35C3 preroll music Herald Angel: We start the next talk. It's by Martin Vigo. He stands here. He is a product security lead and researcher and he's responsible for mobile security, identity, and authentication. So he helps people design and secure systems and applications. And he has worked on stuff like breaking password managers or exploiting Apple's FaceTime to create a spy... yeah, a spy program. So give him a warm applause for his talk. Applause Martin Vigo: Thank you for joining me in this talk. I'm super excited to be here. It's actually my second year at the conference, so super super excited that the first year I was sitting there, and the second year I'm sitting here. This is me, but an introduction was already made. Just pointing out that this is me, 9 year old, with an Amstrad CPC 6128. You had this machine before? I see only one hand? I think this was sold in Europe, but I was playing here La Abadía del crímen, which is the best video game ever written. If you guys like abandonware, you should definitely check it out. So like any good research we have to start by looking at previous art, right? We can learn a lot from researchers that did stuff in the past. And in this case I went all the way back to the 80s to understand how freakers of the time, when the hacking thing started, we're doing to actually hack into voicemail systems. I condensed everything I learned in five different paragraphs of five different essences, that I actually got from frac website, which is an amazing resource. So, here from the Hacking Telephone Answering Machines, the paragraph that I extracted was that "You can just enter all 2-digit combinations until you get the right one", "A more sophisticated and fast way to do this is to take advantage of the fact that such machines typically do not read two numbers at a time, and discard them, but just look for the correct sequence". What is this about? In older voicemail systems if you will enter like 1234 for the 2-digit PIN, it will not process 12 and 34 to to verify the PIN, but it will also process 23, which is very interesting. In fact, in Hacking AT&T Answering Machines, again, this is amazing from their 90s or 80s, we actually get the correct sequence to cover the entire 2-digit key space. So, if you enter all these, you are basically brute forcing the entire key space, without having to enter in the entire thing that covers it. I also learned, from A Tutorial of Aspen Voice Mailbox Systems, that in the 80s there was default passwords. Surprise, surprise! But also that as humans, we actually have patterns when we choose PINs. And so we have the classics: 1111, 9999, 1234. And another thing that I learned in Hacking Answering Machines in the 90s, was that "There is also the old 'change the message' secret to make it say something to the effect of this line accepts all toll charges so you can bill third party calls to that number". This is basically a trick used by inmates to get free calls. Basically, they would record in the voicemail a greeting message "yes, yes, yes", so when the automated system comes in and asks "Do you want to accept the toll charges from the call from the penitentiary, it will go and they will be able to do free calls. So, condensing everything and summarizing what what I learned from looking at what previous hackers did in the 80s: we know that the voicemail system security looked like... there was default PINs, there was common PINs, there was bruteforceable PINs, there was efficient bruteforcing because we can enter multiple PINs at the same time, that the greeting message is actually an attack vector. So let's play a game. Let's do checklist and let's look at the voicemail security today. So, I looked at the American carriers because I live in the US, but because I was invited to talk in Germany, I took some friends to give me some SIM cards and I actually wanted to put about German carriers as well. So, checklist time, default PINs: all American carriers do have default PINs and unfortunately they are really not a secret because most of them is actually the last digits of your phone number. When it comes to German carriers it's actually a much better state, for example Vodaphone it's the last 4 digits of the client number which you don't know. I mean, you know as the customer, not others, it's a secret. Or if it comes to the CallYa, that is the card that I got, it's the last 4 digits of the PUK. For Telekom it's the last 4 digits of the card number, which is the card you get with the SIM card. For O2, unfortunately, there is a default PIN, which is 8705, which is the only PIN you can't set, when you choose to set one. Yeah. So, voicemail security today when it comes to common PINs: according to like a fantastic research from Data Genetics, this is actually about people choosing PINs for their credit cards, but there was a lot of conclusions that I learned from this research and basically, to summarize the most important regarding this work, is that for example by trying the top 20 most common PINs, you have a 22 percent chance of getting the right one. What this means in other words is for every fourth victim that I tried to brute force the PIN from their voicemail system, I will get it right every fourth person. There are other conclusions that are very interesting like, the PINs mostly start by 19. Who has an idea why is that? Birth year, right? Is very common to set as your birth year. Most of us were born in the 20th century... to set it as a PIN. Bruteforceable PINs. Same thing in Germany and in the US, it accepts 4-digit PINs which, we will see later, is just not enough key space. Efficient bruteforcing