Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/319 Thanks!
So it is my great pleasure
to be able to announce our next
speaker for those of
you who have been to previous Congresses
to be, as Angle has been presenting
it, 18 C three on
the short message service protocols
and on twenty five C three
on locating phones with as seven
through SMS routing.
And as Tobias's
an intimate friend and foe
of diverse protocols and their
implementations, I'm much looking
forward to see what he has found today
in his talk as a seven locate,
track and manipulate.
So please join me and give a very
warm welcome to Single.
Thank you.
Um, yeah, so, uh, as Andrea's
already said, I want to talk
about further security issues with
S7 today, so
why should you care?
Everybody who has a phone in his pocket
indirectly uses as a weapon.
And I'm going to talk about how
your every movement can be tracked
all over the world and how
people can intercept your calls
in the middle of them and your short
messages and all of that
only by knowing your phone number.
OK, one thing in advance.
A few weeks ago, Cost contacted me.
He has the talk after this one
and we realized that his company
and I did a lot
of parallel research over this year.
So we kind of split split
up the topics a little bit.
And also, as I was made of,
was was I made aware of only
two days ago, two Russians
say I, Sergei Pruzan cough and Dimitri
Cuba to have already presented
and that on that subject in May
and talked a lot about
the same issues.
So it really seems 2014
is the year of the S7 research.
OK, how did this tour come
together?
Earlier this year, a journalist contacted
me from the Washington Post and
told me that there are
several companies out there
selling, uh,
uh, tracking
for people or tracking of
people. And
so, as you can see, I didn't I didn't
come up with a title of my talk myself.
OK, track, manipulate.
It's actually the subtitle of a brochure
about, uh, Weland on their Skylake
product.
And yet, as it turns out,
companies are selling
that ability.
And as you can see, it's very detailed
tracking down city streets
all over the world.
And all you need is the phone number
two to track these people.
And the journalist asked me how
because I had done
similar work on the subject and
how that would be possible.
And I wanted to find out.
But first.
Let's look at what signaling System seven
is,
it's the protocols used by most
telecom network operators throughout the
world, um, for the switches
to talk to each other.
It was designed a long time ago.
And back then in the 80s, there
were no mobile phones.
Um, it was all just
fixed line phones connected to a socket
in the wall. So there were no privacy
implications.
And also there
were only very few telecom operators,
state controlled big companies
who you trusted, who trusted each
other.
And then came the mobile
phones and.
New features with them,
and so new protocols had
to be added to as a seven.
So now you could take your phone
everywhere you went
to other countries.
So roaming had to be implemented.
You could send text messages.
You have the Internet.
Um, so the mobile
application part map
was added that
does all those things that mobile phones
can do, that fixed line phones cannot do.
Then even later, a new
protocol was added to the application
part, um,
that allows operators to build
custom services that cannot be
that are not possible. With more on that
later, and for
none of these services, any
authentication exists.
So if you are in the Seven Network and
you have a roaming agreement
with other operators, you can simply
use these services and don't
have to authenticate.
Yeah, and getting access to S7 is
becoming easier all the time,
and it can simply be bought from
telecom operators and
network operators,
because if you are, I don't know if
you plan on on some
some servers or something like that, you
might actually need seven exes.
So it can simply be bought.
Um,
usually.
So the seven axis
as it is, is simply like an
Internet access without an IP address.
So you still
need the address. It's called a global
title.
Um,
and.
And you need roaming agreements that
cover that global title so that your
messages get routed usually, but
not always. Sometimes it works with
roaming agreements. And also several
telcos are reselling
global titles that are covered by their
roaming agreements.
Also, network operators
taps that network operators leave their
equipment and on the Internet
and also there have been several
reports of femtocell hacking
and femtocell are an extension
of the core network of the network
operators core network into your home.
So if you can hack femtocell,
there's also a chance that you have
access to it as a seven.
Quick overview of the protocol stack
down there on the left side, empty pill,
everyone that
the physical layout, one or even
lines back in the days
nowadays, it's often
routed over IP.
But this talk focuses on SICP
map kepp the network
layer and the mobile application part
that implements all the features
for mobile phones.
Quick network overview
on the left and on the right, you see the
base station subsistent, this is the part
our phones talk to with the cell towers,
the base station controllers and so on.
This is not the focus of our talk.
The focus is
the core network of the operator
of the red lines. You can see our seven
connections so the operators equipment
uses as a service and also between
operators, as is being
used, one of
the most important network elements
of the home location register.
That's a database containing all
information on a subscriber, meaning his
phone number is a prepaid or postpaid
contract.
What is he allowed to do?
Data, text messages, calls, incoming,
outgoing, are there any call forwarding
set? And so on.
And also the home database, the home
location register knows
which mobile switching
center masc or via our
visitor location register is
currently closest
to a subscriber.
So the visitor location register, it
receives a copy of the subscriber's
data as soon as you switch on your phone
from the car.
And so, for example, there is for
many networks.
So, for example, most networks
will have one switching center or
one model switching center for Hamburg
here. So we are all logged into
the respective network switching centers
for Hamburg right now.
And that received a copy of
your respective
of your subscriber data.
And so Visitor Location Register and
the mobile switching center is actually
rooting for calls.
It's always co-located
with the arrow.
So I put them in one box.
There's two different logical entry
entities, but it's
they also have the same address and it's
mostly the same machine.
Everything is by global title.
Global title look just like
international phone numbers on the left
for German network on the right for US
network.
Um, most
of you, if you have ever come
in contact with a global title for
the SNC back in the days when you still
had to enter the same see
on your phone by hand, then you enter
the the global title for the
Smithee so that you could send for the
short message service center so that you
could send short messages.
OK, so much for the quick overview.
Now to cell level tracking.
So what what those commercial providers
are offering and
the network, of course, needs to
know your position.
It needs to know which base,
station or cell is closest
to you because you want to receive
calls, you want to receive short messages
and so on.
So if somebody can find out the idea
so every every base station in the world
has a unique idea,
somebody can can find out that idea.
Then he can use
that I.D. to look up its geographical
position
in one of several databases on the
Internet. So, for example, Google has a
is a very big
database
and of course, especially in cities
where the cell towers are pretty close.
The position or the location of
the cell tower closest to you is also
a pretty good idea of,
uh, of where you are currently.
So, um, the commercial
providers claim, uh, coverage of
about 70 percent of worldwide
mobile subscribers, meaning
you don't have to be close to that
subscriber, you don't have to know where
he currently is.
You just need to know his phone number.
And some have some non-technical
limitations. So, for example, from the
very brochure, they say you cannot
locate Israeli subscribers in Israel or
U.S. subscribers worldwide.
Verint, by the way, is a US Israeli
company.
Um,
yeah. And so, uh, Skylake
infiltrator, they're all very nice names
for their product.
OK, how does it look on the protocol
level, on
the left, the attacker?
He sends a map any time,
interrogation requests or any time.
Interrogation is exactly for that
purpose, for finding out the
idea of a mobile subscriber.
And it's used for
network internal purposes.
Normally, for example, if you have a
Holmes answer, that you can
make cheaper calls if you're currently at
home and so on. So that's what it's used
for. But it can also be used by
attackers to find out
the cell. So the entertainment
organization goes to the home database of
the subscriber and says, OK,
please let me know the ID.
And if you want if you want
also the army, either the phone
serial number of that subscriber
and the home database doesn't know the
cell idea. It just knows what
switching center is currently serving
that subscriber. So it sends a provide
subscriber info request to the switching
center, the
switch pages.
So the mother
gets paged.
Um, uh, so
that the switch can be sure that it's
really, really got the current,
the current cell and the, uh, information
gets returned to the attacker.
So it's really only meant as a network
Internet service.
Um, but still, as you can see,
this, uh, Wireshark trace of, um,
uh, of, uh,
request we send. And
it still works for for many networks
here. You can see the cell at the bottom.
OK, but, um, many networks,
especially in Europe, most of the
networks actually, or at least in
Germany, all the networks block any time
interrogation by now.
But as we have seen before, the,
um, the
ah, the home database doesn't even know
the idea, so.
We just need to find out the address
of the switching center and
then we can ask the switching center
itself.
Also, we need to find out the AMSA,
the international mobile subscriber
identifier of the subscriber,
because internally in the network, not
phone numbers are are used for routing,
but the Amazigh.
So and luckily
there's a request for that.
We can just ask the
the home database to ah please
tell me the as
I and what switching center the
subscriber is currently that's used for
some routing normally.
So if you want, if you, if you're in a
different network and want to send a
short message to that subscriber so
the information is returned and then the
attacker can simply
ask the switching center
itself and it works
just like before.
And that works really for
a lot of networks
because also most
masses switching centers
accept requests from just
anywhere and anyone.
So you would say, OK, if if
if there's a German subscriber currently
in at home in his German network,
for example, and I don't know, Indonesian
network should have no business
clearing his location.
But the NSC or
doesn't doesn't do any plausibility
checks and the request will
get answered.
OK, so, um,
so to demonstrate is better, um,
for them for about two weeks, um,
we tracked some people who
are nice enough to give me their phone
number and said, OK, uh,
uh, you can track me
and, uh, let me see if
I can show that to you.
Yeah. OK, they're there somewhere.
They're.
OK.
Let's see.
OK, my touchpads is acting
weird, um.
OK, let's start.
So.
That's a Dutch subscriber who was
when I started tracking
him, who was in Seattle,
and, um,
you can.
As you can see, Don, there are the times
and.
Yeah, OK, so he said he didn't use the
ferry. So that's that's on the water
there.
That was a by
the location database gave me a
wrong position, but he said that very
accurately.
And yet where he lives and where he works
and theater.
And so it continued
for a few days and.
Then that subscriber
for Christmas, as you can see down there,
he flew back to the Netherlands.
And.
And let's see if we can really see.
So he is people and we can
really see so the next tracking was when
he was on the train away from skippable
and
then through the Netherlands
and.
Uh, yeah, and he asked me to remove
the last point of those tracks
because
he said that was too close to home
and.
OK. Uh.
Some other.
Let's see.
So here we can see very nicely
somebody who lives in.
Luxenberg Um.
You can actually see him traveling down
the autobahn, then stopping
somewhere, then continue traveling,
and then, um,
after some time taking the
taking the plane to Hamburg
one, what's he doing there?
And.
Uh.
So, yeah, so you can see
how he traveled to the to the
Congress and also.
I know I think you you got
you got the general idea of
somebody living living in
Hanover.
Our.
Darmstadt.
And also, you can see.
Pretty good where he took
the autobahn, where he traveled,
what route he took, um.
Also to Hamburg in the end,
so and as you can see, it's
really relatively precise.
So, yeah,
um.
This is possible for almost all
of us.
Um.
So let me check.
OK.
Oops.
And I think it's really scary because, I
mean, you don't have to know somebody,
you just have to know his phone number
and
you can track him from the other side of
the world.
You don't have to be near him.
You can. You just need, as I said, an
excess. And, of course,
those companies who are offering those
services, they are saying they're only
offering those services to government
agencies and law enforcement and so on.
But I don't know about you.
There are many countries in the world
world whose governments I wouldn't trust
with this functionality.
OK, then.
We talked to one of the
big German operators to about those
problems, and they were really shocked
finding finding out about that,
um, and started
monitoring the network and
found a lot of traffic
that was carrying people's positions
and other stuff.
So then after awhile, they implemented
some filters, um,
filtering out the possibility to
figure out I am as I and
the current mobile switching center.
So as we saw earlier, you need that.
You need to find out. I am as I was
switching center. So they disable
that ability
and the traffic the attack
traffic dropped more than 80 percent
and they started to try and figure
out what the traffic
where the traffic came from so that
some of the traffic was simply
misconfiguration and other networks
that was quickly fixed.
Then some commercial use cases, for
example, a shipping company tracking its
vehicles and also
some provider who provided a service for
banks sending mobile
transaction numbers, one time passwords,
a short messages to phones.
And they wanted to check if a zoom card
had been swapped because a few years ago
there was a case where criminals
swapped the SIM cards of their victims
and got the mobile transaction number.
And so they they wanted
to check if the SIM card had been had
been changed to prevent that kind.
But they were using a network Internet
service for that. And that was
also switched off then.
And some of those network operators
that were contacted by the German
operator, they either didn't
answer or said they didn't know about
anything. So the German operator believes
that, uh,
those were requests by state actors
then or by the network,
by those other network operators
themselves.
And some of these attacks still persist.
