applause Karsten Nohl: Great to be back. Thank you very much, talking once again on mobile security, taking two very different angles, though, from what we talked about the last couple of years. This time we want to dive into the same topic that Tobias Engel just did, looking at insecurities that arise from the interconnect networks between different operators and we want to add another angle. And that is how YOU can start self defending yourself from the insecurities that many of your operators have left open for many years, including the new ones that Tobias and myself talk about. If you do watch this on a download, do go back and also watch Tobias's talk, it's well worth it and also covers a lot of the basics that I'm just going to skip over now for the sake of time. Great talk, by the way. Thank you Tobias. So aside from. applause Aside from those SS7 based attacks, we want to talk about 3G insecurities, not too many of them, but severe as ever, as well as in the last chapter. Then a few tips, as well as a new tool to help you start self defending against these mobile attacks. Now, just briefly, then, what is the SS7 Network Tobias has already covered the basics. So just a quick definition from me. It's this network that different mobile operators are connected to, to exchange data among each other. For instance, text messages are sent over this network. So without SS7, you couldn't be using this ancient chatting technology SMS. Thank you SS7. But also more security relevant information is exchanged over SS7. For instance, if you're using your phone in another country, as many of you currently do, you still want this visiting network to be able to use encryption with your phone, but how is that network going to know the right encryption key? So this visiting network, the German network has to ask your home network for the correct encryption key and that goes over SS7. And you can already see if there's cryptographic information being exchanged, if the wrong people ask and still receive an answer, insecurities arise. More interesting from a security perspective, though, are messages that are exchanged within one network over SS7. So SS7 is often misunderstood as this technology that's used for worldwide exchange of information. The same network, though, is used inside an operator. So there's no need for interconnect. There's already SS7 flows going on between those different mobile switching centers, MSC. And each mobile switching center covers one area, let's say a city. So imagine a situation where you are. You're in a call and you're traversing from one area to another. You're crossing, let's say, your state boundary. So there's new MSC, doesn't know how to handle your call. It needs the decryption key for the already ongoing conversation. So there's another SS7 message that allows you to query for the key of a transaction that's currently going on. OK? And again, you can already see how if the wrong people send this type of message and they receive an answer, insecurities arise. The insecurity that that has most been talked about in recent years, again, up until Tobias's talk, was tracking. And tracking was often understood as: There's this evil message, the any time interrogation and The Washington Post focused a lot an article on just one message. And it's a it's really evil. It should not been I have been ever standardized. And whenever it's used, it's for evil purposes. There's no usefulness in this message. And Tobias quoted a number that I think The Washington Post found in a lot of marketing material, 70 percent of mobile networks respond to this message. Now, this is information from earlier this year. A lot of networks, very good news, have moved to to stop responding to anytime interrogation message. This evil spying message is not being responded to by, for instance, all German networks. You can't use this message in Germany anymore. However, this is a very retroactive approach to securing SS7 because there's a number of other messages that, consider them Gadgets, get you to the same place, take a phone number and take you all the way to somebody's location. And here's just a snapshot of of which messages you can use and Tobias went into a greater level of detail in how these different messages come together. So if anybody thinks that just barring anytime integration, you solved the tracking problem, they are wrong. But at the same time, it's not that SS7 is not secureable. It's just a much larger challenge that people consider currently to be. So you see how stringing together some of these messages get you to intermediate values that also shouldn't be public and then all the way to a cell ID. And up until all these messages or at least every path that takes you from left to right is blocked by a network, tracking to the same accuracy, to cell ID stays possible. Now, this is just one of many areas in which SS7 can become an issue. Here is 4 more, it's an intercept risk. If people can read your SMS text or listen to your calls, it's a denial of service risk. If people cut you off from phone connectivity for anywhere from an hour until the next location update or until your next reboot your phone, so you can really cut people off badly from it, from the phone network. This area of fraud that I don't think many people want to talk about publicly, certainly I don't. But there's many fraud risks in SS7 in which you can easily put charges on somebody else's bill, or more interestingly, you can remove limits on your own prepaid cards, basically run up infinite charges on prepaid cards and, you know, running up a lot of bills to a two to premium numbers, for instance. And then there's the risk of spamming, which from what I hear is already happening, SS7 based spam attacks. Now, for the sake of this talk, I want to focus on intercept, which I consider aside from tracking the most intrusive and the most relevant for us, just as a risk, they're more relevant for the network operators. And if they don't solve them, well, so be it, as long as they foot the bill for it. So intercept. And I want to go into three possible scenarios in which SS7 assisted intercept can happen. The first abuses the exact message, as we looked at in the introduction, these messages where different parts of networks ask each other for encryption information and it's a pretty straightforward attack. You record the airwaves. Around somebody in somebody's vicinity and you record somebody's encrypted transaction as part of that, right? So and 3G transaction, for instance, are pretty well secured, but they're not very hard to record. In fact, 3G is a little bit easier than 2G because it doesn't jump around all these frequencies. So you record, let's say, 3G data and you have a bunch of transactions. And all of them encrypted. And you can use this message over SS7 to decrypt them. It's called Send ID. And as a as I said on one of the earlier slides, it's supposed to be used when you're moving from one MFC into another MSC, but still within your own network so that the call doesn't get disrupted. It's not supposed to be used when when somebody foreign wants to query your phone, if they need a new encryption key, a new call needs to start anyway. There's no way to hand over a call from one operator to another operator without disruption. So this message is used only for internal purposes. However, out of the four German operator earlier this month, all four responded to this request coming from another country, another country that doesn't even border Germany. So there's no way to even conceptually think a call would be handed over. So four out of four. And that's not an anomaly. Most networks require an international response to an outside number when asked for the current decryption key. I'll show you a quick demo on this at the end of this chapter. But I first finish the enumeration of all the different possibilities in which 3G calls can be intercepted. The second one, the good old IMSI catchers, which we also wouldn't work on 3G. And I guess for the most part they don't unless SS7 comes to the help. So why don't they work without SS7? An IMSI catcher pretends to be a base station. And if it's 2G technology, the phone has no way of knowing the difference between the real base station and a fake base station. But then 3G, the 3G standard introduced what I call mutual authentication. So this time the base station has to prove to a phone that in fact it's legitimate and unless it does that, the phone won't connect. Now, this only solves part of the IMSI catcher problem. Just taken by the name even the catching is still possible, IMSI catching in the sense of creating a list of all the IMSIs in a location. Because there's certain chicken and egg problem. If you want me as a base station to authenticate to you, you first have to tell me who you are. There's no such thing as SSL or any type of public key on the mobile network. It's all symmetric key. So you first have to tell me which key to use and by that I know who you are. So IMSI catching is always possible. And that's why if you Google for 3G IMSI catcher, those things exist. But they aren't capable of recording phone calls or SMS because those then required a mutual authentication. They aren't capable of doing so unless they ask over SS7 for an authentication key. So IMSI catchers are back in the 3G world big time, unless we solve these SS7 problems, right? The third possibility of of intercept - this is probably the scariest because it can happen completely remotely - Boaster once enumerated so far, you have to be somewhere in the vicinity in the vicinity of somewhere. So the third possibility, I want to call the rerouting attacks and they work in both directions. Rerouting is the idea. And to be as touched on this, of taking… of taking somebodies phone calls and changing the destination number so that, in fact, you call somebody else unbeknownst to you, of course, as the victim. And this will expose for incoming calls and outgoing calls, but using very different methods. So it just kind of accidentally works in both directions. And this part, I just briefly want to demonstrate to BSN that coordinated on most of this. But this part, I guess we kind of misunderstood each other as we both showed us. I'll keep this very brief. And the point I want to get across is that, one, a single SS7 message is already a big intercept problem. Let's see. Connected here. Um, so I'll try not to make the same mistake as Tobias and try to cut off part of my number here. So 31C3 demo phone. So I'm calling a a phone that in fact, accidentally we left in. So … fuck Laughter and applause Ring-back tone starts So I am calling this number and I don't know if you can hear it, but it's ringing. And we did leave his phone back in Berlin accidentally. But for the sake of this demo, that makes no difference. So it's a it's a phone somewhere in Berlin. Nobody answers to. Here is another phone. Ring-back tone stops So if I if I register what they call a supplementary service to this number. And that's just fancy language for, for, for call forwarding, if I call this exact same number again. Ring-back tone starts Phone ringing also starts This phone is ringing. Applause Both ring-back and ring-tone stop Still applause Now, of course, to make this real intercept, I wouldn't forward it to a phone, I would forward it to a computer that then is smart enough to very quickly erase the call forwarding and call the original number and then connect it to so that the phone, the phone call actually goes to where it was supposed to go. Just I'm sitting in the middle and I'm receiving a copy of it. OK, so that's the idea in this direction, in the other direction, the exact same thing works as well. And Tobias already told you how these services that say, let me rewrite your phone number for you because you don't know how to dial a phone number when you're on vacation. Right. Those services can be set by anybody, at least on a lot of networks. And you can see how the exact same thing works there so that every time you dial a number that just move their own number in place of that number and then connect those two calls. So, as I said, I consider those to the scariest type of attacks because they were completely remotely you don't have to be in the radio vicinity of anybody. And surprisingly, this still works against a bunch of networks, even against those networks that move to solve some of the earlier issues. So networks [are] still very retroactive. So what do what do those mobile networks now have to do to to solve those issues? Well, as always, of course, the answer: It depends. It depends in this case on the tech type. Some of the techs can simply be blocked. Like the AnytimeInterrogation, that earlier this year they said 70% of the networks are vulnerable. Now in Germany it's zero. So something happened there. And the same is true for the for the first type of attack that I've shown. The passive intercept I said when we tested earlier this month for other four networks are vulnerable. Now it's down to two. So within two weeks, two networks put in a firewall rule that says this message has no purpose. Traversing our outside network boundary, just block it. The typical firewall is the same isn't possible for these other two types of attacks because those messages are actually useful. They do something, at least in certain circumstances. If you block the second type of query here to send authentication info, you couldn't be roaming in another country anymore. If you blocked a third one, you couldn't be changing your your voice mail forwarding from another country anymore. So these are needed. Still we couldn't, we can't accept that just anybody who asks over SS7 ... Phone ringing Nohl sighs You guys! Laughter Switched this off. We can't accept that just anybody who asks over SS7 receives an answer, at the very least we would expect networks to only answer to their friends on SS7, and that is their roaming partners. That's already a lot fewer companies and especially a lot fewer sketchy companies than everybody else on SS7. We would then want those networks to do some plausibility checking. Right. So this does phone in Berlin that just put a supplementary service on. The network operator knows the phone is in Berlin and I send us from the other end of the world. Still, they are not on it. Right. Any type of possibility checking what would clearly see that this is not possible for a phone to be in one country and for this user to want to change their voicemail setting from somewhere completely different. And then thirdly, networks need to limit the rate at which this happens. Those services that The Washington Post talked about is tracking services. These are large operations. They seem to be tracking thousands of people, constantly. This will show in logs, you don't allow some random network somewhere else in the world to constantly interrogate hundreds of your users, right? It's clearly abuse. Has any network move to put such sensible rules in? I'm not aware of it, but it's certainly the next step. And I'm not ready to give up on SS7 yet. I've heard one too many times that SS7 is an old technology built with no security in mind and we just can't fix it. The Internet also is an old technology built was not secured in mind, and we did fix it since the 90s, since when you connected to Windows 95 computer to the Internet, it got infected with the virus right away. We have moved to put in firewalls. We're not exposing our printer daemon and now file-sharing daemon on the entire Internet anymore for four billion people to connect to and the same as possible on SS7. Which is, we we're still in the nineties. Thank you. Applause Having said that though, let me show you what what happens if we don't do that, the fun part. So. We argued whether or not we wanted to show this as a live demo. You'll understand why we don't show it as a live demo. There is just too much stuff that could go wrong. But here's the setup. We start with just a phone number and we want to string together a couple of SS7 gadgets while also having this radio handy that can capture 3G information to capture yet more information that's not available over SS7. Right. So we start with a phone number and we send what's called an SRI-for-SM message, which gives us, if the network is configured answer, the IMSI and the MSI that the subscriber currently is connected for. Those two are used as parameters into another call. Called the PSI message, provide subscriber info. And then that call then gives us the Cell ID. This is just how you get more and more information with different gadgets. Now the Cell ID tells us where somebody is physically. So imagine we now move our radio to that location and we again send a PSI. We record the PSI. We set radio, not the PSI, what happens over the airways when we send the PSI and the phone gets paged. So when we send the PSI over SS7, the phone receives some information. Right. This radio plus a little bit GNU radio scripting gives us that information: Who has been paged during that short window of time that we that we recorded? Now when we record something on UMTS, we always record for different cells – they share frequencies. But you see that the one cell with the Cell ID came back over SS7 is included in our set. So we filter the data for that cell and we look for which IMSIs are included. And luckily for us, only one IMSI got paged within those few seconds on that cell. It's the same. Same. This is now the TMSI that belongs to this phone. This is information we can't get over SS7. But what you can do over SS7 with the TMSI is request a key, so it gets complicated. But so we have the decryption key now and the next time this phone receives something, unless it changes the key, in which case we can ask again for a new key. Next time this phone receives something. And what you don't see in the video is, somebody is now sending a text message to the phone. We can also record that right. Again, same radio, the one shown in the picture, now the phone that received a text message. And there's a few more steps. So the phone received a text message and we also, again, recorded the airwaves. We again run it through some GNU radio script. Now, was was UMTS everything? It is kind of complicated, so there's a different connection, of course, happening all at the same time, and then they'll get allocated to different channels. So now, in order to to decode this text message, we're going to find out which channel is used. So this command gives us the list of which which channels have been allocated. And we got to find a TMSI from earlier in one of these channel allocations. And Wireshark is a great help in this. We didn't have to do anything with Wireshark. I just knows all that 3G stuff right out of the box. So luckily, the first of these five connecting requests is the right one and scroll all the way down, there's then the parameters that say which channel this transaction happened on. So those two numbers, 15 and 48 is the channel. So we, we need to cell frequency, but we need those those two two numbers, that, that are the channel and the key, you know, this is only 64 bit. I'll discuss that a little later. And that's all we need to decrypt an SMS. And there it is. Applause Thank you. This still works today, but only against two out of the four German networks. Some of them move to to to stop some of these messages, of course, most importantly, this SI message that gives you the decryption key. But even if you block this message, just acquiring somebody's location can already be intrusive enough. All right. Moving on to 3G security or rather extending on 3G security since this already touched through 3G in a big way. You remember the good old days where where you could just intercept all phone calls was the Osmocon phone. Thank you, by the way, for that open source project that helped us so much over the years. And you combine that with the kraken software to decrypt the phone call. So with 20 year old vers of phone and the server you can listen to anybody's GSM calls as long as they're using the A5/1 cipher. Some networks recently moved into A5/3. So it doesn't work this way anymore. Now, how does this now compare to 3G security? As I've just shown, basically the same attacks are possible. Instead of the Osmocom phone, we use a programable radio, some more software, but again, very affordable 400 euros or something. And you combine that using instead of kraken SS7 queries. So unless we fix SS7, 3G is no more secure than 2G and neither is A5/3, the recent upgrade of GSM because those keys are again exposed over SS7. Now, some networks, you don't even need that second part, so they have bigger things to worry about and then SS7 attacks and our data set isn't all that large. Some of you provided measurements through through a software release last year. So thank you very much for that. And we have captures from maybe 20, 25 countries out of those five having to use no 3G encryption at all. Well, four countries. Five network operators. Right. Which I find shocking. Some of these even have encryption turned on on their GSM network and then forgot to turn it on or deliberately left it out because it's harder to intercept on the 3G variant. Right. So those networks, as I said, have much more, much more worrisome issues than SS7 attacks. And they really need to be called out. And we do that with an extension of a website that we've been maintaining for a couple of years, gsmmap, big update of gsmmap launched today with all the 3G measurements, we, we collected and you collected over the last couple of years. Now, some of you may have used gsmmap before. The idea as to to rank operators in the three categories. How hard is it to intercept phone calls and SMS? Is it easy to impersonate a person and then put charges on a bill, for instance, or receive the calls? How hard is it to track them? And as you see, over the last years, networks have improved their security, at least some, as always. God. And as you also see, these are the 2G networks, even the best secure 2G network. And in Germany anyway, in our opinion, is less secure than the worst secured 3G networks. These are for 3G networks, still we want networks to implement all security features. And as you saw before, some other countries don't have that luxury of all 3G secure networks reasonably secure. Not the first version of our metric is very crude and we want to improve upon this over time. But currently how we calculate the score is we'll give ninety percent of the points to anybody who switches on encryption. That's the main security feature and the remaining 10 percent you earn by changing the TMSI quickly. TMSI is what we needed for these SS7 attacks to work well. So if you keep changing it, it really confuses the that the person trying to to haunt you also this makes other types of attacks more difficult, will factor in a couple of more values as we collect more data. But this is it for now. So, yeah, big update on gsmmap. If you haven't checked it out, check out your country on gsmmap, read the country report. So does a six page or so report, auto generated, that explains what types of measurements we included into into these graphs and why we think they they constitute certain risks. Maybe forward it to to your network and say if you're not improving, I'm going to change, switch to another network. Now, not everything is on, on gsmmap yet because we don't have enough data. And there's one problem in particular that I want to start warning about, because I really think we're running into an issue here. And that is the lengths of encryption key you saw in the in the capture, in the video data that I showed that the key that came back over SS7 was actually only 64bit from this particular network. And the SIM card that was there was used in this attack, was bought that very same week. So we recorded this video last week. So it's the the most recent SIM card you can buy from this network. And still it only uses 64 bit. And that, in my view, is incompatible with what we have learned from from recent Snowden documents that the NSA in 2011, 2012 funded a project to break A5/3. This is a 64 bit cipher. And we had estimated at this very conference a year ago that you'd need about a million dollars to break A5/3. Now, they did it a little bit earlier. So Moore's Law, everything's more expensive and probably to have overhead, too. But they spend apparently four billion pounds. I don't know why pound, not dollars, but it may have been some GCHQ Corporation. So for four million pound a couple of years ago, you could already break 64 bit crypto and 64 bit is more prevalent in mobile networks than you would have thought when they upgraded the GSM networks to A5/3. They didn't actually upgraded it to UMTS security, as everybody claimed they did. They upgraded it to the cipher used in UMTS with a key half the size. When writing the A5/3 standards though, the people were smart enough to also put in the real UMTS cipher with full key size, they called it A5/4 and it has never been seen anywhere since. It's written in the standard. It was released the same day that A5/3 was released. Nobody has ever moved to implement that. So GSM for the time being is and will be vulnerable to anybody. It was a one million dollar machine in the basement. Certainly NSA, but more and more people as we move forward. And what costs a million dollars today, thanks to Moore's Law in a couple of years, anybody can break it on a computers like we today. Break the A5/1. If your network uses certain older SIM cards, differentiation years between a SIM card and a USIM as a UMTS SIM card. If your network only uses SIM cards, then even your 3G transactions are 64 bit encrypted. So there is no way to generate more entropy. You could query for two keys, I guess, but they weren't smart enough to do that. So 64 bit encryption for UMTS and that's just not good enough. And as I said, the network that we did the demo with we were surprised to see a 64 bit key. We went back in our database of SIM cards. We found a lot of SIM cards that have this problem. We want to add this to gsmmap, but we don't want to be unfair just because we see one very old SIM card in the network. We don't want to give them a low score versus somebody else, where we only see a new card. So we need lots and lots of data. Help us collect those data and we'll make it public. Now, that's one reason why we stay on this ball and progress the research. The other main reason, and this is really what keeps us awake at night is this question of how can we get out of the mess. We've been producing more and more problems. I should not say produce, we make you aware of more and more problems over the years and we always criticize that at least many networks do not respond to those. So we have to stockpile ever growing stockpile of mobile security issues and nobody seems to be addressing. And all we do is wait for our networks to do something eventually. Now waiting's over for me, at least I'm impatient. I want to do something now and I want to address all these issues all at once. Those issues that we talked about for several years now, including the SIM card attacks from last year, silent SMS based tracking the SMS, the SS7 abuse discussed today, IMSI Catcher Vulnerabilities and insufficiently configured networks, 2G as well as 3G. All of these problems have one thing in common. Your phone technically knows that these attacks are happening and your phone technically knows that a network is configured insecurely. But unfortunately it's buried very deep inside the phone. It's buried inside the baseband. So as much as you can program Android, you don't get access to that information. At least so we saw it and then we set out and just took the better part of this year. We wanted to dig the information out from these phones. It's somewhere in there. There must be some way to hack it out of it. And we found debug possibilities for Qualcomm chipsets, just one vendor, but extremely popular. Right now. There seem to be in every LTE phone and in a bunch of other phones. And we found, we found ways of producing exactly all the data on the right hand side to make it accessible through an Android application. And we also wrote an application for you. So: Release today. Applause Thank you, released today, SnoopSnitch under GPL. A tool that collects all the baseband information mostly to keep it on the phone and run some analysis on it, warn you about, as I said, SIM card attacks, but also those SS7 attacks that Tobias and I talked about today. How do you take those those attacks? Well, by the pagings, I showed you in the video that every time we send certain queries to the phone, to, over SS7, that the phone actually also receives information useful for the attacker. Also useful for the defender. If those empty pagings, we call them, are received by the phone, strong evidence that somebody is messing with you over SS7. Right. So it collects all that information and it produces warnings. You can also upload information issues, so you choose. It's optional of course, it runs, as I said, on a bunch of Android phones that are currently popular. It requires a somewhat recent Android version we haven't tested was Android 5 yet, but I don't see why it wouldn't work, though. We just have to put the time and your phone needs to be routed. So we have access to a certain interface that otherwise is not accessible. And it needs of course, a Qualcomm chipset, which, as you see by this list, is in most current flagship phones. It's on Google Play right now. So download it if you're interested. Now, how does this tool work? One example only, of course, right, read the source code if you if you want to know the rest. If you, for instance, IMSI catcher detection. There have been a bunch of tools so far to do IMSI catcher detection. The one we released a couple of years ago was called CatcherCatcher, but it had two limitations. One practical, one more bound to experience. The practical limitation was that it ran on Osmocom phones and Osmocom phones can't do most phone functionality. So always your second phone? And it had to be connected to a computer. So very unlikely that you carried this around all the time. And we wanted to move it onto a real phone that you can use onto your phone. Right? I think we succeeded in that. The second limitation was that we really didn't know how IMSI catchers behaved or we also didn't know how real networks behaved. And thanks to all the data on gsmmap, we think we have a much better understanding now of all the weird corner cases, how real networks behave and created a much better ruleset for for an Android based catcher catcher tool now. And the rules go in two categories. One is the configuration of the of these different cells. For instance, the lack of encryption when, you know, from the gsmmap database that this network does usually support encryption, that's a big red flag. Also certain other configurations. So that's a configuration of the network, the adjusted behavior and the IMSI catcher wants to get information out from you at the very least, the IMSI, of course, it's in the name. Right. So that suspicious behavior now, none of these things taken by themselves did allow you to detect an IMSI catcher. So we compute score over these different events, doing stream analysis on everything that happens on your phone and eventually then come out with a warning. If the score crosses a certain threshold, there's a bunch more we would have wanted to include that's even on a Qualcomm chipset in it's debug mode not available. So this is still ongoing work as these chipsets progress and may give us more information in the future. Now, if you do find alerts, let's call them alarms on your phone. We'd be grateful if you could share them. Now, as I said, this is optional, right? You get you get the alerts shown in shown in your little tool and then you can choose to upload whichever ones you think should be shared if we get enough of them and and think that there's really hot spots of of of abuse, of course, we'll try to make that transparent, perhaps even put little dots on the GSM website so people know where abuse could be happening around demonstrations, around embassies, wherever. Applause You can also actively choose to submit data by by running an active test now usually the phone looks at everything that you produce, your phone calls, your SMS that's always stored on the phone. There's no way to upload that. And you compute a score for how secure your network is using the exact same metrics that we use on gsmmap. So that's all ported to the phone now. But if you feel like the score on gsmmap is heavily outdated, click this button. It runs some benign tests, has nothing to do with your transactions. I guess your location where you're currently connected would be included in the data and it uploads it to gsmmap. So that becomes better and better. And we can spot more networks that, for instance, like any encryption at all. Yeah, so what's what what are you what I like you to do, I think you should do to better protect yourself from mobile abuse, of course you could keep waiting for your mobile networks to fix all these issues, which I must say more recently, more networks have moved to fix issues, but still not the majority. And no network has even started to address the majority of issues. So it's just scratching the surface. So what I'd rather have you do is start defending yourself. Check out gsmmap, see if you are on a network that generally protects things like encryption. You saw the networks that lack encryption. Don't use those. And if you really choose to