LTE Redirection
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Shan, Haoqi
Zhang, Wanqiao
LTE is a more advanced mobile network but not absolutely secure. Recently there already some papers those exposed the vulnerabilities of LTE network. In this presentation, we will introduce one method which jointly exploits the vulnerabilities in tracking area update procedure, attach procedure, and RRC redirection procedure, and finally can force a targeted LTE cellphone to downgrade into a malicious GSM network, then consequently can eavesdrop its data traffic or even voice call. This attack is not a simple DoS attack. It can select the targeted cellphone by filtering the IMSI number (IMSI catcher function), so it will not influence the other cellphones and keep them still in the real network. Further more, it can force the cellphone into the malicious network that we setup (a fake network) or we assign (operator’s network), therefore the cellphone has no chance to choose other secure network. This is the danger point of this attack. Bio: Haiqi Shan, currently a wireless/hardware security researcher in Unicorn Team. He focuses on GSM system, router/switcher hacking etc. Other research interests include reverse engineering on embedded devices such as femto-cell base station. He has gave presentations about GSM devices hacking and wireless hacking suit on DEF CON, Cansecwest, Syscan Wanqiao Zhang, is a communication security researcher, from Unicorn Team of Qihoo 360 China. She received her master degree in electronic information engineering form Nanjing University of Aeronautics and Astronautics in 2015. Fascinated by the world of wireless security, she is currently focus on the security research of the GPS system and the cellular network
 All right, so This is the point where you see the scary talk and at the end you probably turn your phone off So these guys have presented for us before they've they've done some amazing research very soon Kind of like they did last year, which was a really really cool talk. I think you guys are in for a real treat Let's give these guys a big hand Thank you guys, I really appreciate that. There's so many people so last a year my team have Had about three presentations and we got the GPS spoofing You've got a famous cell and we also got you know the Z could be and I really happy to stand here right again and You know share something so Here's my talk and This is the LTE redirection. So people will know about We People will know about you know, LT is for generation first generation, but people think it's more secure and Than the two generation and the third generation. So today let's Let's learn how to break it and My name is Ho Chi Shan and here is my colleague and his name is Wanchao So we come from the Chihu 360 and the unicorn team Our team are focusing on, you know, several security issues in about such as wireless system and embedded hardware hardware so This is a this topic is about LTE network We will show you how to force a target LTE cell phone into a specific Unsafe network. So but don't worry. We didn't bring the device. So your phone is still in safe So first generation network is more advanced than it's a more advanced mobile network than to second generation and third generation but Absolutely, it's not absolutely secure. So there are already some papers Show how to expose these vulnerabilities of LTE networks and one of them has one of them is the presentations in the last year and If you guys had listened to it, it's on the black hat Europe Yeah, so this presentation introduced the LTE emissary catcher and the LTE cell phones tracking and the DOS attack DOS attack of your LTE cell phone so Then I call it to show you how to break your LTE cell phones network and in detail, please Hello, glad to see you. My name is Vancho and To start with let's have a look at the two common attacks against LTE network The first one is emissary catcher. How does this work? From this picture We can see the left tower is a real LTE network base station, which is controlled by operators Well, the right one is a fake LTE base station which cover by small which cover small space Okay, when the cell phone comes into the area of the fake LTE network It will immediately asked to report it is in this number by the fake base station Okay Well, you know the aims number stands for the user sorry Well, you know the aims number stands for the user identifier which can trick user locations and movements This kind of device is mostly used by national security departments to check criminal suspects And I also hear that there are some illegal casino to use it for raising alert when some strangers approach Well, the other attack is called the denial of service attack after fake base station gets the aims number always covered cell phone It can do father attack to cell phone. It can send a reject message such as you are illegal cell phone Or there is no available network Well when the cell phone gets this kind of message it usually turn into the no service status for a very long time What's more some cell phone can only recover by the booting But different kinds of cell phone reacting in different manners According to the experiments we have take the old iPhones and the majority of Android system Cell phones are influenced by their vulnerable elements Okay, now let's take a look at the new attack we have been working on The picture shows there are two fake network one the LT base station. Well, the other is a GSM fake base station When the cell phone approaches them then the adversely attaching the malicious LT base station then Automatically