Telecom System Security - cs.haifa.ac.ilorrd/CompSecSeminar/2016/Chapter20-Boris.pdf · Phone phreaking ... – Signaling codes ... Boris Krush Telecom System Security 18. Title:

TELECOM SYSTEM SECURITY

Ross Anderson’s book “Security Engineering” -

Chapter 20

Computer Security Seminar

Presenter: Boris Krush

31/05/2016

Abusing the System

■ Letters

■ Heliograph

■ Telegraph

2Telecom System SecurityBoris Krush

Getting creative

■ Phone Operators

– Payment verification

– Caller identification

■ Tools To Hack

– A piece of metal

– Call forwarding

– Magic button


Getting creative

■ Clip-on

– Students

– Criminals


Getting creative

■ Phone phreaking

– Joe Engresia - whistle

– Blue Box


We are not alone

■ Fight the “Man”

– Signaling codes

– Switch features


Social engineering

■ Calling Cards

– Pay phones

– Long distance calls

■ Premium numbers


Unsecured systems

■ Switching and Configuration

– Getting unlisted numbers

– Auto forwarding calls

■ Kevin Poulsen 1985-1988

– Free calling

– Wiretapping and espionage

– Obtaining unlisted numbers

– Winning a Porsche


Unsecured systems

■ Insiders

– Fixing the odds

■ Kevin Mitnick

’Companies can spend millions of dollars

toward technological protections and that’s wasted if

somebody can basically

call someone on the telephone and either convince

them to do something on

the computer that lowers the computer’s defenses or

reveals the information

they were seeking’


Unsecured systems

■ PBX - private branch exchange

– Dial-through

– Backdoors

■ Attacks examples

– Scotland Yard

– Chinese Gang

– Moldova Scam

– Red Browser Worm

*Kabul


Features and services

■ Voicemails and answering machines

– Voicemail

■ Is it Broken?

– Multilingual options

■ Holla!

– Calling without dialing

■ Hide Me

– Call forwarding

■ Skip the bank

– Ringback

■ I'm not Paying

– Conference calls

■ I’m here


Mobile Phones Analog (1G)

■ Used analog signals with no real authentication

– The headset sent two serial numbers

■ Equipment serial number

■ Subscriber serial number

– The signal was sent in clear over the air link

■ Almost immediately were created devices to capture and emit this signal

– Call-Sell operation

– Tumblers - multiple identity phones

– Fake base station


GSM - Global System for Mobile Communications (2G)

■ Digital technology

– International roaming

– No more cloning

– Securing and protecting the line

■ SIM –Subscriber Identity Module

– PIN - personal identification number

– IMSI - international mobile subscriber identification

– Ki -subscriber authentication key


GSM - Global System for Mobile Communications (2G)

■ Vulnerabilities in this protocol

– Unencrypted transmission between BSC and VLR

– Foreign networks can replay the info

– Cramming

■ GSM after effects

– Almost no cloning

– Increase in stealing phones, credit cards and identities

– Prepaid based fraud

– IMSI-catcher


Long arm of the low

■ Weakening of encryptions in smaller countries

■ Demanding access to private information and location

■ Deals between phone companies and the government


UMTS – Universal Mobile Telecommunications (3G)

■ A few upgrades to the GSM vulnerabilities

– Use of the A5/3 cipher block also known as “Kasumi” instead of the less

secure A5/1,A5/2 cipher blocks witch were used in the GSM security

– Increase in bandwidth from 10kKbit/sec of GSM to 7.2Mbit/sec of 3G

– Two way authentication ,ending the IMSI-catcher vulnerability


Billing Mechanisms and their vulnerabilities

■ CDR – Call Detail Record

– Generated only after finishing the call

– Vulnerable to conference call over prepaid fraud

– Dealt by dropping a long lasting call

■ Billing and accounting systems

– Weren’t built to handle real money transactions

– Easy to abuse from the inside

– No appropriate regulations


Summery

■ The art of getting paid services for free is an ancient one

■ If security isn’t one of the building blocks, implementing it later will be hard and sometimes useless

■ Sometimes security and government prevent technological improvement

■ As long as human interaction is part of the process ,social engendering can bypass all kinds of security measures

■ Closed and private solutions are easier to break than solutions molded and scrutinized by the public

■ There are two kinds of fools. One says, ‘‘This is old, therefore it is good.’’ The other says, ‘‘This is new, therefore it is better’’

— Dean William Inge


Documents

Telecom System Security - cs.haifa.ac.ilorrd/CompSecSeminar/2016/Chapter20-Boris.pdf · Phone phreaking ... – Signaling codes ... Boris Krush Telecom System Security 18. Title: