WordPress Websites for Engineers: Elevate Your Brand
How to Intercept a Conversation Held on the Other Side of the Planet
1.
2. How to Intercept a Conversation
Held on the Other Side of the
Planet
3. Who we are
Sergey Puzankov
Dmitry Kurbatov
Information Security Specialists
Positive Technologies
4. Denial of Service on Mobile Switching Center
Fraud in SS7 network
Short Message Interception
USSD Money Transfer
Subscriber’s Location
Voice Call Interception
Hot for Mobile network operators
Hot for everyone
Topics
5. All of us are subscribers
Service Availability
Quality of Service
Security
11. Today: Widen Borders
Get your own femtocell
• Hack it
• Upload modified firmware
• Make a call/SMS interception
• Get into IPsec
• Get into Core network
42. SS7
Make it starve
HLR
Attacker
as HLR
B
MSC
VLR
Gateway
MSC
We know
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
3PRNprovideRoamingNumber
I am HLR.
My GT 1 321 4567801.
Provide MSRN for
Subscriber-B IMSI 15 digits.
43. SS7
Make it starve
HLR
Attacker
as HLR
B
MSC
VLR
Gateway
MSC
We know
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
MSRN 0 123 4560001
3PRN
4 provideRoamingNumber
MSRN 0 123 4560001
44. SS7
Make it starve
HLR
Attacker
as HLR
B
MSC
VLR
Gateway
MSC
We know
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
MSRN 0 123 4560001
3PRN
4
Default timeouts for MSRN:
• Ericsson – 30 sec
• Huawei – 45 sec
provideRoamingNumber
MSRN 0 123 4560001
45. SS7
Make it starve
HLR
Attacker
as HLR
B
MSC
VLR
Gateway
MSC
We know
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
MSRN 0 123 4560001
…
MSRN 0 123 4569999
3PRN
4
provideRoamingNumber
I am HLR.
My GT 1 321 4567801.
Provide MSRN for
Subscriber-B IMSI 15 digits.
provideRoamingNumber
I am HLR.
My GT 1 321 4567801.
Provide MSRN for
Subscriber-B IMSI 15 digits.
provideRoamingNumber
I am HLR.
My GT 1 321 4567801.
Provide MSRN for
Subscriber-B IMSI 15 digits.…
provideRoamingNumber
MSRN 0 123 4560001provideRoamingNumber
MSRN 0 123 4560001
provideRoamingNumber
MSRN 0 123 4569999…
46. SS7
Make it starve
HLR
Attacker
as HLR
B
MSC
VLR
Gateway
MSC
We know
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
MSRN 0 123 4560001
…
MSRN 0 123 4569999
3PRN
4
provideRoamingNumber
I am HLR.
My GT 1 321 4567801.
Provide MSRN for
Subscriber-B IMSI 15 digits.
69. SS7
Forward a call
HLR
Attacker
as MSC
B
MSC
VLR
Gateway
MSCA
HLR stores
Subscriber-B
MSISDN 0 123 4567802
IMSI 15 digits
MSC/VLR 1 321 4567801
5
6
sendRoutingInfo
Where is
Subscriber-B MSISDN 0 123 4567802
=
Where is Subscriber-B located?
70. SS7
Forward a call
HLR
Attacker
as MSC
B
MSC
VLR
Gateway
MSCA 5
6
HLR stores
Subscriber-B
MSISDN 0 123 4567802
IMSI 15 digits
MSC/VLR 1 321 4567801
7 provideSubscriberInfo
I am HLR.
My GT 0 123 4567800.
Provide location for the
Subscriber-B.
71. SS7
Forward a call
HLR
Attacker
as MSC
B
MSC
VLR
Gateway
MSCA 5
6
HLR stores
Subscriber-B
MSISDN 0 123 4567802
IMSI 15 digits
MSC/VLR 1 321 4567801
7
8
provideSubscriberInfo
Subscriber-B is in the
Home network.
72. SS7
Forward a call
HLR
Attacker
as MSC
B
MSC
VLR
Gateway
MSCA 5
6
HLR stores
Subscriber-B
MSISDN 0 123 4567802
IMSI 15 digits
MSC/VLR 1 321 4567801
GatewayMSC knows that
Subscriber-B is at home.
This information will be
sent to a billing platform.
