Tag: TelcoSecDay

Events
by Enno Rey

Final Agenda of Troopers15 TelcoSecDay

Admitted, we’re a bit late this time, but here we go with the agenda of this year’s TelcoSecDay.

Given the high number of quality contributions overall there’s more talks than in the previous years and we’ll hence start more early (and finish later 🙂 ), so please plan accordingly.
This is the agenda, details for the invididual talks can be found in the respective links:

8:30-9:00 Opening & Intro
9:00-9:45 Luca Bruno: Through the Looking-Glass, and What Eve Found There
9:45-10:30 Dieter Spaar: How to Assess M2M Communication from an Attacker’s Perspective
Break
11:00-11:45 Tobias Engel: Securing the SS7 Interconnect
11:45-12:30 Ravishankar Borgaonkar: TelcoSecurity Mirage: 1G to 5G
12:30-13:00 Hendrik Schmidt: Security Aspects of VoLTE
Lunch
14:00-14:45 Rob Kuiters: On her majesty’s secret service – GRX and a Spy Agency
14:45-15:30 “Watching the Watchers”
Break
16:00-16:45 Markus Vervier: Borrowing Mobile Network Identities – Just Because We Can
16:45-17:15 Shahar Tal: I hunt TR-069 admins – CWMP Insecurity
Refreshment
17:30-18:00 SĂ©bastien Roche (Orange): tba

19:30 Dinner (it will be hosted by us, location & details will be provided during workshop and from @WEareTROOPERS).

 

See you all there, have a safe trip everybody

Enno

 

Continue reading
Events
by Enno Rey

Troopers 15 TelcoSecDay – First Talks

At Troopers15 there will be another TelcoSecDay, like in the years before (2014, 2013, 2012). Here’s the first three talks (of overall 5-6):

Luca Bruno: Through the Looking-Glass, and What Eve Found There

Synopsis: Traditionally, network operators have provided some kind of public read-only access to their current view of the BGP routing table, by the means of a “looking glass”.
In this talk we inspect looking glass instances from a security point of view, showing many shortcomings and flaws which could let a malicious entity take control of critical devices connected to them. In particular, we will highlight how easy it is for a low-skilled attacker to gain access to core routers within multiple ISP infrastructures.

Markus Vervier: Borrowing Mobile Network Identities –  Just Because We Can

Synopsis: This talk features an attack that enables active cloning of mobile identities.
It is shown how to patch a baseband firmware for Android devices to implement a virtual SIM card. Additionally different methods enabling access to the SIM card on unmodified Android devices are presented. Running a mobile network authentication algorithm on a SIM card in a first device and forwarding the result to a patched baseband on a second device allows the second device to retrieve valid authentication tokens. The second device can use these tokens to authenticate to the mobile network without having permanent access to the SIM card.
This results in taking over mobile network identities of others as well as in possibilities to evade surveillance by rapidly changing network identities.

Bio: Markus Vervier is a security researcher from Germany. Having more than 10 years of experience in penetration testing, source code auditing and network security, he was involved in finding vulnerabilities in banking systems as well as operating system features such as BSD Securelevels.

 
Tobias Engel: Securing the SS7 Interconnect

Synopsis: Recent disclosures made public a reality long known to telco network operators: Once an attacker gains access to SS7, there are almost no barriers against spying on subscribers and committing billing fraud. sternraute is currently developing an SS7/MAP application level firewall to be deployed by operators. This talk will look at the different approaches our firewall employs to detect and filter illegitimate traffic and what operators can do beyond that to protect their customers and networks.

Bio: Tobias Engel, born in 1974, is founder and managing partner of Berlin-based sternraute GmbH, which develops security products for mobile networks. As an active member of Germany’s Chaos Computer Club,he repeatedly called attention to security vulnerabilities in ICTsystems. For many years, Engel has been a consultant and software developer for various companies in the IT and telecommunications sector.

===

We’ll finalize the agenda in the upcoming days and publish details as for the other talks then, too. Stay tuned…
Have a good one

Enno

 

 

 

Continue reading
Events
by Enno Rey

Preliminary Agenda for Troopers 2014 Telco Sec Day

Given we’ve received a number of inquiries as for the agenda of this year’s TelcoSecDay here’s a first preliminary agenda. To get an idea of the event’s character you might have a look at the agenda of the 2012 edition or the 2013 edition. Pls note that there might be changes/additions to the following outline as we’re currently discussing potential contributions with two European operators. Here we go, for today:

9:00: Opening Remarks & Introduction
9:15: Ravi Borgaonkor – Evolution of SIM Card Security
10:15: Break
10:45: Adrian Dabrowski
11:45: Collin Mulliner – PatchDroid – Third Party Security Patches for Android
12:30: Lunch
13:45: Philippe Langlois
14:45: Break
15:15: Haya Shulman – The Illusion of Challenge-Response Authentication
16:00: Christian Sielaff & Daniel Hauenstein – Breaking Network Monitoring Tools Used in Telco Space
16:30: Closing Remarks
19:00: Joint dinner (hosted by ERNW) in Heidelberg Altstadt for those interested and/or staying for the main conference

Continue reading “Preliminary Agenda for Troopers 2014 Telco Sec Day”

Continue reading
Events
by Enno Rey

TROOPERS13: TelcoSecDay, IPv6 Security Summit and some more Updates

Here’s a number of updates as for upcoming TROOPERS13.

The preliminary agenda for this year’s TelcoSecDay can be found here.

Here‘s the (again: preliminary) agenda of the IPv6 Security Summit.

Last, but not least we’ve included another four talks in the main conference:

======

Sergey Bratus & Travis Goodspeed: You wouldn’t share a syringe. Would you share a USB port?

Synopsis: Previous work has shown that a USB port left unattended may be subject to pwnage via insertion of a device that types into your command shell (e.g. here). Impressive attack payloads have been delivered over USB to jailbreak PS3 and a “smart TV“. Not surprisingly, USB stacks started incorporating defenses such as device registration, USB firewalls, and other protective kits. But do these protective measures go far enough to let you safely plug in a strange thumb drive into your laptop’s USB port?

We demonstrate that the scope of the OS code manipulation feasible through a USB port is much broader than could be expected. USB stack abuse is not limited to emulating HID keyboards or a few exotic devices — it is a clear and present danger throughout the USB software stack and can reach into any part of the operating system kernel and driver code. We show a simple development environment that is capable of emulating any USB device to engage whatever software on the host computer is meant to interact with such devices — and break any and all of the assumptions made by such software, leading to pwnage. In a nutshell, sharing a USB port belongs in the past — just as the era of downloading arbitrary executables and other Internet “free love”.

 

Continue reading “TROOPERS13: TelcoSecDay, IPv6 Security Summit and some more Updates”

Continue reading
Events
by Enno Rey

Slides from Troopers Telco Sec Day Online

As I mentioned the Telco Sec Day in the last post… for those who missed Flo’s announcement: in the interim all slides of the Telco Sec Day are available online here.

Obviously, given I initiated the event, I’m biased 😉 but to me it provided great insight from both the talks and the networking with other guys from the telco security field, and it did actually what it was meant for: fostering the exchange between different players in that space, for the sake of sustainably improving its’ overall security posture.

A number of participants suggested performing it again which we hence plan to do, at next year’s Troopers (probably happening in the week 03/12-03/16 [calendar week 11]).

See you there, all the best

Enno

 

Continue reading