Karsten Nohl: Mobile self-defense

applause

Karsten Nohl: Great to be back. Thank you
very much, talking once again on mobile

security, taking two very different
angles, though, from what we talked about

the last couple of years. This time we want
to dive into the same topic that Tobias

Engel just did, looking at insecurities
that arise from the interconnect networks

between different operators and we want to
add another angle. And that is how YOU

can start self defending yourself from the
insecurities that many of your operators

have left open for many years, including
the new ones that Tobias and myself talk

about. If you do watch this on a download,
do go back and also watch Tobias's talk,

it's well worth it and also covers a lot
of the basics that I'm just going to skip

over now for the sake of time. Great talk,
by the way. Thank you Tobias. So aside

from. applause Aside from those SS7
based attacks, we want to talk about 3G

insecurities, not too many of them, but
severe as ever, as well as in the last

chapter. Then a few tips, as well as a new
tool to help you start self defending

against these mobile attacks. Now, just
briefly, then, what is the SS7 Network

Tobias has already covered the basics. So
just a quick definition from me. It's this

network that different mobile operators
are connected to, to exchange data among

each other. For instance, text messages
are sent over this network. So without SS7,

you couldn't be using this ancient chatting
technology SMS. Thank you SS7. But also

more security relevant information is
exchanged over SS7. For instance, if you're

using your phone in another country, as
many of you currently do, you still want

this visiting network to be able to use
encryption with your phone, but how is that

network going to know the right encryption
key? So this visiting network, the German

network has to ask your home network for
the correct encryption key and that goes

over SS7. And you can already see if
there's cryptographic information being

exchanged, if the wrong people ask and
still receive an answer, insecurities

arise. More interesting from a security
perspective, though, are messages that are

exchanged within one network over SS7.
So SS7 is often misunderstood as this

technology that's used for worldwide
exchange of information. The same network,

though, is used inside an operator. So
there's no need for interconnect. There's

already SS7 flows going on between those
different mobile switching centers, MSC.

And each mobile switching center covers
one area, let's say a city. So imagine a

situation where you are. You're in a call
and you're traversing from one area to

another. You're crossing, let's say, your
state boundary. So there's new MSC,

doesn't know how to handle your call. It
needs the decryption key for the already

ongoing conversation. So there's another
SS7 message that allows you to query for

the key of a transaction that's currently
going on. OK? And again, you can already

see how if the wrong people send this type
of message and they receive an answer,

insecurities arise. The insecurity that
that has most been talked about in recent

years, again, up until Tobias's talk, was
tracking. And tracking was often understood

as: There's this evil message, the any time
interrogation and The Washington Post

focused a lot an article on just one
message. And it's a it's really evil. It

should not been I have been ever
standardized. And whenever it's used, it's

for evil purposes. There's no
usefulness in this message. And Tobias

quoted a number that I think The
Washington Post found in a lot of

marketing material, 70 percent of mobile
networks respond to this message. Now,

this is information from earlier this year.
A lot of networks, very good news, have

moved to to stop responding to anytime
interrogation message. This evil spying

message is not being responded to by, for
instance, all German networks. You can't

use this message in Germany anymore.
However, this is a very retroactive

approach to securing SS7 because there's a
number of other messages that, consider them

Gadgets, get you to the same place, take a
phone number and take you all the way to

somebody's location. And here's just a
snapshot of of which messages you can use

and Tobias went into a greater level of
detail in how these different messages

come together. So if anybody thinks that
just barring anytime integration, you

solved the tracking problem, they are wrong.
But at the same time, it's not that SS7 is

not secureable. It's just a much larger
challenge that people consider currently

to be. So you see how stringing
together some of these messages get you to

intermediate values that also shouldn't be
public and then all the way to a cell ID.

And up until all these messages or at
least every path that takes you from left

to right is blocked by a network, tracking
to the same accuracy, to cell ID stays

possible. Now, this is just one of many
areas in which SS7 can become an issue.

Here is 4 more, it's an intercept risk.
If people can read your SMS text or listen

to your calls, it's a denial of service
risk. If people cut you off from

phone connectivity for anywhere from an
hour until the next location update or

until your next reboot your phone, so you
can really cut people off badly from it,

from the phone network. This area of fraud
that I don't think many people want to

talk about publicly, certainly I don't.
But there's many fraud risks in SS7

in which you can easily put charges
on somebody else's bill, or more

interestingly, you can remove limits on
your own prepaid cards, basically run up

infinite charges on prepaid cards and, you
know, running up a lot of bills to a two

to premium numbers, for instance. And then
there's the risk of spamming, which from

what I hear is already happening, SS7
based spam attacks. Now, for the sake of

this talk, I want to focus on intercept,
which I consider aside from tracking the

most intrusive and the most relevant for
us, just as a risk, they're more relevant

for the network operators. And if they
don't solve them, well, so be it, as long

as they foot the bill for it. So
intercept. And I want to go into three

possible scenarios in which SS7 assisted
intercept can happen. The first abuses

the exact message, as we looked at in the
introduction, these messages where

different parts of networks ask each other
for encryption information and it's a

pretty straightforward attack. You record
the airwaves. Around somebody in

somebody's vicinity and you record
somebody's encrypted transaction as part of

that, right? So and 3G transaction, for
instance, are pretty well secured, but

they're not very hard to record. In fact,
3G is a little bit easier than 2G because

it doesn't jump around all these
frequencies. So you record, let's say, 3G

data and you have a bunch of transactions.
And all of them encrypted. And you can use

this message over SS7 to decrypt them.
It's called Send ID. And as a as I said on

one of the earlier slides, it's supposed
to be used when you're moving from one MFC

into another MSC, but still within your
own network so that the call doesn't get

disrupted. It's not supposed to be used
when when somebody foreign wants to

query your phone, if they need a new
encryption key, a new call needs to start

anyway. There's no way to hand over a call
from one operator to another operator

without disruption. So this message is
used only for internal purposes. However,

out of the four German operator earlier
this month, all four responded to this

request coming from another country,
another country that doesn't even border

Germany. So there's no way to even
conceptually think a call would be handed

over. So four out of four. And that's not
an anomaly. Most networks require an

international response to an
outside number when asked for the current

decryption key. I'll show you a quick demo
on this at the end of this chapter.

