Cellular networks are connected with each other through a worldwide private, but not unaccessible network, called IPX network. Through this network user related information is exchanged for roaming purposes or for cross-network communication. This private network has been breached by criminals and nation states. Cellular networks are extremely complex and many attacks have been already been found e.g. DoS, location tracking, SMS interception, data interception. Many attacks have been seen in practice, but not all attack are understood and not all attack avenues using the IPX network have been explored. This presentation shows how a S9 interface in 4G networks, which is used for charging related user information exchange between operators can be exploited to perform fraud attacks. A demonstration with technical details will be given and guidance on practical countermeasures.

1. 1 <Change information classification in footer> © Nokia 2016
Bell Labs
Bell Labs
4G - Who is paying
your cellular phone
bill?Silke Holtmanns
Isha Singh
Nokia Bell Labs

2. 2 <Change information classification in footer> © Nokia 2016
Bell Labs
Bell Labs
Industrial Security
Research?

3. 3
Bell Labs
• Theoretical studies go into attack and
countermeasure design
• Validation and awareness of our research by
GSMA standards input and publication
• Customer feedback and test results allow us
to fine-tune and optimize our
countermeasures
• Research input will fit product needs and
operators requests
• Operator needs can be discovered ”live” for
new research challenges and disruptive new
solutions
Nokia Bell Labs – Future Attacks and Mitigation
Research that solves real problems together with our customers and sometimes even competitors
Lab
Problem study /
Threats/Attack
Design Attack
Testing
Counter
measures
Validation and
Awareness
Customer
Feedback
Product
Improvements
Bell Labs Research Lifecycle

4. 4 <Change information classification in footer> © Nokia 2016
Bell Labs
Bell Labs
You connect
What does actually
happen?

5. 5
Bell Labs
Roaming
Why should you care?
Source: DefCon, National Geographics,
Wikipedia
You connected to AT&T,
Verizon, T-Mobile, Sprint
DefCon participants
CMCC, Airtel,
MegaFon, Telenor
My colleagues,
friends, family
connected to DNA,
Elisa, Telia

6. 6
Bell Labs
Connecting networks – The hidden private Internet
The Interconnection Network (IPX)

7. 7
Bell Labs
I switch on my phone
Las Vegas
Antenna Core Network
Carrier / IPX
Carrier / IPX
Core Network
Authentication -> run to home network
Checking subscriber

8. 8 <Change information classification in footer> © Nokia 2016
Bell Labs
Bell Labs
What is this secret network?
Where does it come from?

9. 9
Bell Labs
<Change information classification in footer> © Nokia 2016
The good auld history
1981 – Nordic Operator Meeting
Need to call my wife, she
has birthday today. Stupid
that I can not use my
mobile.
The sauna is not hot
enough. Lets connect
the networks. So you
call me and I can heat
up the sauna before you
arrive.
The beer is warm….
Should be longer in
the fridge.
Source: Kauppalehti.fi / Erja Lempinen

10. 10
Bell Labs
<Change information classification in footer> © Nokia 2016
Starting of practical discusions
Cold beer would be nicer. Yeah
we should connect the
networks…..then you can put it
before in the fridge in time.
We would need a cable
under the water of the
baltic sea…
Source: Kauppalehti.fi / Erja Lempinen

11. 11
Bell Labs
The technical details were worked out
Some new protocol
is needed for this.
We don’t need
security. It is a
closed network
just for us
We could invite
some other
operators.
Can you pass me
another beer and the
mustard?
People will love it.
Pizza delivery
everywhere.
I know
someone
in ITU
who can
help
The networks are
owned by the
governments
anyway.
Source: Kauppalehti.fi / Erja Lempinen

12. 12
Bell Labs
• Started with 5 Nordic operators and calls only about 35 years
ago
• Now about 2000 companies connected to it
- Mobile operators
- Service providers (SMS aggregators, password recovery)
- Satelite communication providers etc
• Very inhomogenous operator structure
• Networks are a mix and match
- 2G, 2.5G, 3G, 4G and now 5G
- Different hardware, protocols, products, releases
- Many services voice, SMS, MMS, IMS, data, VoIP
• Network evolved, but security awareness only recently
started (2014)
Evolutions of IPX
SMS providers

13. 13
Bell Labs
SEP – Somebody Else Problem?
Message for you…..

14. 14
Bell Labs
It is not only you that is ”reachable”

15. 15 <Change information classification in footer> © Nokia 2016
Bell Labs
Bell Labs
Security?

16. 16
Bell Labs
Source: wired, the intercept, Verint skylock product description, vault.co, trace any
mobile, bankinfosecurity, the hill
Who would hack this network

17. 17
Bell Labs
Source: Security Week, The register, YouTube, wireless, wired, techworm
Existing Attacks for the ”old” SS7
• Location Tracking
• Eavesdropping
• Fraud
• Denial of Service user & network
• Credential theft
• Data session hijacking
• Unblocking stolen phone
• SMS interception
• One time password theft and account
takeover for banks, Telegram, Facebook,
Whatsapp, bitcoin wallet
Most of the attacks today are still SS7 – but things change

18. 18
Bell Labs
How do attackers get in
Rent a Service
Kick in the door
Hack via Internet Social Engineering
Become an Operator
Bribing and Employee

19. 19
Bell Labs
That is how they get in
Well, of course there might be legitimate reason…maybe….
Some big Asian country

20. 20 <Change information classification in footer> © Nokia 2016
Bell Labs
Bell Labs
New protocol -
New luck?

