A big challenge for mobile network operators in the new, ever-evolving 5G era is the signaling security of the standardized protocols used in order to exchange data. Telecommunication companies face this challenge and have to be on the verge every time there is a potential hacker attack. What is the best way to approach these striking threats and even to be ready before it occurs? In our webinar, Positive Technologies will offer you several breakthrough strategies on how to deal with security flaws in telecom. Our expert will show you the evolution of protocol security, share insights into the potential activities of a hacker and give useful advice about compliance with security standards.

1. Signaling Security
essentials.
Ready, steady, 5G!
Paolo Emiliani
Leading Technical Manager

2. Agenda
1/4 of presentation
V
Introduction about me and Positive Technologies
V
V
Security guidelines
V
Inherited and new security issues in 5G & IoT
The never ending battle

3. Who I am
 Started as Telecommunication and Airlines system Engineer in 1996
 System & Network Engineer in 2000
 Broadband/Distributed Network Designer
(deployment of one of biggest private network based on DWDM technology)
 Switched to security in 2010
 Working, having fun in a team of eager security friends
@ Positive Technologies, since 2012
 IoT Security Analyst
Signaling System 7
(SS7) security report
Vulnerabilities of
mobile Internet (GPRS)
2014 2016
Primary security threats
to SS7 cellular networks
2017
Threats to packet core
security of 4G network
Next-generation networks, next-level
cybersecurity problems (Diameter vulnerabilities)
2018
Diameter vulnerabilities
exposure report
2019
5G security
analytics

4. Positive Technologies at glance
V V
V
V
VV
17 years
of experience
in security development
and research
200+
zero-day vulnerabilities
discovered yearly
900 employees:
security engineers,
developers, analysts,
and others
200+
corporate security audits
performed for clients annually
250 experts
at our security
research center
50%
of all industrial and telecom
vulnerabilities are discovered
by our experts
We protect enterprise information
systems from cyberthreats by:
 Creating products and solutions
 Performing security audits
 Investigating incidents
 Researching threats

5. What we do
Competences:
Identification of threats and possible
attack scenarios in companies of any
business sphere
Global cybersecurity research
Wide range of products and services
portfolio: corporate, ICS, telecom,
financial, media, retail, government
National scale sports and government
cybersecurity service provider
Worldwide leadership
Web
Banking
ERP
Telecom
IoT
ICS
More IT technologies
penetrate
into other segments

6. Analytics
and research
OVER 20+
PUBLICATIONS YEARLY:
Quarterly reports on the latest cyber threats and
trends, forecasts and investigations of hacker
activity, industry-specific information
positive-tech.com/articles/
ptsecurity.com/ww-en/analytics

7. Agenda
2/4 of presentation
V
Introduction about me and Positive Technologies
V
V
Security guidelines
V
Inherited and new security issues in 5G & IoT
The never ending battle

8. Analogue
1980 1991 1999 2001 2005 2010 2017
1G 2G 2.5G+ 3G 3.5G 4G 5G
SS7
GTP
SIP
4.5G
APIs
Diameter
Mobile signaling history
2019
Constant & continual introduction of additional network access

9. 1G 2G 2.5G+ 3G 3.5G 4G 5G4.5G
How everything started for us
Tell a story about how we
started. The first SA, the first
findings, how we helped
customers
...and then how we continued
to help customers on 3G 4 & 4.5G, customers
everywhere are experiencing
the new trending cross
protocol attacks
...and then how we continued
to help customers on 3G
Stories about people

10. Protocol threat comparisons
Successful attacks by threat types
Threat
Percentage of vulnerable
networks (2017)
SS7
networks
Diameter
networks
Subscriber information disclosure 100% 100%
Network information disclosure 63% 75%
Subscriber traffic interception 89% —*
Fraud 78% 33%
Subscriber denial of service 100% 100%
* In the tested networks, SMS transmission using the Diameter network was not carried out.
To establish voice calls in 4G networks, the SIP protocol is used.
Possible different reasons for previous generations
out performing Diameter in certain areas.
 SS7 threat awareness is higher
 Diameter specific challenges
Positive Technologies have further research being
published very soon looking at Diameter.
Comparing 4G networks using Diameter against
earlier network generations

11. Positive Technologies
SS7 Research Facts and Figures
Threat
Average number
of attacks per day
Subscriber information disclosure 4,827
IMSI disclosure 3,087
Subscriber location disclosure 3,718
Subscriber profile disclosure 47
Network information disclosure 4,294
Fraud 62
Call redirection 2
USSD request manipulation 59
Real-time billing evasion 2
SMS interception 1
Disruption of service availability for subscribers 4

