The document summarizes security threats related to small cells and mobile networks. It discusses physical threats, device and hardware vulnerabilities, risks associated with virtualization and network functions. The document also covers security issues for 5G networks, risks of data manipulation, and the need for resilience against threats like IoT botnets. Existing research on attacks are also referenced.

1. Security Briefing
Prof. David Rogers, Copper Horse
@drogersuk
1st March 2017
Mobile World Congress 2017
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved. 1

2. Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Introduction
2

3. • What are the existing threats in the small cells world
• Why?
• What do you need to look for?
• Who is targeting small cells?
• The user as an enemy
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Security Threats and Risks
3

4. Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Physical and Environment Security
4
• How easy is it to target infrastructure?
• Physical attacks on small cells
• Constrained environments
• Remote installations and satellite considerations
• Measures you can take

5. Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Device and Hardware Security
5
• Getting the foundations right
• Building for failure
• Advanced defensive techniques
• Moving functionality off the device
• How attackers approach hardware hacks and why they do it

6. Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Virtualisation
6
• NFV and SDN
• Sandboxing and containerisation
• Cloud processing and attacks
• Resilience
• Randomness and non-randomness
• Where is my data?
• X86, what?
• Attacks
Image source: ETSI

7. • Different networks, different security
• Accepting risk
• Untrusted backhaul
• Gateway security and traffic monitoring
• Jamming
• Don’t be flooded
• Points of security failure
• Self-Organising Networks (SON)
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Protecting the Network
7

8. Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Who is Connected to the Future Internet?
8
Source:
http://cheezburger.com/8068370944
Source:
http://spectrum.ieee.org/computing/em
bedded-systems/on-the-internet-of-
things-nobody-knows-youre-a-dog

9. Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
5G
9
• Considering how to design 5G for multiple needs
• Safety and privacy
• Appropriate security at nodes
• Network density security aspects
• The potential of downgrade attacks
• Masquerading
• 5G security planning

10. Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Security Contexts
10
• Appropriate security, deployed correctly

11. Natural Disasters & Critical Infrastructure
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved. 11
Image source: https://nayabchohan.com/author/nayabchohan786/

12. Wireless from Above
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved. 12
http://www.mobilephonesecurity.org

13. Can You Trust the Data?
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved. 13
Source: “Worldwide Threat Assessment of the US Intelligence Community, February 2015 and 2016”
http://www.dni.gov/files/documents/Unclassified_2015_ATA_SFR_-_SASC_FINAL.pdf
http://www.dni.gov/files/documents/SASC_Unclassified_2016_ATA_SFR_FINAL.pdf
James Clapper, US Director of National Intelligence:
“we might also see more cyber operations that will change
or manipulate electronic information in order to
compromise its integrity (i.e. accuracy and reliability)
instead of deleting it or disrupting access to it.” (2015)
“cyber actors will seek to exploit the integrity of networked
and online information. This runs the gamut from modifying
and transmitting false data to public utilities and market
firms, to implanting false information on online media. ”
(2016)

14. Data Manipulation (1)
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved. 14

15. Data Manipulation (2)
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved. 15

16. Resilience
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved. 16

17. Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Compromised Connected Pets and Toys
17

18. Legacy?
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Servants’ Bells Copyright Adam Tinworth
https://www.flickr.com/photos/adders/6
041931491
CC BY-ND 2.0
18

19. Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Mr Robot
19
Images: fair use, Amazon

20. Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
Existing and Upcoming Security Research
20
 DEF CON 24, 2016

21.  Largest DDoS recorded
 Scans the whole internet
 Brute-forces telnet and infects
 Uses default passwords
– Admin / admin etc.
 Mostly CCTV cameras / routers
– Major network operator hit badly
– Also cars, trucks, laptops, M2M…
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
IoT botnet: Mirai
21
Image: www.malwaretech.com
Further reading: http://blog.mobilephonesecurity.org/2016/10/dead-on-arrival-
whats-next-for-iot.html
https://www.malwaretech.com/2016/10/mapping-mirai-a-botnet-case-study.html

22.  Open source
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
IoT botnet: Mirai (2)
22
Image: https://github.com/jgamblin/Mirai-Source-Code/issues/8

23. Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved.
SHA-1
23

24. SCF Release 9
Small Cell Forum Release 9, security:
http://www.scf.io/en/documents/171_Comprehensive_overview
_of_small_cell_security.php
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved. 24

25. Thanks!
david.rogers [@] copperhorse.co.uk
@drogersuk
@copperhorseuk
Copyright © 2017 Copper Horse Solutions Ltd. All rights reserved. 25