HLR – Found in many European and Worldwide operators – Very similar to Apertio OneHLR • TSP: Telco Server Platform (Ericsson) / Telco Service Platform (NSN, others, generic name) • RTP: Resilient Telco Platform (NSN)
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Example of Telco network stack: NSN TSP / RTP + Ulticom Signalware • SS7 Protocol handling Reminder: SS7 stack
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Network Fuzzing
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Fuzzing SS7: M3UA • Example: Flooding badly handled – Leads to alerts flooding in OSS – Leads to loss of previous alerts ! – P1VID#799
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Fuzzing SS7: SCCP • Example result: 1 specific MSU repeated 2 times causes DoS of all Signaling Interconnections – HLR is down during 2 minutes – Total Denial of Service of the network – Nobody can receive calls in the whole country core 'core.xxx' of 15477: /export/home/xxx 01 msu_processing () 02 msg_distribution () 03 main () 04 _start () – If the attack is repeated, the DoS is permanent during the attack – P1VID#773 So long for the critical infrastructure …
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Fuzzing SS7: SCCP
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Fuzzing SS7: MAP • Example results: 1 specific MSU causes MAP process crashes – 5 MSU/second makes HLR totally unresponsive to any other MAP Query • Total Denial of Service of the network • Nobody can receive calls in the whole country – 1 MSU/second makes HLR totally drop 50% of other MAP Queries • Network is highly perturbed • 50% of the called in the whole country are failing – P1VID#772
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Fuzzing Diameter • Process Crash with 1 specific manually crafted MSU Logs do not even report process crash. Neither the OSS Alerts. Application logs: Services_Esm_Log_Message: vc_Priority=LOG_ERR, vc_MessageInformation=ESM: Service could not be processed correctly, vc_AdditionalInformation=Reason: xxxxxxxxx data unavailable, Message Type: S6a-xxxxxxxxx Services_Esm_Log_Message: vc_Priority=LOG_ERR, vc_MessageInformation=ESM: Service could not be processed correctly, vc_AdditionalInformation=Reason: xxxxxxxxx data unavailable, Message Type: S6a-xxxxxxxxx UTC Tue Sep 3 01:20:44 2013 Services_Esm_Log_Message: vc_Priority=LOG_ERR, vc_MessageInformation=ESM: Service could not be processed correctly, vc_AdditionalInformation=Reason: xxxxxxxxx data unavailable, Message Type: S6a-xxxxxxxxx Services_Esm_Log_Message: vc_Priority=LOG_ERR, vc_MessageInformation=ESM: Service could not be processed correctly, vc_AdditionalInformation=Reason: xxxxxxxxx data unavailable, Message Type: S6a-xxxxxxxxx Behind that, process core dumps are created… P1VID#718
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Does redundancy saves you ? • No ! • Same N front-ends == same crashes • Messages just needs to be sent N times
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Binaries reverse
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Often, too much help… • Binaries not stripped – Debug symbols / function names / … available • No anti-debug mechanism • Libraries headers on production machines – Great help in understanding the internals • Large documentation about internals on production machines – Great help in understanding the internals • Updated binaries and previous binaries both on production machines – Binary diff to track issues fixed
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Signalware Kernel modules • Example: Parsing of SCCP header
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Signalware Kernel modules • Kernel modules signaling parsing is robust • IPC to communicate with userland binaries • Complexity leads to other type of errors – Logic errors – Race conditions – Slow handling of some types of MSUs
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Signalware userland binaries • Parsing less robust (less tested) • Example logic error due to IPC / Framework complexity: Can be triggered from the International SS7 network Null pointer dereference