12. Positive Technologies
SS7 Research Facts and Figures
Threat
Average number
of attacks per day
Subscriber information disclosure 4,827
IMSI disclosure 3,087
Subscriber location disclosure 3,718
Subscriber profile disclosure 47
Network information disclosure 4,294
Fraud 62
Call redirection 2
USSD request manipulation 59
Real-time billing evasion 2
SMS interception 1
Disruption of service availability for subscribers 4
Hackers exploit SS7
flaws to drain bank accounts
February 2017, Germany
Perform phishing attack and
steal usernames/passwords
for bank accounts
Perform SMS interception
attacks via SS7 and obtain
one-time passwords
Use OTPs to confirm
money transfer
theregister.co.uk/2017/05/03/hackers_fire_up_ss7_flaw

13. Causes of Diameter
Vulnerabilities
Encryption is formally mandatory, however not often used in home
and only occasionally at boundaries. In addition, encryption is peer-to-peer,
and not end-to-end so relies on trust
Substitution of the source is a specific behaviour of the Diameter protocol
where all responses must follow the same route the request came from.
Category 1
Category 2
Category 3
Successful Diameter attacks by GSMA FS.19 Category
* GSMA FS.19 document also describes the zero category but not considered here
CAT0
describes basic traffic filtering
at the network level
CAT1
includes configuring the
allowed interfaces and
messages on the DEA / DRA
CAT2
defines message filtering
and blocking by legitimacy
IMSI/source combination
CAT2
Operator mist cross reference
messages correspond to the
subscriber's motion matrix
(i.e. last fixed location and the
time since last location update).
Complex

14. Agenda
3/4 of presentation
V
Introduction about me and Positive Technologies
V
V
Security guidelines
V
Inherited and new security issues in 5G & IoT
The never ending battle

15. Convergence of
telecom and IT world
 The 5G network core
is TCP/IP-based
 These protocols are
open and well-known
 Tools for finding and
exploiting vulnerabilities
are available to
any adversary

16. Where do I start … slicing
 Splitting a network
into isolated slices
 Allocating separate
(virtual) resources
 Unique security
policies to each slice

17. Where do I start … slicing
more slices =
more virtual devices =
more configurations
BUT
1/3 successful attacks
during 4G network testing
due to misconfiguration
75% of corp harbored critical
or high-severity vulnerabilities
because of configuration flaws
Misconfiguration Misconfiguration Vulnerability in Rest API
Vulnerability in network equipment

18. New core, all virtual
 Lots of VMs
and containers
 Communication
over software bus
BUT NEF NRF PCF UDM AF
Network Exposure
Function
NF Repository
Function
Policy Control
Function
Unified Data
Management
Application
Function
AUSF
Authentication
Server Function
AMF
Core Access and Mobility
Management Function
SMF
Session Management
Function
Nnef Nnrf Npcf Nudm Naf
Nusf Namf Nsmf
UE (R)AN UPF DN
User Plane
Function
N2 N4
N5N3
N1

19. New core, all virtual, web-based
Example
of communication
between functions
Service Registration
Service Discovery
Session Establishment
Session
Establishment Request
HTTP PUT (NF register)
201 Created
HTTP PUT (NFDiscovery)
200 OK (List of SMSFs)
HTTP POST (Create PDU Session)
201 Created

20. More security by design but many
heterogeneous engress points
Plane Generation Protocol Authentication Confidentiality Integrity
2G/3G
SS7 — — —
GTPv1 — — —
4G
Diameter partial partial partial
GTPv2 — — —
5G HTTP/2 + + +
2G/3G/4G GTP — — —
5G
GTP-over-
IPSec
+ + +
Diameter usage can be
extended. Implementation is
under discussion with GSMA.
Encryption using IPsec can
provide more security in 5G.
But all the same was planned
for Diameter – never
implemented in real life.
Signaling /
Control
Data / User

21. The migration process
from 4G to 5G
The network evolution will happen in 2 steps
The existing network uses legacy
protocols. This stack of technologies
has security deficiencies that can lead
to data interception, fraud and DoS
attacks
During transition phase new 5G
radio network will be using EPC
since 5G core is not in place yet.
This means that all security issues
from the past are still relevant.
As soon as 5G standalone is
implemented it will probably solve
legacy security issues. But we need
to keep eye on new ones that will
definitely appear.
EPC
eNB
EPC
eNB gNB
EPC
eNB gNB
5GC
Today: 4G 2-5 years horizon:
Non-Standalone 5G
(Option #3, for instance)
In future:
Standalone 5G

22. Old/new threats applied
to the 5G architecture
An example 5G deployment
and the relevant attacks:
 Data interception
 Impersonation
 Denial of Service
 Asset compromise
 etc.

23. Inherited issue
AvailabilityConfidentiality
IntegrityIntegrity
ConfidentialityAvailability
USUALSECURITY
PRIORITIES
IOTSECURITY
PRIORITIES
5G non-standalone is vulnerable to denial of service

24. Problem is still there and not solved
Hacking 5G will be possible as hacking the web or enterprise
Difficulty of bypassing the perimeter (percentage of systems) Security level (percentage of web applications)

25. Now what can a hacker do?
Easily
From
anywhere
Any mobile
operator
No special
skills needed
Steal your money
Get access to your
email and social media
Track your location
Intercept your data, calls,
and SMS messages
Take control of
your digital identity
from
GSM to 5G
Different protocols
SAME THREATS
Perform massive
denial-of-service attacks

26. Briefly about IoT
GARTNER: "By 2020, over 25% of identified attacks in enterprises will involve IoT"
32%
37%
24%
8%
0
5
10
15
20
25
30
35
40
1 2 3 4
Smart metering
 Gas metering
 Water metering
Smart cities
 Streetlights
 Parking
 Waste management
Consumer
 White goods
 People tracking
Smart buildings
 Alarm systems
 HVAC
 Access control
Agriculture / Environment
 Land / Environment monitoring
 Pillution monitoring
 Animal trackingAlready
use IoT
Preparing to
implement IoT
Will wait
and see
Will wait as long
possible

27. Guess how easy is it?
Millions of connected IoT devices mean
millions of potential botnet soldiers
Mirai,
500K devices
in botnet
2016
1M potentially
vulnerable
2019 TOTAL RESULTS 1,086,395
TOP COUNTRIES

28. Application
Network
Device
IoT/Cellular IoT Device
Reserve Analyze and Security
Assessment on IoT Device
M2M SIM
SS7 SA, GTP SA
Diameter SA,
Secure Network
GTP SA,
Penetration Testing
IoT Web &
Mobile App
Web and Mobile
Application
Testing
MNO IoT
Manegement
System
Penetration
Testing
SIM
Management
Platform
Penetration
Testing
Big Data
Platform
Penetration
Testing
Management Level:
Service Providers IoT
with Private offices
for B2B Clients
Penetration Testing
To Secure IoT you have
to know its DNA

29. Agenda
4/4 of presentation
V
Security guidelines
 Adherence to standards
 4/5G Security cycle
 IoT Security recomendations

30. Security
recommendations
GSMA
 FS.07 SS7 and SIGTRAN Network Security
 FS.11 SS7 Interconnect Security Monitoring Guidelines
 IR.82 Security SS7 implementation on SS7 network
guidelines
 FS.21 Overview document on SS7 Diameter and GTP.
 FS.19 Diameter Protocol Security
 IR.88 Provides detail on Diameter & GTP protocols
and interworking with SS7
FCC
FCC Public Notice and CSRIC's Legacy
Systems Risk Reductions Report
ENISA
Signaling Security in Telecom
SS7/Diameter/5G. EU level assessment
of the current situation

31. GSMA Recommendations
Explained
GSMA
FS.07
GSMA
FS.11
GSMA
FS.82
Monitoring
Filtering
SS7 Interconnect security monitoring and firewall guidelines
SS7 and SIGTRAN network security
SS7 security network implementation guidlines
1.1 Overview
Signalling System 7 (SS7) was designed and initially deployed for a closed telecommunications community because
relatively few telephone companies with well-defined network boundaries existed. Therefore, SS7 possesses limited
security capabilities, but that environment no longer exists because of market liberalization/deregulation.
1.1 Overview
This document is designed to outline at a high level how mobile operators can monitor and sample interconnect Signalling
System 7 (SS7) traffic to investigate if they have experienced, or are likely to experience, unwanted or malicious SS7 traffic
that may affect their network, and to improve the protection of their networks against such traffic. It outlines signs of
abnormalities, how operators can handle these abnormalities to protect their networks, and how an operator can report
these abnormalities to the GSMA.
1.1 Overview
This document describes the different recommended and practical technical details of SS7 security aspects implemented
by PLMNs or carriers in order to counter potential SS7 attacks.
Earlier versions of this document (before 2014) were focussed only on SMS and the scope is now extended to all SS7
messages, including MAP and CAP signalling.

