HES2010-planglois-Attacking-SS7.pdfVIP

Getting in the SS7 kingdom: hard technology and disturbingly easy hacks to get entry points in the walled garden. Telecommunications Infrastructure Security Philippe Langlois, P1 Security Inc. phil@ P1 Security Inc, SS7 network Reliability P1 Security Inc, Why do we have SS7? ? Thanks to hackers! ? CCITT#5 in-band signalling sends control messages over the speech channel, allowing trunks to be controlled ? Seize trunk (2600) / KP1 or KP2 / destination / ST ? Started in mid-60’s, became popular after Esquire 1971 ? Sounds produced by whistles, electronics dialers, computer programs, recorded tones 3 Steve Jobs and Steve Wozniak in 1975 with a bluebox P1 Security Inc, How to get in? ? HLR/VLR Home Location Register, Visitor Location Register ? AuC : Authentication Center (within HLR) ? EIR : Equipment Identity Register ? MSC : Mobile Switching Center ? STP : Signaling Transfer Point (i.e. Router) ? LIG : Legal Interception Gateway? ME vuln. research OpenBSC OpenBTS + crypto cracking External APIs to HLR: location, IMSI SMS injection Scanning and Hacking SS7 CN FemtoCell hacking ? Illegal : SQL Injection? Uhh? ? Consulting : Nahh... not possible! (?) ? Product : Yes please! P1 Security Inc, Under the hood: SS7 stack P1 Security Inc, Important SS7 protocols ? MTP (Message Transfer Part) Layers 1-3: lower level functionality at the Physical, Data Link and Network Level. They serve as a signaling transfer point, and support multiple congestion priority, message discrimination, distribution and routing. ? ISUP (Integrated Services Digital Network User Part): network side protocol for the signaling functions required to support voice, data, text and video services in ISDN. ISUP supports the call control function for the control of analog or digital circuit switched network connections carrying voice or data traffic. ? SCCP (Signaling Control Connection Part): supports higher protocol layers such as TCAP with an array of data transfer services including c