But I first finish the enumeration of
all the different possibilities in which

3G calls can be intercepted. The second
one, the good old IMSI catchers, which we

also wouldn't work on 3G. And I guess for
the most part they don't unless SS7

comes to the help. So why don't they
work without SS7? An IMSI catcher

pretends to be a base station. And if
it's 2G technology, the phone has no way

of knowing the difference between the real
base station and a fake base station. But

then 3G, the 3G standard introduced what I
call mutual authentication. So this time

the base station has to prove to a phone
that in fact it's legitimate and unless it

does that, the phone won't connect. Now,
this only solves part of the IMSI catcher

problem. Just taken by the name even the
catching is still possible, IMSI catching

in the sense of creating a list of all the
IMSIs in a location. Because there's

certain chicken and egg problem.
If you want me as a base station to

authenticate to you, you first have to
tell me who you are. There's no such thing

as SSL or any type of public key on the
mobile network. It's all symmetric key. So

you first have to tell me which key to use
and by that I know who you are. So IMSI

catching is always possible. And that's why
if you Google for 3G IMSI catcher, those

things exist. But they aren't capable of
recording phone calls or SMS because those

then required a mutual authentication. They
aren't capable of doing so unless they ask

over SS7 for an authentication key. So
IMSI catchers are back in the 3G world

big time, unless we solve these SS7
problems, right? The third possibility of

of intercept - this is probably the
scariest because it can happen completely

remotely - Boaster once enumerated so far,
you have to be somewhere in the vicinity

in the vicinity of somewhere. So the third
possibility, I want to call the rerouting

attacks and they work in both directions.
Rerouting is the idea. And to be as

touched on this, of taking… of taking
somebodies phone calls and changing

the destination number so that, in fact,
you call somebody else unbeknownst to you,

of course, as the victim. And this will
expose for incoming calls and outgoing

calls, but using very different methods.
So it just kind of accidentally works in

both directions. And this part, I just
briefly want to demonstrate to BSN that

coordinated on most of this. But this
part, I guess we kind of misunderstood

each other as we both showed us. I'll
keep this very brief. And the point I want

to get across is that, one, a single SS7
message is already a big intercept

problem. Let's see. Connected here. Um, so
I'll try not to make the same mistake as

Tobias and try to cut off part of my
number here. So 31C3 demo phone.

So I'm calling a a phone that in fact,
accidentally we left in. So … fuck

Laughter and applause
Ring-back tone starts

So I am calling this number and I don't
know if you can hear it, but it's ringing.

And we did leave his phone back in Berlin
accidentally. But for the sake of this

demo, that makes no difference. So it's a
it's a phone somewhere in Berlin. Nobody

answers to. Here is another phone.

Ring-back tone stops

So if I if I register what they call a

supplementary service to this number. And
that's just fancy language for, for, for

call forwarding, if I call this exact same
number again.

Ring-back tone starts

Phone ringing also starts

This phone is ringing.

Applause

Both ring-back and ring-tone stop

Still applause

Now, of course, to make this real
intercept, I wouldn't forward it to a

phone, I would forward it to a computer
that then is smart enough to very quickly

erase the call forwarding and call the
original number and then connect it to so

that the phone, the phone call actually
goes to where it was supposed to go. Just

I'm sitting in the middle and I'm
receiving a copy of it. OK, so that's the

idea in this direction, in the other
direction, the exact same thing works as

well. And Tobias already told you how
these services that say, let me rewrite

your phone number for you because you
don't know how to dial a phone number when

you're on vacation. Right. Those services
can be set by anybody, at least on a lot

of networks. And you can see how the exact
same thing works there so that every time

you dial a number that just move their own
number in place of that number and then

connect those two calls. So, as I said, I
consider those to the scariest type of

attacks because they were completely
remotely you don't have to be in the radio

vicinity of anybody. And surprisingly,
this still works against a bunch of

networks, even against those networks that
move to solve some of the earlier issues.

So networks [are] still very retroactive.
So what do what do those mobile networks

now have to do to to solve those issues?
Well, as always, of course, the answer:

It depends. It depends in this case on the
tech type. Some of the techs can simply be

blocked. Like the AnytimeInterrogation,
that earlier this year they said 70% of

the networks are vulnerable. Now in
Germany it's zero. So something happened

there. And the same is true for the for
the first type of attack that I've shown.

The passive intercept I said when we
tested earlier this month for other four

networks are vulnerable. Now it's down to
two. So within two weeks, two networks put

in a firewall rule that says this message
has no purpose. Traversing our outside

network boundary, just block it. The
typical firewall is the same isn't

possible for these other two types of
attacks because those messages are

actually useful. They do something, at
least in certain circumstances. If you

block the second type of query here to
send authentication info, you couldn't be

roaming in another country anymore. If you
blocked a third one, you couldn't be

changing your your voice mail forwarding
from another country anymore. So these are

needed. Still we couldn't, we can't accept
that just anybody who asks over SS7 ...

