Hendrik Schmidt on Insinuator.net - Bold Statements

Troopers17 GSM Network – How about your own SMPP Service?

Wed, 01 Mar 2017 00:00:00 +0000

The event of the events is getting closer and again, we are very optimistic to have a lot of awesome trainings, talks, evening events, and discussions. But we again will also have some “features” and gimmicks for those of you who would like to play with new, old, or just interesting technologies. As you might remember, since some years one of these features is and again will be our own GSM Network. As we are improving our setup from year to year, this time we’d like to give you the chance to actively participate with ideas and your own services.

TelcoSecDay 2017 – 2nd Round of Talks

Tue, 03 Jan 2017 00:00:00 +0000

Hello and a Happy new Year!

There are only two and a half months left, so I’d like to publish the next two talks for TelcoSecDay 2017, taking place at 21st of March in Heidelberg. Both talks are about the security of an upcoming technology which importance will raise in near future: 5G Networks.

One of the talks will be from an attacker’s point of view, highlighting weaknesses of 2G/3G/4G networks and what we have to fix in 5G, and the other one will give us insights into current developments of the 3GPP standardization group.

TelcoSecDay 2017 – First Talks Published

Thu, 08 Dec 2016 00:00:00 +0000

Even if the CFP for TelcoSecDay 2017 is officially closed, I am still getting mails in. First of all: thank you for all your great feedback! As the TelcoSecDay is a complimentary and non-public event with highly specialized topics, it only works by sharing knowledge with each other. But please keep in mind that the speaker-slots are limited and I have to make a decision at some point of time.
Anyhow, I am looking forward for a great event and I am proud to publish the first accepted talks:

TelcoSecDay 2017 – CFP Opens

Sat, 29 Oct 2016 00:00:00 +0000

For the 6th year in a row, the next TelcoSecDay will take place in 2017 on March 21th. Again, it will be held one day before Troopers IT-Security Conference as an invitation-only event. For those of you who don’t know the TSD, it is organized by ERNW and is aimed at bringing researchers and people from the telecommunication industry together to discuss about current security weaknesses, challenges and strategies. To do so, various topics will be presented during the talks and there will surely be enough time to follow-up in extensive discussions.
To give you an idea, here’s the TSD 2016 agenda, and here’s the one of 2015.

Attacking BaseStations @Defcon24

Tue, 20 Sep 2016 00:00:00 +0000

Hello Guys,
back from my vacation I’d like to give you some impressions about Defcon 24 and our talk “Attacking BaseStations”. Defcon itself had a couple of great talks but was a very crowded location. Anyhow, we had a couple of great discussions with the people before and after our talk.

The talk “Attacking BaseStations” focussed on attack vectors we simulated in our lab. Besides attacking a BaseStation via Radio interface, in this talk we focussed on local and remote interfaces as introduced in “LTE vs. Darwin”. As target of evaluation one of our eNodeB’s came into play, which we purchased on the Internet. Anyhow, the talk covered the following attack scenarios:

VoLTE Security Analysis, part 2

Fri, 24 Jun 2016 00:00:00 +0000

In our talk IMSEcure – Attacking VoLTE Brian and me presented some theoretical and practical attacks against IP Multimedia Subsystems (IMS). Some of the attacks already have been introduced in a former blogpost and Ahmad continued with a deeper analysis of the Flooding and targeted DoS scenario. But still, there are some open topics I’d like to continue with now. The methods I am demonstrating here also help to get a better understanding of VoLTE/IMS and how it is implemented on modern smartphones.

Area41 Conference 2016

Sat, 18 Jun 2016 00:00:00 +0000

Last Friday, Brian and I were at the Area41 Security Conference. The conference is a branch of Defcon conference and is more or less a small conference of the Swiss hacker community. Being in a “rock music club”, the speakers presented on a stage where usually the rock stars are performing – which gives the conference a very special flair and an interesting atmosphere. We’ve been at the conference to present our research about VoLTE technology including some attack scenarios we’ve evaluated in the past. More on this later, let’s first talk about the conference itself.

The ULIN Story

Fri, 03 Jun 2016 00:00:00 +0000

Some of you might have noticed the articles, or the leaked manual itself, about a tool called ULIN. ULIN is a “bleeding-edge spy tool” for mobile communication networks. According to the manual, it is aimed to be a surveillance software for agencies (or others with enough money) for tracking and intercepting the Voice Calls and SMS of arbitrary phones. They call this “remote recording and geolocation of mobile handsets using 2G/3G/4G networks”.

Some Notes on Utilizing Telco Networks for Penetration Tests

Wed, 25 May 2016 00:00:00 +0000

After a couple of years in pentesting Telco Networks, I’d like to give you some insight into our pentesting methodology and setup we are using for testing “Mobile and Telecommunication Devices”. I am not talking about pentesting professional providers’ equipment (as in previous blogposts), it is about pentesting of devices that have a modem in place like a lot of IoT devices (you know about the fridge having a GSM Modem, right?) do.

