http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/SS7-ASN1-Flaw_zpslcpchclx.jpg

Preface

People might questions leonardo Da Vinci if he still alive. Why did he choose this woman became mona lisa? Since nobody could explain on behalf of him. But strongly believe that this is the original design.

Linux are everywhere today, in workstation, servers, mobile devices and IoT devices. On the other hand, the culture of modern world relies on electronic communications system. Therefore network communication protocol especially TCP/IP protocol and Signaling System 7 are the major elements in nowadays world.

Recall historical data of specific elements (quick & dirty)

1. ASN.1

Originally defined in 1984 as part of CCITT X.409:1984

Design objective:

i. Overcome how different computer systems transmit data
ii. Model parameters exchanged between application entities

 

2. Signalling System 7

It was developed in 1975

Design objective

i. SS7 controls telephone calls, both wired and wireless, through the use of a control signal that is separate from the actual voice circuit.

ii. It allows phone networks to exchange the information needed for passing calls and text messages between each other.

3. TCP/IP version 4

The first version of this predecessor of modern TCP was written in 1973

Design objective

i. A set of general design guidelines and implementations of specific networking protocols to enable computers to communicate over networks.

ii. TCP/IP provides end-to-end connectivity specifying how data should be formatted, addressed, transmitted, routed and received at the destination.

Flaws found as of today

TCP/IP version 4 (CVE-2016-5696)

The difficult part for hacker taking over TCP connection is to guess the source port of the client and the current sequence number. A group of researchers found that open a connection to the server and send with the source of the attacker as much “RST” handshake packets with the wrong sequence mixed with a few spoofed packets. By counting how much “challenge ACK” handshake packet get returned to the attacker side.  Attacker might knowing the rate limit one can infer how much of the spoofed packets resulted in a challenge ACK to the spoofed client and thus how many of the guesses where correct. This way can quickly narrow down which values of port and sequence are correct.

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/ninja-anima-ver2_zpsoonzpftm.gif

Interim solution apply to Linux environment

Linux are everywhere today, in workstation, servers, mobile devices and IoT devices. Append the following to /etc/sysctl.conf:

net.ipv4.tcp_challenge_ack_limit = 999999999

Use “sysctl -p” to activate this feature

Flaw found in ASN.1 compiler

For more details, please see below:

https://www.linkedin.com/pulse/flaw-found-communications-industry-yet-determined-1-picco

Interim solution: unavailable

Current status: The extent of the vulnerability has yet to be determined, IT folks this vulnerability looks critical. It is hard to imagine what’s the impact at this moment. We keep our eyes open see whether a remediation will be announced by the telecommunication providers?

SS7 Vulnerability

A proof of concept shown that attacker could use the telephone network to access the voice data of a mobile phone, find its location and collect other information. Hacker able to manipulating USSD commands to spoof financial transactions such as the authorization of purchases or the transfer of funds between accounts.

The hacks exploit the SS7 vulnerability by tricking the telecom network believing the attacker’s phone has the same number as the victim’s phone. We know that hackers can hijack whatsApp and telegram via ss7. A vulnerability found on 2008.

Interim solution

Mobile phone network services provider has employed security experts to perform analysis of the SS7 systems in use to try and prevent unauthorised access.

For additional information details, please refer below:

SS7 hack explained: what can you do about it?

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/OSI-vs-SS7_zpsk76izco4.gif

How to protect your IT premises in regards to above flaws?

For weakness of TCP/IP protocol, the IP version 6 able to resolve design limitation of sequence number. In the long run, it is recommend IT team get rid of IP version 4. However the truth is that v4 and v6 are mixed mode in nowadays IT world.

The most headache topics are the ANS.1 complier flaw and Signalling system 7 vulnerability. For SS7 vulnerability, since those item of works (remediation and mitigation) are relies on Telecommunication service providers. Mobile phone network services provider employing security experts to perform analysis of the SS7 systems in use to try and prevent unauthorised access. For text messages, avoiding using SMS. As far as we know, whatsapp communication is being encrypted today!