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security So verdict ?
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security So verdict ? • Misconceptions! – No crashes on a Critical Core Network Element • FAIL – Robustness against network attacks • FAIL • Redundancy != Robust, attack kills Front-end one by one – Modern • Depends, but from what we see there is much room for improvement
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Mobile Operators and governance • Reality on Threats analysis: Maybe • Reality of Telco equipment security: Very bad • Public information: Very bad • Telco private sector information: Didn’t see impact
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Consequences • Mobile Network crashes for unknown publicly available reason • Spying on phone calls / customer activities from a single point (Core Network) is relatively easy • Fraud
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Recommendations • Secure SDLC (Secure Software Development Life Cycle) – Design – Implementation – Testing • Especially for vendors custom stacks/services TCAP/MAP parsing bugs leading to overflows, … • Vendors security audits (HLR isolated) – System audit – Network audit • Testbed audits (HLR in environment) – System audit – Network audit – Before deploying to production
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Recommendations: securing the OS • Use Solaris Zones to split services: P1VID#764 • Use Solaris Audit mechanism: P1VID#765 • Authenticate the hardware – To prevent emulation • Use the latest OS protections against exploitation – Solaris 11 has ASLR – Use custom Linux kernel • Use a firewall by default on the machine itself • …
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Recommendations: OSS • Make it faster ! – People should be able to use it to react when under attack – E.g. NSN @vantage commander • Need access to all low-level network traffic for forensics
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Recommendations: For the operators • Push the vendors to fix the bugs • Some of the attacks we discovered can be filtered – Operators do not have to wait for bugs to be fixed – Filter at perimeter boundaries (typically STP / Router) – Depends on STP / Router models and security “features” • Sometime filtering options are charged by vendor • It is possible to filter also at the SCCP provider level
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security To be continued • Telecom Network Elements security is low – We tested multiple Network Element types/models, from different vendors • Vendors, Governments and security researchers have work to do • Vulnerability disclosure in security critical infrastructure is scarce – Dangerous ? – Not if there is collaboration
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Other aspects of Telecom Security • We talked here about equipment security – It’s a work in progress, and only HLR/HSS – Mainly Network Equipment Vendor responsibility • Also consider – Other Network Elements security – GRX / IPX / SCCP Providers security – Deployment security (passwords policies, filtering…), Operator responsability – Telecom Network Fraud (SS7 spoofing, Call/SMS Spoofing, …), Operator responsability
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security References Governance literature on critical infrastructure: • European level – 2007: http://www.nato-pa.int/default.asp?COM=1165&LNG=0 – 2012 http://www.nato.int/cps/en/natolive/news_88054.htm?selectedLocale=en – 2013 http://ec.europa.eu/dgs/home-affairs/what-we-do/policies/crisis-and- terrorism/critical-infrastructure/index_en.htm http://ec.europa.eu/dgs/home-affairs/what-we-do/policies/crisis-and- terrorism/critical-infrastructure/docs/swd_2013_318_on_epcip_en.pdf • France – 2012 http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000026638421 &dateTexte=&categorieLien=id – 2013 http://www.gouvernement.fr/gouvernement/livre-blanc-2013-de-la-defense-et- de-la-securite-nationale
2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security That’s it, please react. Thank you laurent@p1sec.com http://www.p1sec.com

