Hello Everybody and greetings from Sao Paulo,
We’re currently enjoying the Brazilian sunshine, waiting for H2H2 11’s closing
remarks and decided to give you a few details on the past three days. The
conference was opened by a short welcome by our fellow Trooper Rodrigo Rubira
Branco and stuffed with loads of great talks. This year’s keynotes came from
Daniel J. Bernstein and Halvar Flake and gave yet another insight into the ever
changing world of InfoSec. The international lineup also included Travis
Goodspeed, Sergej Bratus and Fernando Gont. H2HC was a great chance for us to
talk to various Hackers from around the world and share our opinions and
knowledge.We can only warmly recommend a visit to next year’s H2HC in Sao
Paulo.
Many many thanks to Rodrigo, Laila and the rest of the team for an awesome
weekend. And a quick hello to all new followers on Insinuator.net, we’re looking
forward to meeting you all again, soon.
We feel lucky to have been invited to present our research about LTE’s Self
Organizing Networks at Sacicon) as well as
H2HC. On H2HC we
gave an updated version of our talk “LTE vs. Darwin”, we formerly presented at
ShmooCon
and HackiToErgoSum.
This time we focused on two parts. The first part is an application for Android
phones we developed for gathering information about LTE cells and information
needed for the baseband to set up a working LTE connection. We plan to implement
war driving scenarios to show to the people how such network architecture is
implemented in reality. The App will be published here on the blog soon.
The second part was about Self Organizing Networks, what they are needed for and
what attackers might do to abuse these. To demonstrate how dangerous those
procedures are, we wrote some scripts as published before and showed the steps
to set up a fake device into a provider’s network. That covers:
1. S1 or X2 Setup Procedure (for initial registration process on an MME)
2. eNodeB Configuration Update (to change information of other eNodeB’s)
3. Handover and other procedures may be abused by attackers
On H2HC we only showed our tools and demonstrated that it real works. On Sacicon
we presented some more technical information and showed how those packets are
build up. We demonstrated it with our Dizzy Scripts for S1AP and X2AP like
published before, but Daniel wrote the Tool S1AP_Enum like
published in a former blog entry
to do it more automatically.
The message behind is that providers really should be careful with such
technologies and must take care of securing access to their network.
Unfortunately a lot of providers are not aware of that and therefore might not
only damage their own network. Think of roaming scenarios, therefore it might be
possible that if one provider’s network is compromised, it might be possible to
inject control messages over the roaming interface to several other providers.
This way to our final slide set! Enjoy!
So far, we hope that you enjoyed our talk, the same as we enjoyed the whole
conference!
Brian & Hendrik