Webinar : How to Hijack a VoLTE Network?
•
0 likes•41 views
How to Hijack a VoLTE Network? VoLTE (Voice over LTE) while being vulnerable is also critical for voice communications on LTE and 5G networks. In this webinar presentation we have shared the alarming insights from our latest VoLTE research Key Topics: • Overview of Our Latest VoLTE Research • VoLTE Security Threats and Vulnerabilities • The VoLTE Kill-Chain • Securing VoLTE network against these threats Read More: • How to secure your VoLTE network from these threats. • Explore best practices and solutions to mitigate vulnerabilities, ensuring the security of connections and subscriber data against VoLTE hacks. If you may have a contact and or question reach: contact@secgen.com
Recommended
Recommended
More Related Content
Similar to Webinar : How to Hijack a VoLTE Network?
Similar to Webinar : How to Hijack a VoLTE Network? (20)
Recently uploaded
Recently uploaded (20)
Webinar : How to Hijack a VoLTE Network?
- 1. How to hijack VoLTE network Pavel Novikov Pavel.Novikov@security-gen.com
- 2. Pavel Novikov Pavel.Novikov@security-gen.com 10 years in telecom security Co-author of GSMA FS.20 GPRS Tunneling Protocol (GTP) Security document Head of telecom security research in SecurityGen Focused on telecom vulnerabilities: RAN, VoLTE, VoWiFi, GTP, Diameter, 5G SA and NSA. Conducting telecom security assessments for mobile operators for many years. 02 1 2 3 4 5 Bio
- 3. Pavel Novikov (SecurityGen) Alex Onegov (ex-SecurityGen) Sergey Mashukov (SecurityGen) 03 1 2 3 Research Team
- 4. Why now? 04 Relevance of the topic
- 5. Short course of mobile network evolution 05
- 6. 06 2G HSS Circuit Switched Core PSTN Public Switched Telephone Network 2G voice-only CS-MGW BTS BSC MSC SMSC
- 7. 02 07 HSS Circuit Switched Core Packet Switched Core Internet PSTN 2G +Data CS-MGW GGSN SGSN 2G BTS BSC MSC SMSC
- 8. 02 08 RNC SGSN GGSN HSS Circuit Switched Core Internet PSTN NodeB Packet Switched Core +3G network CS-MGW 2G 3G BSC BTS MSC SMSC
- 9. 02 09 RNC SGSN GGSN HSS Circuit Switched Core Internet PSTN NodeB Packet Switched Core +4G data CS-MGW 2G 3G BSC BTS MSC SMSC eNodeB SGW MME PGW 4G Evolved Packet core
- 10. 02 10 RNC SGSN GGSN HSS Circuit Switched Core Internet PSTN NodeB Packet Switched Core 4G voice? CS-MGW 2G 3G BSC BTS MSC SMSC eNodeB SGW MME PGW 4G Evolved Packet core
- 11. 02 11 RNC SGSN GGSN HSS Circuit Switched Core Internet PSTN NodeB Packet Switched Core 4G native voice CS-MGW 2G 3G BSC BTS MSC SMSC eNodeB SGW MME PGW 4G Evolved Packet core IP Multimedia Subsystem IMS
- 12. 02 12 RNC SGSN GGSN HSS Circuit Switched Core Internet PSTN NodeB Packet Switched Core 4G native voice CS-MGW 2G 3G BSC BTS MSC SMSC eNodeB SGW MME PGW 4G Evolved Packet core IP Multimedia Subsystem IMS SIP-protocol based
- 13. 02 13 RNC SGSN GGSN HSS Circuit Switched Core Internet PSTN NodeB Packet Switched Core Voice-over-LTE = VoLTE CS-MGW 2G 3G BSC BTS MSC SMSC eNodeB SGW MME PGW 4G Evolved Packet core IP Multimedia Subsystem IMS
- 14. 02 14 RNC SGSN GGSN HSS Circuit Switched Core Internet PSTN NodeB Packet Switched Core CS-Fallback voice CS-MGW 2G 3G BSC BTS MSC SMSC eNodeB SGW MME PGW 4G Evolved Packet core
- 15. 02 15 RNC SGSN GGSN HSS Circuit Switched Core Internet PSTN NodeB Packet Switched Core CS-Fallback voice CS-MGW 2G 3G BSC BTS MSC SMSC eNodeB SGW MME PGW 4G Evolved Packet core
- 16. 16 MME Evolved Packet core IP Multimedia Subsystem HSS gNodeB Internet SGW IMS eNodeB PGW 5G NSA native voice 4G 5G NSA
- 17. 17 MME Evolved Packet core IP Multimedia Subsystem HSS gNodeB Internet SGW IMS eNodeB PGW 5G NSA native voice 4G 5G NSA
- 18. 18 MME UDR Evolved Packet core 5G core network HSS SBA -network gNodeB Internet SMF UPF AMF SGW IMS eNodeB PGW UDM 5G native voice IP Multimedia Subsystem 4G 5G SA
- 19. 19 MME UDR Evolved Packet core 5G core network HSS SBA -network gNodeB Internet SMF UPF AMF SGW IMS eNodeB PGW UDM 5G native voice IP Multimedia Subsystem 4G 5G SA
- 20. 02 20 RNC SGSN GGSN HSS Circuit Switched Core Internet PSTN NodeB Packet Switched Core 5G NSA fallback CS-MGW 2G 3G BSC BTS MSC SMSC eNodeB SGW MME PGW 4G Evolved Packet core 5G NSA gNodeB
- 21. 02 21 RNC SGSN GGSN HSS Circuit Switched Core Internet PSTN NodeB Packet Switched Core 5G NSA fallback CS-MGW 2G 3G BSC BTS MSC SMSC eNodeB SGW MME PGW 4G Evolved Packet core 5G SA gNodeB 5G core AMF
- 22. • 1st LTE network deployed in December 2009 (TeliaSonera, Sweden + Norway) 22 Let’s dig into the history
- 23. 23 • 1st LTE network deployed in December 2009 (TeliaSonera, Sweden + Norway) • 1st VoLTE network support in August 2012 (USA) and first VoLTE phone LG Connect 4G Let’s dig into the history
- 24. 24 • 1st LTE network deployed in December 2009 (TeliaSonera, Sweden + Norway) • 1st VoLTE network support in August 2012 (USA) and first VoLTE phone LG Connect 4G • Full-featured VoLTE network in May 2014 (Singapore) with only phone Samsung Galaxy Note 3 Let’s dig into the history
- 25. 25 • 1st LTE network deployed in December 2009 (TeliaSonera, Sweden + Norway) • 1st VoLTE network support in August 2012 (USA) and first VoLTE phone LG Connect 4G • Full-featured VoLTE network in May 2014 (Singapore) with only phone Samsung Galaxy Note 3 • Almost all new phones having VoLTE support in 2020 Let’s dig into the history
- 26. • Almost all new phones having VoLTE support ONLY in 2020... 10 years after LTE network was deployed 26 Let’s dig into the history
- 27. Telco industry is very slow 27 MNO: It seems time to deploy VoLTE…
- 28. 28 Bombshell Verizon (USA) retire their 2G and 3G network by 31 December 2022
- 29. Verizon (USA) retire their 2G and 3G network by 31 December 2022 Initially they said that it will happen in the end of 2019, but they postponed, because industry was not ready, that’s why many other haven’t believed that in the end of 2022 they will do that. 29 Bombshell
- 30. 02 30 RNC SGSN GGSN HSS Circuit Switched Core Internet PSTN NodeB Packet Switched Core 2G/3G retire CS-MGW 2G 3G BSC BTS MSC SMSC eNodeB SGW MME PGW 4G Evolved Packet core 5G NSA gNodeB IMS
- 31. 3 1 • Verizon (USA) retire their 2G and 3G network by 31 December 2022 • It means, that if subscriber of some network without VoLTE goes to the USA, he will not be able to call anymore. 31 All the networks in the world was affected
- 32. 32 All the networks in the world was affected • Verizon (USA) retire their 2G and 3G network by 31 December 2022 • It means, that if subscriber of some network without VoLTE goes to the USA, he will not be able to call anymore. • Money and reputation are affected
- 33. 33 Build VoLTE network in 60 seconds… • Operators started to build their VoLTE network very fast, many of them built it in few months.
- 34. 34 • Operators started to build their VoLTE network very fast, many of them built it in few months. • Many configuration mistakes were made Build VoLTE network in 60 seconds…
- 36. 36 MME Evolved Packet core HSS gNodeB Internet SGW IMS eNodeB PGW APN – outside network 4G 5G NSA ?
- 37. 37 MME Evolved Packet core HSS gNodeB Internet SGW IMS eNodeB PGW APN – outside network 4G 5G NSA
- 38. 38 IMS APN
- 39. Modern phones are hiding IMS APN from list of APNs 39 Security by obscurity
- 40. PGW HSS Evolved Packet core P-CSCF I-CSCF S-CSCF MGCF MGW SGW PSTN BGCF IP Multimedia Subsystem (IMS) APN: ims 40 IMS network IP phones
- 41. So.. How to hijack VoLTE network? Break rules! 41
- 42. 42 IMS APN
- 43. 43 Run nmap?