then the malicious LT base station will tell the phone go to my GSM network Okay, the cell phone has to follow its command and enters into the malicious GSM network well when the cell phone enters The malicious GSM network the malicious GSM network the attackers could do father attacks such as if stooping on transitions Intercepting the SMS or analyzing data traffic Here is a demonstration platform we developed to verify the redirection attack. There are two computers with the USRPs the right one is a Mini desktop computer with an USRP B210 And it runs an open LT program and the creator fake LT network Well, the left one is a Apple Mac laptop with the USRP B210 mini running the open BTS program Okay, let's show the video It's done the video so we can put it in our PowerPoint. So let's play it for you It loves the Just one minute Okay You know the LT The cell phone from the real 4G network to the fake 4G network to and then down to the GSM network at a Is a faster procedure. So it's Very difficult to show this variation Pay attention to this short video. It lasts only one minute Okay, now let's check the computer with the 2G Fake network Okay, we can see the aims number from the fake network Now Yeah Okay Wow Okay Okay Okay Okay Okay Okay Okay Okay Okay Okay Okay Okay Okay In this video, we utilize the open BTS to build a fake network, which means the cell phone can't connect to the internet In other words, it loses connection to the real world But the fake networks still can do some malicious attacks such as making a call or sending SMS with any calling numbers Okay, besides there is a more advanced attack advanced attack. This attack utilizes open the femtoselle, a rogue network, other pictures. This is already hacked by our team. This is the femtoselle and it was already hacked by our team. Last year my partner Haoqi has given a presentation about how to hack this femtoselle and you know the femtoselle can connect to the operator's real network but it can also controlled by attackers. Then the attacker can e-drop all the traffic including voice and data. Such rogue femtoselle can be 2G or even 3G. Okay, now let's go further into the protocol to see how this attack is realized. Here is the LT basic procedure. When cell phone is powered on it firstly search the cell around it and choose the cell with a strong signal to attach. In this case the cell phone will initiate an RRC connection. All the connection the cell phone will send an attached request message to start authentication. Okay, when the authentication procedure finish the RRC connection will enter status with security and serving protection. In other words the basic station and the cell phone will establish a security network service but before this step all the message are not encrypted. So this are accessorized part is the attack space. The blue signalings. Let's see how to realize AIMS catcher from the signaling process value. Now we presume the phone is staying in the operator's network then we set up a fake network around it. Then it find a better cell, the fake cell and try to connect to it. To avoid easily exposing the cell phone itself it will not directly send the AIMS number but send a tricking error update request with a team's number. The team's number stand for the temporary mobile subscriber identity which is decided by base station. If this is a normal cell with selection procedure in normal network then the base station should know the team's number and then complete tricking error updating. But obviously a fake LTE base station doesn't know the cell phone's identity so it sends back a tricking error update reject message. At the same time this message will cause reason why network refuse cell phones request. There are many kinds of causes for refusal and each cause has a number. If we send the cause number 9 to cell phone which is described in the specification UE identity can't be drive by the network then the cell phone will initiate the attach procedure by sending attach request. This message contains information what the attacker wants, yes the AIMS number. We already know that there are many kinds of causes for refusal. Well when we guide the AIMS number we can do further attack to throw the next message. In this case we can send attach reject with some special causes. Here are several causes for typical does attack. Number 3, number 7, number 8 and number 14. Cause number 3 means illegal UE. Cause number 7 means EPS service are not allowed. Well cause number 8 means EPS service and non-EPS service are not allowed. Cause number 14 means EPS service are not allowed in this PLMN. All of these causes may lead the cell phone to shut down their mode and to keep off for very long time. Okay the third attack, RRC redirection. Follow the attack, reject message. From this picture we can see the red words, yeah. The malicious networks send an RRC connection release message additionally. Well the release message could call extension information called redirection, redirection clear info. The redirected clear can be any type of network, 4G, 3G or 2G. So we could redirect a target cell phone into 2G or 3G network and redirect other cell phone into the neighboring 4G network. Well someone may argue that you just downgrade the cell phone into an unsafe network to 2G or 3G or 2G. But we could use jamming tool as well and it's much easier than coding. Yes jamming tool can also light 4G network and workable and downgrade cell phone into 3G or 2G. But the point is in this manner it will influence all cell phones. That's why we claim that our, that's why we claim that the redirection attack could accurately attack the target cell phone and do not influence any other cell phone. They can still keep in the 4G network and don't need to worry about rewilling information. Okay after knowing about the principle of this attack, let's talk about the method to build a set of demo system to verify the attack. Well here is the test platform. We used the common tool, USRP plus a computer. The model of the USRP is B210, B210, yeah. The computer is gigabat and it's small enough to hide itself. There are several open source LTE project. Well I think these two projects are most popular. The first one is open air interface developed by Eurocom. This is the most complicated, this is the most completed open source LTE project and it has been developed for many years. What's more, it provides a connection between the real cell phone and the internet. But the OAS system refers to a very complicated software architecture. So there's a little difficult to modify in the code. Well the second project is named open LTE, written by only one person Ben. He was a Motorola engineer and joined a Google project long in last year. Ben gives this project on a very beautiful coding style. So it's quite easy to understand the whole architecture and to extend its function. That's why it has a more popular situation in security research. However the shortcoming of this project is it hasn't achieved a stable LTE data connection. But for our experiment the functionally is enough to build a fake LTE network. I wrote a few slides to give the TEP and open LTE source code. If you want to build a fake LTE network just look at this single list. Let's see the single list again. In Inkscatcher we need to send a tricky error update reject message with special cost. Yeah, in current open LTE software the TAU request isn't handled. You can see the line not handling tricky error update request. Luckily we found the TAU reject message packing function is ready. So in this part we can see this part. MME tracking error update reject message. So what we need to do is just adding some cost to handle TAU keys with this function. Okay. Just like the principle. Okay when receiving the TAU request from cell phone we should firstly set the MME procedure as TAU request. Then what we need to do is just writing a function to call a TAU reject message. Yeah, when writing this TAU reject to function you can refer to the attached reject to function. It was already too. Then how about DOS attack? We can directly use this function. Send attached reject. As you see the highlighted line you can set your reject to causes here. Yeah. In the next message we can do further attack. Sending attached reject with some special causes. Here. Okay. And the third case is the RSE redirection. This is a little complicated. You have to read the specification to know the message format and insert the redirected query info into RSE connection release message. From the red circle we can see we write on one to this function. Yeah it is because here. Yeah this part is a 3GPP protocol about RSE connection release message. We can see the top layer of this message. Yeah the red line. The redirected query info choice is optional. So in this case we just need to open this, open this choice and set one in this bit. Then we can modify the last code in this manner. Okay. That's all the method we need to modify. Now it's how to stem less, less can you introduce why we do this? Okay. Yeah. Sorry. This picture is a cell phone screenshot and this cell phone has login capability and I use it to check whether it really received my redirection info. So yes it did receive. The clear info is GIN. Yeah it means GSM network. And it's ARFC frequency number is 42. Then the cell phone will firstly search this frequency. Yeah this are almost all the source code you need to modify if you want to build a tag tool. Quite simple right. Now it's how to stem less can you introduce why we do this? Okay. All right. Thanks to my colleagues for their work and she actually she did most of the job. Yeah. Pretty awesome. Thank you. So actually we are our team's not a team that has very strong attack abilities. We often said we you know like of imagination of doing some bad things. We just to find the vulnerabilities but we don't know how to use it. We prefer to be a defender. So we tell ourselves that you know from this presentation and we will emphasize not only the risk of the vulnerabilities of your I just said LTE network you know from the attacker's side but also think about the background. So the reasons why these vulnerabilities exist. So our question is why is the double RC redirection message not encrypted? I suppose some of you will think of the same question. First question is is this really a new problem? We consult with several you know Huawei security. It's a really large company in China and the 3GPP standard experts. So surprisingly she found she's finding is not a new and the 3GPP knows risk about 10 years ago. Really 10 years ago. So here is a document in generally in general 20 yeah 26 26 years. So which introduced a force handover attack. So let's see this program. I don't know. Yeah you can see it clearly. So this compromise the base station can be can be in it. A reconfiguration procedure to the UE. Directly to a cell or network chosen by the attacker. So this could be this could function as a denial of a device. You know if the target network cannot or will not offer to the UE device or to allow a chosen network to capture UES. So this document this document writes this problem I just mentioned before. And then about 10 months later so in November and 26 the 3GPP's meta decision. So let's us read the two key points in this decision. And the point one is you know the double RC is integrated and the suffering will be started only once. Just once during the attached procedure and for example after the aka has been performed. So it cannot be deactivated later. And the point two is the double RC integrated and the suffering of the rhythm can only be changed in the case you know of the E node B handover. So you see here 3GPP's they give an expression on the double RC suffering and here is a question why they did this. So you know because some special in some special case such as earthquake during hot events there will be too many cell phones trying to access one just one best stations. The Mac these best stations will be overloaded. So to let a network load you know balanced. So this best station can ask the new coming cell phone to redirect to another best station. If you don't tell the cell phone you know which best station is light loaded the cell phone might bind and effectively to search one by one this cause a lot of powers. So finally increase the whole network loaded. So 3GPP's they think the new best station should take the responsibility to you know to all the cell phone so they decide to encrypt they decide not to encrypt the double RC reduction procedure. So I explain just explain the background reason of these 3 attack here and in the catcher they cannot avoid avoid be avoided because we need a global money and you have to firstly show you and find and then to do the Oath. So Wi-Fi security system you know they have the similar situation we all know that you know the Mac address people can use it to track you. So from iOS 8 and Windows 10 so there will be some you know Mac randomization and this method it will be used. But actually you know to factorize the network manager management the random Mac address only enabled in a strict condition. So if a terminal use Wi-Fi hotspot such as 2.0 the Wi-Fi hotspot 2.0 is a specification for the Wi-Fi Romani. So in that case this Mac randomization will also be disabled. That's a little bit short. So global Romani and identify identity privacy is conflict and it's need to trade off. DOS attack and you know the battery energy saving is another trade off. So both this network is really really unusable and so if you if this cell phone keep searching the network you consume too much energy and quickly consume out. So this is also a bad thing. As you can see this network protocol designer they have to make many many trade off between the basic connection requirement and the high level requirement the privacy. The privacy is what we are caring about. So I gave the excuse of this vulnerabilities. I believe people should. So do not mean I refuse to fix this problem. So let's find out how to fix this. In this slide let's discuss this yeah let's discuss this contumers. So firstly at the cell phone manufacturer side since you know the standard and modern side chipsets haven't fixed this problem. So what do they can do for example is such as yeah don't follow the reduction command but also auto research the other available at the best station. Or you can say cell phone can follow the reduction command but you should give your users some alert. Such as warning you are downgraded and to the lower security network but I think it's really hard work. So we know about the root of this problem is the unsafe GSM network. So why don't we try to solve this problem. And the GSM network is still needed by the operators. You know there's a lot of device you need to just support the GSM network. So you want to change it you need a long time. So from the standard side they are making effort to fit you know the weak point of the GSM network. So here is a very fresh news. Just a couple months ago 3GPB received a proposal of the GSM A. So the basic idea of the upgrade the mobile device security capability and since you know the older network equipment we cannot or you can say difficult to upgrade it. So GSM A they propose two methods. One is the mobile device you know they refuse one way or the other and if they visit a network it's 3G capable. And the second method is you know disable some weak encryption such as the A5 one. Yeah A5 algorithm in mobile. So this proposal having finally you know standardized by the 3GPB because you want to be a bigger standard is really hard and not quite easy. But we see a good beginning is someone trying to fix this situation and okay. Yeah actually we show you how to break and show you how to fix this problem and we did it both way but I think there are some you know some self manufacturers can learn something from this presentation and I hope so. So here is our presentation today and we thank so many companies give us a lot of help such as Huawei and Qualcomm and Apple. Yeah Apple. So if you have any questions about how to you know how to build your own LTE networks that are all some malicious and say or you can say unsafe network so please feel free to contact us and you're welcome to take a picture. Thank you.
 All right, so  This is the point where you see the scary talk and at the end you probably turn your phone off  So these guys have presented for us before they've they've done some amazing research very soon  Kind of like they did last year, which was a really really cool talk. I think you guys are in for a real treat  Let's give these guys a big hand  Thank you guys, I really appreciate that. There's so many people so last a year my team have  Had about three presentations and we got the GPS spoofing  You've got a famous cell and we also got you know the Z could be and I really happy to stand here right again and  You know  share something so  Here's my talk and  This is the LTE redirection. So people will know about  We  People will know about you know, LT is for generation first generation, but people think it's more secure and  Than the two generation and the third generation. So  today let's  Let's learn how to break it and  My name is Ho Chi Shan and here is my colleague and his name is Wanchao  So we come from the Chihu 360 and the unicorn team  Our team are focusing on, you know, several security issues in about such as wireless system and embedded hardware hardware  so  This is a this topic is about LTE network  We will show you how to force a target LTE cell phone into a specific  Unsafe network. So but don't worry. We didn't bring the device. So your phone is still in safe  So first generation network is more advanced  than it's a more advanced mobile network than to second generation and third generation  but  Absolutely, it's not absolutely secure. So there are already some papers  Show how to expose these vulnerabilities of LTE networks and one of them has one of them is the  presentations in the last year and  If you guys had listened to it, it's on the black hat Europe  Yeah, so this presentation introduced the LTE emissary catcher and the LTE cell phones tracking and the DOS attack  DOS attack of  your LTE cell phone so  Then I call it to show you how to break your LTE cell phones network and in detail, please  Hello, glad to see you. My name is Vancho and  To start with let's have a look at the two common attacks against LTE network  The first one is emissary catcher. How does this work? From this picture  We can see the left tower is a real LTE network base station, which is controlled by operators  Well, the right one is a fake LTE base station which cover by small which cover small space  Okay, when the cell phone comes into the area of the fake LTE network  It will immediately asked to report it is in this number by the fake base station  Okay  Well, you know the aims number stands for the user sorry  Well, you know the aims number stands for the user identifier which can trick user locations and movements  This kind of device is mostly used by national security departments to check criminal suspects  And I also hear that there are some illegal casino to use it for raising alert when some strangers approach  Well, the other attack is called the denial of service attack after fake base station gets the aims number always covered cell phone  It can do father attack to cell phone. It can send a reject message such as you are illegal cell phone  Or there is no available network  Well when the cell phone gets this kind of message it usually turn into the no service status for a very long time  What's more some cell phone can only recover by the booting  But different kinds of cell phone reacting in different manners  According to the experiments we have take the old iPhones and the majority of Android system  Cell phones are influenced by their vulnerable elements  Okay, now let's take a look at the new attack we have been working on  The picture shows there are two fake network one the LT base station. Well, the other is a GSM fake base station  When the cell phone approaches them then the  adversely attaching the malicious LT base station  then  Automatically then the malicious LT base station will tell the phone go to my GSM network  Okay, the cell phone has to follow its command and enters into the malicious GSM network  well when the cell phone enters  The malicious GSM network the malicious GSM network the attackers could do father attacks such as if stooping on  transitions  Intercepting the SMS or analyzing data traffic  Here is a demonstration platform we developed to verify the redirection attack. There are two  computers with the USRPs the right one is a  Mini desktop computer with an USRP B210  And it runs an open LT program and the creator fake LT network  Well, the left one is a  Apple Mac laptop with the USRP B210 mini running the open BTS program  Okay, let's show the video  It's done the video so we can put it in our PowerPoint. So let's play it for you  It loves the  Just one minute  Okay  You know the LT  The cell phone from the real 4G network to the fake 4G network to and then down to the GSM network at a  Is a faster procedure. So it's  Very difficult to show this variation  Pay attention to this short video. It lasts only one minute  Okay, now let's check the computer with the 2G  Fake network  Okay, we can see the aims number from the fake network  Now  Yeah  Okay  Wow  Okay  Okay  Okay  Okay  Okay  Okay  Okay  Okay  Okay  Okay  Okay  Okay  Okay  In this video, we utilize the open BTS to build a fake network, which means the cell phone can't connect to the internet  In other words, it loses connection to the real world  But the fake networks still can do some malicious attacks such as making a call or sending SMS with any calling numbers  Okay, besides there is a more advanced attack  advanced attack. This attack utilizes open the femtoselle, a rogue network, other pictures.  This is already hacked by our team. This is the femtoselle and it was already hacked by  our team. Last year my partner Haoqi has given a presentation about how to hack this femtoselle  and you know the femtoselle can connect to the operator's real network but it can also  controlled by attackers. Then the attacker can e-drop all the traffic including voice  and data. Such rogue femtoselle can be 2G or even 3G.  