Root Canal A new class of SS7 vulnerabilities Agenda SS7 - - PowerPoint PPT Presentation

Outstanding Communications Solutions

Root Canal

A new class of SS7 vulnerabilities

• SS7 – Vulnerable by design
• Acknowledged signalling vulnerabilities
• The root problem
• Mitigation – The signaling band-aid
• A new class of SS7 vulnerabilities
• Malformed Packets
• Prerequisites
• Attacking and Tunneling
• Multi stage exploit
• Proposed mitigation and limits

Agenda

2

• Presenter – Fredrik Söderlund
• Symsoft – Software and Systems Security Advisor
• Background in
• Reverse engineering
• Debug tools development
• Telecom security
• Security researcher and contributor to the GSMA CVD program
• Worked on multiple SS7 firewall designs both for SMS and full

spectrum SS7

Introduction

3

• Symsoft – CLX Communications
• Communications Solutions for Operators
• 75+ Mobile Operator Customers
• 1000+ Enterprise Customers
• IoT and MVNO Platforms
• Fraud & Security
• Real-Time BSS
• Value Added Services

Introduction

4

SS7 – Vulnerable by design

5

Signaling Vulnerabilities

• Signaling based attacks
• Location tracking – ATI, PSI
• Spying on subscribers or VIPs
• Profile manipulation – ISD, registerSS
• Fraud, call redirection or denial of service
• Subscriber hijacking, DoS – UL, DSD
• Eavesdropping, fraud or denial of service

Acknowledged vulnerabilities

6

• Yes they are dangerous, costly and indicates

the network is vulnerable

• But they are also perfectly normal and the

expected functionality of an SS7 network

• The network is doing exactly what is intended
• Attacks or misuse? These attacks have been

known for a long time and were easy to predict.

Acknowledged vulnerabilities

7

• The root problem is always the same…
• Subscriber tracking
• Lack of authentication (who is reading?)
• Profile manipulation
• Lack of authentication (who is writing?)
• Location update
• Lack of authentication (who is moving?)

Acknowledged vulnerabilities

8

• Everyone trusts everyone
• If you’re on the network you’re a friend
• Anyone can impersonate anyone
• If you’re on the network we assume you are who you

say you are

The root problem

9

• The obvious answer to signaling problems:
• Introduce authentication!
• Let’s not do that…
• Instead we will:
• Cat 1 - Filter network edge for unexpected or unwanted
• perations
• Cat 2 - Verify fields across stack layers without 1:1 match of

components (CC+NNGT : MCC+MNC)

• Cat 3 - Verify subscriber location by last known location or

plausibility of movement

Mitigation - The signaling band-aid

10

• In addition to filtering we can also configure
• ur networks better
• Whitelist roaming partners, known nodes/peers
• Introduce home routing
• Whitelist exceptions based on origin and opcode
• The result is a reasonably secure network
• The Signaling band-aid works pretty good

Mitigation - The signaling band-aid

11

• So what is the problem?

Mitigation - The signaling band-aid

12

A new class of SS7 vulnerabilities

13

Malformed Packets

Well formed Packet

14

Malformed Packet

15

Non signaling based attacks in malformed packets

• Routable attacks using malformed ASN.1 or

SCCP layer data

• Crafted payloads targeting known firmware

vulnerable to encoding based attacks

• Sophisticated attacks most likely using hijacked

infrastructure

• Potential attackers include APTs such as nation

states or criminal networks

Malformed Packets

16

▪ Denial of Service

Aim is to crash the targeted network element either to influence network performance or steer traffic to alternative links where attacker may have better visibility

• Methods include for example: buffer overflows, null pointers, stack depletion,

memory corruption, infinite nesting

▪ Remote Code Execution

Aims to take control of the targeted network element in order to exfiltrate data, scan network, generate traffic, commit fraud or eavesdrop on network traffic or subscribers

• Methods include the same as Denial of Service attacks but with

the goal of executing code via controllable crash.