TSD 2016 – Follow Up

Thu, 07 Apr 2016 00:00:00 +0000

Thanks again for all the great talks and fruitful discussions @TSD 2016! I hope everybody had a safe trip home and enjoyed Troopers as we did. In the meantime I contacted all speakers to talk about publication of their slidesets. Some of them agreed (or already published them on their own) so I’d like to share these with you:

Alexandre De Oliveira – Assaulting IPX Diameter roaming network
Siddharth Rao – The known unknowns of SS7 and beyond.
Joao Collier de Mendonca – “rucki zucki” scanning tool
Harald Welte – Open Source Network Elements for Security Analysis of Mobile Networks
Ravi & Altaf Shaik – Don’t connect to my 4G base station: investigating info leaks in 4G basebands

Troopers16 – GSM Network

Wed, 16 Mar 2016 00:00:00 +0000

Hello Troopers!

only a few seconds left! As a short reminder, there is a GSM network running on Troopers 2016. It should be available in the whole building. To attend the network you need to

Get a SIM Card @Troopers_Desk
Put it in your phone
Start the phone

That’s it!

You can always dial *#100# to get your phone number. All further information (and a phonebook) you’ll find on gsm.troopers.de, but here again a brief summary:

TelcoSecDay 2016 – Final Agenda and more

Thu, 10 Mar 2016 00:00:00 +0000

Only a few days left until Troopers! I’d like to use this chance to publish the final agenda of TelcoSecDay 2016. We will start around 8:30am and will finish at about 6:15pm. After this, we will have a shared dinner in the historic center of Heidelberg. The exact location will be announced during the TSD.

8:30: Opening Remarks
9:00: David Batanero – New Age Phreaking: Magic tricks for wholesale fraud
9:45: Adrian Dabrowski – Towards Carrier Based IMSI Catcher Detection
10:30: Break
11:00: Alexandre De Oliveira – Assaulting IPX Diameter roaming networks
11:45: Rao Siddharth – The known and unknowns of SS7 and beyond
12:30: Joao Collier de Mendonca – “rucki zucki” scanning tool
13:00: Lunch
14:00: Harald Welte – Open Source Network Elements for Security Analysis of Mobile Networks
14:45: Rahul Sasi – Advance APT Attribution for researchers
15:30: Break
16:00: Ravi and Altaf Shaik – Don’t connect to my 4G base station: investigating info leaks in 4G basebands
16:45: Talk from some guy with interest in telco sec
17:15: Break
17:30: Dieter Spaar – Observations on mobile communication platforms

Troopers16 – GSM Network

Thu, 03 Mar 2016 00:00:00 +0000

Same as last year, we will have a GSM based telephony network running at Troopers 2016. The network will be a closed network, which means it only can be used with Troopers SIM cards and between Troopers attendees only. You can use the network for

doing Voice Calls
send Short Messages (SMS)
have Internet Access
submit Challenge Tokens (see below)

In contrast to last year, you will need a Troopers SIM card to attend the network with your cellphone. The SIM cards will be handed out at the registration desk; if you have questions you always can contact me or Kevin Redon (thanks again for assisting us).

TelcoSecDay 2016 – Second Round of Talks

Wed, 03 Feb 2016 00:00:00 +0000

I am very happy to announce the second round of talks for the TelcoSecDay 2016. As mentioned in my previous post it will take place on March 15th. All invitations should be out by now; if you think you can contribute to the group and you are willing to join us – please let me know (hschmidt@ernw.de).

Still, not all talks are confirmed but the newly published talks will provide an idea about TSD 2016 and its discussions.

TelcoSecDay – First Round of Talks

Sat, 16 Jan 2016 00:00:00 +0000

Dear all,
This year the TelcoSecDay will take place on March 15th. For those of you who does not know about: the TelcoSecDay it is a sub-event of Troopers bringing together researchers, vendors and practitioners from the telecommunication / mobile security field.

The event is celebrating its 5th anniversary now, that’s why I’d like to say “thank you” to everybody taking part at this very great discussion round in the last few years. We always had a lot of very good feedback and interesting discussions and the increasing participation list of operators from year to year says (almost) everything!

Security Analysis of VoLTE, Part 1

Wed, 06 Jan 2016 00:00:00 +0000

Hello everybody,
this time I’d like to share some thoughts and results about our telco research last year. We gathered a lot of information out of some projects we’d like to share and discuss with you. The following sections also provide an idea of the upcoming Telecommunication Security Workshop I will give with Kevin Redon at Troopers (click). The workshop will be about Radio Network Security (covered by Kevin) and security aspects of the Core Network (covered by myself), mainly focusing on Voice over LTE (VoLTE). That’s also the topic of today’s post.