Okay, now let's go further into the protocol to see how this attack is realized. Here is  the LT basic procedure. When cell phone is powered on it firstly search the cell around  it and choose the cell with a strong signal to attach. In this case the cell phone will  initiate an RRC connection. All the connection the cell phone will send an attached request  message to start authentication. Okay, when the authentication procedure finish the RRC  connection will enter status with security and serving protection. In other words the  basic station and the cell phone will establish a security network service but before this  step all the message are not encrypted. So this are accessorized part is the attack  space. The blue signalings. Let's see how to realize AIMS catcher from the signaling  process value. Now we presume the phone is staying in the operator's network then we  set up a fake network around it. Then it find a better cell, the fake cell and try to connect  to it. To avoid easily exposing the cell phone itself it will not directly send the AIMS  number but send a tricking error update request with a team's number. The team's number stand  for the temporary mobile subscriber identity which is decided by base station. If this  is a normal cell with selection procedure in normal network then the base station should  know the team's number and then complete tricking error updating. But obviously a fake  LTE base station doesn't know the cell phone's identity so it sends back a tricking error  update reject message. At the same time this message will cause reason why network refuse  cell phones request. There are many kinds of causes for refusal and each cause has a  number. If we send the cause number 9 to cell phone which is described in the specification  UE identity can't be drive by the network then the cell phone will initiate the attach  procedure by sending attach request. This message contains information what the attacker  wants, yes the AIMS number. We already know that there are many kinds of causes for  refusal. Well when we guide the AIMS number we can do further attack to throw the next  message. In this case we can send attach reject with some special causes. Here are several  causes for typical does attack. Number 3, number 7, number 8 and number 14. Cause number 3  means illegal UE. Cause number 7 means EPS service are not allowed. Well cause number  8 means EPS service and non-EPS service are not allowed. Cause number 14 means EPS service  are not allowed in this PLMN. All of these causes may lead the cell phone to shut down  their mode and to keep off for very long time. Okay the third attack, RRC redirection. Follow  the attack, reject message. From this picture we can see the red words, yeah. The malicious  networks send an RRC connection release message additionally. Well the release message could  call extension information called redirection, redirection clear info. The redirected clear  can be any type of network, 4G, 3G or 2G. So we could redirect a target cell phone into  2G or 3G network and redirect other cell phone into the neighboring 4G network. Well someone  may argue that you just downgrade the cell phone into an unsafe network to 2G or 3G or  2G. But we could use jamming tool as well and it's much easier than coding. Yes jamming  tool can also light 4G network and workable and downgrade cell phone into 3G or 2G. But  the point is in this manner it will influence all cell phones. That's why we claim that  our, that's why we claim that the redirection attack could accurately attack the target cell  phone and do not influence any other cell phone. They can still keep in the 4G network and  don't need to worry about rewilling information. Okay after knowing about the principle of  this attack, let's talk about the method to build a set of demo system to verify the  attack. Well here is the test platform. We used the common tool, USRP plus a computer.  The model of the USRP is B210, B210, yeah. The computer is gigabat and it's small enough  to hide itself. There are several open source LTE project. Well I think these two projects  are most popular. The first one is open air interface developed by Eurocom. This is the  most complicated, this is the most completed open source LTE project and it has been developed  for many years. What's more, it provides a connection between the real cell phone and  the internet. But the OAS system refers to a very complicated software architecture.  So there's a little difficult to modify in the code. Well the second project is named  open LTE, written by only one person Ben. He was a Motorola engineer and joined a Google  project long in last year. Ben gives this project on a very beautiful coding style.  So it's quite easy to understand the whole architecture and to extend its function. That's  why it has a more popular situation in security research. However the shortcoming of this  project is it hasn't achieved a stable LTE data connection. But for our experiment the  functionally is enough to build a fake LTE network. I wrote a few slides to give the  TEP and open LTE source code. If you want to build a fake LTE network just look at this  single list. Let's see the single list again. In Inkscatcher we need to send a tricky error  update reject message with special cost. Yeah, in current open LTE software the TAU request  isn't handled. You can see the line not handling tricky error update request. Luckily we found  the TAU reject message packing function is ready. So in this part we can see this part.  