- 44. LTE modem + laptop Configure APN: ims Take profit! 44 Better to use common tools
- 45. 45 Subscriber isolation for internet connection MME HSS Evolved Packet core 4G eNodeB Internet SGW PGW
- 46. 46 No isolation for IMS interface SGW PGW MME HSS Evolved Packet core 4G eNodeB IMS OK
- 47. 47 Let’s get access as legal subscriber SGW PGW MME HSS Evolved Packet core 4G eNodeB IMS OK
- 48. SGW PGW MME HSS Evolved Packet core 48 4G eNodeB IMS Build own fakeIMS infra? FakeIMS
- 49. PGW HSS Evolved Packet core P-CSCF I-CSCF S-CSCF IP phones MGCF MGW SGW BGCF IP Multimedia Subsystem (IMS) APN: ims 49 PSTN Emulate IMS network
- 50. 50 PGW HSS Evolved Packet core P-CSCF I-CSCF S-CSCF MGCF MGW SGW BGCF IP Multimedia Subsystem (IMS) APN: ims IP phones PSTN Emulate IMS network
- 51. 51 PGW HSS Evolved Packet core P-CSCF I-CSCF S-CSCF MGCF MGW SGW BGCF IP Multimedia Subsystem (IMS) APN: ims IP phones PSTN Emulate IMS network
- 52. 52 PGW HSS Evolved Packet core P-CSCF I-CSCF S-CSCF MGCF MGW SGW BGCF IP Multimedia Subsystem (IMS) APN: ims IP phones PSTN Emulate IMS network
- 53. 53 PGW HSS Evolved Packet core P-CSCF I-CSCF S-CSCF MGCF MGW SGW BGCF IP Multimedia Subsystem (IMS) APN: ims IP phones PSTN Emulate IMS network
- 54. PGW HSS Evolved Packet core P-CSCF I-CSCF S-CSCF MGCF MGW SGW BGCF IP Multimedia Subsystem (IMS) APN: ims IP phones PSTN 54 Emulate IMS network
- 55. Bypass to real one 55 PGW HSS Evolved Packet core P-CSCF I-CSCF S-CSCF MGCF MGW SGW BGCF IP Multimedia Subsystem (IMS) APN: ims IP phones PSTN Emulate IMS network
- 56. eNodeB SGW PGW MME HSS Evolved Packet core IMS Simple proxy script as P-CSCF 56 4G MiTM?
- 57. 57 4G eNodeB SGW PGW MME HSS Evolved Packet core IMS Simple proxy script as P-CSCF Push P-CSCF address during connection procedure Need to push P-CSCF address to the phone
- 58. 58 4G eNodeB SGW PGW MME HSS Evolved Packet core IMS Simple proxy script as P-CSCF Push P-CSCF address during connection procedure Need to push P-CSCF address to the phone How?
- 59. 59 Decided to hack phone
- 60. 60 Decided to hack phone If it is not enough – “root” may help Or editing “mbn” config on Qualcomm based devices
- 61. 61 4G eNodeB SGW PGW MME HSS Evolved Packet core IMS Simple proxy script as P-CSCF MiTM successful? Re-configured phone
- 62. 62 4G eNodeB SGW PGW MME HSS Evolved Packet core IMS Hijack VoLTE network Internet OK
- 63. 63 4G eNodeB SGW PGW MME HSS Evolved Packet core IMS Hijack VoLTE network Internet OK
- 64. 64 4G eNodeB SGW PGW MME HSS Evolved Packet core IMS Hijack VoLTE network Internet OK
- 65. 65 4G eNodeB SGW PGW MME HSS Evolved Packet core IMS Use internet for free Internet OK
- 66. If network provides VoLTE roaming – then we can implement free internet in Roaming (leaving laptop in home network) Profit Internet APN charging based on used amount of data, but IMS network charging based on minutes and implemented into IMS infrastructure As we don’t use IMS infrastructure at all, data over IMS APN will not be charged Due to lack of isolation, we can establish direct subscriber-to- subscriber communication We can set up OpenVPN tunnel to another subscriber and use his internet Other kind of tunnels are also work, or even p2p networks 1 4 2 5 3 6 66
- 67. 69 4G eNodeB SGW PGW MME HSS Evolved Packet core IMS Use internet for free Internet OK
- 68. Implement IMS network monitoring Mitigation for MNO Turn on subscriber isolation, as it is usually done for Internet APN 1 2 70
- 69. Mobile operators are a bit slow; many postponed deployment of IMS infrastructure for more then 10 years of LTE network. But now many of them are in hurry and deploying VoLTE network very fast and not secure. Conclusion Such misconfiguration (lack of subscriber isolation on ims APN) we see in more then 50% of tested network XX Bringing the minimum required level of security is not a difficult task at all if addressed properly. It's similar to the 1-10-100 rule in quality assurance testing: the sooner you catch the issue, the cheaper it will be to fix.