• Once code execution has been achieved the attacker is likely to

proceed with privilege escalation and full compromise of the network element

Malformed Packets

17

18

• Compare a normal packet to a letter
• A letter flows by country, city, street and finally

reaches a person

• In a malformed packet the attacker attempts

to interrupt this flow or even trap it in an infinite loop & ultimately crash the application

Malformed Packets

19

• Malformed data can also point to sections
• f code or data outside the actual packet
• Such pointers can redirect the flow and

introduce a predictable and reproduceable crash of the application

Malformed Packets

20

• Most dangerous is Remote Code Execution
• The predictable crash is exploited to run code
• The code installs a Command & Control server
• Attacker can scan and control the network
• Worst case - The attack is totally transparent

Malformed Packets

A new class of SS7 vulnerabilities

21

Prerequisites

Prerequisites

22

• What we need to launch this attack
• A vulnerable ASN.1 parser in the target node
• Some type of UE registered in the target

network

• To act as a known recipient in the target network
• The ability to send a routable SCCP packet

carrying a 500 byte payload

Prerequisites

23

• A vulnerable ASN.1 parser, does it exist?

Prerequisites

24

• Get a handset into the target network

should be doable

• Sending a 500 byte payload over SS7
• Over M3UA it seems that most nodes accept

payloads above 500 byte size without question

• Over MTP3 there is a physical limit of 272 bytes
• This limitation may carry over to M2PA
• This could be a bottleneck...

Prerequisites

25

Prerequisites

26

• Full length or concatenated SMS are larger

than 272 bytes

• They usually consist of an empty TCAP Begin

followed by the payload in a TCAP Continue

• Payloads larger than 272 bytes can be sent

divided into multiple parts

• This means that also SS7 has ways of passing

larger packets to the application layer

Prerequisites

27

• SCCP UDT (Unitdata) has a size limitation (still

however well above what an attacker needs)

• If a packet however exceeds the size limit of 272

bytes it may be transported over XUDT to accommodate the legacy size limit

• SCCP XUDT (Extended Unitdata) offers

fragmentation and can therefore encapsulate larger packets also over MTP3 and M2PA

• Fragmented packets are reassembled on arrival and

passed in original form to the application

Prerequisites

28

• We have a method of delivery
• Regular SCCP UDT over M3UA appears to be

widely accepted with larger packets sizes

• XUDT over MTP3/M2PA offers a fragmented

alternative to overcome physical barrier of legacy technology

A new class of SS7 vulnerabilities

29

Attacking and Tunneling

Attacking and Tunneling

30

• Crafting the attack
• We are still subject to some limits with regards to size
• f the attacks. No hard cap, but an attacker needs to

limit size of initial infection for better chance of success

• This means crafting a multi stage attack
• Characteristics of the ideal MAP operation for initial

infection:

• Spoofable (we don’t need the returnResult)
• Variable size
• Optional parameters

Attacking and Tunneling

31

• MAP reset – Fits the description
• Spoofable and contains a variable size hlr-List of

IMSI:s as optional parameter…

Multi stage exploit

32

• Primary infection: 500 bytes carried in the optional list

parameter of MAP reset

• Trigger vulnerability, start execution
• Allocate space for hook procedures
• Adjust memory protection of 1 page of code
• Patch recv function and install hook 1
• Hook 1 filters all incoming SMS traffic towards the attacker

UE registered in the target network

• Chunks of executable code are delivered and assembled into

second stage of infection

• When all chunks have been delivered, hook 1 is replaced by

hook 2

Multi stage exploit

33

• Secondary infection: 2000 bytes of PoC code
• Does not need to connect back to original attacker GT
• The Primary infection may be spoofed
• Offers the ability to execute commands on target
• Has the ability to report back to attacker
• Data is tunneled to target using MT SMS
• Data is tunneled from target using MO SMS
• Infection is transparent to target node and leaves no stains
• n the file system.

Call Flow

34

• Multiple stage attack using MAP reset and MT SMS
• Delivers exploit, installs Command & Control (C2)
• Attacker can proceed to control network remotely
• Scan, cross infect, commit fraud, deny service

Call Flow

35

• First stage attacks encoding at ASN.1 or SCCP
• Crashes the MSC in a predictable way
• Installs hook procedure to filter incoming MT SMS
• Returns control to application and starts filtering

Call Flow

36

• Second Stage is built using MT SMS
• MT SMS contain code for C2 in TPDU User-Data
• Hook detects incoming MT SMS by known UE IMSI
• Reassembles MT SMS chunks to build C2 server

Call Flow

37

• C2 server acts as attacker inside network
• Attacker send commands using MT SMS
• C2 executes attacker commands
• C2 functionality can be extended if required

Multi stage exploit

38

• Alternative methods
• Using SMS leaves CDR records…
• Is it possible to build a stealth version to avoid or

limit CDR records?

• And what about evading SS7 Firewalls?

Multi stage exploit (stealth ver)

39

• extensionContainers
• privateExtensionList
• Encoding can be vendor specific

Multi stage exploit (stealth ver)

40

• A sophisticated attacker could use

extensionContainers both for primary attack and tunneling

• Could use fake UL from hook to trigger stream of

ISD from attacker

• ISD can carry extensionContainers
• This could be very difficult to detect
• Vendor specific encoding must either be ignored by

SS7 Firewall or blocked by default. So extensions may actually pass through firewalls unfiltered

Multi stage exploit (stealth ver)

41

• An attacker could also create virtual

subscribers on the hijacked MSC to

• bfuscate and hide tunneled data further
• Generate UL to simulate an inbound roamer

registering with the network

• This could also leave limited or no information

in CDRs especially if virtual subscribers are created at random by the attacker

Multi stage exploit (SMS vs PE)

42

• MT SMS
• +Easy tunneling, simple encoding and exchange
• +Control network node without SS7 connectivity (after initial hook

all other things can be done from a phone)

• All communications logged in CDRs
• Unless attacker wipes them, if possible
• Private Extensions
• +Possibly better stealth capability
• +May pass through SS7 Firewalls as it relies on propriety data

structures

• More complex encoding and exchange
• Less bandwidth than SMS tunneling

A new class of SS7 vulnerabilities

43

Proposed Mitigation and Limits

Denial of Service – Protection Mechanisms

• Validation of encoding and packet structure
• ASN.1 Validation for TCAP, MAP, CAP layers

Validation of packet size, pointers, nesting levels, adherence to specification

• Parameter validation for SCCP

Parameter size/position Flags, bitmasks and format of data, such as invalid structure of parameters or pointers reaching outside the SCCP packet

44

Proposed mitigation and limits

Remote Code Execution - Protection Mechanisms

• Payload size monitoring
• For an attacker to successfully perform an encoding based attack

the initial attack must contain both an exploit part and actual code. Some specific SS7 Operations, such as MAP reset, can be monitored specifically for abnormal size

• Fragmentation checks – XUDT/XUDTS
• Generally fragmented traffic is very rare and occur if traffic has

passed through E1/TDM type networks or potentially M2PA links

• Monitor fragmented traffic, if there are spikes it could be an

indication that attack testing is being conducted towards receiving network

45

Proposed mitigation and limits

Proposed mitigation and limits

46

• There are limits to what can be protected
• The initial attack could be delivered over any

interface that accept packets above 500 bytes in size

• That could be almost any interface…
• Initial attack could arrive over OAM, SIP, HTTP,

Charging or any proprietary interface on the target SS7 node. As long as the vulnerability is known it can switch to SS7 tunneling after hook 1 is installed.

Proposed mitigation and limits

47

• Reasonable protection can be achieved
• Main responsibility sits with vendors
• Encourage development of secure parsers
• Ask the right questions
• Don’t assume another node will deal with the
• problem. The edge/firewall/security GW needs

to handle it.

• Enforcing ASLR – While not a perfectly reliable protection, Address

Space Layout Randomization does make certain attacks more difficult

• Process privilege levels – Ensure only required privileges are granted
• Vendors should be required to perform fuzz tests of critical code
• Fuzz any code that manage data generated either directly or indirectly from

processing signaling traffic

• Fuzz network stack and parsers at any routable layer (SCCP and above).
• Monitoring of outbound traffic can help detect if a network element has

been compromised

• Consider blocking of private extension containers since they can contain

vendor specific proprietary data structures that an SS7 Firewall may be unable to inspect

General Recommendations

48

Proof of Concept – Demo attack

49

Vulnerable MSC attack simulation

Real World Bonus Content

50

Please memset

• The following capture is from a production environment
• Network specific details have been blacked out
• Illustrates how poorly written encoders can leak information

SS7 vs ASLR

51

THREE SLIDES FROM THE ORIGINAL PRESENTATION HAVE INTENTIONALLY BEEN REMOVED. THEY ILLUSTRATE BROKEN ENCODER LEAKING STACK INFORMATION VIA BADLY IMPLEMENTED PADDING OF SCCP LAYER

SS7 vs ASLR

52

• Poorly written encoder
• Leaves scraps from local variables in the padding
• Can give hints about where modules are loaded
• Can expose base address of stack
• Attacker can simply “ask” for ASLR details
• Send an invoke to get returnResult or trigger ISD
• Answer contains fragments of local variables
• Suddenly ASLR isn’t R at all

SS7 vs ASLR

53

Questions

54