all the carriers accept concatenation of payload. So, in this case I use it to try different PINs and I don't even have to wait for error messages. I just use the pound as kind of like an enter in a voicemail system and I can try three PINs at a time. Usually carriers will hang up when you enter three PINs wrong, for security purposes, but we will take advantage of that. So with everything that I learned from the 80s, I verified that it was still a problem today. I decided to write a tool that allows you to brute force voicemail system fast, cheap, easily, efficiently, and undetected. So, fast: I used Twilio... who is familiar with Twilio here? Some of you? So a Twilio is basically an online services that allows you to programmatically interact with phone calls. You can make phone calls, interact with them, and all that. So I use it to launch hundreds and hundreds of calls at the same time in order to brute force PINs. It's cheap! The entire 4-digit keyspace costs 40 dollars. So if I want to have a 100 percent chance of getting your 4-digit PIN, I only have to pay 40 bucks. A 50 percent chance, according to the research from Data Genetics, it will cost me five dollars. So once every two victims, I will get the PIN. Actually, if I want to take a different approach and instead of just trying to brute force only yours, I want to brute force the PIN from everyone here, according to Data Genetics, and in this case, according to the fact that that is default PINs... I'm not going to ask how many of you have O2, now that they know that there is a default PIN to their voicemail system. It will be more interesting to actually try a thousand phone numbers for that default PIN for O2 customers, only for 13 dollars. It's easy: fully automated, the tool does everything for you, you just have to provide the victim number, the carrier, and couple other parameters and it's efficient! It optimizes brute forcing, I use the research from Data Genetics to favor the PINs that are most common, and obviously it tries different PINs and all that stuff. But the most important here is detection, because think about it. In order for me to interact with your voicemail system I need to call you and you cannot pick up, because if not, it doesn't go to the voicemail system. So I was trying to find ways, because I need to, in the end, make a lot of calls, trying different PINs. How can I interact directly with your voicemail? I try call flooding like basically doing three calls at a time, because the line gets flooded just with three calls, it goes directly to the voicemail, but it wasn't very reliable. You can use OSINT techniques, a lot of people likes to tweet that they, you know, they go on a trip, they are about to board a plane, so it goes into airplane mode, or you go in a remote area, or you are in a movie theater, or at night you put in Do Not Disturb. Those are all situations in which calls go directly to the voicemail. You can use HLR database to find out if mobile devices are disconnected or the SIM cards have been discarded, but they are still assigned to an account. And you can use online services like realphonevalidation.com which I actually reached out and they provide services that allow you to know if a phone is acutally connected to a tower at the moment, so it's basically available, so you could use that too. You can also use class 0 SMS, which gives you feedback. It's basically a type of SMS that will... it has more priority and will basically display on the screen and you'll get the feedback if it was displayed. So, that's a nice trick to find out if the phone actually connected to a tower. But in reality, I wanted a bullet proof way to do this and in the U.S. I found that there is this concept of backdoor voice mail systems. So instead of me calling you, I'm going to call one of these services that you guys have listed here for every carrier and there I enter the number, in this case the number of the victim from the voicemail I want to interact to. And of course it allows you to access to the logging prompt. Actually in Germany I find it interesting that you guys have it as a service, because in the US it's more a secret that I had to found using Google, but here... Basically if I dial your phone number and when it comes to Vodafone between the area code and the rest of the number I put 55, or for Telekom 13, or for O2 33, I directly go to the voicemail, you won't ring your phone. So I can use that. Who was aware of this, that is from Germany? OK, many of you. So that's what I thought. Like here it's not really like something you guys care too much about. In the U.S. it's actually used a lot for scammers or to leave directly voicemail messages from spammers as well. So, voicemailcracker actually takes advantage of backdoor numbers, so it allows you to be undetected. I don't need to call you, I don't need to wait till you are flying, I can do that. And for example for the U.S. it's great, because when I launch that many calls, the line gets flooded even if you are offline. But when I use these backdoor voicemail systems, because they are meant to be used by everyone, those don't get flooded. So I literally make hundreds and hundreds of calls and it never fails.So, but you know like carriers, or some of them, add a brute force protections, right? So that you can't actually launch brute forcing attacks. And I looked at the German carriers and for example Vodafone, I saw that it resets the 6 digit PIN and sends it over SMS. So, I guess I can flood your phone with text but who cares, that's not a big deal, but I think it's actually a pretty effective measure against voicemail... against brute forcing. Telekom blocks the Caller ID from accessing the mailbox or even leaving messages. I tried and after six times that it's wrong every time, I call it says "Hey, you can't do anything", and it hangs up. And for O2 it connects directly to the customer help-line, but someone started talking German and my German is not that good. So brute force, I wanted to be able to bypass this writing and so if you look at telecom I mentioned that it blocks the caller I.D. but it turns out that Twilio you can actually buy caller IDs you can, well, you can buy phone numbers, right? and they are really cheap. So it's very easy for me to do randomization of caller I.D.s for very very cheap and bypass telecom's brute force protection. So voicemailcracker also supports that. It supports caller ID randomization. So let's make the first demo. So as you can see here on the left is the victim's mobile device, and on the right is the tool. And in this case I'm going to use the brute force option. The brute force option allows me to basically brute force the pin. It makes hundreds of calls as I explain and I'll try to guess it. And there is a number of parameters like the victim number, the carrier... the carrier is important because they put their specific payloads for every single carrier because all the voicemail systems are different, how you interact with them, and in this case are using a backdoor number because he's more efficient. And then there is no detection. And in this case I did the option of top pin. So this is basically trying the top 20 pins according to the research for four digits. So as you can see it's trying actually three pins at a time as I mentioned before rather than one. So we have to do a third of the of the of the calls, right? And how did you think that I'm detecting if the pin was correct or not? Any ideas? Unintelligible suggestion from audience M.V.: OK. So the disconnect and hang up. That's what I heard. And that's exactly right. If you think about it I can look at the call duration because when I tried three pins and it hangs up it's always the same call duration. For T-Mobile in this case it's like 18 seconds. So I instruct Twilio to after dialing and putting the payload to interact with the voicemail system trying the pins to wait 10 extra seconds. So all I got to do, I don't need any sound processing to try to guess what the voicemail voice is telling me if it's correct or not. I just use the call duration. So if the call duration is ten times longer then I know that's the right pin because because it locked in. So as you can see it found out one of those three is actually the correct one: in this case it's 1983. So in order to give you the exact one because at that time it tried the three of them, now it's trying one by one and it may look like it's taking longer than it should for only 20 pins but remember failing pins is very very quick. It's just that because in the top 20 found already the right pin it takes longer than it should, and there you go. We got that it's 1983. Awesome. So what is the impact really why am I here talking to you at CCC that has such amazing talks, right? And this is really the thing about this. No one cares about the voicemail. Probably if I ask here, who knows his own voicemail pin? laughter M.V.: Nice. That's what I was expecting. Probably less hands here. So some of them are lying but that's the thing, right? We don't care about the voicemail. We don't even use it, which is the crazy thing here. We have we have an open door for discussing an issue that we don't even know about or we don't even remember. So many people is not familiar with the fact that you can a reset passwords over phone call. We are familiar with resetting passwords over e-mail. You get a unique link maybe over SMS you get a code that you that you then have to enter in the UI. But a lot of people cannot receive SMS, or that's what services claim. So they allow you to provide that temporary code over a phone call, and that's exactly what we take advantage of, because I ask you what what happens if you don't pick up the phone if basically I go to a service, enter your e-mail or your phone number and reset a password, and everyone can do that. Anyone can reset it, initiate the reset password process, and I know that you are not going to pick up the phone. I know that thanks to my tool I got access to your voicemail system. So basically the voicemail system will pick up the call and it will start recording, so it will record the voice spelling out the code that I need to basically reset your account and get access to it. So -- oops! -- and I press play here. Static M.V.: Okay, so, what does the attack vector look like? You brute force the voicemail system using the tool ideally using backdoor numbers. For that particular call -- that is, the call that the victim will receive once you initiate the password reset -- that one it cannot go through the backdoor number, right?, because it's gonna-- PayPal is gonna directly call the victim. So for that one you need to make sure that the victim is not connected to a tower through all the methods that I showed before. You start the password reset process using the economy feature. You listen to the recorded message, secret code and profit. You hijacked that account, and Voicemailcracker can do all that for you. Let's compromise Whatsapp. So on the left you see my number, right?, with a secret lover group, and a secret group, and all that stuff. On the right notice that I'm not even using an actual device. It's an android emulator that I installed, an APK. And there is some sound to this, and you are gonna see -- so again on your left it's the victims number. On the right is an emulator of the attacker. So you'll see that I'm going to use my tool with the message payload, with the message option. So in this case what I'm doing is I'm setting the victim's phone to airplane mode, simulating that it's now offline for some reason, and I detected that. So if you see, WhatsApp allows sends you a text to actually register as a WhatsApp user, but if you don't reply in a minute it allows you-- it gives you an option to call, to call me, right? And that's exactly what I click. So now WhatsApp is basically calling the victim which is again in airplane mode, because he went on a remote trip or on a plane, and so I'm using Voicemailcracker with the option "message" to automatically retrieve that newest message. So the tool is gonna provide me as you can see the last option is the pin, because I brute forced it before. So it's going to give me a URL with the recording of the newest message, which, hopefully -- it's a recorded demo -- hopefully contains actually the code. So let's see... I got the URL. Phone alert sound Computerized phone voice: New Message! -- M.V.: It's interacting with the voicemail system right now. Phone voice: -- your verification code is: 3 6 5 9 1 5. Your verification code is: 3 6 5 9 1 5. Your ver-- M.V.: And that simple. We just hijacked that person's WhatsApp, and I -- here I'm fast forwarding just to show you-- Applause M.V: --that you get actually that. Thank you. I do want to point out that WhatsApp is super secure, it like-- end to end encryption all that -- and there is a number of things that you can notice this attack. For example you wouldn't be able to see the previous messages that were there but you can just hold on and ask people, right? The groups will pop up. So you hijacked that WhatsApp account. There is also fingerprinting. But who really pays attention to the fingerprinting when someone changes the device, right? So are we done? Not yet. Because the truth is, some researchers talked about this in the past then and actually services tried to slowly pick up. So that is actually something that I found in several services. That is what I call the user interaction based protection. So when you received that phone call that provides you with the temporary code in reality it's not giving it away. You have to press a key. It comes in three different flavors from what I found from my tests. Please press any key to hear the code, so when you get the call, you have to press, and then it will tell you the code; please press a random key so specifically please press 1, please press 2, or please enter the code. PayPal does that, and instead of you having to press a key to hear the code when you reset the password you will see a four digits code that you have to enter when you receive the call and then it will reset the password. So I'm going to get the help from all of you guys. Can we beat this currently recommended protection what is nowadays recommended to prevent these kind of attacks? And we're going to play a game. I'm going to give you two hints. This is the first one. So, you probably guys are familiar with this, but Captain Crunch. Again we go back today it is we can learn so much from them, use this to generate specific sounds at a specific frequency to basically -- you can go and read it -- to get free international calls. So he will create that sound and the system will process it on the on the line. And the second one is that I cheated. When we did the checklist, I actually skipped one , which was the greeting message is an attack vector. So I ask you guys how can we bypass the protection that requires user interaction in order to get the code recorded on the voicemail system? Inaudible suggestion from audience M.V.: What was that?... Exactly. Record DTMF tones as the greeting message. We own the voice mail system so we can alter the greeting message. So this is exactly how it works: We just alter the greeting message we call the DTMF that the system is expecting and it works every single time. The best thing of this is what really is so awesome about about all of us that really care about technology. We want to have a deep understanding because when I was asking people when when you know I wanted to show them this I was asking them how does this protection really work. And they will say well you have to press a key and then you know it will give you the code. But that's not really true. That's what you have to do is to provide a specific sound that the system is expecting. That is different than saying you have to press a key, because if you say I have to press a key that requires physical access. If you say I have to provide a sound, now we know it doesn't require physical access. That is why hackers are so cool, because we really want to understand what is happening backstage, and we take advantage of that. So how does the attack vector look like? Bruteforcing voicemail systems as before. So basically we have an extra step which is update the greeting message according to the account to be hacked in voicemail. Cracker can do that for you. Let's compromise PayPal. Laughter M.V.: So on the left side you see that as before I brute force the pin of the voice mail. And in this case on the right side I'm going to start a password reset for that account. So I do that and I choose "please call me with a temporary code". But in this case PayPal works differently because it will show me a four digits code that I need to enter when I receive the call in order to reset the password. So you see that here I'm using the greeting option. So the greeting is going to allow me to enter a payload that I want to record as the greeting message. In this case is 6 3 5 3. So I may be very very verbose for this demo. There you see the last option use PayPal code and I enter 6 3 5 3. Now the tool is going to use the pin to log into the voicemail system, interact with it, change the greeting message, record the DTMF tones according to 6 3 5 3 and then it should be able to fool the call. In this case I'm asking to call again, because it didn't have enough time to do that. And in 3 2 1 we should get that we actually compromise PayPal's account, and there we go. We can now set our own password. Applause M.V.: Thank you. So, I showed you some vulnerable servers. Let's go very quick about it because I'm I'm concerned I'm running out of time. So, I'm just mentioning Alexa top 100 types of services, no favoring anything, but... so for password reset that supports over phone call: PayPal, Instagram-- no, Snapchat-- Netflix, Ebay, LinkdIn. I'm still on Facebook. What can I say? 2FA for all they major forms so 2FA over phone call for Apple, Google, Microsoft, Yahoo... Verification: So basically you don't register with a username and password on on WhatsApp or Signal you actually use directly the phone number, right? As we saw before and you register through a phone call or SMS. So you can compromise this too. Twilio, the own service that I use for these is actually really cool because you can own a caller I.D. by verifying it by getting a phone call so I can actually own your caller ID and make calls on your behalf, send texts, and these all legitimately, right?, because you've pressed one. Google Voice, it's actually another interesting service because it's used a lot by scammers, right? And this is the same thing: you have to verify ownership so you can do those phone calls and you can fool it as well with this, but I found I was looking like what other services really take advantage of this? And this is super common in San Francisco, where I live. You can buzz in people like when they want to enter, right?, they enter your house number, and then your phone rings and you press any key to open the door. So we are talking about physical security now. And I've seen this in offices as well. They all work this way, basically because they want to be able -- for tenants, that you know, come and go -- be able to switch that very quickly. So it works just through the phone that you buzz people in. But my favorite is consent, because when we think about consent we think about lawyers and we think about signing papers and we think about all of these difficult things. And I find out about these location smart service that is not anymore there and you will see why... But this was recently in the news because, basically Brian Krebs wrote a really great article about it. But I'm going to let you hear then their YouTube channel, how Location Smart works. LS vid speaker 1: The screen that you're showing, that you're seeing right now is a demo that we have on our Web site it's at location smart.com/pride, and I've entered my name, my email, my mobile phone number, and it's again going to get my permission by calling my phone, and then it'll locate. So let's go ahead and, I clicked the box to say yes I agree, click the locate, and the screen now shows that it's going to call my device to get my permission. vid speaker's phone vibrates, sounds like an airhorn in video LS vid speaker 2: Heh, that's a nice ring tone -- M.V.: No, it's not-- LS vid speaker 1's phone: To log into Location Smart Services, press 1 or say 'Yes'. To repeat, press 2 or say 'Repeat'. LSVS1: Yes Phone: Congratulations. You have been opted in to Location Smart Services. Goodbye M.V.: So as you see, this service, this Web site had a free demo, had a free demo that allow you to put out a phone number -- yours, of course -- and you will get a phone call and then you will give permission by pressing one. So someone could locate you and keep tracking -- I mean, I checked with them -- for up to 30 days, real time. So now you know why they don't exist anymore! Applause M.V.: Open source.. More Applause M.V: Open source. So, and this was with the permission of the carriers. This was not some fishy thing. This was actually a service. So I wanted to release code, because I want you guys to verify that what I mentioned is true and have code to hopefully help push the industry forward to make a voice mail systems more secure, right?. We want to push carriers to do so. A but I didn't want to provide on tool that works out of the box and anyone can very easily as we saw like just start to bruteforce pins, especially because I saw that there is so many people with the default PINs out there. So I just removed the brute forcing, so the tool allows you to test it on your own. You can test, you know, you can test the greeting message you can test the retreiving messages compromising the services and all that. So the tool allows you to test on your own device. I won't give you code to brute force someone else's device. And feel free to go to my github repo. So now like all the talks comes the recommendations, but I know what you guys are thinking, right? When someone comes with all this paranoia and stuff you still think "yeah but you know still like no one is gonna come after me. I don't have anything to hide" or anything like that. So I wanted to give you reasons why you should still care about this, and why we need to do better. Because do carriers set default PINs? Yes, we saw that. Is testing for default pins cheap, fast, undetected, and automatable? Yes it is. Is updating reading the message automatable? Yes it is. Is