More Related Content

PDF
Worldwide attacks on SS7/SIGTRAN network
P1Security
 
PDF
Telecom security from ss7 to all ip all-open-v3-zeronights
P1Security
 
PDF
Attacking GRX - GPRS Roaming eXchange
P1Security
 
PPT
Gsm call routing
Ramakrishna Pulikonda
 
PPT
IMS Standards
Marie-Paule Odini
 
PDF
VoLTE Interfaces , Protocols & IMS Stack
Vikas Shokeen
 
PDF
LTE network: How it all comes together architecture technical poster
David Swift
 
PDF
volte ims network architecture
Vikas Shokeen
 
Worldwide attacks on SS7/SIGTRAN network
P1Security
 
Telecom security from ss7 to all ip all-open-v3-zeronights
P1Security
 
Attacking GRX - GPRS Roaming eXchange
P1Security
 
Gsm call routing
Ramakrishna Pulikonda
 
IMS Standards
Marie-Paule Odini
 
VoLTE Interfaces , Protocols & IMS Stack
Vikas Shokeen
 
LTE network: How it all comes together architecture technical poster
David Swift
 
volte ims network architecture
Vikas Shokeen
 

What's hot (20)

PDF
volte call flow - SIP IMS Call Flow - MO and MT Call - Volte Mobile originati...
Vikas Shokeen
 
PPTX
Lte default and dedicated bearer / VoLTE
manish_sapra
 
PDF
Simplified Call Flow Signaling: Registration - The Attach Procedure
3G4G
 
PPTX
SS7: the bad neighbor you're stuck with during the 5G migration and far beyond
PositiveTechnologies
 
PDF
Advanced: 5G Service Based Architecture (SBA)
3G4G
 
PDF
Worldwide attacks on SS7 network
Alexandre De Oliveira
 
PDF
ims registration call flow procedure volte sip
Vikas Shokeen
 
PDF
UMTS Protocols
Naveen Jakhar, I.T.S
 
PDF
Lte attach-messaging
Praveen Kumar
 
PPTX
Packet core network basics
Mustafa Golam
 
PPTX
IMS ENUM and DNS Mechanism
Kent Loh
 
PDF
VoLTE Interfaces , Protocols & IMS Stack Explained
Vikas Shokeen
 
PDF
End-to-End QoS in LTE
Radisys Corporation
 
PPTX
Introduction to Diameter Protocol - Part1
Basim Aly (JNCIP-SP, JNCIP-ENT)
 
PPTX
Srvcc overview
Yau Boon
 
PDF
AIRCOM LTE Webinar 1 - Network Architecture
AIRCOM International
 
PDF
5g introduction_NR
Nitin George Thomas
 
PDF
LTE Air Interface
Spiros Louvros
 
PDF
UMTS/LTE/EPC Call Flows for CSFB
Justin MA (馬嘉昌)
 
PPTX
2G / 3G / 4G / IMS / 5G Overview with Focus on Core Network
Hamidreza Bolhasani
 
volte call flow - SIP IMS Call Flow - MO and MT Call - Volte Mobile originati...
Vikas Shokeen
 
Lte default and dedicated bearer / VoLTE
manish_sapra
 
Simplified Call Flow Signaling: Registration - The Attach Procedure
3G4G
 
SS7: the bad neighbor you're stuck with during the 5G migration and far beyond
PositiveTechnologies
 
Advanced: 5G Service Based Architecture (SBA)
3G4G
 
Worldwide attacks on SS7 network
Alexandre De Oliveira
 
ims registration call flow procedure volte sip
Vikas Shokeen
 
UMTS Protocols
Naveen Jakhar, I.T.S
 
Lte attach-messaging
Praveen Kumar
 
Packet core network basics
Mustafa Golam
 
IMS ENUM and DNS Mechanism
Kent Loh
 
VoLTE Interfaces , Protocols & IMS Stack Explained
Vikas Shokeen
 
End-to-End QoS in LTE
Radisys Corporation
 
Introduction to Diameter Protocol - Part1
Basim Aly (JNCIP-SP, JNCIP-ENT)
 
Srvcc overview
Yau Boon
 
AIRCOM LTE Webinar 1 - Network Architecture
AIRCOM International
 
5g introduction_NR
Nitin George Thomas
 
LTE Air Interface
Spiros Louvros
 
UMTS/LTE/EPC Call Flows for CSFB
Justin MA (馬嘉昌)
 
2G / 3G / 4G / IMS / 5G Overview with Focus on Core Network
Hamidreza Bolhasani
 

Viewers also liked (6)

PDF
InfiltrateCon 2016 - Why Nation-State Hack Telco Networks
Omer Coskun
 
PPTX
How to hack a telecommunication company and stay alive. Sergey Gordeychik
Positive Hack Days
 
PPTX
Критически опасные уязвимости в популярных 3G- и 4G-модемах или как построить...
Positive Hack Days
 
PDF
How to Intercept a Conversation Held on the Other Side of the Planet
Positive Hack Days
 