How to Get a BaseStation

Sun, 17 May 2015 00:00:00 +0000

In our talks in the past we showed what might be possible if an attacker gets access to backhaul and/or core network of a telecommunication provider. In a security analysts perspective this is really disgusting, but provider always will argument that those attack scenarios are not realistic.

Because of legal restrictions we are not able to demonstrate this in practice (e.g. by breaking in into a BTS environment somewhere in the woods) but what we can do is this: building a lab.
Sometimes it is really shocking what you can buy on Ebay, right? Here we got one very interesting component: a Huawei BBU3900 BaseStation which is used by a couple of providers. Okay, it is for GSM-Rail, but the technology behind is very equal. And for 100 dollars (plus shipping) you don’t ask further questions…

GSM@Troopers

Wed, 18 Mar 2015 00:00:00 +0000

Additionally to Wifi, Troopers is also offering a GSM network.
If you want to use it, simply ask your phone to scan for available mobile networks. There you should see the usual T-Mobile D, Vodafone.de, E-Plus, O2-de operators, but also the unusual D 23 or 262 23. Just select this one, and your are done. You also can use the Troopers SIMs which you get on the welcome desk on the ground floor.

Telco Research 2015

Fri, 02 Jan 2015 00:00:00 +0000

Hello and a happy new year 2015 to everybody!

As follow up of our 2014 talk “LTE vs. Darwin” I want to inform you about our telco research in 2015. We are currently dealing with the so called IP Multimedia Subsystem (IMS), which handles the call and media logic of 4G telecommunication networks. This network part provides functions like VoIP (or VoLTE) and takes care of the interconnection to other call or media related networks.

Hackito Ergo Sum 2014

Fri, 02 May 2014 00:00:00 +0000

Greetings from Heidelberg to Paris,

and thanks for a great time at HES14! A nice venue (a museum), sweet talks and stacks of spirit carried us through the three day con. It all set off with a keynote byTROOPERs veteran Edmond ‘bigezy’ Rogers, who stuck to a quite simple principle: “People do stupid things” and I guess every single one of you has quite a few examples for that on offer. Next to every speaker referenced that statement at some point during her/his talk. Furthermore we presented an updated version of our talk LTE vs. Darwin, covering our research of security in LTE networks and potential upcoming problems.

LTE@ShmooCon, a Summary

Tue, 28 Jan 2014 00:00:00 +0000

Hey guys,
as some of you may have noticed, just recently at ShmooCon we gave our talk “LTE vs. Darwin” (Slides here). There we presented some results of our research in 4G telco network security. Some of those originate from our research contribution to ASMONIA, but we expanded the scope and also took a look at the air interface. Both the air interface and the backend links & protocols must be secured appropriately; otherwise communication may be eavesdropped or sensitive information may be compromised. In the following we want to provide an overview of LTE main components and potential attack vectors.

ShmooCon 2014

Sun, 26 Jan 2014 00:00:00 +0000

Last weekend, from 17 to 19 January, ShmooCon was held in Washington, DC. A number of different topics was covered in great talks and we want to give you a short overview of the conference. In the following our favorite talks are briefly summarized.

Privacy Online: What Now?
Ian Goldberg, one of the designers of the OTR Protocol, gave the keynote on the first day. His talk was quite interesting and he presented some really nice approaches, one of those being an attack against PGP. He described the attack as follows: an attacker could copy a key server by downloading all the stored keys. If this is done it is possible to create new key pairs with exactly the same settings as the keys downloaded. The third step is to create all the signing links between the keys as they exist on the real key server. Finally, the attacker uploads these new keys including the signing links to the original key server.
Now, in case Alice wants to retrieve the public key of Bob, Alice would find two keys with seemingly identical properties. If choosing the wrong key for encryption the message will be decipherable by the attacker and in case of MitM situation be accessed. Furthermore, if Alice then signs the “mirror key”, the cloned keys and the original would merge, resulting in further problems.
This was just one consideration discussed in Goldberg’s talk. For the full content, watch the recording, available soon on ShmooCon page.

Some notes on 30C3

Wed, 08 Jan 2014 00:00:00 +0000

We wish you a happy new year and a good start to 2014. A new year has begun and, just before that, 30C3 took place. I think almost all of you have heard about the congress and its topics. In particukar there was Glenn Greenwald’s keynote or there were new publications/revelations by Jacob Appelbaum, which you will probably have heard about from main media.
But besides of all that, there were really a lot of other interesting talks we want to give you a short introduction to. Overall it was a really good conference this year and a lot of awesome talks. But, like always, it is not possible to see all of them, so here is a short summary of some of our favorites: