Mobile Network Security: a tale of tracking, spoofing and owning mobile phones. Defcon Moscow. OpenBTS & IMSI-catcher.

•

20 likes•17,908 views

Quick overview of some case studies about: IMSI-Catcher (Stingray phone tracker), tracking phones, GPRS sniffing, GSM-R catching and DoS, POS, gambling machines, etc.

Technology

Mobile Network Security: a tale of tracking, spoofing and owning mobile phones. Defcon Moscow. OpenBTS & IMSI-catcher.

What's hot

Packet sniffers

Kunal Thakur

Hacking SIP Like a Boss!

Fatih Ozavci

Sandboxing

Lan & Wan Solutions

Publication performed by Alexandre De Oliveira and Pierre-Olivier Vauboin during Hackito Ergo Sum 2014 Mobile telecommunication networks are complex and provide a wide range of services, making them a tempting target for fraudsters and for intelligence agencies. Moreover, the architecture, equipment and protocols used on these networks were never designed with security in mind, availability being the first concern. Today, even though some telecom operators are investing money into securing their network, events confirm that for most of them maturity in term of security is yet to come, as recently shown with the example of massive traffic interception on compromised SCCP and GRX providers like Belgacom’s BICS. Here we present the most typical and legitimate telecom callflows from making a mobile phone call to sending a SMS. Then we describe the protocol layers involved and how to abuse them, which fields can be manipulated in order to attack both the operator infrastructure and its subscribers. Finally, we show a real life example of scan performed from an international SS7 interconnection and practical attacks on subscribers such as spam, spoofed SMS and user location tracking.

Worldwide attacks on SS7/SIGTRAN network

P1Security

NMAP - The Network Scanner

n|u - The Open Security Community

Firewall & packet filter new

Karnav Rana

Nmap basics

n|u - The Open Security Community

Understanding NMAP

Phannarith Ou, G-CISO

Intrusion prevention system(ips)

Cisco ASA Firewalls

Snort

Snort

Public key cryptography and RSA

Shafaan Khaliq Bhatti

Cyber Security - Unit - 2 - Network Defense tools Firewalls and Packet Filters

Gyanmanjari Institute Of Technology

Systems Vulnerability Scanning Overview of vulnerability scanning, Open Port / Service Identification, Banner / Version Check, Traffic Probe, Vulnerability Probe, Vulnerability Examples, OpenVAS, Metasploit. Networks Vulnerability Scanning - Netcat, Socat, understanding Port and Services tools - Datapipe, Fpipe, WinRelay, Network Reconnaissance – Nmap, THC-Amap and System tools. Network Sniffers and Injection tools – Tcpdump and Windump, Wireshark, Ettercap, Hping Kismet.

Cyber Security - Unit - 1 - Systems Vulnerability Scanning Overview of Vulner...

Gyanmanjari Institute Of Technology

Mobile computing security

Zachariah Pabi

Android Security & Penetration Testing

Subho Halder

Linux privilege escalation

SongchaiDuangpan

CNS - Unit - 5 - Cryptographic Hash Functions

Gyanmanjari Institute Of Technology

Fundamentals of Network security

APNIC

What's hot (20)

Packet sniffers

Hacking SIP Like a Boss!

Sandboxing

Worldwide attacks on SS7/SIGTRAN network

NMAP - The Network Scanner

Firewall & packet filter new

Nmap basics

Understanding NMAP

Intrusion prevention system(ips)

Cisco ASA Firewalls

Snort

Public key cryptography and RSA

Cyber Security - Unit - 2 - Network Defense tools Firewalls and Packet Filters

Cyber Security - Unit - 1 - Systems Vulnerability Scanning Overview of Vulner...

Mobile computing security

Android Security & Penetration Testing

Linux privilege escalation

CNS - Unit - 5 - Cryptographic Hash Functions

Fundamentals of Network security

Viewers also liked

OpenBTS: Emergency GSM Messaging & Monitoring System for Civil Protection

Luca Bongiorni

Hunting the hunter, can you tell if your phone’s being captured by a rogue cell phone tower/ IMSI catcher/ Stingray? Learn strategies to detect rogue cell phone towers and hear stories from adventures war walking Las Vegas during Defcon. Learn about IMSI catchers their capabilities, LTE to GSM downgrade attacks, and ways to protect yourself from these devices. Discover open source projects and other ways you can get involved to help make cellular technologies safer for users. Video Link: https://www.youtube.com/watch?v=eivHO1OzF5E