7
8
8
73. SS7
Forward a call
HLR
Attacker
as MSC
B
MSC
VLR
Gateway
MSCA
HLR stores
Subscriber-B
MSISDN 0 123 4567802
IMSI 15 digits
MSC/VLR 1 321 4567801
5
9
sendRoutingInfo
Where is
Subscriber-B MSISDN 0 123 4567802
located =
What is MSRN for Subscriber-B?
74. SS7
Forward a call
HLR
Attacker
as MSC
B
MSC
VLR
Gateway
MSCA 5
9
HLR stores
Subscriber-B
MSISDN 0 123 4567802
IMSI 15 digits
MSC/VLR 1 321 4567801
provideRoamingNumber
I am HLR.
My GT 0 123 4567800.
Provide MSRN for
Subscriber-B IMSI 15 digits.
10
80. Who pays?
ACall from to while at “home” = $ 0.05B
ACall from to = $ 1.00Cuba
$ 1.00 - $ 0.05 = $ 0.95 – Attacker profit
81. Call from to = $ 0.30
Who pays?
ACall from to while at “home” = $ 0.05B
ACall from to = $ 1.00Cuba
$ 1.00 - $ 0.05 = $ 0.95 – Attacker profit
How much Mobile operator loses? MNO Cuba
90. SS7
SMS interception
HLR
B
MSC
VLR
Gateway
MSC
7
5 6
Attacker
as MSC
A
sendRoutingInfoForSM
I am SMSC.
My GT 0 123 4567804.
Where is
Subscriber-B MSISDN 0 123 4567802?
sendRoutingInfoForSM
I am HLR 0 123 4567800
MSC/VLR 1 321 4567801
Subscriber-B IMSI 15 digits
SMS-C
5
“Hi, meet at 8pm at Baker
Street”
HLR sends Attacker address
instead of real MSC!
91. SS7
SMS interception
HLR
B
MSC
VLR
Gateway
MSC
7
5 6
8
Attacker
as MSC
A
sendRoutingInfoForSM
I am SMSC.
My GT 0 123 4567804.
Where is
Subscriber-B MSISDN 0 123 4567802?
sendRoutingInfoForSM
I am HLR 0 123 4567800
MSC/VLR 1 321 4567801
Subscriber-B IMSI 15 digits
SMS-C
5
“Hi, meet at 8pm at Baker
Street”
SMS-C routes this SMS to
the received address.
92. SS7
SMS interception
HLR
B
MSC
VLR
Gateway
MSC
7
5 6
8
Attacker
as MSC
A
sendRoutingInfoForSM
I am SMSC.
My GT 0 123 4567804.
Where is
Subscriber-B MSISDN 0 123 4567802?
sendRoutingInfoForSM
I am HLR 0 123 4567800
MSC/VLR 1 321 4567801
Subscriber-B IMSI 15 digits
SMS-C
5
“Hi, meet at 8pm at Baker
Street”
SMS-C routes this SMS to
the received address.
93. SMS interception
1. SMS chats
2. One time passwords
3. Confirmation codes
4. Password recovery
97. SS7
Collect info
HLR
B
MSC
VLR
Gateway
MSC
1
1
2
2
SRI4SM
We know
B-Number 0 123 4567802
HLR 0 123 4567800
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
Attacker
as SMSC
A
SRI4SMsendRoutingInfoForSM
I am SMSC.
My GT 1 321 4567801.
Where is
Subscriber-B MSISDN 0 123 4567802?
sendRoutingInfoForSM
I am HLR 0 123 4567800
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
98. SS7
Send USSD 1
HLR
Attacker
as MSC/VLR
B
MSC
VLR
Gateway
MSCA
We know
HLR 0 123 4567800
Subscriber-B IMSI 15 digits
*100#3
processUnstructuredSS-Request
I am MSC/VLR.
Request how much money has
subscriber with IMSI 15 digits?
99. SS7
Send USSD 1
HLR
Attacker
as MSC/VLR
B
MSC
VLR
Gateway
MSCA
processUnstructuredSS-Request
I am MSC/VLR.
Request how much money has
subscriber with IMSI 15 digits?
We know
HLR 0 123 4567800
Subscriber-B IMSI 15 digits
Account info.
3
4
processUnstructuredSS-Request
Subscriber’s account is $$$$$.