PDF
HITB Labs: Practical Attacks Against 3G/4G Telecommunication Networks
Jim Geovedi
 
PDF
4G LTE Security - What hackers know?
Stephen Kho
 
InfiltrateCon 2016 - Why Nation-State Hack Telco Networks
Omer Coskun
 
How to hack a telecommunication company and stay alive. Sergey Gordeychik
Positive Hack Days
 
Критически опасные уязвимости в популярных 3G- и 4G-модемах или как построить...
Positive Hack Days
 
How to Intercept a Conversation Held on the Other Side of the Planet
Positive Hack Days
 
HITB Labs: Practical Attacks Against 3G/4G Telecommunication Networks
Jim Geovedi
 
4G LTE Security - What hackers know?
Stephen Kho
 

Similar to Hacking Telco equipment: The HLR/HSS, by Laurent Ghigonis (20)

PDF
Hacking bluetooth enabled mobile phones and beyond.pdf
boliti9570
 
PDF
ACS-2010
Bob Radvanovsky
 
PDF
D1 t1 t. yunusov k. nesterov - bootkit via sms
qqlan
 
PDF
adm6: ip6tables, pf.conf, ipf mit python in deutsch
Marc Manthey
 
PDF
RenasCON 2023: Learning from honeypots
APNIC
 
PDF
Homer metrics | LORENZO MANGANI Y FEDERICO CABIDDU - VoIP2DAY 2017
VOIP2DAY
 
PPT
aaa
hungnhatban
 
PPT
Sectools
securedome
 
PPTX
Decreasing Incident Response Time
Boni Bruno
 
PPT
an_introduction_to_network_analyzers_new.ppt
Iwan89629
 
PDF
Filip palian mateuszkocielski. simplest ownage human observed… routers
Yury Chemerkin
 
PDF
Simplest-Ownage-Human-Observed… - Routers
Logicaltrust pl
 
PDF
Creating OTP with free software
Giuseppe Paterno'
 
PDF
Federico Cabiddu - VoIP2DAY 2016 | VoIP and RTC Troubleshooting using the Sip...
VOIP2DAY
 
PDF
Placing backdoors-through-firewalls
Akapo Damilola
 
PDF
GiacomoVacca - WebRTC - troubleshooting media negotiation.pdf
Giacomo Vacca
 
PPTX
How to Use GSM/3G/4G in Embedded Linux Systems
Toradex
 
DOCX
Advanced Log Processing
Anton Chuvakin
 
PPTX
Redteaming HID attacks
Juan Espin
 
PDF
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
Felipe Prado
 
Hacking bluetooth enabled mobile phones and beyond.pdf
boliti9570
 
ACS-2010
Bob Radvanovsky
 
D1 t1 t. yunusov k. nesterov - bootkit via sms
qqlan
 
adm6: ip6tables, pf.conf, ipf mit python in deutsch
Marc Manthey
 
RenasCON 2023: Learning from honeypots
APNIC
 
Homer metrics | LORENZO MANGANI Y FEDERICO CABIDDU - VoIP2DAY 2017
VOIP2DAY
 
aaa
hungnhatban
 
Sectools
securedome
 
Decreasing Incident Response Time
Boni Bruno
 
an_introduction_to_network_analyzers_new.ppt
Iwan89629
 
Filip palian mateuszkocielski. simplest ownage human observed… routers
Yury Chemerkin
 
Simplest-Ownage-Human-Observed… - Routers
Logicaltrust pl
 
Creating OTP with free software
Giuseppe Paterno'
 
Federico Cabiddu - VoIP2DAY 2016 | VoIP and RTC Troubleshooting using the Sip...
VOIP2DAY
 
Placing backdoors-through-firewalls
Akapo Damilola
 
GiacomoVacca - WebRTC - troubleshooting media negotiation.pdf
Giacomo Vacca
 
How to Use GSM/3G/4G in Embedded Linux Systems
Toradex
 
Advanced Log Processing
Anton Chuvakin
 
Redteaming HID attacks
Juan Espin
 
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
Felipe Prado
 

Recently uploaded (20)