21. 21
Bell Labs
I switch on my phone
Las Vegas
Antenna Core Network
Carrier / IPX
Carrier / IPX
Core Network
Checking subscriber:
”Hey, does she have money, and what
did he pay for”
”Make sure it is really her”

22. 22
Bell Labs
UE eNB
MME
HSS
SGW
PCRF
PGW
S9
Network used for testing of attack

23. 23
Bell Labs

24. 24
Bell Labs
IPX
S9
S9
Operator A
Operator B
Operator D
Operator F
Operators with connected S9 billing interface

25. 25
Bell Labs
S1 MME
HSS
SGW PGW
PCRF
Here You Are...
eNB
INTERNET
S6a
S5
S11
Gx
Network Architecture (3G/4G)

26. 26
Bell Labs

27. 27
Bell Labs
Visited -
PCRF
Home -
PCRF
S9
CCR
CCA
RAR
RAA
Credit Control Request
- Money?
- What kind of service?
Re-Authentication Request
- All kind of control and information
- PCC management
Normal incoming request for roaming (Fin in US)

28. 28
Bell Labs
• Policy Charging Control
- Defines everything about your subsription
- Data type
- Data rates
- Whatever cellular service you can think off
• Defines how to handle you and what to grant you ”service flow filters”
• Usually identified by a string
• My own subscription is company paid and quite ”generous”
- Perfect target for an attacker
What is a ”PCC”?
Something you all have

29. 29
Bell Labs
Diameter Routing Issue – Two Possibilities how to route…..Hop-by-Hop
Core Network Carrier / IPX Carrier / IPX Core Network
Request
Orig:
FakeFin
Dest:
US_NW
Hop-by-hop
ID: 3
Attacker
Request
Orig:
FakeFin
Dest:
US_NW
Hop-by-hop
ID: 2
Request
Orig:
FakeFin
Dest:
US_NW
Hop-by-hop
ID: 1
Answer
Orig:
US_NW
Hop-by-hop
ID: 3
Answer
Orig:
US_NW
Hop-by-hop
ID: 2
Answer
Orig:
US_NW
Hop-by-hop
ID: 1

30. 30 <Change information classification in footer> © Nokia 2016
Bell Labs
Bell Labs
Attack
1. Steal PCC of good subscription
2. Update cheap subscription with
PCC of good subscripion

31. 31
Bell Labs
V-PCRFH-PCRF
S9
CCR
CCA
Credit Control Request
- I have a customer, lets do
business
Attacker
Attack scenario against finnish operator – Request PCC via CCR
Message Format:
<CC-Request> ::= < Diameter Header: 272, REQ, PXY >
< Session-Id >
{ Origin-Host }
Diameter Edge Agent (DEA)
{ Origin-Realm }
Used operator
{ Destination-Realm }

32. 32
Bell Labs
H-PCRFH-PCRF
S9
RAR
RAA
Re-Authentication Request (RAR)
- IMSI
Re-Authentication Answer (RAA)
- QoS-Rule-Install AVP
Attacker
Requesting PCC via RAR (posing as home network)

33. 33
Bell Labs

34. 34
Bell Labs

35. H-PCRFH-PCRF
S9
RAR
RAA
Attacker
Re-Authentication Request
- QoS-Rule-Install
Answer does not matter
Attack Scenario 1: Putting PCC via RAR (posing as home network)

36. 36
Bell Labs
H-PCRFV-PCRF
S9
RAR
RAA
Re-Authentication Request (RAR)
- IMSI
Re-Authentication Answer (RAA)
- QoS-Rule-Install AVP
Attacker
Attack Scenario 2: Putting PCC via RAR to outgoing roamer

37. 37
Bell Labs

38. 38
Bell Labs

39. 39
Bell Labs
Before and After

40. 40
Bell Labs
• Attacker:
- Better services
- Shifting the costs – Letting somebody else pay the phone bill
- Re-selling ”opportunity”
• Users:
- Might be billed for services he has not used (in particular company subscriptions are at risk)
• Operators:
- Bill disputes (service desks)
- Loss of coporate customers
- Costs with partners that can not be charged to a user
• IPX carriers still want to see their money
Impacts

41. 41 <Change information classification in footer> © Nokia 2016
Bell Labs
Bell Labs
Countermeasures

42. 42
Bell Labs
Switch it off – build it from scratch?

43. 43
Bell Labs
• S9 Interface -> use IPSec with trusted
partners directly
• S9 only open on need basis
• Routing via origin realm, origin host
• IMSI range – operator match
• Check not to get messages from
yourself
• Logical seperation of visitors and own
subscribers
• Location distance
• Fingerprint partner
• Fingerprint ”flows”
Countermeasures
For Operators For “normal” Users
• Check your bill
• Keep an eye on the news
• Security and network protection is
something that needs to be part of a
Service Layer Agreement
• It is a quality indicator, similar to
bandwith and coverage
For “corporate” Users

44. 44 <Change information classification in footer> © Nokia 2016
Bell Labs
Bell Labs
Thanks to
EU SCOTT Project for funding part of this research
Questions?
Silke.Holtmanns@nokia.com