Phone ringing
Nohl sighs

You guys!
Laughter

Switched this off. We can't accept
that just anybody who asks over SS7

receives an answer, at the very least
we would expect networks to only answer to

their friends on SS7, and
that is their roaming partners. That's

already a lot fewer companies and
especially a lot fewer sketchy companies

than everybody else on SS7. We would
then want those networks to do some

plausibility checking. Right. So this does
phone in Berlin that just put a

supplementary service on. The network
operator knows the phone is in Berlin and

I send us from the other end of the world.
Still, they are not on it. Right. Any type

of possibility checking what would clearly
see that this is not possible for a phone

to be in one country and for this user to
want to change their voicemail setting

from somewhere completely different. And
then thirdly, networks need to limit the

rate at which this happens. Those services
that The Washington Post talked about is

tracking services. These are large
operations. They seem to be tracking

thousands of people, constantly. This will
show in logs, you don't allow some random

network somewhere else in the world to
constantly interrogate hundreds of your

users, right? It's clearly abuse. Has any
network move to put such sensible rules

in? I'm not aware of it, but it's
certainly the next step. And I'm not ready

to give up on SS7 yet. I've heard one too
many times that SS7 is an old technology

built with no security in mind and we just
can't fix it. The Internet also is an old

technology built was not secured in mind,
and we did fix it since the 90s, since

when you connected to Windows 95 computer
to the Internet, it got infected with the

virus right away. We have moved to put in
firewalls. We're not exposing our printer

daemon and now file-sharing daemon on the
entire Internet anymore for four billion

people to connect to and the same as
possible on SS7. Which is, we we're still

in the nineties. Thank you.
Applause

Having said that though, let me show you
what what happens if we don't do that,

the fun part. So. We argued whether or not
we wanted to show this as a live demo.

You'll understand why we don't show it as
a live demo. There is just too much stuff

that could go wrong. But here's the setup.
We start with just a phone number

and we want to string together a couple of
SS7 gadgets while also having this radio

handy that can capture 3G information to
capture yet more information that's not

available over SS7. Right. So we start
with a phone number and we send what's

called an SRI-for-SM message, which gives
us, if the network is configured answer,

the IMSI and the MSI that the subscriber
currently is connected for. Those two are

used as parameters into another call.
Called the PSI message, provide

subscriber info. And then that call then
gives us the Cell ID. This is just how

you get more and more information with
different gadgets. Now the Cell ID tells

us where somebody is physically. So imagine
we now move our radio to that

location and we again send a PSI. We record
the PSI. We set radio, not the PSI, what

happens over the airways when we send the
PSI and the phone gets paged. So when we

send the PSI over SS7, the phone receives
some information. Right. This radio plus a

little bit GNU radio scripting gives us
that information: Who has been paged

during that short window of time that we
that we recorded? Now when we record

something on UMTS, we always record for
different cells – they share frequencies.

But you see that the one cell with the
Cell ID came back over SS7 is included

in our set. So we filter the data for
that cell and we look for which IMSIs are

included. And luckily for us, only one
IMSI got paged within those few

seconds on that cell. It's the same. Same.
This is now the TMSI that belongs to

this phone. This is information we can't
get over SS7. But what you can do over SS7

with the TMSI is request a key, so it gets
complicated. But so we have the decryption

key now and the next time this phone
receives something, unless it changes the

key, in which case we can ask again for
a new key. Next time this phone receives

something. And what you don't see in the
video is, somebody is now sending a text

message to the phone. We can also record
that right. Again, same radio, the one

shown in the picture, now the phone that
received a text message. And there's a few

more steps. So the phone received a text
message and we also, again, recorded the

airwaves. We again run it through some GNU
radio script. Now, was was UMTS

everything? It is kind of complicated, so
there's a different connection, of

course, happening all at the same time,
and then they'll get allocated to

different channels. So now, in order to to
decode this text message, we're going to

find out which channel is used. So this
command gives us the list of which which

channels have been allocated. And we got
to find a TMSI from earlier in one of

these channel allocations. And Wireshark
is a great help in this. We didn't have to

do anything with Wireshark. I just knows
all that 3G stuff right out of the box. So

luckily, the first of these five
connecting requests is the right one and

scroll all the way down, there's then the
parameters that say which channel this

transaction happened on. So those two
numbers, 15 and 48 is the channel. So we,

we need to cell frequency, but we need
those those two two numbers, that, that

are the channel and the key, you know,
this is only 64 bit. I'll discuss that

a little later. And that's all we need to
decrypt an SMS. And there it is.

Applause
Thank you.

This still works today, but only against
two out of the four German networks. Some

of them move to to to stop some of these
messages, of course, most importantly,

this SI message that gives you the
decryption key. But even if you block this

message, just acquiring somebody's
location can already be intrusive enough.

All right. Moving on to 3G security or
rather extending on 3G security since this

already touched through 3G in a big way.
You remember the good old days where where

you could just intercept all phone calls
was the Osmocon phone. Thank you, by the

way, for that open source project that
helped us so much over the years. And you

combine that with the kraken software to
decrypt the phone call. So with 20 year

old vers of phone and the server you can
listen to anybody's GSM calls as long as

they're using the A5/1 cipher. Some
networks recently moved into A5/3.

So it doesn't work this way anymore. Now,
how does this now compare to 3G security?