32. GSMA Recommendations
Explained
GSMA
FS.19
GSMA
FS.21
GSMA
FS.88
Diameter interconnect security
Interconnect signaling security recommendations
LTE and EPC Roaming guidlines
1.1 Overview
Mobile network operators (MNOs) have historically treated all signaling messages received from outside the network as trusted and
necessary/ As access to and use of the signaling networks has evolved, interconnect signaling protocols such as Signaling System number
7 (SS7), Diameter, and the GPRS Tunneling Protocol (GTP) have been discovered to be vulnerable to exploitation, potentially enabling
attackers to perform eavesdropping, service denial, location tracking and fraud. The GSMA has produced recommendations for mobile
operators to mitigate these risks and prevent attacks by monitoring and filtering signaling traffic, leading to greater protection for their
customers and businesses/ This document provides a risk-based introduction to the topic in a non-technical manner.
1.1 Overview
This document outlines potential Diameter based attacks against mobile networks and their customers, and
countermeasures for those attacks. It aims to provide an understanding of potential risks, threats and countermeasures
related to LTE and 5G interconnection security to GSMA members. This document describes attacks and countermeasures
known to the authors at the time of publication, but future research may highlight possible new attacks at any time. The
full details of technical countermeasures can be found in GSMA permanent reference document (PRD) IR.88 [9].
1.1 Overview
This document aims to provide a standardised view on how Long Term Evolution (LTE) and Evolved Packet Core (EPC)
networks can interwork in order to provide "Next Generation Mobile Network" capabilities when users roam onto a
network different from their HPMN. Expectations of the "Next Generation Mobile Network” capabilities are described in
the GSMA Project Document: Next Generation Roaming and Interoperability (NGRAI) Project Scope White Paper [16].

33. Complete Telecom
Operator Security
V
GSMA Recommendations
Start monitoring
Impossible to prevent signaling network
access: detection is the key
GSMA, Interconnect Security
The usage of automated ways of testing
and monitoring may become mandatory Assess
Monitor
Protect
Auditing provides the essential
visibility to fully understand your
ever changing network risks.
Continual real time monitoring is essential
to measure network security efficiency
and provide rapid detection and mitigation.
Completely secure
your network by
addressing both
generic
vulnerabilities
(GSMA) and the
threats that actually
effect you as an
ongoing process.

34. Complete Telecom
Operator Security
V
GSMA Recommendations
Start security testing
Network Architecture and
ImplementationAudit / Testing
 Auditing … is the only way to ensure
that security is working the way it should
 A variety of attacks have already been successfully
performed on production network equipment of MNOs
 Only a comprehensive approach to security will
result in effectively countering the attacks described
Assess
Monitor
Protect
Auditing provides the essential
visibility to fully understand your
ever changing network risks.
Continual real time monitoring is essential
to measure network security efficiency
and provide rapid detection and mitigation.
Completely secure
your network by
addressing both
generic
vulnerabilities
(GSMA) and the
threats that actually
effect you as an
ongoing process.

35. Step 1. Introduce monitoring
of signaling security
Step 1 Step 2 Step 3 Step 4 Step 5
Why you need it
Your network is being attacked right now:
focus your attention on the vulnerabilities
being exploited in real-time
Always be aware of new breaches
and threats
Follow GSMA recommendations
on security monitoring (FS.11)
Results
Ability to take proactive measures
during early stages of an attack
Empirical evidence for the
operator showing the likely sources
of illegitimate traffic
How to do it
Install SS7 security monitoring system
Route copy of external signaling traffic
to the system
Identify malicious traffic
and its sources in real time

36. PT—TAD (Treat inteligence – IDS)
Passive traffic taps feed
monitor with raw traffic
or traffic copy
Detect dangerous traffic
and list active attack
sources
Analyze and prioritize
real threats for your
network and subscribers

37. Step 2.
Implement protection measures
Step 1 Step 2 Step 3 Step 4 Step 5
Why you need it
You already know your attack
exposure and which vulnerabilities are
being exploited, so now protect your
network immediately
Results
Improved security level
of the network
Reduction in the number
of attack attempts
How to do it
Create a filtering policy
Fine-tune network configuration
Contact the MNOs that originate
suspicious traffic

38. Protect
Targeted protection
against hacker attacks
Protection against
configuration errors
More security with less
efforts
Powerful threat
intelligence

39. Step 3.
Signaling security assessment
Step 1 Step 2 Step 3 Step 4 Step 5
Why you need it
Gain visibility into signaling network
vulnerabilities
See your network the way a hacker sees it
Follow GSMA recommendations (IR.82)
Results
Understanding of all existing
vulnerabilities
Step-by-step plan for mitigating
weaknesses before intruders start
abusing them
How to do it
Scan the network from international
signaling vantage point
Use advanced methods to check whether
current security tools are effective

40. Vulnerability
Management
Deliverables
 Information about existing
and potential vulnerabilities
 Recommendations for
improving network security
 Highly valuable info to
assess risks — you see
what hackers see!