retrieving you the newest message automatable? Yes it is. Is there speech to text description, so that I can get the sound that I played before with the code and get it in text? Yeah. Twilio gives you that as well. So can the account compromise process be automatable? Of course you can use selenium if you want to automate the UI. Or you can use a Web proxy and look at the APIs and do it yourself. So it is only a matter of time that someone actually does all these steps that I showed you step by step and just makes it all straight and starts to go over phone numbers trying the default PINs, and just automatically compromising services like WhatsApp like PayPal and all that. You can do basically, not a worm, but, you know, you can compromise a lot of devices without doing anything. Recommendations for online services. Don't use automated calls for security purposes. if not possible detect answering machines and fail. I mean this is not very accurate and you can still trick it. Require user interaction before providing the secret. I just show you how to bypass that, but that's with hope that carriers ban DTMF tones from the greeting message. I don't see why that should be supported, right? Recommendations for carriers. The most important thing: Ban DTMF tones from the greeting message, eliminate backdoor mobile services, or at least a give no access to the login prompt, right? There is no reason why you should be able to access your voicemail directly to leave a message. But then I can access the login prompt by pressing star. Voicemail disabled by default. This is very important and can only be activated from the actual phone, or online maybe with a special code. Oh great I have time for questions. No default pins. Learn from the German carriers: don't allow common pins, detect and prevent brute force attempts, don't process multiple pins at once. Recommendations for you which, is in the end, very important here. disable the voice mail if you don't use it. I found though that some carriers you're still through the backdoor voicemail numbers you are unable to activate it again. So kind of sucks. So I guess use the longest possible random pin. Don't provide phone numbers to online services unless required, or is the only way to get 2FA. 2FA is more important. Use a virtual number to prevent OSINT like a Google Voice number so no one can you know learn about your phone number digits by resetting the password or do SIM swapping. Use 2FA apps only. And I always like to finish my talk with ones like that kind of summarizes everything. Automated phone calls are a common solution for password reset, 2FA, verification, and other services. These can be compromised by leveraging old weaknesses and current technology to exploit the weakest link voicemail systems. Thank you so much. Danke Schön, CCC! Applause Herald Angel: Thank you, Martin. We have time for questions, so if you have any questions or if someone in the Internet has questions just go to these microphones. Where is the microphone? You've got it. Yes. You were black and the microphone too. So maybe you start and we take the question from the Internet. Q: Yes I have a question. You mentioned that the phone needed to be offline. Would a call like a sim teen's call to the phone that it would be in what is called in english - besetzt?- like occupied so let's say I already called the victim. So the caller gets, yeah, the line's occupied that would then go to voicemail, wouldn't it? M.V.: So that's a great question. I think the question is if you are on a call and someone else calls you, so your attack will be: I somehow make up a story to keep the person on the phone call while I launch other calls... that will work. I tried that but the problem is usually to force, I mean that will not be too big of a deal I guess but it supports two calls right. They will warn you all there is another incoming call. But I guess you could keep doing more. So that's what I meant a partly with a call flooding. In that case what I tried was just launching all of them at the same time. And if the person picks up I don't care but it's somewhat related to what you mentioned and that's definitely possible. Questioner: Okay. Thank you. M.V.: Yeah. Herald: Question from the internet please Signal Angel: Does this work with the phone calls that start talking immediately, will the new code being recorded then? M.V.: if I understood the question correctly it's that when the voicemail picks up like basically the automated system that spits out the code already started to talk. I believe that's the question. Herald: We don't know it's from the Internet. M.V.: OK so if that is the question I found actually that, because usually greeting messages last like 15 seconds so by the time it starts recording you already finish the recording that gives you the code, but you own the greeting message so you make it as short as one second. And I never found a problem with that. You actually recorded DTMF tones for like two seconds. Herald: Ladies first let me take your question. Q: You talked about how you learned all of that through reading e-zines. How are they called, and how do I find them? M.V: That's the best question I've ever heard and it deserves an applause, seriously. I like that because you also want to learn about it. So that's that's really fantastic. So the Phrack Web site is the best resource you can get. I guess everyone will agree here. So you just look up google for phrack magazine and there is a lot a lot of interesting stuff that we can learn there still today. Q: Are there any others? M.V.: Yeah I mean you can then follow the classic. I mean I like Twitter to get my security news because it's very concise so I kind of get like you know the 140 characters version.. if I'm interested then I will read it. So I think you can google for like top security people to follow. Brian Krebs is great. It depends also on your technical depth. There is different people for that. And if not just you know specialized blogs in magazines. Q: All right. Thanks. M.V.: Thank you. Herald: And your question please. Q: Hi. And so for me the solution is obvious: I just turn off my voicemail. But thinking about some relatives which are maybe too lazy or don't really care and still use two factor authentication. I was thinking about could I easily adapt your script to automatically turn off voice boxes or generate random pins? M.V.: You can automate it to turn off the pin. Like for example on Vodaphone I don't know why that allows you to turn off the pin. To turn off the voicemail... I don't... I haven't tested that. I think you may have to call the IT department but you know what. It would be really great to do that. It would be really awesome. Great question. I guess if you can turn it off then you can turn it on as well. Yeah. Herald: Your question please. Q: Did Twilio ban you or did they find out what you did? M.V.:I got some emails I got some emails but they were really cool. I have to say that. I explained to them what I was coming from, I gave them my identity... like I wasn't hiding anything. Actually I had to pay quite some money and because of all the calls that I was doing while I was doing the research, so I do think hide my identity at all. So, they did detect tact that I was doing many calls and stuff like that. So there is I guess at the high volumes there is some detection, but Twilio is not the only service. So again you can switch between services, space it out, change caller I.D.s, a number of things. Herald: And one more question here. Q: Hi. You talked about being undetected when making all these calls by going directly to these direct access numbers. In Germany it's very common that if someone calls your voicemail you get an SMS text even if they don't leave a message. But I suspect there's some kind of undocumented API to actually turn that off through the menus. Have you looked into that? M.V.: No I haven't looked into that specifically. The question is that usually in Germany for the carriers you'll get an SMS when you when you get a call. I wonder... the test that I did on the German carriers, I was getting a text if I was leaving a message, not if someone was calling there. I guess you are talking about a missed call, that kind of notification. I'm not sure about it. What I do want to point out is remember that a you can do these while the person is offline maybe on a long trip so you can time it, and that will be a good probation I guess to just not launch at any, you know, at any point in time, but you can just always time it, and by the time the person gets a million text it's too late. Q: Thanks. M.V.: Yeah. Herald: One more question over here please. Q: Thank you. On apple phones you can activate with some care the, what they call visual voicemail. Would that prevent your attack to work, or..? M.V.: No there is actually, I believe he was an Australian researcher, that looked into the visual voicemail and he was able to find that in reality uses the IMAP, If I remember correctly, protocol, and for some carriers he was able to to launch brute force attacks because the authentication wasn't with the same pin as you get when you dial in. But he found at least one carrier in Australia I believe that was vulnerable through visual voice mail protocol. And I check for German carriers. I did that, I actually follow the steps that he did, to see if that was worth mentioned in here. I didn't find it to be vulnerable, but that doesn't mean that that's not the case. Herald: One more last question. Q: Thank you for the talk. What is your recommendation to American carriers to protect themselves against this attack? M.V.: I put a slight slide there. Like for me I guess the most important thing is really look at what some German carriers are doing I really like that in the recent past where it sends it to you over SMS as soon as it detects that someone dialed, tried six times the wrong pin. I mean if you have physical access to a locked device you could claim that if someone has the preview turned on the device you could still see the pin, you know when you get it so. But then it wouldn't be like a remote attack anymore, so definitely detect brute forcing and shut down. I mean we know that with the caller I.D. is not working so well for a Telecom, because I was able to bypass it. But I know that, because I did some test with HLR records that you can actually tell the type of device that it is, if it's a virtual number. So if carriers could actually look at the type of phone that is trying to call in. I think if it's a virtual number, you know, red flag. If it's not I don't think someone is going to have... I guess the government could like, you know have 3333 devices because you try one pin for the 10000 keyspace, you know. You try 3 pins at a time and just have 3333 SIM cards and so it will come from real devices. But then at least it will quite significantly mitigate it. And then like again like if you ban DTMF tones from the greeting message that will help as well. Herald: Thank you Martin. I have never provided any telephone number to any platform and now thanks to you I know why. Warm applause for Martin Vigo please. M.V.: Thank you applause 35c3 postroll music subtitles created by c3subtitles.de in the year 2019. Join, and help us!