As I've just shown, basically the same
attacks are possible. Instead of the

Osmocom phone, we use a programable radio,
some more software, but again, very

affordable 400 euros or
something. And you combine that using

instead of kraken SS7 queries. So unless
we fix SS7, 3G is no more secure than 2G

and neither is A5/3, the recent
upgrade of GSM because those keys are

again exposed over SS7. Now, some
networks, you don't even need that second

part, so they have bigger things to worry
about and then SS7 attacks and our data

set isn't all that large. Some of you
provided measurements through through a

software release last year. So thank you
very much for that. And we have captures

from maybe 20, 25 countries out of those
five having to use no 3G encryption at

all. Well, four countries. Five network
operators. Right. Which I find shocking.

Some of these even have encryption turned
on on their GSM network and then forgot to

turn it on or deliberately left it out
because it's harder to intercept on the 3G

variant. Right. So those networks, as I
said, have much more, much more worrisome

issues than SS7 attacks. And they really
need to be called out. And we do that with

an extension of a website that we've been
maintaining for a couple of years, gsmmap,

big update of gsmmap launched today
with all the 3G measurements, we, we

collected and you collected over the last
couple of years. Now, some of you may have

used gsmmap before. The idea as to to rank
operators in the three categories. How

hard is it to intercept phone calls and
SMS? Is it easy to impersonate a person

and then put charges on a bill, for
instance, or receive the calls? How hard

is it to track them? And as you see, over
the last years, networks have improved

their security, at least some, as always.
God. And as you also see, these are the 2G

networks, even the best secure 2G network.
And in Germany anyway, in our opinion, is

less secure than the worst secured 3G
networks. These are for 3G networks, still

we want networks to implement all security
features. And as you saw before, some

other countries don't have that luxury of
all 3G secure networks reasonably secure.

Not the first version of our metric is
very crude and we want to improve upon

this over time. But currently how we
calculate the score is we'll give ninety

percent of the points to anybody who
switches on encryption. That's the main

security feature and the remaining 10
percent you earn by changing the TMSI

quickly. TMSI is what we needed for these
SS7 attacks to work well. So if you keep

changing it, it really confuses the that
the person trying to to haunt you also

this makes other types of attacks more
difficult, will factor in a couple of more

values as we collect more data. But this
is it for now. So, yeah, big update on

gsmmap. If you haven't checked it out,
check out your country on gsmmap, read the

country report. So does a six page or so
report, auto generated, that explains what

types of measurements we included into
into these graphs and why we think they

they constitute certain risks. Maybe
forward it to to your network and say if

you're not improving, I'm going to change,
switch to another network. Now, not

everything is on, on gsmmap yet because we
don't have enough data. And there's one

problem in particular that I want to start
warning about, because I really think

we're running into an issue here. And that
is the lengths of encryption key you saw

in the in the capture, in the video data
that I showed that the key that came back

over SS7 was actually only 64bit from this
particular network. And the SIM card that

was there was used in this attack, was
bought that very same week. So we recorded

this video last week. So it's the the most
recent SIM card you can buy from this

network. And still it only uses 64 bit.
And that, in my view, is incompatible with

what we have learned from from recent
Snowden documents that the NSA in 2011,

2012 funded a project to break A5/3.
This is a 64 bit cipher. And we had

estimated at this very conference a year
ago that you'd need about a million

dollars to break A5/3. Now, they
did it a little bit earlier. So Moore's

Law, everything's more expensive and
probably to have overhead, too. But they

spend apparently four billion pounds. I
don't know why pound, not dollars, but it

may have been some GCHQ Corporation. So
for four million pound a couple of years

ago, you could already break 64 bit crypto and
64 bit is more prevalent in mobile

networks than you would have thought when
they upgraded the GSM networks to A5/3.

They didn't actually upgraded it to UMTS
security, as everybody claimed they did.

They upgraded it to the cipher used in
UMTS with a key half the size. When

writing the A5/3 standards though, the
people were smart enough to also put in

the real UMTS cipher with full key size,
they called it A5/4 and it has never

been seen anywhere since. It's written in
the standard. It was released the same day

that A5/3 was released. Nobody has ever
moved to implement that. So GSM for the

time being is and will be vulnerable to
anybody. It was a one million dollar

machine in the basement. Certainly NSA,
but more and more people as we move

forward. And what costs a million dollars
today, thanks to Moore's Law in a couple

of years, anybody can break it on a
computers like we today. Break the A5/1.

If your network uses certain older
SIM cards, differentiation years between a

SIM card and a USIM as a UMTS SIM card.
If your network only uses SIM cards, then

even your 3G transactions are 64 bit
encrypted. So there is no way to generate

more entropy. You could query for two
keys, I guess, but they weren't smart

enough to do that. So 64 bit encryption
for UMTS and that's just not good enough.

And as I said, the network that we did
the demo with we were surprised to see a

64 bit key. We went back in our database
of SIM cards. We found a lot of SIM cards

that have this problem. We want to add
this to gsmmap, but we don't want to be

unfair just because we see one very old SIM
card in the network. We don't want to give

them a low score versus somebody else,
where we only see a new card. So we need

lots and lots of data. Help us collect
those data and we'll make it public.