100. SS7
Send USSD 1
HLR
Attacker
as MSC/VLR
B
MSC
VLR
Gateway
MSCA
We know
HLR 0 123 4567800
Subscriber-B IMSI 15 digits
Account info.
4
processUnstructuredSS-Request
Subscriber’s account is $$$$$.
processUnstructuredSS-Request
I am MSC/VLR.
Request how much money has
subscriber with IMSI 15 digits?
3
101. SS7
Send USSD 2
HLR
Attacker
as MSC/VLR
B
MSC
VLR
Gateway
MSCA
We know
HLR 0 123 4567800
Subscriber-B IMSI 15 digits
Account info.
*123*01238765400*100#
processUnstructuredSS-Request
I am MSC/VLR.
Transfer money from IMSI 15 digits to
my mobile account.
5
102. SS7
Send USSD 2
HLR
Attacker
as MSC/VLR
B
MSC
VLR
Gateway
MSCA
We know
HLR 0 123 4567800
Subscriber-B IMSI 15 digits
Account info.
6
processUnstructuredSS-Request
OK.
processUnstructuredSS-Request
I am MSC/VLR.
Transfer money from IMSI 15 digits to
my mobile account.
5
103. SS7
Send USSD 2
HLR
Attacker
as MSC/VLR
B
MSC
VLR
Gateway
MSCA
We know
HLR 0 123 4567800
Subscriber-B IMSI 15 digits
Real account info.
Subscriber B does not get
SMS notification if Attacker
combines this attack with
the previuos one.
6
processUnstructuredSS-Request
OK.
processUnstructuredSS-Request
I am MSC/VLR.
Transfer money from IMSI 15 digits to
my mobile account.
5
104. SS7
Send USSD 2
HLR
Attacker
as MSC/VLR
B
MSC
VLR
Gateway
MSCA
We know
HLR 0 123 4567800
Subscriber-B IMSI 15 digits
Real account info.
Subscriber B does not get
SMS notification if Attacker
combines this attack with
the previuos one.
6
processUnstructuredSS-Request
OK.
processUnstructuredSS-Request
I am MSC/VLR.
Transfer money from IMSI 15 digits to
my mobile account.
5
108. SS7
Collect info
HLR
B
MSC
VLR
Gateway
MSC
1
1
2
2
SRI4SM
We know
B-Number 0 123 4567802
HLR 0 123 4567800
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
Attacker
as SMSC
A
SRI4SMsendRoutingInfoForSM
I am SMSC.
My GT 1 321 4567801.
Where is
Subscriber-B MSISDN 0 123 4567802?
sendRoutingInfoForSM
I am HLR 0 123 4567800
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
109. SS7
Get Cell ID
HLR
Attacker
as HLR
B
MSC
VLR
Gateway
MSC
We know
B-Number 0 123 4567802
HLR 0 123 4567800
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
3PSIprovideSubscriberInfo
I am HLR.
My GT 1 321 4567801.
Provide location for the
Subscriber-B.
110. SS7
Get Cell ID
HLR
Attacker
as HLR
B
MSC
VLR
Gateway
MSC
We know
B-Number 0 123 4567802
HLR 0 123 4567800
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
Cell ID
3PRN
4 provideSubscriberInfo
Cell ID.
provideSubscriberInfo
I am HLR.
My GT 1 321 4567801.
Provide location for the
Subscriber-B.
111. SS7
Get Cell ID
HLR
Attacker
as HLR
B
MSC
VLR
Gateway
MSC
We know
B-Number 0 123 4567802
HLR 0 123 4567800
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
Cell ID
3PRN
4 provideSubscriberInfo
Cell ID.
provideSubscriberInfo
I am HLR.
My GT 1 321 4567801.
Provide location for the
Subscriber-B.
MCC: 250
MNC: 90
LAC: 4A67
CID: 673D
112. SS7
Get location
HLR
Attacker
as HLR
B
MSC
VLR
Gateway
MSC
We know
B-Number 0 123 4567802
HLR 0 123 4567800
MSC/VLR 0 123 4567803
Subscriber-B IMSI 15 digits
Cell ID
5
MCC: 250
MNC: 90
LAC: 4A67
CID: 673D
Search in Internet physical
location by MCC, MNC, LAC, CID