41. Step 4.
Threats Validation / evaluation
Step 1 Step 2 Step 3 Step 4 Step 5
Why you need it
Identify threats and risks
Evaluate which risks are most
urgent for your company
Results
Informed decision
Tailored strategy
Effective action plan
How to do it
You already know:
 Your network flaws
 Vulnerabilities that are being exploited
 Vulnerabilities that could be exploited in the future
 Malicious countries, operators, and sources
 Attacked subscribers
With all information at hand,
now decide which risks to tackle first

42. Step 5.
Deploy security process
Step 1 Step 2 Step 3 Step 4 Step 5
Why you need it
Once you have an action plan and
know exactly what to do, it’s time
to implement your security strategy
Then check that the implemented
measures are effective
Results
Persistent awareness of the state
of security on your network
Benchmarking of the security level
Immediate reaction to security
incidents
How to do it
Continue security monitoring
Respond to threats as they occur
Scan the network regularly

43. Conclusion
Assess
Monitor
Protect
Auditing provides essential
visibility to fully understand your
ever-changing network risks.
Non-stop real-time monitoring is essential for
verifying the effectiveness of network security
and supporting rapid detection and mitigation.
Completely secure
your network by
addressing both
generic
vulnerabilities
(GSMA) and the
threats that actually
affect you as part of
an ongoing process.
 Visibility is the key to securing any protocol
as it allows informed security decisions
 Protection is possible using a number
of strategies
 Expert support speeds mitigations
and reduces resource demands
 Security is an ongoing process
and developing so long term easily
actionable strategy is key

44. Comprehensive
Multifaceted IoT Security Roadmap
Security
Assessment
Protection
Enforcement
Continuous
compliance

45. And new MQTT—
Enterprise landscapes

46. And new MQTT—
Enterprise landscapes
Technical aspect and Benefits
 Ability to filter out/in topics allowed
 Real-time dashboard & centralized console to:
 manage all IoT Firewalls in the domain
 view and manage attacks/exclusions/configurations
 Ability to drill-down into single firewall’s event
 Compact, yet powerful, dedicated hardware or Vm
 TLS offloading
 Monitor of anomalies of publisher/
subscriber by DPI
 Parse and identify anomalies automatically
(HMM) or manually (with regex)
 Ability to manage certificates for authentic-
cation with self-signed CA or their own CA

47. IoT How to secure?
IoT/NB-IoT Device
Reserve Analyze and Security
Assessment on IoT Device
M2M SIM
SS7 SA, GTP SA
Diameter SA,
Secure Network
GTP SA,
Penetration Testing
IoT Web &
Mobile App
Web and Mobile
Application
Testing
MNO IoT
Manegement
System
Penetration
Testing
SIM
Management
Platform
Penetration
Testing
Big Data
Platform
Penetration
Testing
Management Level:
Service Providers IoT
with Private offices
for B2B Clients
Penetration Testing
 Multi-Discipline Security
Supply chain security certification / SA
 Potentially Requires Large
Operator Security Team — Or Partnership
with a Large or Multiple Security Suppliers
 Continually Developing Services
Ongoing and Growing
Security Testing + MQTT FW

48. 5G deployment
verification
Ensure protection
where interoperability
required from day one
Secure new
interfaces and
communications
channels
Safeguard
SDN/NFV and
virtual environment
Implement policies
separately for
network slices
Take IoT in your
network under control
where possible

49. Get support
from our experts
Take a comprehensive
security approach:
 positive-tech.com/products/signalling-firewall/
 positive-tech.com/products/signalling-ids/
 positive-tech.com/services/express-monitoring/
 positive-tech.com/services/gsma-compliance-check/
 positive-tech.com/services/telecom-security/
 positive-tech.com/services/iot-security/
Learn more about
telecom security:
 positive-tech.com/articles/5g-security-issues/
 positive-tech.com/articles/ss7-vulnerability-2018/
 positive-tech.com/articles/next-generation-networks-next-level-
cybersecurity-problems/
with more at
positive-tech.com
contact@positive-tech.com

50. Thank
you