MME tracking error update reject message. So what we need to do is just adding some  cost to handle TAU keys with this function. Okay. Just like the principle. Okay when  receiving the TAU request from cell phone we should firstly set the MME procedure as  TAU request. Then what we need to do is just writing a function to call a TAU reject message.  Yeah, when writing this TAU reject to function you can refer to the attached reject to function. It was already too. Then how about  DOS attack? We can directly use this function. Send attached reject. As you see the highlighted  line you can set your reject to causes here. Yeah. In the next message we can do further  attack. Sending attached reject with some special causes. Here. Okay. And the third  case is the RSE redirection. This is a little complicated. You have to read the specification  to know the message format and insert the redirected query info into RSE connection  release message. From the red circle we can see we write on one to this function. Yeah  it is because here. Yeah this part is a 3GPP protocol about RSE connection release message.  We can see the top layer of this message. Yeah the red line. The redirected query info  choice is optional. So in this case we just need to open this, open this choice and set  one in this bit. Then we can modify the last code in this manner. Okay. That's all the  method we need to modify. Now it's how to stem less, less can you introduce why we do  this? Okay. Yeah. Sorry. This picture is a cell phone screenshot and this cell phone has  login capability and I use it to check whether it really received my redirection info. So  yes it did receive. The clear info is GIN. Yeah it means GSM network. And it's ARFC  frequency number is 42. Then the cell phone will firstly search this frequency. Yeah  this are almost all the source code you need to modify if you want to build a tag tool.  Quite simple right. Now it's how to stem less can you introduce why we do this? Okay.  All right. Thanks to my colleagues for their work and she actually she did most of the  job. Yeah. Pretty awesome. Thank you. So actually we are our team's not a team that has very  strong attack abilities. We often said we you know like of imagination of doing some bad  things. We just to find the vulnerabilities but we don't know how to use it. We prefer  to be a defender. So we tell ourselves that you know from this presentation and we will  emphasize not only the risk of the vulnerabilities of your I just said LTE network you know from  the attacker's side but also think about the background. So the reasons why these  vulnerabilities exist. So our question is why is the double RC redirection message not  encrypted? I suppose some of you will think of the same question. First question is is  this really a new problem? We consult with several you know Huawei security. It's a really  large company in China and the 3GPP standard experts. So surprisingly she found she's finding  is not a new and the 3GPP knows risk about 10 years ago. Really 10 years ago. So here  is a document in generally in general 20 yeah 26 26 years. So which introduced a force  handover attack. So let's see this program. I don't know. Yeah you can see it clearly.  So this compromise the base station can be can be in it. A reconfiguration procedure  to the UE. Directly to a cell or network chosen by the attacker. So this could be this could  function as a denial of a device. You know if the target network cannot or will not offer  to the UE device or to allow a chosen network to capture UES. So this document this document  writes this problem I just mentioned before. And then about 10 months later so in November  and 26 the 3GPP's meta decision. So let's us read the two key points in this decision. And the  point one is you know the double RC is integrated and the suffering will be started only once.  Just once during the attached procedure and for example after the aka has been performed. So it  cannot be deactivated later. And the point two is the double RC integrated and the suffering  of the rhythm can only be changed in the case you know of the E node B handover. So you see  here 3GPP's they give an expression on the double RC suffering and here is a question why they  did this. So you know because some special in some special case such as earthquake during  hot events there will be too many cell phones trying to access one just one best stations.  The Mac these best stations will be overloaded. So to let a network load you know balanced.  So this best station can ask the new coming cell phone to redirect to another best station. If  you don't tell the cell phone you know which best station is light loaded the cell phone  might bind and effectively to search one by one this cause a lot of powers. So finally increase  the whole network loaded. So 3GPP's they think the new best station should take the responsibility  to you know to all the cell phone so they decide to encrypt they decide not to encrypt the double  RC reduction procedure. So I explain just explain the background reason of these 3 attack here  and in the catcher they cannot avoid avoid be avoided because we need a global money and you  have to firstly show you and find and then to do the Oath. So Wi-Fi security system you  know they have the similar situation we all know that you know the Mac address people can use it  to track you. So from iOS 8 and Windows 10 so there will be some you know Mac randomization  and this method it will be used. But actually you know to factorize the network manager  management the random Mac address only enabled in a strict condition. So if a terminal use Wi-Fi  hotspot such as 2.0 the Wi-Fi hotspot 2.0 is a specification for the