Now, that's one reason why we stay on this
ball and progress the research. The other

main reason, and this is really what keeps
us awake at night is this question of

how can we get out of the mess. We've been
producing more and more problems. I should

not say produce, we make you aware of more
and more problems over the years and we

always criticize that at least many
networks do not respond to those. So we

have to stockpile ever growing stockpile
of mobile security issues and nobody seems

to be addressing. And all we do is wait
for our networks to do something

eventually. Now waiting's over for me, at
least I'm impatient. I want to do

something now and I want to address all
these issues all at once. Those issues

that we talked about for several years
now, including the SIM card attacks from

last year, silent SMS based tracking the
SMS, the SS7 abuse discussed today,

IMSI Catcher Vulnerabilities and
insufficiently configured networks, 2G as

well as 3G. All of these problems have one
thing in common. Your phone technically

knows that these attacks are happening and
your phone technically knows that a

network is configured insecurely. But
unfortunately it's buried very deep inside

the phone. It's buried inside the
baseband. So as much as you can program

Android, you don't get access to that
information. At least so we saw it and

then we set out and just took the better
part of this year. We wanted to dig the

information out from these phones. It's
somewhere in there. There must be some way

to hack it out of it. And we found debug
possibilities for Qualcomm chipsets, just

one vendor, but extremely popular. Right
now. There seem to be in every LTE phone

and in a bunch of other phones. And we
found, we found ways of producing exactly

all the data on the right hand side to
make it accessible through an Android

application. And we also wrote an
application for you. So: Release today.

Applause

Thank you, released today, SnoopSnitch
under GPL. A tool that collects all the

baseband information mostly to keep it
on the phone and run some analysis on it,

warn you about, as I said, SIM card
attacks, but also those SS7 attacks that

Tobias and I talked about today. How do
you take those those attacks? Well, by the

pagings, I showed you in the video
that every time we send certain queries to

the phone, to, over SS7, that the phone
actually also receives information useful

for the attacker. Also useful for the
defender. If those empty pagings, we call

them, are received by the phone, strong
evidence that somebody is messing with you

over SS7. Right. So it collects all that
information and it produces warnings. You

can also upload information issues, so you
choose. It's optional of course, it runs,

as I said, on a bunch of Android phones
that are currently popular. It requires a

somewhat recent Android version we haven't
tested was Android 5 yet, but I don't

see why it wouldn't work, though. We just
have to put the time and your phone needs

to be routed. So we have access to a
certain interface that otherwise is not

accessible. And it needs of course, a
Qualcomm chipset, which, as you see by

this list, is in most current flagship
phones. It's on Google Play right now. So

download it if you're interested. Now, how
does this tool work? One example only, of

course, right, read the source code if you
if you want to know the rest. If you, for

instance, IMSI catcher detection. There
have been a bunch of tools so far to do

IMSI catcher detection. The one we released
a couple of years ago was called CatcherCatcher,

but it had two limitations. One
practical, one more bound to experience.

The practical limitation was that it ran
on Osmocom phones and Osmocom phones can't

do most phone functionality. So always
your second phone? And it had to be

connected to a computer. So very unlikely
that you carried this around all the time.

And we wanted to move it onto a real phone
that you can use onto your phone. Right? I

think we succeeded in that. The second
limitation was that we really didn't know

how IMSI catchers behaved or we also
didn't know how real networks behaved. And

thanks to all the data on gsmmap, we think
we have a much better understanding now of

all the weird corner cases, how real
networks behave and created a much better

ruleset for for an Android based catcher
catcher tool now. And the rules go in two

categories. One is the configuration of
the of these different cells. For

instance, the lack of encryption when, you
know, from the gsmmap database that this

network does usually support encryption,
that's a big red flag. Also certain other

configurations. So that's a configuration
of the network, the adjusted behavior and

the IMSI catcher wants to get
information out from you at the very

least, the IMSI, of course, it's in the
name. Right. So that suspicious behavior

now, none of these things taken by
themselves did allow you to detect an

IMSI catcher. So we compute score over
these different events, doing stream

analysis on everything that happens on
your phone and eventually then come out

with a warning. If the score crosses a
certain threshold, there's a bunch more we

would have wanted to include that's even
on a Qualcomm chipset in it's debug mode

not available. So this is still ongoing work
as these chipsets progress and may give

us more information in the future. Now, if
you do find alerts, let's call them alarms

on your phone. We'd be grateful if you
could share them. Now, as I said, this is

optional, right? You get you get the
alerts shown in shown in your little tool

and then you can choose to upload
whichever ones you think should be shared

if we get enough of them and and think
that there's really hot spots of of of

abuse, of course, we'll try to make that
transparent, perhaps even put little dots

on the GSM website so people know where
abuse could be happening around

demonstrations, around embassies, wherever.
Applause

You can also actively choose to

submit data by by running an active test
now usually the phone looks at everything

that you produce, your phone calls, your
SMS that's always stored on the phone.

There's no way to upload that. And you
compute a score for how secure your

network is using the exact same metrics
that we use on gsmmap. So that's all

ported to the phone now. But if you feel
like the score on gsmmap is heavily outdated,

click this button. It runs some benign tests,
has nothing to do with your transactions. I

guess your location where you're currently
connected would be included in the data

and it uploads it to gsmmap. So that
becomes better and better. And we can spot

more networks that, for instance, like any
encryption at all. Yeah, so what's what

what are you what I like you to do, I
think you should do to better protect

yourself from mobile abuse, of course you
could keep waiting for your mobile

networks to fix all these issues, which I
must say more recently, more networks have

moved to fix issues, but still not the
majority. And no network has even started

to address the majority of issues. So it's
just scratching the surface. So what I'd

rather have you do is start defending
yourself. Check out gsmmap, see if you

are on a network that generally protects
things like encryption. You saw the

networks that lack encryption. Don't use
those. And if you really choose to self

defense, download, SnoopSnitch, this new
tool and actively look out for abuse, for

Silent SMS, binary SMS that you receive,
for empty pagings, for IMSI catcher

evidence and help us grow this database of
abuse. Right. Also help us grow the

tool base that we use. This is released
open source and we put in a lot of work to

make the data accessible. But now it is
accessible, right? Just take it as a

library and go wild with it. Do whatever
you always wanted to do with raw baseband

data on 2G, 3G, 4G. I am very much looking
forward to your contributions to this and

all that's left for me to say is thank you
very much.

applause

Herald: Thank you, Karsten, then we will
beginning with the Q&A, please, for

everybody that will be asking questions,
please line up on the microphones in the

room and for people that exit the room,
please do it with no noise and quickly.

Karsten: Now, before getting into the
question, let me give you one reason to

actually do leave now. There's a workshop
happening right now or in a few minutes

that will explain how this tool works and
what it can all do. We'll have an IMSI

catcher there a day or so. You can tell us
how that feels like being connected to an

IMSI catcher. It's happening in room C,
which is when you exit here one floor

down and to this end.
Herald: And additional information, the

workshop that's Karsten says start at
nineteen forty five.

K: And now to your questions.
distant noise

K: Sure.
Herald: OK, microphone number two and

please, before before we before you can
start number two, please do it with no

noise that we hear the question from the
audience. OK, number two, please.

Mic 2: Thank you. Can you quickly say a
few words about why it wouldn't work on

custom ROMs? Because we could just install
it into cyanogen phones and apparently

installed and it seems to work.
K: Oh, OK. So the way I understood custom

ROMs is that they first remove a bunch of
stuff from the phone and then put a bunch

of stuff on it. Part of what we need are
these proprietary Qualcomm libraries and

at least on the phones where we tried
cyanogen mod and what they are being

removed. So if cyanogen mod could stop
doing that, it would work beautifully.

It's not that we need anything additional.
We just need less to be deleted.

Mic 2: OK, thank you.
Herald: OK. Microphone number …, will you

ask. OK, are there some questions from the
IRC?

K: I think we have a bunch of questions.
Signal Angel: Actually, there is five

questions, so I will just ask one or two
for starting. The first one is, can all

these shown attacks that you proved on
your speech be mitigated by… by higher

protocols levels, like encrypted VoIP or
TextSecure, things like that? And what

will be the residual risks?
K: Mm, yeah. A good question. So how much

can you protect yourself by using the
mobile network less on using it as a dumb

pipe, I guess is the question, what if you
use just apps to call and send text? Well,

obviously your calls and texts won't be
intercepted anymore if they are encrypted

one more time in a way that's not
breakable. However, this does not solve

the location tracking. It does not solve
the fraud. It does not solve the denial of

service. It does not solve the spamming.
So you are tied to a mobile network and it

has a lot of control over you, your
location and your phone bill. None of that

is going to go away.
Herald: Another question from the IRC, one.

Signal Angel: Yeah, um, the second one is:
Wouldn't it be easier to design from

scratch a new mobile mobile network than
trying to find all flaws from actual

networks, which is an endless task?
K: Or I don't know where you would even

start designing everything from scratch
completely? The closest that I can think

of designing the mobile network from
scratch is LTE in the name of long term

evolution. It really wants to change
everything, but gives it a couple of years

but as Tobias pointed out, those
issues we pointed out today, they are

again included in LTE. Diameter is the
interconnect protocol. So we already

missed a chance to to remove much of this
issues by just upgrade. We'll have to fix

it through firewalls and monitoring like
we never got to update the Internet.

Herald: OK, microphone number four,
please.

Mic 4: Yet just a short thing. Could you
just provide a list of those libraries

you need from the stock images? So I think
it's pretty easy to copy them to this

cyanogen mod images.
K: Ok

Mic 4: OK, and if the app is open source,

maybe you can put it on fdroid?
K: Oh absolutely. Yes. Thank you.

applause
Herald: The microphone number two, please.

Mic 2: Got two questions, if I understood
correctly, you need to be inside the

operator network to actually
perform those SS7 queries, right?

K: Um, well, I would I would like for this
to be the case. But currently, does

anybody in the world connected to SS7 can
send his queries.

Mic 2: OK, so my question is that what was
your hook point for actually doing this

test?
K: I think I'll quote Tobias here by

saying I would rather not say anything
about that.

Mic 2: OK, so the second question is about
the case you mentioned it's if I am not

mistaken, is the session key. Right? It's and
it should involve that nonce value, right?

K: Yeah.
Mic 2: So if it is, it already has the nonce

value. So in order the attack to work, we
also need to intercept the initial

messages, the nonce exchange between the
target and the basis station. Is that

correct?
K: No, the nonce is… as as they are. So

the SIM card knows which key to produce.
Yes. But it helps the phone to find the

right encryption key. We are not the
phone. We don't have the SIM card. Right.

If you just give us the encryption key,
we don't need the nonce.

Mic 2: Yes. So what you're saying is that
the query you're sending there, it

actually sends you not only the encryption
key, but also the nonce that is required..

K: It doesn't send us the nonce and we
don't need the nonce. We can take that

offline now, explain how everything works.
Thank you.

Herald: To microphone number three,
please.

Mic 3: First of all, thank you for a very
good presentation and very impressive work

you've done here.
applause

K: Thank you.
Mic 3: The question I have might be a

little naive, but have you also, besides
taking a look at this closing this whole

issue technically wise, also been taking a
look into how what measures can be taken

legally, at least in Germany and some
countries in Europe now that we have

disclosed that basically certain rules /
laws have not been fulfilled, that we can

enforce the operators to implement this
stuff on legal ways?

