4G and 5G Networks Altaf af Shai aik (Technische Universitt - - PowerPoint PPT Presentation

▶
4g and 5g networks
SMART_READER_LITE
LIVE PREVIEW

4G and 5G Networks Altaf af Shai aik (Technische Universitt - - PowerPoint PPT Presentation

Dec 12, 2023 564 likes •941 views

Exposing Device Features on KAITIAKI 4G and 5G Networks Altaf af Shai aik (Technische Universitt Berlin, Germany) Ravishankar Borgaonkar (SINTEF Digital, Norway) Hardware.io 2019, Netherlands 26.09.2019 1 5G? G? Human Communication

slide-1
SLIDE 1

Exposing Device Features on 4G and 5G Networks

Altaf af Shai aik

(Technische Universität Berlin, Germany)

Ravishankar Borgaonkar

(SINTEF Digital, Norway)

1 26.09.2019

Hardware.io 2019, Netherlands

KAITIAKI

slide-2
SLIDE 2

5G? G?

2 26.09.2019

Human Communication Machine Communication

slide-3
SLIDE 3

5G G Sec.?

3 26.09.2019

Source: https://www.informationsecuritybuzz.com/articles/security-challenges-next-generation-5g-mobile-networks/

New Services (Use Cases) LTE Security Requirements + Enhancements New Networking Technologies NFV/SDN

5G Security Requirements

slide-4
SLIDE 4

5G G Securi rity y Elem emen ents

26.09.2019 4

Device identifiers/ Credentials/ Authentication+/ Encryption/ Integrity+/ Privacy+/ Resilience+

Edge Cloud

Network Slicing Security/ NFV/SDN Security/

Central Cloud

Mobile Edge Computing/

Cell

slide-5
SLIDE 5

Securi rity Evo volution

  • n (OTA)

5 26.09.2019

slide-6
SLIDE 6

IMSI SI Catcher ers in n 5G. G.?

6 26.09.2019

IMSI IMEI IMSI IMEI IMSI IMEI IMSI IMEI

slide-7
SLIDE 7

5G G Securi rity? y?

  • 5G Security >> 4G ? (What’s new)
  • Same Protocols, Same security algorithms
  • Attacks in 4G/LTE fixed.?
  • Downgrade attacks, DoS attacks, Location tracking
  • What’s not fixed in 4G – copy paste to 5G

7 26.09.2019

slide-8
SLIDE 8

UE Capabilities

Core network Capabilities1 (Security algorithms, voice calling support, V2V) Radio access Capabilities2 (frequency bands, Rx & Tx features, MIMO, CA, Category)

Capabilities es?

1. 3GPP TS 24.301, 23.401, 24.008 2. 3GPP TS 36.331

8 26.09.2019

slide-9
SLIDE 9

Cor

  • re Capabilities

es

9 26.09.2019

slide-10
SLIDE 10

Capabilities es 5G

10 26.09.2019

  • V2X: Connected Cars
  • Prose (D2D): Location services
  • CIoT: IoT specific
slide-11
SLIDE 11

Ra Radi dio

  • Capabilities

es

11 26.09.2019

slide-12
SLIDE 12

Get capabilities Registration Success Authentication and Security Send Capabilities Radio Access Capabilities Save all Capabilities Registration (Core Network Capabilities) OTA Security

LTE Reg egistration

  • n

12 26.09.2019

  • UE Capabilities
  • sent to network while registration
  • Stored at network for long periods
  • visible in plain-text over-the-air
  • Passive and active attacks
slide-13
SLIDE 13

Issu sue? e?

13 26.09.2019

UE Capabilities

  • Accessible by rogue base stations
  • Sent plain-text over the air
  • Standard + Implementation bugs
slide-14
SLIDE 14

Attacks?

14 26.09.2019

  • MNmap (active or passive)
  • Bidding down (MITM)
  • Battery Drain (MITM)
slide-15
SLIDE 15

Set etup – LTE MitM attacker er

  • Hardware
  • 2 X (USRP B210 + Laptops)
  • Phones, Quectel modems,

cars, IoT devices, trackers, laptops, routers….

  • Software
  • SRSLTE
  • Attacks tested with real

devices and commercial networks

15 26.09.2019

slide-16
SLIDE 16
  • 1. MNmap

17 26.09.2019

  • (Mobile Network Mapping)

similar to IP Nmap

  • Maker
  • Model
  • OS
  • Applications
  • Version
slide-17
SLIDE 17

MNmap

Baseband Vendor Name and Model Cellular Phone (Tablet) Android Samsung Huawei HTC LG NOKIA iOS Iphone, Ipad (with version) Others Car Railways Router USB dongle Hotspots Laptops Vending machines Wearables Cellular IoT NB-IoT Smart Meters Smart grid Sensors LTE-M Asset Trackers Agriculture Home automation

Identify any Cellular device in the wild

Chip Maker, Device Model, Operating System, Application of device, Baseband Software Version

18 26.09.2019

slide-18
SLIDE 18

Ide dentification n – How

  • w

Baseband Vendors implement capabilities differently

  • For e.g., Qualcomm Chipsets always Disable EAI0
  • Many Capabilities are optional, (disabled/enabled)

Each target Application requires different set of UE Capabilities

 V2V for automated car  Voice calling and codec support for phone  GPS capability for tracker  Data only support for routers, USB data sticks (SMS only)