Catching imsi catchers

Geoffrey Vaughan

Introduction to Mobile Application Security - Techcity 2015 (Vilnius)

Luca Bongiorni

The security flaws of legacy GSM networks, which lack of mutual authentication and implement an outdated encryption algorithm, are well understood among the technology community. Moreover, until now, the main cellular vulnerabilities being discovered and exploited in the mobile security research field were based on 2G base stations and GSM open source implementations. The Long Term Evolution (LTE) is the newest standard being deployed globally for mobile communications, and is generally considered secure. LTE’s mutual authentication and strong encryption schemes result in the false assumption that LTE networks are not vulnerable to, for example, rogue base stations, IMSI catchers and protocol exploits. However, these threats are also possible in LTE. Before the authentication and encryption steps of an LTE connection are executed, a mobile device engages in a substantial exchange of unprotected messages with *any* LTE base station (real or rogue) that advertises itself with the right broadcast information. Eavesdropping or spoofing these messages can be leveraged to implement a long list of exploits to which all LTE mobile devices are vulnerable. This talk will demonstrate how to eavesdrop LTE base station broadcast messages, and how to implement full-LTE IMSI catchers and other LTE protocol exploits, such as blocking SIMs and devices. Details will be provided as well on a previously unknown technique to track the location of mobile devices as the connection moves from tower to tower. We will discuss as well the necessary toolset to implement these and other exploits, which are possible with simply $1.5k worth of off-the-shelf hardware and some modifications of the code of widely available LTE open source implementations.

LTE protocol exploits – IMSI catchers, blocking devices and location leaks - ...

EC-Council

B sides

Daniel Arcila

Imsi catcher

Tri Sumarno

29c3 OpenBTS workshop - Hardware and sotware

Alexander Chemeris

Hacking Gsm - Secret Keys Revealed

shlominar

Osmocom

0xDEADC0DE

Lockpicking Baltic Cyber Security Forum 2013

Luca Bongiorni

Catching IMSI Catchers

Security Innovation

Abusing Calypso Phones

Positive Hack Days

Un paseo por la seguridad de las comunicaciones móviles (2G/3G) de voz y datos

Eventos Creativos

Speaker: Michael Iedema "OpenBTS implements a complete GSM stack for voice and SMS. It also supports GPRS and UMTS 3G data standards. With an off-the-shelf server and SDR (software defined radio), it is now possible to build real mobile networks. These networks can be used to support true fixed-mobile convergence, bring coverage to remote areas or just experiment and innovate within the cellular network itself. Because OpenBTS converts all cellular signalling and media directly to SIP and RTP, the development environment should be familiar!" ElastixWorld Santiago de Chile October 2014

OpenBTS - Building Real Mobile Networks, Big or Small

PaloSanto Solutions

OpenBTS AirPutih

Akhmat Safrudin

Certificate Pinning in Mobile Applications

Luca Bongiorni

Hablemos claro de las 4G

Agencia Nacional de Infraestructura

Gsm hacking

thiagosenac

Layakk - Atacando 3G Vol. 2 [rootedvlc2]

RootedCON

Mobile security

home

Viewers also liked (20)

OpenBTS: Emergency GSM Messaging & Monitoring System for Civil Protection

Catching imsi catchers

Introduction to Mobile Application Security - Techcity 2015 (Vilnius)

LTE protocol exploits – IMSI catchers, blocking devices and location leaks - ...

B sides

Imsi catcher

29c3 OpenBTS workshop - Hardware and sotware

Hacking Gsm - Secret Keys Revealed

Osmocom

Lockpicking Baltic Cyber Security Forum 2013

Catching IMSI Catchers

Abusing Calypso Phones

Un paseo por la seguridad de las comunicaciones móviles (2G/3G) de voz y datos

OpenBTS - Building Real Mobile Networks, Big or Small

OpenBTS AirPutih

Certificate Pinning in Mobile Applications

Hablemos claro de las 4G

Gsm hacking

Layakk - Atacando 3G Vol. 2 [rootedvlc2]

Mobile security

Recently uploaded

In the thrilling conclusion to 2023, ransomware groups had a banner year, really outdoing themselves in the "make everyone's life miserable" department. LockBit 3.0 took gold in the hacking olympics, followed by the plucky upstarts Clop and ALPHV/BlackCat. Apparently, 48% of organizations were feeling left out and decided to get in on the cyber attack action. Business services won the "most likely to get digitally mugged" award, with education and retail nipping at their heels. Hackers expanded their repertoire beyond boring old encryption to the much more exciting world of extortion. The US, UK and Canada took top honors in the "countries most likely to pay up" category. Bitcoins were the currency of choice for discerning hackers, because who doesn't love untraceable money?

Ransomware_Q4_2023. The report. [EN].pdf

Overkill Security

Abhishek Deb(1), Mr Abdul Kalam(2) M. Des (UX) , School of Design, DIT University , Dehradun. This paper explores the future potential of AI-enabled smartphone processors, aiming to investigate the advancements, capabilities, and implications of integrating artificial intelligence (AI) into smartphone technology. The research study goals consist of evaluating the development of AI in mobile phone processors, analyzing the existing state as well as abilities of AI-enabled cpus determining future patterns as well as chances together with reviewing obstacles as well as factors to consider for more growth.

Exploring the Future Potential of AI-Enabled Smartphone Processors

debabhi2

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

The Good, the Bad and the Governed - Why is governance a dirty word? David O'Neill, Chief Operating Officer - APIContext Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

apidays

Real Time Object Detection Using Open CV

Khem

FWD Group - Insurer Innovation Award 2024

The Digital Insurer

Corporate and higher education. Two industries that, in the past, have had a clear divide with very little crossover. The difference in goals, learning styles and objectives paved the way for differing learning technologies platforms to evolve. Now, those stark lines are blurring as both sides are discovering they have content that’s relevant to the other. Join Tammy Rutherford as she walks through the pros and cons of corporate and higher ed collaborating. And the challenges of these different technology platforms working together for a brighter future.

Corporate and higher education May webinar.pptx

Rustici Software

Three things you will take away from the session: • How to run an effective tenant-to-tenant migration • Best practices for before, during, and after migration • Tips for using migration as a springboard to prepare for Copilot in Microsoft 365 Main ideas: Migration Overview: The presentation covers the current reality of cross-tenant migrations, the triggers, phases, best practices, and benefits of a successful tenant migration Considerations: When considering a migration, it is important to consider the migration scope, performance, customization, flexibility, user-friendly interface, automation, monitoring, support, training, scalability, data integrity, data security, cost, and licensing structure Next Wave: The next wave of change includes the launch of Copilot, which requires businesses to be prepared for upcoming changes related to Copilot and the cloud, and to consolidate data and tighten governance ShareGate: ShareGate can help with pre-migration analysis, configurable migration tool, and automated, end-user driven collaborative governance

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

sammart93

Scaling API-first – The story of a global engineering organization Ian Reasor, Senior Computer Scientist - Adobe Radu Cotescu, Senior Computer Scientist - Adobe Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

apidays

Webinar Recording: https://www.panagenda.com/webinars/why-teams-call-analytics-is-critical-to-your-entire-business Nothing is as frustrating and noticeable as being in an important call and being unable to see or hear the other person. Not surprising then, that issues with Teams calls are among the most common problems users call their helpdesk for. Having in depth insight into everything relevant going on at the user’s device, local network, ISP and Microsoft itself during the call is crucial for good Microsoft Teams Call quality support. To ensure a quick and adequate solution and to ensure your users get the most out of their Microsoft 365. But did you know that ‘bad calls’ are also an excellent indicator of other problems arising? Precisely because it is so noticeable!? Like the canary in the mine, bad calls can be early indicators of problems. Problems that might otherwise not have been noticed for a while but can have a big impact on productivity and satisfaction. Join this session by Christoph Adler to learn how true Microsoft Teams call quality analytics helped other organizations troubleshoot bad calls and identify and fix problems that impacted Teams calls or the use of Microsoft365 in general. See what it can do to keep your users happy and productive! In this session we will cover - Why CQD data alone is not enough to troubleshoot call problems - The importance of attributing call problems to the right call participant - What call quality analytics can do to help you quickly find, fix-, and prevent problems - Why having retrospective detailed insights matters - Real life examples of how others have used Microsoft Teams call quality monitoring to problem shoot problems with their ISP, network, device health and more.

Why Teams call analytics are critical to your entire business

panagenda

Join our latest Connector Corner webinar to discover how UiPath Integration Service revolutionizes API-centric automation in a 'Quote to Cash' process—and how that automation empowers businesses to accelerate revenue generation. A comprehensive demo will explore connecting systems, GenAI, and people, through powerful pre-built connectors designed to speed process cycle times. Speakers: James Dickson, Senior Software Engineer Charlie Greenberg, Host, Product Marketing Manager

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

DianaGray10

💉💊+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHABI}}+971581248768 +971581248768 Mtp-Kit (500MG) Prices » Dubai [(+971581248768**)] Abortion Pills For Sale In Dubai, UAE, Mifepristone and Misoprostol Tablets Available In Dubai, UAE CONTACT DR.Maya Whatsapp +971581248768 We Have Abortion Pills / Cytotec Tablets /Mifegest Kit Available in Dubai, Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain, UAE, Buy cytotec in Dubai +971581248768''''Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of Misoprostol, Cytotec” +971581248768' Dr.DEEM ''BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE, CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE'' Contact me now via What's App…… abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be very happy to do abortion in Dubai we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication abortion offers an alternative to Surgical Abortion for women in the early weeks of pregnancy. We only offer abortion pills from 1 week-6 Months. We then advise you to use surgery if its beyond 6 months. Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides the safest and most advanced techniques for providing non-surgical, medical and surgical abortion methods for early through late second trimester, including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone, early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec (Misoprostol). The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day Abortion Procedure using medications that are taken on the first day of the office visit and will cause the abortion to occur generally within 4 to 6 hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant. When Mifepristone and Misoprostol are used, 50% of patients complete in 4 to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen that allows for completion without the need for surgery 99% of the time. All advanced second trimester and late term pregnancies at our Tampa clinic (17 to 24 weeks or greater) can be completed within 24 hours or less 99% of the time without the need surgery. The procedure is completed with minimal to no complications. Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses the latest medications for medical abortions (RU-486, Mifeprex, Mifegyne, Mifepristone, early options French abortion pill), Methotrexate and Cytotec (Misoprostol). The safety standards of our Abu Dhabi, United Arab Emirates Abortion Doctors remain unparalleled. They consistently maintain the lowest complication rates throughout the nation. Our Physicians and staff are always available to answer questions and care for women in one of the most difficult times in their lives. The decision to have an abortion at the Abortion Cl

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

This presentations targets students or working professionals. You may know Google for search, YouTube, Android, Chrome, and Gmail, but did you know Google has many developer tools, platforms & APIs? This comprehensive yet still high-level overview outlines the most impactful tools for where to run your code, store & analyze your data. It will also inspire you as to what's possible. This talk is 50 minutes in length.

Powerful Google developer tools for immediate impact! (2023-24 C)

wesley chun

Architecting Cloud Native Applications

WSO2

How to Troubleshoot Apps for the Modern Connected Worker

ThousandEyes

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Martijn de Jong

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving

Edi Saputra

Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows. We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases. This video focuses on the deployment of external web forms using Jotform for Bonterra Impact Management. This solution can be customized to your organization’s needs and deployed to support the common use cases below: - Intake and consent - Assessments - Surveys - Applications - Program registration Interested in deploying web form automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Jeffrey Haguewood

In this session, we will delve into strategic approaches for optimizing knowledge management within Microsoft 365, amidst the evolving landscape of Copilot. From leveraging automatic metadata classification and permission governance with SharePoint Premium, to unlocking Viva Engage for the cultivation of knowledge and communities, you will gain actionable insights to bolster your organization's knowledge-sharing initiatives. In this session, we will also explore how to facilitate solutions to enable your employees to find answers and expertise within Microsoft 365. You will leave equipped with practical techniques and a deeper understanding of how there is more to effective knowledge management than just enabling Copilot, but building actual solutions to prepare the knowledge that Copilot and your employees can use.

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Drew Madelung

Building Digital Trust in a Digital Economy Veronica Tan, Director - Cyber Security Agency of Singapore Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

apidays

Recently uploaded (20)

Ransomware_Q4_2023. The report. [EN].pdf

Exploring the Future Potential of AI-Enabled Smartphone Processors

Boost Fertility New Invention Ups Success Rates.pdf

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

Real Time Object Detection Using Open CV

FWD Group - Insurer Innovation Award 2024

Corporate and higher education May webinar.pptx

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

Why Teams call analytics are critical to your entire business

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

Powerful Google developer tools for immediate impact! (2023-24 C)

Architecting Cloud Native Applications

How to Troubleshoot Apps for the Modern Connected Worker

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

Mobile Network Security: a tale of tracking, spoofing and owning mobile phones. Defcon Moscow. OpenBTS & IMSI-catcher.

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Recently uploaded

Recently uploaded (20)