K: We have not looked into it. Of course,
we consider the possibility as soon as

somebody has an overview of where these
attacks happen. And that seems to be the

issue right now. There's zero attack
transparency. Nobody is looking for these

issues. And partly that's to the to their
own disbenefit, because as soon as they do

look for this issue, some of these attack
patterns are very easy to stop, as I said,

two German networks, mitigated them within
two weeks. And these issues had been open

for 20 years. Had they ever looked into
their own data, that would have seen this

going on. So I'm not very confident that
anybody in Germany at least has an

overview of where abuse would come from.
And as soon as it does, I don't think

there's much point in litigating. Let's
just stop the possibility of abuse. Right,

instead of complaining about it happening.
But I'm with you. If there's corner cases

in which abuse just can't be stopped,
let's fight it legally, of course. Right.

And if all of you contribute information
through SnoopSearch, does the empty

pagings, if we can find patterns of
abuse, of course, we'll aggregate them and

try to move against them.
Herald: OK, microphone number four,

please.
Mic 4: You said you can buy your way into

the SS7 Network, but how easy is it
actually to get your access? And what do

you estimate: How many players are
there in the network? Can you give any

estimation?
K: I have absolutely no idea. I know that

there's some 800 companies who who are
legally allowed to access SS7 and then

those, of course, have subcontractors,
legal and illegal, and some people who

bribe them. Yet other people who hack
their systems or the systems of the

subcontractors, it's very hard to
estimate. No idea. But definitely too many

to trust all of them.
Mic 4: And would it be possible for me to

get access to this without any operator
stuff or. I don't want to operate a phone

network, but I want to have access because
I want to provide a service, some service?

K: Well, I wish the answer was no, but of
course, right of to be as an I and a bunch

of other people can get access. You should
be able to get that too. But I'm not going

to tell you how.
laughter and applause

Herald: Yet another question from the IRC.
Signal Angel: We're about nine questions,

so no problem for me. First one, what
about Windows phones, jail breaked

iPhones, or something like this will the
app in the end [be] on this phones?

K: Our app doesn't run on anything other
than Android, but the chipsets are, of

course, the same. So if you can speak to a
chipset through a jail broken iPhone, for

instance, you could create a similar
application. We just wanted to target the

biggest population of phones, and that
seems to be Android phones.

Herald: Then number two, please.
Mic 2: One further thought on self-defense

as self-defense has don't has to be
proportionate, I think, and identities are

not secure in the digital sphere. How
about developing some proactive, as we

heard the word defense tools?
K: Proactive as in hack the networks,

until they have no chance but to fix?
Mic 2: That's what you understood, but.

But, I support that. laughter
K: I'm not going to say that I dislike the

idea. But you won't see me here next year
explaining how I did it.

Mic 2: Thank you.
Herald: Microphone number three, please.

OK. When did you check the other two
German networks didn't fix the identifier

and the issue.
K. Which network do you work for?

Mic 2: I'm Holger. We talked last week.
K: Yeah. So yeah. Maybe you fixed it too.

We didn't, we didn't check.
Mic 2: We fixed it within 24 hour, 24

hours after our call.
K: Wow. OK.

Mic 2: On both networks.
applause

Thank you. Better late than never. Thank
you.

Mic 2: That's right.
K: OK, so that's three out of four now,

that fix one out of 100 problems.
Mic 2: No, it's… I know that's why we

don't go to the press and don't tell that
SS7 is fixed and we know we still have

problems also. It's all four. I work for
Telefonica, which is O2 and eplus.

K: Oh yeah. Well, congratulations. Sorry.
Sorry for spoiling your Christmas.

laughter

Herald: Microphone number two, please.
Mic 2: I'd like to know why these empty

pagings occur in the context of the
location tracking, I thought, as soon as

the phone registers in the network, the
base station, which is this connected to,

is known in the network anyway. Is that
the case?

K: That's a very good question. And let me
let me go back to one earlier slide to to

explain that, one second, so that the
empty pagings do not occure when you send

these creepy AnytimeInterrogation
messages. They are just there for spying

and there's no way to page the customer.
But since this got blocked and Tobias went

into great level of detail explaining
this, you need a couple of other messages

to now track some of this location and
these messages when meant for location

tracking them and ment for other purposes.
For instance, as I provide subscriber info

that however you reach it is always the
last message you need. This does do a

paging and then to provide subscriber info
really makes no sense unless you send

something afterwards also, deliver an SMS
connect to call or whatever. So the paging

is already sent in anticipation that an
SMS will come or that the call will come.

But if you're only the creepy guy tracking
it, they're going to send it SMS and

that's where the empty paging comes from.
Mic 2: OK, but still also in these cases

where something follows the paging, isn't
it a type of double checking whether it's

really there or I mean, the location info
itself should already be present and the

network, isn't it?
K: Yeah, yeah. It just reconfirms that the

subscriber is really there. So it's
basically saying: Somebody you just

interrogated your location because they
want to send you something. Let's check

that you're really still there because
otherwise we'll tell them something wrong.

But Tobias do you want to comment on that.
Tobias: Yeah. OK, so the empty paging is

not anticipation or something that's
coming after. It's to get the current cell

that you are located at, because when you
are moving around in your location area

and the area that is covered by the
switching center that you're currently

being served by, your phone doesn't
necessarily contact the base station. So

it could be that that the networks last
position of you is somewhere you received

an SMS or text or call, and then you moved
to a completely different area if your

phone didn't have network contact in the
meantime, the network would still only

know the last point of contact. So that's
why the why the empty paging happens so

that the that the network knows the base
station that's actually currently closest

to you. That's also why the law
enforcement uses a lot of Silent SMS so

that that they can get the last position
in the network. And it's also an option if

you send provide subscriber information,
you can just send it and get back the last

known position without a paging or you can
set the current location flag and provide

subscriber information. And only then the
subscriber gets paged and you will receive

the current location.
K: And that's that's one good example for

how SS7, which is supposed to be
so insecure we can never fix it, can

easily be fixed. There's an option that
says we're using this as normal feature

that's absolutely needed. And we have this
creepy extension to also ask for the

location. And some networks choose to not
answer that. The answer was zero zero zero

zero and nothing broke. Right. So you can
just ignore the insecure parts of SS7 and

do whatever you think is right. And for
the most part, it continues to work. But

I think we're well beyond answering
your question now right?