Wi-Fi Romani. So in that  case this Mac randomization will also be disabled. That's a little bit short. So global Romani and  identify identity privacy is conflict and it's need to trade off. DOS attack and you know the  battery energy saving is another trade off. So both this network is really really  unusable and so if you if this cell phone keep searching the network you consume too much  energy and quickly consume out. So this is also a bad thing. As you can see this network  protocol designer they have to make many many trade off between the basic connection requirement  and the high level requirement the privacy. The privacy is what we are caring about. So I  gave the excuse of this vulnerabilities. I believe people should. So do not mean I refuse to fix  this problem. So let's find out how to fix this. In this slide let's discuss this yeah let's  discuss this contumers. So firstly at the cell phone manufacturer side since you know the  standard and modern side chipsets haven't fixed this problem. So what do they can do for example  is such as yeah don't follow the reduction command but also auto research the other available  at the best station. Or you can say cell phone can follow the reduction command but you should  give your users some alert. Such as warning you are downgraded and to the lower security  network but I think it's really hard work. So we know about the root of this problem is  the unsafe GSM network. So why don't we try to solve this problem. And the GSM network  is still needed by the operators. You know there's a lot of device you need to just support  the GSM network. So you want to change it you need a long time. So from the standard  side they are making effort to fit you know the weak point of the GSM network. So here  is a very fresh news. Just a couple months ago 3GPB received a proposal of the GSM A.  So the basic idea of the upgrade the mobile device security capability and since you know  the older network equipment we cannot or you can say difficult to upgrade it. So GSM  A they propose two methods. One is the mobile device you know they refuse one way or the  other and if they visit a network it's 3G capable. And the second method is you know  disable some weak encryption such as the A5 one. Yeah A5 algorithm in mobile. So this  proposal having finally you know standardized by the 3GPB because you want to be a bigger  standard is really hard and not quite easy. But we see a good beginning is someone trying  to fix this situation and okay. Yeah actually we show you how to break and show you how  to fix this problem and we did it both way but I think there are some you know some self  manufacturers can learn something from this presentation and I hope so. So here is our  presentation today and we thank so many companies give us a lot of help such as Huawei and  Qualcomm and Apple. Yeah Apple. So if you have any questions about how to you know how to  build your own LTE networks that are all some malicious and say or you can say unsafe network  so please feel free to contact us and you're welcome to take a picture. Thank you.
DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_0_227.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_228_539.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_540_2447.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_2448_3107.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_3108_3539.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_3540_4619.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_4620_9935.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_9936_9983.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_9984_10199.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_10200_10307.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_10308_10403.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_10404_10607.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_10608_10691.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_10692_10739.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_10740_10799.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_10800_11087.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_11088_11147.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_11148_11195.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_11196_11243.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_11244_11303.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_11304_11675.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_11676_11903.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_11904_11951.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_11952_12095.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_12096_15755.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_15756_16955.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_16956_20639.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_20640_26711.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_26712_26879.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_26880_27227.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_27228_27287.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_27288_29327.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_29328_29651.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_29652_37259.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_37260_37703.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_37704_43523.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_43524_45119.png DEF_CON_24_-_Haoqi_Shan__Wanqiao_Zhang_-_Forcing_a_Targeted_LTE_phone_into_Unsafe_Netw_Nn8Pwz9MxSA_45120_46488.png