• Abstract and Figures
• Public Full-text

VULNERABILITIES OF MOBILE INTERNET (GPRS) Dmitry Kurbatov Sergey Puzankov Pavel Novikov 2014 CONTENTS 1. INTRODUCTION 3 2. SUMMARY 3 3. MOBILE NETWORK SCHEME 4 4. GTP PROTOCOL 5 5. SEARCHING FOR MOBILE OPERATOR’S FACILITIES ON THE INTERNET 7 6. THREATS 10 6.1. IMSI BRUTE FORCE 10 6.2. THE DISCLOSURE OF SUBSCRIBER’S DATA VIA IMSI 11 6.3. DisCONNECTION OF AUTHORIZED SUBSCRIBERS FROM THE INTERNET 12 6.4. BLOCKING THE CONNECTION TO THE INTERNET 13 6.5. INTERNET AT THE EXPENSE OF OTHERS 14 6.6. DATA INTERCEPTION 15 6.7. DNS TUNNELING 16 6.8. SUBSTITUTION OF DNS FOR GGSN 17 7. CONCLUSION AND RECOMMENDATIONS 18 VULNERABILITIES OF MOBILE INTERNET (GPRS), 2014 2 1. INTRODUCTION Modern mobile networks facilitate the most convenient access to the to this, a great number of security solutions were introduced to pro- Internet without the need for static infrastructures. People can access tect this services sector, such as antivirus software, firewalls, etc. By email, messengers, social networks and online stores whenever and contrast, the level of consciousness about security while using the wherever they need it. A range of businesses use mobile Internet for mobile Internet is relatively low. Most users assume that mobile net- remote administration, financial operations, e-commerce, M2M and work access is much safer because a big mobile-telecoms provider some other purposes. Government organizations provide more and will protect subscribers and has the benefit of the developments in more services via the web, and it results in a significant increase in security from the broadband Internet arena. Unfortunately, as prac- the volume of the world’s mobile data traffic. This traffic is expected tice shows, mobile Internet is a great opportunity for the attacker, to increase significantly in both 3G/3.5G and 4G through 2018, see and can be less secure than more traditional options. This report will table below. provide an analysis of these threats, as well as recommendations to Many users have approached the use of broadband Internet access ensure the safety of mobile Internet services. with caution, due to publicity around security breaches. In response Exabytes per Month 18 16 3% 14 12 46% 10 8 6 4 51% 2/2.5G 9% 2 3/3.5G 60% 0 4G 30% 2013 2014 2015 2016 2017 2018 Source: Cisco VNI Mobile 2014 Fig. 1. The expected growth in mobile data traffic [1] 2. SUMMARY Positive Technologies has determined that there are serious security 2. Obtaining subscriber’s data via IMSI (including his/her location) issues in the networks that support mobile Internet devices. A large 3. Disconnection of subscribers from the Internet or blocking their number of devices belonging to 2G/3G networks of mobile network access to the Internet operators are available via open GTP ports as well as some other open 4. Connecting to the Internet with credentials of the legitimate communication protocols (FTP, Telnet, HTTP). An attacker can connect user and at the expense of others to the node of a mobile network operator by exploiting vulnerabilities 5. Listening to the traffic of the victim (for example, default passwords) in these interfaces. 6. Engage in a fishing attack Having acquired access to the network of any operator, an at- tacker can automatically gain access to the GRX network, which in Security measures required to protect against such attacks include turn allows him/her to perform various attacks on subscribers of any proper configuration of equipment, utilizing a firewall and regular se- operator: curity monitoring. More details on the recommended set of protec- 1. Searching for valid IMSI tive measures is provided in the final part of this review. 2 VULNERABILITIES OF MOBILE INTERNET (GPRS), 2014 3 3. MOBILE NETWORK SCHEME Fig. 2. Provider’s mobile network Mobile provider’s network consists of the Circuit Switched Core • Subscriber’s Mobile Station Network (CS core), the Packet Switched Core Network (PS core), • The Internet the base station network and its 2G controllers (BSC and BTS in the • The GRX network, i.e. via another mobile provider scheme), and the base station network and its 3G controllers (Node Thus if an attacker enters the network of any mobile provider in the B and RNC). The scheme shows that 3G network is based on 2G radio world, he/she will be able to affect other providers. access network; the rest of the operator’s network does not undergo Service GPRS Support Node (SGSN) and Gateway GPRS Support any significant changes in the evolution to the third generation. As Node (GGSN) are the basic elements for data transmission. The former clearly outlined in Figure 2.2, the operators’ networks have not under- one is used to provide subscribers with data transmission services and gone any significant changes in terms of security from 2G to 3G to 4G. it also interacts with other network elements; the latter is a gateway Below is the packet data transfer subsystem (PS core). between the internal operator’s network and the Internet. The scheme in Figure 3 illustrates the architecture of the system In addition to the Internet connection, there is a connection to used to transmit data in a 2G network. There are some differences in the GRX network — Global Roaming eXchange, which is based on the chain MS (mobile station) — SGSN within the 3G network (UMTS complicated relationships between individual operators (intercon- network). The scheme shows that an attacker can access the provid- nection of networks) used to provide Internet access to subscribers er’s network using: in roaming. VULNERABILITIES OF MOBILE INTERNET (GPRS), 2014 4 Fig. 3. A scheme for the packet data transmission within mobile networks (including information on protocols) 4. GTP PROTOCOL GTP protocol is used to send the traffic within PS core and GRX. This is a other information) contains the login, password, and APN. tunneling protocol, which runs over UDP and utilizes port 2123 (for man- 2. After receiving the APN, SGSN tries to resolve it on the internal agement purposes, GTP-C), port 2152 (for transmitting user data, GTP-U), DNS server; the server resolves the received APN and provides the cor- and 3386 (for billing, GTP’). responding GGSN address. Message Type field in the GTP header is primarily used for manage- 3. The SGSN sends the Create PDP Context request to this address. ment purposes in GTP-C. Usually, in GTP-U Message Type = 0xFF (T-PDU). 4. The GGSN authenticates the submitted login and password, for ex- Tunnel Endpoint Identifier (TEID) is a tunnel identifier that is not associ- ample, on the RADIUS server. ated with an IP address, i.e., packages can be sent with the same TEID but 5. The GGSN obtains an IP address for the mobile phone and transmits from different IP addresses (in case if the subscriber moves and switches all data required for PDP context activation back to the SGSN. to another SGSN). 6. The SGSN accomplishes the activation procedure by sending back PDP Context Activation procedure is executed when the subscriber is to the phone all the data required for establishing a connection. connecting to the Internet. In fact, the PDP Context Activation procedure is the creation of a tun- In simplified form, the procedure is as follows: nel between a cell phone and a gateway (GGSN) on the operator’s mo- 1. The phone sends an Activate PDP Context request, which (amongst bile network. 4 VULNERABILITIES OF MOBILE INTERNET (GPRS), 2014 5 Octets 8 7 6 5 4 3 2 1 1 Version PT (*) E S PN 2 Message Type 3 Length (1st Octet) 4 Length (2nd Octet) 5 Tunnel Endpoint Identifier (1st Octet) 6 Tunnel Endpoint Identifier (2nd Octet) 7 Tunnel Endpoint Identifier (3rd Octet) 8 Tunnel Endpoint Identifier (4th Octet) 9 Sequence Number (1st Octet)1) 4) 10 Sequence Number (2nd Octet)1) 4) 11 N-PDU Number2) 4) 12 Next Extension Header Type3) 4) NOTE 0: (*) This bit is a spare bit. It shall be sent as '0'. The receiver shall not evaluate this bit. NOTE 1: 1) This field shall only be evaluated when indicated by the S flag set to 1. NOTE 2: 2) This field shall only be evaluated when indicated by the PN flag set to 1. NOTE 3: 3) This field shall only be evaluated when indicated by the E flag set to 1. NOTE 4: 4) This field shall be present if and only if any one or more of the S, PN and E flags are set. Fig. 4. GTP header structure PDP Context Activation SGSN DNS GGSN RADIUS DHCP 1. Activate PDP 2a. DNS Request 4a. Radius Authenticate Context Request mncXXX.mscXXX.internet Request 2b. DNS Response GGSN IP 4b. Radius Authenticate Response 3. Create PDP Context Request 5a. DHCP Address Request 7. Activate PDP 6. Create PDP Context Response 5a. DHCP Address Assignment Context Accept GTP U GTP C + GTP U Fig. 5. The procedure for establishing a connection VULNERABILITIES OF MOBILE INTERNET (GPRS), 2014 6 5. SEARCHING FOR MOBILE OPERATOR’S FACILITIES ON THE INTERNET We already know that GGSN must be deployed as an edge device. Us- find the required devices by their banners. ing Shodan.io search engine for Internet-connected devices, we can Fig. 6. Search results in Shodan Search result displays about 40 devices using this abbreviation in the world creates this opportunity for attack to many other mobile their banners. The screenshot provides a list of some devices that use networks. There are more ways of using the compromised boundary this abbreviation, including devices with open Telnet and turned off host, for example, DNS spoofing attack (more information about at- password authentication.

Load more

  20

Copy Link