Mic 2: No, but from your answers. Thank
you very much. But another question

arises, because if it's actually to locate
your phone and to find out which cell

you're actually in, then it implies that
it's not only one base station that since

the paging call, but a whole bunch of base
stations. Do you know something about the

algorithm? I mean, how many around the
last known location are paging everybody

nationwide or how does..
K: Everybody can implement this as they

wish? And I don't have much insights into
how 3G does it, but in 2G typically is:

There's one paging send in the last cell
that saw you. You don't respond. It's send

in a larger area. You don't respond. It's
sent for the whole location area. And then

some networks, you don't respond. They
send it in the entire country. But that's

rare. Right?
Mic 2: Thank you very much.

Herald: Okay. Questions from the IRC?
Signal Angel: Did SnoopSnitch allow you to

reveal any kind of attack in countries.
Not special name in mind.

K: Does it allow you to detect attacks in
countries? Yeah, yeah, some kind of

Tapsell. I think the answer is yes. Its
whole purpose is to detect attacks. And it

also works in countries…
laughter

Herald: Did you succeed in detecting attacks.
K: Did we succeed in

detecting. Yes, we did. And if you go down
to the Saal C, Room C, you can see how it's

currently people are being attacked and
currently they detect that. Ok

Herald: OK microphone number five, please.
Mic 5: Yes, thanks, it's going back to SS7

basics. Can you quickly explain how SS7 is
implemented? Is this a VPN on the public

Internet through the providers? What's the
technical reality of transport?

K: That's a very good question. Of course,
that's a very good question. And I only

have half of the information, too. I keep
learning. But so it seems that it was

implemented initially as a network between
Western European telcos and their run

cables, dedicated cables for SS7.
SIGTRAN they called this and then a couple

more networks connected to it. And each
of them had to run the cable to one of the

other telcos. But eventually they changed
that and then introduced what I call

routing providers. So telcos are not
connected to each other usually, but

through a routing provider like on the
Internet and those routing providers, they

typically don't run a cable to your house
anymore. If you are a new telco, they give

you a VPN over the Internet. So it's
diverse. I'm sure there's still some

dedicated lines between Germany and
France, say, and there's some others

connecting and these big clouds that are
routing providers. And it's actually

really difficult to get your address
routed everywhere in the world. So even if

you connect to SS7, all you're connected
to is one routing provider and that

routing provider knows that you own these
addresses. Now it's up to you to convince

every other of the big seven or nine,
depending on how you count routing

providers that you are that guy with those
addresses. So the BGP equivalent of SS7 is

to get nine roaming agreements signed with
people on these other nine operators and

then fax those roaming agreements to
everybody else involved. So they type it

into your computer, into their computers,
very manual and very hard to grow the

network. But for the most part, it doesn't
change, of course-

Mic 5: So that the low level transport is
not really an attack surface from the

public Internet.
K: It can be the low level transport can

be an attack surface if people just
stupidly leave open their local networks.

But it's rare. It's much more common,
speaking about our talk next year,

hopefully on the other interconnect
networks, there's one interconnect network

for data roaming. It's called GRX. And
since everything is IP anyway on data

roaming, people sometimes do leave it out
on the Internet or just do it unencrypted

over the Internet. And it does seem to
become more popular also with the SS7

replacement Diameter, which again is pure
IP. So there's no dedicated thing that you

first have to encapsulate in a VPN before
you can route it over the Internet. You

can run Diameter over the open Internet if
you want. It's stupid, but people seem to

do it anyway.
Herald: OK, the microphone number six,

please.
Mic 6: OK, my question is, if you could

comment why these message were put in the
protocol at the first place, it they are

so easy to block and to fix. And the other
question is, if all the other problems

that you pointed out are as easy to fix
for the network operators.

K: So I don't have an answer to your first
question. Why do you put a tracking

message in the standard and then call it
AnytimeInterrogation, gosh, like that

invokes feelings for me,
interrogation room and all. I mean, this

is spy stuff, right? And there's no
practical, purposeful but. Right. Who

wrote SS7 standard? Western European
governments being afraid of the Russians,

of their own citizens, who knows? Right. I
don't know why they put every single

message in, though. So your second
question was what again?

Mic 6: If the other vulnerabilities are as
easy as to fix? Or just blocking messages.

K: No they're not. And I tried to point
that out in one of the slides that… that

AnytimeInterrogation can be fixed, as can,
for instance, as does SendIdentification

message, right. You just block that has no
purpose, routing this internationally. But

the other queries on this page, at least
you need those internationally, at least

to enable roaming. So the best you can do
is, as I said, first block these queries

from anybody who's not your roaming
partner, right? Don't respond to those

people and then do some plausibility
checking, secondly, make sure that if a

subscriber is actually in your own network,
that you don't honor requests from another

country. Right. And that should remove most
of the issues because most abuse comes from

other countries. It's just more likely if
there's 800 parties connected to this

network that the one doing the abuse is
not yours. Good question. Thanks.

Subtitles created by c3subtitles.de
in the year 2021. Join, and help us!