19 26.09.2019

slide-19
SLIDE 19

DUT

20 26.09.2019

slide-20
SLIDE 20

Ref ef model

21 26.09.2019

Devices

  • Baseband vendor
  • Application
  • Chipset name
  • 3GPP release
slide-21
SLIDE 21

Fing nger erpri rints

Capability Huawei Samsung Intel Mediatek Qualcomm CM Service Prompt 1 1 EIA0 1 1 1 1 Access class controlfor CSFB 1 1 1 Extended Measurement Capability 1

Implementation differences among Baseband vendors

22 26.09.2019

slide-22
SLIDE 22

Chi hipset inf nfo

23 26.09.2019

slide-23
SLIDE 23

Half-way

24 26.09.2019

  • 1. Baseband Maker
  • 2. Baseband Model
  • 3. List of supported devices for the chipset
  • 4. Identify the right device and application
slide-24
SLIDE 24

Fing nger erpri rints

Capability Phone Others UE’s Usage setting Voice or Data Not present Voice domain preference CS Voice

  • r PS

Voice Not present UMTS AMR codec Present Not

Difference b/w phone and other devices

Capability Android iOS MS assisted GPS 1 Voice over PS-HS- UTRA-FDD-r9 1

Difference b/w iOS and Android

Capability Cellular IoT Cellular PSM Timer 1 T3412 ext period TAU timer 1

Difference b/w cellular and cellular IoT

26.09.2019

Phone Baseband Huawei Huawei Samsung Samsung Apple Intel or QCT

Phone and preferred Baseband

26

slide-25
SLIDE 25

MNmap issu sues es

  • SIM card can have affect on capabilities
  • enabled/disabled – operator setting, e.g., bands
  • IoT applications lte-M vs NB-IoT
  • Timer values (low for smart meters, high for asset trackers)
  • Success and failures in detecting (close to round off, multiple options)

27 26.09.2019

slide-26
SLIDE 26

Wha What nex next

  • Passive MNmap also works (active base station not required)
  • Privacy
  • Link IMSI to device capabilities on 4G
  • (associate device fingerprints to people)
  • Launch target specific attack
  • Open source MNmap : share traces and automated tool

29 26.09.2019

slide-27
SLIDE 27
  • 2. Bidd

dding g do down

  • Hijacking
  • Radio Capabilities
  • MitM relay before OTA

Security

  • Network/Phone cannot

detect

30 26.09.2019

Get capabilities Registration Success Send Capabilities

Radio Capabilities

Save all Capabilities OTA Security

Radio Capabilities

RELAY

slide-28
SLIDE 28

Bidd dding g do down

  • Radio Capabilities are modified
  • UE Category changed (Cat 12 -> Cat 1)
  • CA and MIMO are disabled
  • Frequency Bands are removed
  • VoLTE mandatory requirements are disabled
  • V2V capabilities can be removed

31 26.09.2019

slide-29
SLIDE 29

Tests with rea real ne networks

  • LTE service downgrade (with elite USIM)
  • Iphone 8 and LTE Netgear router (Qualcomm Basebands)
  • Data Rate (downlink) 48 Mbps to 2 Mbps (USA and Europe)
  • VoLTE calls are denied to UE (CSFB used)
  • Handovers to 2G/3G due to lack of band support – downgraded

26.09.2019 32 32

slide-30
SLIDE 30

Impact

  • 22 out of 32 Tested LTE networks worldwide (Europe, Asia, NA) are

affected (USA, Switzerland, France, Japan, Korea Netherlands, UK, Belgium, Iceland)

  • Persistent for 7 days
  • Capabilities are Cached at Core network
  • Restart device for normal operation
  • **Radio is bottleneck for speed data service

33 26.09.2019

slide-31
SLIDE 31

Wh Why y without ut/b /before e Secu ecurity

34 26.09.2019

***T *To do early optimization fo for better service ce/connect ctivity

slide-32
SLIDE 32
  • 3. Battery

ery Drain

35 26.09.2019

Registration Success

Capabilities Capabilities

  • NB-IoT (Narrow Band)
  • Power Saving Mode (PSM)
  • OFF when not in use

Registration

PSM_enable PSM_disabled

Authentication and Security

PSM_Not_enabled Battery_Drain

slide-33
SLIDE 33

Tests

  • PSM disabled (UE and network don’t detect)
  • Continuous activity - Neighbor cell measurements
  • drains battery (10 year battery??)
  • Experiment with NB-IoT UE (Quectel BC68 modem)
  • Reconnects after 310 hours (13 days)
  • Battery lifetime reduced by 5 times
  • Persistent attack: restart required to restore

36 26.09.2019

slide-34
SLIDE 34

Vul ulner erability y Status

  • Reported to GSMA, 3GPP SA3 and other affected operators and

vendors

  • Positive acknowledgement / could be implementation issues
  • Thanks to GSMA, SA3: 3GPP to add fixes
  • Core network capabilities are still unprotected
  • MNmap still possible on 5G : passive, active

37 26.09.2019

slide-35
SLIDE 35

Fixes es

38 26.09.2019

 Fixes in LTE release 14 for NB-IoT will be commercial soon UE Capabilities should be security protected : accessible only after mutual authentication

  • Operators eNodeB implementation/configuration should be

updated Capabilities should be replayed to UE after NAS security setup for verification – Hash of them

  • V2V, Voice calling features, PSM timers, etc.
slide-36
SLIDE 36

Thank you

altaf329@sect.tu-berlin.de Ravi.borgaonkar@sintef.no Director@kaitiaki.in

26.09.2019 39