PPT
Teaching material agriculture food technology
LiaRayya
 
PDF
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
PDF
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PDF
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
PDF
gpt5_lecture_notes_comprehensive_20250812015547.pdf
Chinchu40
 
PPTX
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
PDF
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PPTX
Tartificialntelligence_presentation.pptx
ry7r52mzb4
 
PPTX
1. Introduction to Computer Programming.pptx
bonakiduza1024
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PPTX
SOPHOS-XG Firewall Administrator PPT.pptx
AgnesMunisi
 
PDF
Getting Started with Data Integration: FME Form 101
Safe Software
 
PDF
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
Teaching material agriculture food technology
LiaRayya
 
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
Approach and Philosophy of On baking technology
30anthuong17
 
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
gpt5_lecture_notes_comprehensive_20250812015547.pdf
Chinchu40
 
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
Tartificialntelligence_presentation.pptx
ry7r52mzb4
 
1. Introduction to Computer Programming.pptx
bonakiduza1024
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
SOPHOS-XG Firewall Administrator PPT.pptx
AgnesMunisi
 
Getting Started with Data Integration: FME Form 101
Safe Software
 
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 

Hacking Telco equipment: The HLR/HSS, by Laurent Ghigonis

  • 1. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Hacking Telco equipment The HLR/HSS Laurent Ghigonis Security researcher at P1 Security
  • 2. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security What are we talking about ? A mobile network operator Core Network Network passive capture showing Global Titles
  • 3. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Mobile Operators • Conveys the majority of voice communications worldwide • Conveys our data • Conveys growing M2M traffic • Emergency systems notifications uses it => We now rely on it and we have some security expectations
  • 4. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Mobile Operators and governance • In Europe
  • 5. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Mobile Operators and governance • In France Lets check the reality …
  • 6. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HSS Front End HLR Front End AuC HSM Provisioning DSA 3 Back Ends Provisioning Gateway Install Server Admin Routing DSA The Witness : An HLR/HSS Typical HLR/HSS in use in operator Core Network
  • 7. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS in Mobile Core Network A mobile network operator Core Network Network passive capture showing Global Titles
  • 8. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS in Mobile Core Network
  • 9. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS in Mobile Core Network
  • 10. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS in Mobile Core Network • HLR is used in all 2G Operator Network • HSS is used in all 3G/4G Operator Network • Stores customer data – Subscriber identifier (IMSI) – Subscriber encryption keys – Subscriber approximate location – Subscriber SIM plan options • Critical to the operator – HLR down == Network down, no calls possible
  • 11. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS in Mobile Core Network HLR/HSS receiving subscriber location update from the operator SS7/Diameter signaling links
  • 12. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Lets make it talk …
  • 13. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security
  • 14. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Plan HLR/HSS Robustness assessment • Virtualization – Virtualization and instrumentation • System Analysis – Localroot, Framework complexity • Network Fuzzing – SS7 Protocols • Binaries Reverse – More vulns
  • 15. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS Virtualization No, it’s not ATCA / NFV
  • 16. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security An HLR/HSS is an ecosystem
  • 17. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security An HLR/HSS is an ecosystem • HLR + HSS Front-end • HLR Administration server • Application/Database routing servers • HLR Backend/Database (multiple) • HSM (Hardware Security Module) for keys
  • 18. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HLR/HSS is never alone
  • 19. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Where to start • Most exposed from the outside => HLR/HSS Front-end – Receives SS7/Diameter traffic • Telecom network stacks – Receives provisioning requests – Connected to the HSM
  • 20. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security HSS Front End HLR Front End AuC HSM Provisioning DSA 3 Back Ends Provisioning Gateway Install Server Admin Routing DSA Where to start Typical HLR/HSS in use in operator Core Network
  • 21. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Virtualization of HLR/HSS Frontend
  • 22. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Original Equipment Manufacturer • Specs of the real equipment – i386 / x64 / Sparc – Solaris / CentOS – 32 GB of RAM – CPU 16 Cores – TB hard drive + External SAN
  • 23. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Qemu/KVM • Faster than VirtualBox • More flexible • Tweak code to add more network interfaces • VDE Switch for networking
  • 24. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Qemu/KVM qemu-system-x86_64 -machine type=pc,accel=kvm:tcg -pidfile ./myhlr.pid -m 7.2g -smp 4 -drive file=/dev/mapper/lvm-vm--myhlr,cache=none -vnc 127.0.0.1:2,password,tls,lossy -display curses -rtc base=localtime,driftfix=slew -net vde,vlan=1,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=1,macaddr=52:54:00:00:10:01 -net vde,vlan=2,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=2,macaddr=52:54:00:00:10:02 -net vde,vlan=3,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=3,macaddr=52:54:00:00:10:02 -net vde,vlan=4, sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=4,macaddr=52:54:00:00:10:02 -net vde,vlan=5,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=5,macaddr=52:54:00:00:10:02 -net vde,vlan=6,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=6,macaddr=52:54:00:00:10:02 -net vde,vlan=7,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=7,macaddr=52:54:00:00:10:02 -net vde,vlan=8,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=8,macaddr=52:54:00:00:10:02 -net vde,vlan=9,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=9,macaddr=52:54:00:00:10:02 -net vde,vlan=10,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=10,macaddr=52:54:00:00:10:02 -net vde,vlan=11,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=11,macaddr=52:54:00:00:10:02 -net vde,vlan=12,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=12,macaddr=52:54:00:00:10:02 • Physical partition for disk – Do not use disk file on host btrfs • super slow • ext4 is ok – http://www.linux-kvm.org/page/Tuning_KVM • Curses output • Improvements: serial terminal
  • 25. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Qemu/KVM • Solaris 10 – Qemu/KVM ok for x64 – Fails for SPARC • Stock kernel – /kernel – /usr/kernel • Custom kernel modules – For Telecom Signaling [Signalware] • Uses grub • Failsafe mode
  • 26. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Inside the machine • ZFS filesystem • Solaris 10 • Everything is installed via packages • Multiple Oracle databases – Even on HLR/HSS Front-end only • A lot of Middleware framework to start the actual network stacks / applications • Telco stacks: based on Ulticom Signalware • The OS expects its precious network cards
  • 27. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security System Analysis
  • 28. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security The filesystem • ZFS = Filesystem + Volume manager • ZFS pool (often mirrored) – ZFS root pool • 100-200GB usually enough • Prepare free space for system/processes dump – ZFS Dump pool • Should be more than size of your RAM – ZFS SWAP pool • Should be more that size of your RAM
  • 29. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security The filesystem • ZFS offers good resilience against data corruption, and is very picky when there is too much corruption – You can’t recover when filesystem is too much broken – You can try $ zdb -e -p /dev/dsk/c0t3d0p0 -F -X -AAA -dd rpool 1 $ zpool import -f -F -X 19485729304958623456 mypool $ zpool import -o readonly=on -o autoreplace=on -o failmode-continue -m -N -f -F -X 19485729304958623456 mypool • If it fails – Code your own tool by modifying ZOL http://zfsonlinux.org/
  • 30. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Filesystem /advdata/ autoinstmnt/ bin@ boot/ cust_data/ dump@ environment.txt* etc/ export/ false/ global@ home/ installmnt/ kernel/ lib/ mnt/ net/ nsr/ opt/ patchmnt/ platform/ root/ rpool/ rtp_environ.txt sbin/ tftpboot/ ti_var/ tmp/ TspAcc@ TspAccBackup@ TspCore@ tspinst/ TspTickets@ updateSW/ usr/ var/ vol/ Grub/platform + failsafe Applications data Kernel Telco specific apps Home + Applications data + Telco specific apps Crashdumps from Telco specific apps
  • 31. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Some packages installed application SMAWrtp Telecommunication Service Platform (TSP) Base Package application OMNI Signalware System application S6U-4 Signalware System application OMNI-C7X Signalware C7 Extensions application INTPahacu AC Utimaco HSM
  • 32. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Low hanging fruits • SUID executables – SUID Total: 162 (155 binaries, 7 scripts) – SUID Root: 142 (137 binaries, 5 scripts) • Signalware Boot process “becoming root” by Design
  • 33. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Local roots • Of course, we often find multiple local roots • Some are really too easy (one command):
  • 34. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Example of Telco network stack: NSN TSP / RTP + Ulticom Signalware • TSP + RTP framework are found on NSN NT- HLR – Found in many European and Worldwide operators – Very similar to Apertio OneHLR • TSP: Telco Server Platform (Ericsson) / Telco Service Platform (NSN, others, generic name) • RTP: Resilient Telco Platform (NSN)
  • 35. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Example of Telco network stack: NSN TSP / RTP + Ulticom Signalware • SS7 Protocol handling Reminder: SS7 stack
  • 36. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Network Fuzzing
  • 37. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Fuzzing SS7: M3UA • Example: Flooding badly handled – Leads to alerts flooding in OSS – Leads to loss of previous alerts ! – P1VID#799
  • 38. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Fuzzing SS7: SCCP • Example result: 1 specific MSU repeated 2 times causes DoS of all Signaling Interconnections – HLR is down during 2 minutes – Total Denial of Service of the network – Nobody can receive calls in the whole country core 'core.xxx' of 15477: /export/home/xxx 01 msu_processing () 02 msg_distribution () 03 main () 04 _start () – If the attack is repeated, the DoS is permanent during the attack – P1VID#773 So long for the critical infrastructure …
  • 39. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Fuzzing SS7: SCCP
  • 40. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Fuzzing SS7: MAP • Example results: 1 specific MSU causes MAP process crashes – 5 MSU/second makes HLR totally unresponsive to any other MAP Query • Total Denial of Service of the network • Nobody can receive calls in the whole country – 1 MSU/second makes HLR totally drop 50% of other MAP Queries • Network is highly perturbed • 50% of the called in the whole country are failing – P1VID#772
  • 41. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Fuzzing Diameter • Process Crash with 1 specific manually crafted MSU Logs do not even report process crash. Neither the OSS Alerts. Application logs: Services_Esm_Log_Message: vc_Priority=LOG_ERR, vc_MessageInformation=ESM: Service could not be processed correctly, vc_AdditionalInformation=Reason: xxxxxxxxx data unavailable, Message Type: S6a-xxxxxxxxx Services_Esm_Log_Message: vc_Priority=LOG_ERR, vc_MessageInformation=ESM: Service could not be processed correctly, vc_AdditionalInformation=Reason: xxxxxxxxx data unavailable, Message Type: S6a-xxxxxxxxx UTC Tue Sep 3 01:20:44 2013 Services_Esm_Log_Message: vc_Priority=LOG_ERR, vc_MessageInformation=ESM: Service could not be processed correctly, vc_AdditionalInformation=Reason: xxxxxxxxx data unavailable, Message Type: S6a-xxxxxxxxx Services_Esm_Log_Message: vc_Priority=LOG_ERR, vc_MessageInformation=ESM: Service could not be processed correctly, vc_AdditionalInformation=Reason: xxxxxxxxx data unavailable, Message Type: S6a-xxxxxxxxx Behind that, process core dumps are created… P1VID#718
  • 42. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Does redundancy saves you ? • No ! • Same N front-ends == same crashes • Messages just needs to be sent N times
  • 43. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Binaries reverse
  • 44. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Often, too much help… • Binaries not stripped – Debug symbols / function names / … available • No anti-debug mechanism • Libraries headers on production machines – Great help in understanding the internals • Large documentation about internals on production machines – Great help in understanding the internals • Updated binaries and previous binaries both on production machines – Binary diff to track issues fixed
  • 45. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Signalware Kernel modules • Example: Parsing of SCCP header
  • 46. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Signalware Kernel modules • Kernel modules signaling parsing is robust • IPC to communicate with userland binaries • Complexity leads to other type of errors – Logic errors – Race conditions – Slow handling of some types of MSUs
  • 47. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Signalware userland binaries • Parsing less robust (less tested) • Example logic error due to IPC / Framework complexity: Can be triggered from the International SS7 network Null pointer dereference
  • 48. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security So verdict ?
  • 49. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security So verdict ? • Misconceptions! – No crashes on a Critical Core Network Element • FAIL – Robustness against network attacks • FAIL • Redundancy != Robust, attack kills Front-end one by one – Modern • Depends, but from what we see there is much room for improvement
  • 50. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Mobile Operators and governance • Reality on Threats analysis: Maybe • Reality of Telco equipment security: Very bad • Public information: Very bad • Telco private sector information: Didn’t see impact
  • 51. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Consequences • Mobile Network crashes for unknown publicly available reason • Spying on phone calls / customer activities from a single point (Core Network) is relatively easy • Fraud
  • 52. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Recommendations • Secure SDLC (Secure Software Development Life Cycle) – Design – Implementation – Testing • Especially for vendors custom stacks/services TCAP/MAP parsing bugs leading to overflows, … • Vendors security audits (HLR isolated) – System audit – Network audit • Testbed audits (HLR in environment) – System audit – Network audit – Before deploying to production
  • 53. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Recommendations: securing the OS • Use Solaris Zones to split services: P1VID#764 • Use Solaris Audit mechanism: P1VID#765 • Authenticate the hardware – To prevent emulation • Use the latest OS protections against exploitation – Solaris 11 has ASLR – Use custom Linux kernel • Use a firewall by default on the machine itself • …
  • 54. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Recommendations: OSS • Make it faster ! – People should be able to use it to react when under attack – E.g. NSN @vantage commander • Need access to all low-level network traffic for forensics
  • 55. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Recommendations: For the operators • Push the vendors to fix the bugs • Some of the attacks we discovered can be filtered – Operators do not have to wait for bugs to be fixed – Filter at perimeter boundaries (typically STP / Router) – Depends on STP / Router models and security “features” • Sometime filtering options are charged by vendor • It is possible to filter also at the SCCP provider level
  • 56. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security To be continued • Telecom Network Elements security is low – We tested multiple Network Element types/models, from different vendors • Vendors, Governments and security researchers have work to do • Vulnerability disclosure in security critical infrastructure is scarce – Dangerous ? – Not if there is collaboration
  • 57. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security Other aspects of Telecom Security • We talked here about equipment security – It’s a work in progress, and only HLR/HSS – Mainly Network Equipment Vendor responsibility • Also consider – Other Network Elements security – GRX / IPX / SCCP Providers security – Deployment security (passwords policies, filtering…), Operator responsability – Telecom Network Fraud (SS7 spoofing, Call/SMS Spoofing, …), Operator responsability
  • 58. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security References Governance literature on critical infrastructure: • European level – 2007: http://www.nato-pa.int/default.asp?COM=1165&LNG=0 – 2012 http://www.nato.int/cps/en/natolive/news_88054.htm?selectedLocale=en – 2013 http://ec.europa.eu/dgs/home-affairs/what-we-do/policies/crisis-and- terrorism/critical-infrastructure/index_en.htm http://ec.europa.eu/dgs/home-affairs/what-we-do/policies/crisis-and- terrorism/critical-infrastructure/docs/swd_2013_318_on_epcip_en.pdf • France – 2012 http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000026638421 &dateTexte=&categorieLien=id – 2013 http://www.gouvernement.fr/gouvernement/livre-blanc-2013-de-la-defense-et- de-la-securite-nationale
  • 59. 2014, Hackito Ergo Sum - Security ConferenceHacking Telco equipment: The HLR/HSS – Laurent Ghigonis – P1 Security That’s it, please react. Thank you laurent@p1sec.com http://www.p1sec.com