How’s the status of ASN.1 compiler right now?

About SS7 vulnerability information update:

Nokia safeguards network operations with new security features in Sep 2015. The features consisting of Signaling Guard and Security Assessment service, detects and prevents attacks that exploit vulnerabilities in the SS7 protocol. For more details. Please refer to url below:

http://company.nokia.com/en/news/press-releases/2015/09/03/nokia-networks-safeguards-network-operations-with-two-new-security-launches-networksperform

About  SS7 vulnerability incident found and reported by German newspaper media on May 2017:

German newspaper (Süddeutsche Zeitung) reported that that hackers relied on SS7 attacks flaw as a backdoor. The vulnerability allow bypass two-factor authentication (2FA) systems to conduct unauthorized wire transfers.

http://www.sueddeutsche.de/digital/it-sicherheit-schwachstelle-im-mobilfunknetz-kriminelle-hacker-raeumen-konten-leer-1.3486504

 

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/4G_zpsfq78cmqj.jpg

Let’s review how cellphones work? Quick & Dirty

1G – frequency-division multiple access (so called analogue cellphones)

It divide the frequency band available into little segments and let each person send and receive on a slightly different frequency.

2G – time-division multiple access (so called digital cellphones)

Phone calls were transmitted by sampling the sound of people’s voices and turning each little segment into a numeric code. As well as sharing phone calls between different frequency bands. The design concept is that giving each phone user a short “time share” of the band. The mobile telephony system splits up every calls into digital chunks and sends each chunk at a slightly different time down the same frequency channel.

3G – code-division multiple access (so called high speed digital cellphones)

The fundamental design of idea for code division multiple access are sharing the features of both TDMA and FDMA.  So a number of different callers can use the same radio frequencies at the same time. The 3G networks are a combination of IP and mobile signalling protocols (SS7).

4G – orthogonal frequency-division multiple access (so called high speed broadband cellphones)

A evolution of the three earlier generation of technologies (TDMA, FDMA, and CDMA). With OFDMA technology, signals are digitally coded, chopped into bits, and sent on separate sub-channels at different frequencies. Since signal has been coded and therefore they are not interfere with each other on the same frequency. But the 4G mobile networks are all IP based network. The 4G LTE networks typically include a number of security features that make communications secure.

4G mobile network – Is it trustworthy?

As we know hacker can hack WhatsApp and Telegram by fooling the network causes by Signalling system 7. SS7 is vulnerable since 2008. Mobile phone network services provider has employed security experts to perform analysis of the SS7 systems in use to try and prevent unauthorised access. In the long run, SS7 might going to obsolete in future because of modern technology fast growing trend. The 3G networks are a combination of IP and mobile signalling protocols (SS7). From cellphones users assurance view point, it is better to migrate their services to 4G mobile network instead of 3G.

Just how secure is 4G?

With 4G technology, encryption is only mandatory over the main Radio Access Network (RAN). The traditional crypto and side-channel attacks, 4G security features are able to addressed. The out of band management on 4G network has security considerations. Since the ‘backhaul’ portion of the network is unencrypted by default. For those company integrate their IT infrastructure to 4G network, they must setup a site to site VPN tunnel (IPsec) connect to other side end point. The primary weakness in 4G security is that its use of cryptography does not provide end-to-end security. It only encrypts the traffic between the phone and the base station, but there is no encryption while the data is communicated over the wired network. This means that there is no security against a malicious or compromised carrier.

