Dr. Hamilton Turner of Silent Circle discusses real-world case studies of mobile security compromises and the current ecosystem of 2/3/4G mobile security with a focus on LTE. Silent Circle is a secure mobility provider of the world-class Silent Phone product. Dr. Turner holds a degree in mobile privacy and security and has 10 years of experience building and securing mobile devices as CTO of multiple companies.

1. Nothingseen.
Nothingheard.
Nothingdisclosed.
EverythingSilent.
SILENT CIRCLE

2. About Silent Circle
Launched in 2012 by security industry experts
Phil Zimmerman – co-founder PGP
Jon Callas, co-founder of PGP Corporation & CSO Apple
Mike Janke – Seal Team 6
HQ in Columbia, MD
Committed to Secure, Private Communications
Silent Phone – Enterprise-managed secure talk, text, file sharing
Silent World – Global coverage + traditional telephone numbers
GoSilent – Portable Next-Gen Firewall + VPN
 Financial, Utilities, Logistics, Legal, Healthcare, Government, IoT
2

3. Cybersecurity Risks in the Mobile Environment
 Real-world financial case studies
 The forgotten risks of using smartphones as phones
 Practical steps to protect the organization
 Presentation by Dr. Hamilton Turner, CTO
 10+ years of mobile security experience
3

4. Stories From the Silent Circle
 Four real Silent Circle customer cases
 All financial or investment firms
 Most based in NY
 Events span 2015 to 2018
4

5. Case 1: Intercepting Board Calls To Short Stock
• Very large public fin. services company
• Mid 2015, preparing to announce quarterly loss
• Board meeting scheduled in Manhattan office
• Multiple pre-meeting phone calls to strategize
• Targeted by well-known organized crime
• Rogue cell towers were installed near NYC office
• Calls & SMS were intercepted
• From many levels e.g. C-level, assistants, others
• Stock shorted, criminals gained 30M
• FBI caught & convicted criminals

6. Case 2: Widespread Intelligence Gathering
• Early 2017, NYC Police detect Russian mafia activity focused on multiple
financial services companies
• Brooklyn-based criminals were tapping cell phones
• Both phones and network towers were targeted
• Numerous companies included – dragnet approach
• Concluded goal - intelligence gathering with intent to damage reputation
• Attacks were not detected or reacted to in real time
• Main conclusion came after criminals stole significant data

7. Case 3: M&A Espionage
Large investment bank
Late 2017 – detected compromise of CEO & COO devices
Traditional voice communications were recommended
3rd party apps were intercepting voice
IA determined multiple M&A opportunities were affected
Including multiple that were not closed successfully
IA response included recommendation for secure voice
telecommunications

8. Case 4: On-device Call Interception
Ongoing
American-based multinational financial
services
Early 2018
Malicious application on-device
App intercepts outbound calls and switched
the telephone number to fraudsters
App intercepts inbound fraudster call and
shows bank logo

9. Understanding the Mobile Ecosystem
• The three pillars of secure mobile
• Mobile Device
• Hardware, OS, Security APIs
• Applications
• Securing Distribution & Execution, Prevent Forgery &
Misleading Actions, App Management
• Network
• Call interception, call monitoring, message interception,
monitoring,
• Disproportionate focus on two pillars – securing
the network is hard!

10. What about the network?
“As early as 1996, members of Congress experienced calls being illegally
intercepted, however no technological solution to this problem has been
systematically deployed and it remains to this day.”
April 2017 Dept. Homeland Security. Study on Mobile Device Security
“In the United States, there are
no regulations requiring carriers
to run encryption or provide
privacy protections to users on
their networks”
“The caller ID display is
unauthenticated and can be
made to display any data,
including fraudulent
information.”
“[mobile devices] remain fully functional when running on non-encrypted
networks; no notification is provided to the user when operating in this mode.”

11. What about the network?
“LTE standards do not provide confidentiality protection for user traffic as
the default configuration”
“integrity protection for user traffic is explicitly prohibited”
“…security capabilities provided by LTE are markedly more
robust [than previous]…yet [LTE systems] coexist with
previous cellular infrastructure.”
“Current mobile devices do not provide the option for a user to know if
their [device’s] connection is encrypted...”
December 2017 NIST SP 800-187 Guide to LTE Security
[1] Jian A. Zhang, Peng Cheng, Andrew R. Weily, Y. Jay Guo. 2014. Towards 5th Generation Cellular Mobile Networks . Australian Journal of Telecommunications and the Digital Economy, Vol 2,
No 2, Article 34. http://doi.org/10.18080/ajtde.v2n2.34(link is external). Published by Telecommunications Association Inc. ABN 34 732 327 053. https://telsoc.org

12. Is Old News still News?
• To security professionals, telecommunication risk is
nothing new[1]!
• Why hasn’t this situation (drastically)?
• Thousands of companies in hundreds of countries
• Tens of technologies
• ~4.7 billion deployed phones
• 2G/3G fallback is consistent – GSM is still prevalent
• Making cellular networks at scale is very hard work
• CVEs may not exist – pentesting can be illegal!
[1] April 2016, NISTR 8071. Jeffrey Cichonski (NIST), Joshua Franklin (NIST), Michael Bartock (NIST) LTE Architecture Overview and Security Analysis
http://theinternetofthings.report/Resources/Whitepapers/
8965b6c5-40e0-448b-950a-a3adc428144b_
The%20Global%20State%20of%202G,%203G,%204G,%20and%205G.pdf

13. Is Old News still News?
• Why has this situation changed, drastically?
• Access to low-cost radio hardware
• In 2014
• “Baseband attacks are considered extremely difficult”[1]
• “system costs as much as $400,000”[2]
• In 2016, GSM ISMI Catcher for $1400[3]
• In 2018, “The cost of the hardware is about €1,250…”[4]
• Ettus USRP, HackRF, BladeRF, etc
• Prevalence of readily-available software
• OpenBTS, OpenBSC, OpenLTE
• Proactive nation-state attackers[5] puts backhaul & core at greater risk
[1] https://www.welivesecurity.com/2014/08/28/android-security-2/
[2] https://resources.infosecinstitute.com/stingray-technology-government-tracks-cellular-devices/
[3] https://securityaffairs.co/wordpress/41513/hacking/low-cost-imsi-catcher-lte.html
[4] https://www.evilsocket.net/2016/03/31/how-to-build-your-own-rogue-gsm-bts-for-fun-and-profit/
[5] https://securelist.com/regin-nation-state-ownage-of-gsm-networks/67741/

14. “Call me on the phone, I don’t want to write this down”
• Voice communications is frequently less secure than Wi-Fi
• But fewer CVEs – pentesting can be illegal
• Also…the logs are only in hands of MNOs/malicious entities
• Passive monitoring of un/poorly-encrypted air-traffic
• From ground or space!
• Calls or messages, device tracking
• Rogue towers
• Active intercept
• Downgrade, de-auth attacks
• Backhaul / Core network attacks
• No end-to-end security of user data
• User data can be sniffed from core network
• Malicious attacks on carrier
• Malicious carrier

15. But isn’t LTE more secure
• GSM is still the most common global connection
• Smart jamming 3G/UMTS and 4G/LTE triggers fallback to 2G/GSM
• Regardless of LTE, the device is not secure due to fallback
• Rogue base stations are still very real
• LTE has poor support for user data security
• By default, no user data encryption by default
• Disallows user data integrity
• No notice to user about non control connection
• No regulations about backhaul/core network
• Prior evidence of nation-state interest here
• Lack of confidentiality – sniff SMS/call traffic
• Physical access is always a weakness
• Geographic deployment of PKI onto towers
• Femtocell-based key theft
• No clear mandate forcing secure backhaul
https://opensignal.com/reports/2018/02/state-of-lte
Feb 2017
Global LTE Availability

16. What should an enterprise do to protect itself?
• Select ‘secure communication’ tools for your organization
• Multiple over-the-top options
• Many are easy to use
• Silent Phone supports management, PSTN integration, etc
• Review your sensitive communication policy
• NIST SP 800-171 - Compliance impossible with LTE-based cellular networks
• ISO 27001 – Does not address cellular well, but A.9.2.3 is difficult
• Short answer – recommend a ‘sensitive calling’ app
• Train your employees
• Traditional voice calls are insecure
• Traditional calls are being attacked
• Use a ‘secure communication’ tool
Steve Davis | Silent Circle
Silent Phone stephendavis
Office 646.681.6841
Mobile 908.285.4525