self defense, download, SnoopSnitch, this new tool and actively look out for abuse, for Silent SMS, binary SMS that you receive, for empty pagings, for IMSI catcher evidence and help us grow this database of abuse. Right. Also help us grow the tool base that we use. This is released open source and we put in a lot of work to make the data accessible. But now it is accessible, right? Just take it as a library and go wild with it. Do whatever you always wanted to do with raw baseband data on 2G, 3G, 4G. I am very much looking forward to your contributions to this and all that's left for me to say is thank you very much. applause Herald: Thank you, Karsten, then we will beginning with the Q&A, please, for everybody that will be asking questions, please line up on the microphones in the room and for people that exit the room, please do it with no noise and quickly. Karsten: Now, before getting into the question, let me give you one reason to actually do leave now. There's a workshop happening right now or in a few minutes that will explain how this tool works and what it can all do. We'll have an IMSI catcher there a day or so. You can tell us how that feels like being connected to an IMSI catcher. It's happening in room C, which is when you exit here one floor down and to this end. Herald: And additional information, the workshop that's Karsten says start at nineteen forty five. K: And now to your questions. distant noise K: Sure. Herald: OK, microphone number two and please, before before we before you can start number two, please do it with no noise that we hear the question from the audience. OK, number two, please. Mic 2: Thank you. Can you quickly say a few words about why it wouldn't work on custom ROMs? Because we could just install it into cyanogen phones and apparently installed and it seems to work. K: Oh, OK. So the way I understood custom ROMs is that they first remove a bunch of stuff from the phone and then put a bunch of stuff on it. Part of what we need are these proprietary Qualcomm libraries and at least on the phones where we tried cyanogen mod and what they are being removed. So if cyanogen mod could stop doing that, it would work beautifully. It's not that we need anything additional. We just need less to be deleted. Mic 2: OK, thank you. Herald: OK. Microphone number …, will you ask. OK, are there some questions from the IRC? K: I think we have a bunch of questions. Signal Angel: Actually, there is five questions, so I will just ask one or two for starting. The first one is, can all these shown attacks that you proved on your speech be mitigated by… by higher protocols levels, like encrypted VoIP or TextSecure, things like that? And what will be the residual risks? K: Mm, yeah. A good question. So how much can you protect yourself by using the mobile network less on using it as a dumb pipe, I guess is the question, what if you use just apps to call and send text? Well, obviously your calls and texts won't be intercepted anymore if they are encrypted one more time in a way that's not breakable. However, this does not solve the location tracking. It does not solve the fraud. It does not solve the denial of service. It does not solve the spamming. So you are tied to a mobile network and it has a lot of control over you, your location and your phone bill. None of that is going to go away. Herald: Another question from the IRC, one. Signal Angel: Yeah, um, the second one is: Wouldn't it be easier to design from scratch a new mobile mobile network than trying to find all flaws from actual networks, which is an endless task? K: Or I don't know where you would even start designing everything from scratch completely? The closest that I can think of designing the mobile network from scratch is LTE in the name of long term evolution. It really wants to change everything, but gives it a couple of years but as Tobias pointed out, those issues we pointed out today, they are again included in LTE. Diameter is the interconnect protocol. So we already missed a chance to to remove much of this issues by just upgrade. We'll have to fix it through firewalls and monitoring like we never got to update the Internet. Herald: OK, microphone number four, please. Mic 4: Yet just a short thing. Could you just provide a list of those libraries you need from the stock images? So I think it's pretty easy to copy them to this cyanogen mod images. K: Ok Mic 4: OK, and if the app is open source, maybe you can put it on fdroid? K: Oh absolutely. Yes. Thank you. applause Herald: The microphone number two, please. Mic 2: Got two questions, if I understood correctly, you need to be inside the operator network to actually perform those SS7 queries, right? K: Um, well, I would I would like for this to be the case. But currently, does anybody in the world connected to SS7 can send his queries. Mic 2: OK, so my question is that what was your hook point for actually doing this test? K: I think I'll quote Tobias here by saying I would rather not say anything about that. Mic 2: OK, so the second question is about the case you mentioned it's if I am not mistaken, is the session key. Right? It's and it should involve that nonce value, right? K: Yeah. Mic 2: So if it is, it already has the nonce value. So in order the attack to work, we also need to intercept the initial messages, the nonce exchange between the target and the basis station. Is that correct? K: No, the nonce is… as as they are. So the SIM card knows which key to produce. Yes. But it helps the phone to find the right encryption key. We are not the phone. We don't have the SIM card. Right. If you just give us the encryption key, we don't need the nonce. Mic 2: Yes. So what you're saying is that the query you're sending there, it actually sends you not only the encryption key, but also the nonce that is required.. K: It doesn't send us the nonce and we don't need the nonce. We can take that offline now, explain how everything works. Thank you. Herald: To microphone number three, please. Mic 3: First of all, thank you for a very good presentation and very impressive work you've done here. applause K: Thank you. Mic 3: The question I have might be a little naive, but have you also, besides taking a look at this closing this whole issue technically wise, also been taking a look into how what measures can be taken legally, at least in Germany and some countries in Europe now that we have disclosed that basically certain rules / laws have not been fulfilled, that we can enforce the operators to implement this stuff on legal ways? K: We have not looked into it. Of course, we consider the possibility as soon as somebody has an overview of where these attacks happen. And that seems to be the issue right now. There's zero attack transparency. Nobody is looking for these issues. And partly that's to the to their own disbenefit, because as soon as they do look for this issue, some of these attack patterns are very easy to stop, as I said, two German networks, mitigated them within two weeks. And these issues had been open for 20 years. Had they ever looked into their own data, that would have seen this going on. So I'm not very confident that anybody in Germany at least has an overview of where abuse would come from. And as soon as it does, I don't think there's much point in litigating. Let's just stop the possibility of abuse. Right, instead of complaining about it happening. But I'm with you. If there's corner cases in which abuse just can't be stopped, let's fight it legally, of course. Right. And if all of you contribute information through SnoopSearch, does the empty pagings, if we can find patterns of abuse, of course, we'll aggregate them and try to move against them. Herald: OK, microphone number four, please. Mic 4: You said you can buy your way into the SS7 Network, but how easy is it actually to get your access? And what do you estimate: How many players are there in the network? Can you give any estimation? K: I have absolutely no idea. I know that there's some 800 companies who who are legally allowed to access SS7 and then those, of course, have subcontractors, legal and illegal, and some people who bribe them. Yet other people who hack their systems or the systems of the subcontractors, it's very hard to estimate. No idea. But definitely too many to trust all of them. Mic 4: And would it be possible for me to get access to this without any operator stuff or. I don't want to operate a phone network, but I want to have access because I want to provide a service, some service? K: Well, I wish the answer was no, but of course, right of to be as an I and a bunch of other people can get access. You should be able to get that too. But I'm not going to tell you how. laughter and applause Herald: Yet another question from the IRC. Signal Angel: We're about nine questions, so no problem for me. First one, what about Windows phones, jail breaked iPhones, or something like this will the app in the end [be] on this phones? K: Our app doesn't run on anything other than Android, but the chipsets are, of course, the same. So if you can speak to a chipset through a jail broken iPhone, for instance, you could create a similar application. We just wanted to target the biggest population of phones, and that seems to be Android phones. Herald: Then number two, please. Mic 2: One further thought on self-defense as self-defense has don't has to be proportionate, I think, and identities are not secure in the digital sphere. How about developing some proactive, as we heard the word defense tools? K: Proactive as in hack the networks, until they have no chance but to fix? Mic 2: That's what you understood, but. But, I support that. laughter K: I'm not going to say that I dislike the idea. But you won't see me here next year explaining how I did it. Mic 2: Thank you. Herald: Microphone number three, please. OK. When did you check the other two German networks didn't fix the identifier and the issue. K. Which network do you work for? Mic 2: I'm Holger. We talked last week. K: Yeah. So yeah. Maybe you fixed it too. We didn't, we didn't check. Mic 2: We fixed it within 24 hour, 24 hours after our call. K: Wow. OK. Mic 2: On both networks. applause Thank you. Better late than never. Thank you. Mic 2: That's right. K: OK, so that's three out of four now, that fix one out of 100 problems. Mic 2: No, it's… I know that's why we don't go to the press and don't tell that SS7 is fixed and we know we still have problems also. It's all four. I work for Telefonica, which is O2 and eplus. K: Oh yeah. Well, congratulations. Sorry. Sorry for spoiling your Christmas. laughter Herald: Microphone number two, please. Mic 2: I'd like to know why these empty pagings occur in the context of the location tracking, I thought, as soon as the phone registers in the network, the base station, which is this connected to, is known in the network anyway. Is that the case? K: That's a very good question. And let me let me go back to one earlier slide to to explain that, one second, so that the empty pagings do not occure when you send these creepy AnytimeInterrogation messages. They are just there for spying and there's no way to page the customer. But since this got blocked and Tobias went into great level of detail explaining this, you need a couple of other messages to now track some of this location and these messages when meant for location tracking them and ment for other purposes. For instance, as I provide subscriber info that however you reach it is always the last message you need. This does do a paging and then to provide subscriber info really makes no sense unless you send something afterwards also, deliver an SMS connect to call or whatever. So the paging is already sent in anticipation that an SMS will come or that the call will come. But if you're only the creepy guy tracking it, they're going to send it SMS and that's where the empty paging comes from. Mic 2: OK, but still also in these cases where something follows the paging, isn't it a type of double checking whether it's really there or I mean, the location info itself should already be present and the network, isn't it? K: Yeah, yeah. It just reconfirms that the subscriber is really there. So it's basically saying: Somebody you just interrogated your location because they want to send you something. Let's check that you're really still there because otherwise we'll tell them something wrong. But Tobias do you want to comment on that. Tobias: Yeah. OK, so the empty paging is not anticipation or something that's coming after. It's to get the current cell that you are located at, because when you are moving around in your location area and the area that is covered by the switching center that you're currently being served by, your phone doesn't necessarily contact the base station. So it could be that that the networks last position of you is somewhere you received an SMS or text or call, and then you moved to a completely different area if your phone didn't have network contact in the meantime, the network would still only know the last point of contact. So that's why the why the empty paging happens so that the that the network knows the base station that's actually currently closest to you. That's also why the law enforcement uses a lot of Silent SMS so that that they can get the last position in the network. And it's also an option if you send provide subscriber information, you can just send it and get back the last known position without a paging or you can set the current location flag and provide subscriber information. And only then the subscriber gets paged and you will receive the current location. K: And that's that's one good example for how SS7, which is supposed to be so insecure we can never fix it, can easily be fixed. There's an option that says we're using this as normal feature that's absolutely needed. And we have this creepy extension to also ask for the location. And some networks choose to not answer that. The answer was zero zero zero zero and nothing broke. Right. So you can just ignore the insecure parts of SS7 and do whatever you think is right. And for the most part, it continues to work. But I think we're well beyond answering your question now right? Mic 2: No, but from your answers. Thank you very much. But another question arises, because if it's actually to locate your phone and to find out which cell you're actually in, then it implies that it's not only one base station that since the paging call, but a whole bunch of base stations. Do you know something about the algorithm? I mean, how many around the last known location are paging everybody nationwide or how does.. K: Everybody can implement this as they wish? And I don't have much insights into how 3G does it, but in 2G typically is: There's one paging send in the last cell that saw you. You don't respond. It's send in a larger area. You don't respond. It's sent for the whole location area. And then some networks, you don't respond. They send it in the entire country. But that's rare. Right? Mic 2: Thank you very much. Herald: Okay. Questions from the IRC? Signal Angel: Did SnoopSnitch allow you to reveal any kind of attack in countries. Not special name in mind. K: Does it allow you to detect attacks in countries? Yeah, yeah, some kind of Tapsell. I think the answer is yes. Its whole purpose is to detect attacks. And it also works in countries… laughter Herald: Did you succeed in detecting attacks. K: Did we succeed in detecting. Yes, we did. And if you go down to the Saal C, Room C, you can see how it's currently people are being attacked and currently they detect that. Ok Herald: OK microphone number five, please. Mic 5: Yes, thanks, it's going back to SS7 basics. Can you quickly explain how SS7 is implemented? Is this a VPN on the public Internet through the providers? What's the technical reality of transport? K: That's a very good question. Of course, that's a very good question. And I only have half of the information, too. I keep learning. But so it seems that it was implemented initially as a network between Western European telcos and their run cables, dedicated cables for SS7. SIGTRAN they called this and then a couple more networks connected to it. And each of them had to run the cable to one of the other telcos. But eventually they changed that and then introduced what I call routing providers. So telcos are not connected to each other usually, but through a routing provider like on the Internet and those routing providers, they typically don't run a cable to your house anymore. If you are a new telco, they give you a VPN over the Internet. So it's diverse. I'm sure there's still some dedicated lines between Germany and France, say, and there's some others connecting and these big clouds that are routing providers. And it's actually really difficult to get your address routed everywhere in the world. So even if you connect to SS7, all you're connected to is one routing provider and that routing provider knows that you own these addresses. Now it's up to you to convince every other of the big seven or nine, depending on how you count routing providers that you are that guy with those addresses. So the BGP equivalent of SS7 is to get nine roaming agreements signed with people on these other nine operators and then fax those roaming agreements to everybody else involved. So they type it into your computer, into their computers, very manual and very hard to grow the network. But for the most part, it doesn't change, of course- Mic 5: So that the low level transport is not really an attack surface from the public Internet. K: It can be the low level transport can be an attack surface if people just stupidly leave open their local networks. But it's rare. It's much more common, speaking about our talk next year, hopefully on the other interconnect networks, there's one interconnect network for data roaming. It's called GRX. And since everything is IP anyway on data roaming, people sometimes do leave it out on the Internet or just do it unencrypted over the Internet. And it does seem to become more popular also with the SS7 replacement Diameter, which again is pure IP. So there's no dedicated thing that you first have to encapsulate in a VPN before you can route it over the Internet. You can run Diameter over the open Internet if you want. It's stupid, but people seem to do it anyway. Herald: OK, the microphone number six, please. Mic 6: OK, my question is, if you could comment why these message were put in the protocol at the first place, it they are so easy to block and to fix. And the other question is, if all the other problems that you pointed out are as easy to fix for the network operators. K: So I don't have an answer to your first question. Why do you put a tracking message in the standard and then call it AnytimeInterrogation, gosh, like that invokes feelings for me, interrogation room and all. I mean, this is spy stuff, right? And there's no practical, purposeful but. Right. Who wrote SS7 standard? Western European governments being afraid of the Russians, of their own citizens, who knows? Right. I don't know why they put every single message in, though. So your second question was what again? Mic 6: If the other vulnerabilities are as easy as to fix? Or just blocking messages. K: No they're not. And I tried to point that out in one of the slides that… that AnytimeInterrogation can be fixed, as can, for instance, as does SendIdentification message, right. You just block that has no purpose, routing this internationally. But the other queries on this page, at least you need those internationally, at least to enable roaming. So the best you can do is, as I said, first block these queries from anybody who's not your roaming partner, right? Don't respond to those people and then do some plausibility checking, secondly, make sure that if a subscriber is actually in your own network, that you don't honor requests from another country. Right. And that should remove most of the issues because most abuse comes from other countries. It's just more likely if there's 800 parties connected to this network that the one doing the abuse is not yours. Good question. Thanks. Subtitles created by c3subtitles.de in the year 2021. Join, and help us!