Unforeseen attack vector due to speedy network

The 4G cellphones that have been infected with malware and are under the control of hackers could also become part of a ‘botnet’, and be used to conduct more advanced attacks, due to the increased bandwidth of 4G. The average download speed for 4G LTE is about 20Mbps. It is faster than traditional 3G network speed 6 times. The Multicast Video delivery scheme in OFDMA-based 4G wireless networks, to optimize multicast video traffic. On the other hand multicast video delivery, which is vulnerable to malicious video flooding attacks. The cyber attack has been changed. From traditional non mobile type network migrate to mobile computing network. The high network speed boost up DDOS power unintentionally. This is the major factor cause distributed denial-of-service (DDoS) attacks rapidly increase.

Theoretical mobile network bandwidth infographic:

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/4G-4_zpst1frchom.gif

Additional key factor :

4G mobile network lure hackers engage cyber attack. It is a jump board. A critical flaw was discovered in the ASN.1 compiler used by leading telecommunications and networking vendors. ASN.1 is an essential ingredient for achieving the lightning-fast mobile broadband networks of the 21st century. Protocols such as 4G: LTE RRC, LTE S1/X2 and IEEE 802.16m WiMAX are defined using ASN.1. Since the extent of the vulnerability of ASN.1 has yet to be determined. And such a way let the 4G mobile network inherent risk increases.

Short term conclusion:

The 4G mobile network looks not secure compared to other mobile network.

Reference: Flaw found ASN.1 & SS7

https://www.linkedin.com/pulse/how-protect-your-premises-found-vulnerability-isnt-picco

 

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/Xor-pic_zpsmuqbdlvz.jpg

XOR DDOS – Tsunami SYN Flood ramping up to 140 Gbps attack against public network backbone.

XOR DDOS attack aggressive last year (2015). Xor DDOS attack triggers by Botnet. The attack capability able to reproduce 150Gbps attack vector. Since the coverage of mobile computing especially cellphone users on demand today. The OS kernel of mobile phone is linux. The architecture of XOR DDOS attack relies on botnet. And the attack target is Linux OS.
This type of attack growth rapidly today. The hackers through TCP 3502 port connect to victim device trigger attack.The objective of attacks are based on flood mechanism (Syn flood and DNS flood).

Historical changes of the MD-5 checksum values:

Oct 2015 – 238ee6c5dd9a9ad3914edd062722ee50

Oct 2015 – 2edd464a8a6b49f1082ac3cc92747ba2

Nov 2014 – fd3f2c810f4391be2e6b82429c53c318 (Attack target specify Linux OS)

Hackers custom cocktail attack mechanism:

SYN and DNS floods generated by the Xor.DDoS Malware have very specific characteristics. The payload consists of garbage memory data, this memory capable to store passwords and ssh private keys.

The attacker will send many SYN packs to victim host with multiple sources. The attack will be launched on port 22 (ssh). This attack is very effective if syn_cookies are turned off. Please be remind that syn_cookies turned off by default on Linux.SYN cookies are now a standard part of Linux and FreeBSD.

DNS floods are symmetrical DDoS attacks. These attacks attempt to exhaust server-side assets (e.g., memory or CPU) with a flood of UDP requests. Since DNS servers rely on the UDP protocol for name resolution, and is a Layer 3 attack. With UDP-based queries (unlike TCP queries), a full circuit is never established, and thus spoofing is more easily.

Design objective of XOR malware:

SYN Cookies is a simple DDoS defence today, and probably suitable for all Internet hosting including mail server and corporate web servers. 500 units of compromised mobile computing devices with an average 200 Kbs of bandwidth each launching an attack will fully utilize your 100Mbs network link.

Attack target:

From technical point of view, SYN Flood and DNS flood are effectively suspend the network connectivity and domain name lookup function. It clearly shown that engage this attack to ISP or Cloud services provider might bring a Tragedy to their business. As far as I know, ISP or Cloud services provider have mechanism to detect botnet in their network and monitor the malicious communications between bot and C&C server. But for victim hosts, since it is not run in the internal network. Even though you install malware detector, define Yara rule looks not help! I believed that this is one of the key topic which headache the ISP and cloud services provider.

For mitigation of the attack, a discussion will continuous on the next phase.