Um, meaning,
um, those
attackers need other information
sources. They somehow need to find out
I Amazigh of the subscribers.
Maybe then they know them from before
or they have other resources
to find to find that out.
And for
the switching center they can simply
brute force if they can simply brute
force the number range.
But yeah, those attacks still continue.
OK,
OK, this very quickly because we
don't have so much time in the
U.S., um, there's a requirement
that if you call nine or one, phones
have to be located very
precisely. So there was a new feature
added to map the location services
that don't just return the cell, but
an actual latitude and longitude.
Um, and they can even
return the GPS position of a phone.
If it has a G.P.S.
receiver, it can be switched on and then
returns its position back to the network.
Um, those emergency
services, they use the GMAC, the Gateway
Mobile Location Center, and
that requires authentication, thank
God.
So this is straight from the
specification you see up there.
The police, for example, is
the client and it, uh,
sensors as a service request to the GMC,
and that requires authentication.
But as we have seen before,
the switching centers, they don't care
about authentication, don't know about
authentication, so you can again
send the provider
subscriber location request directly to
the switching center.
So in practice,
that works as seen before.
Just ask for the AMA's.
I ask for the switching center, then
create the switching center directly.
But as I wrote here, they implemented
some funny kind of sender
address verification because they said,
OK, maybe those requests shouldn't be
allowed from outside the network.
So they wanted to
to verify the sender address.
So the network and destination address
format messages are in the SCC player,
so this is how it looks, calling
party means the equipment
that sends the message and called party,
for example, the calling party
in this case, the other the home location
who just like called party you are.
And the problem is this FCC
player doesn't know who is
allowed to use Web services or not.
So the solution is they
have the sender of the message
put in another copy
of the sender address in the player.
So the sponsors will be
routed to the calling party address
up there, but verify
it will be the address down there,
meaning if you tell the truth, put
in the same address twice, you get back
unauthorized requesting network.
But if you just put in an address that
looks similar to the network so that the
networks thinks it's an Internet address,
it works. So you get back to
the latitude and longitude.
OK, this is obviously not a GPS
position.
I don't know, maybe that person was
somewhere where G.P.S.
was not available or something.
OK, so now we have
seen a lot about how
it's possible to gather information
from the embassy and
but it's also possible to manipulate
information there.
Sorry.
Um.
So, um, you.
OK, so it was it's just right there, OK?
The colors, it's actually colored
here on my display, but yeah, um.
So if you if you remember
back in the beginning, I said when you
switch on your phone,
the home, your home database, there are
transfers, a copy of your subscriber
data to the to the
mercy of your
home.
And the viewer are, from that point on,
controls everything you can do with your
phone. But an attacker can also
play it and send
a send a copy of the
subscriber data as he modifies
it to your current switching
center.
Meaning he can enable or disable
the possibility to make calls,
incoming or outgoing SMS or
DETAT or delete the subscriber
altogether from the arm
came and that.
Another thing, new protocol,
uh, the customized applications for
mobile networks enhanced Lodrick, nobody
ever can remember that.
Um.
It's like an
overlay over the usual
map logic, and it gives
your network operator
the ability to say, OK, for
example, if you are currently
I don't know, you're a German subscriber,
you're currently in France.
Um, your home
network operator can say, hey, every time
that subscriber from my German home
network, um,
wants to make a call, contact the home
network.
It's the service controlled
contact, the service control function and
the home network.
So and the service control function of
the home network then decides if that
call can continue
or if the data will be modified
or if it will be canceled.
So on the left, we have the home network
with the service control function, it
sends the address of the service control
function to the switching center because
you see the German subscriber currently
in France. So it sends the address
of the service control function
to the French embassy
and says, OK, contact me whenever
that subscriber of mine wants to make a
call.
OK, then the subscriber wants
to make a call and he forgets to add
the International Country Court
before the phone number, he just dials
like just outside like a German phone
number. And usually that wouldn't work
because of French or
French switching center
doesn't know anything about how German
phone numbers work, but
the servers control function gets
contact. It says, OK, your subscriber
wants to call that number, what should I
do with it? And the service control
function rewrites it because the
international number and then the call
can be set up
and the subscriber doesn't know anything
about it. You just dial the number like
usually from Germany and it works.
So but if you remember the address
of that service control function, it gets
sent to the switch
by the home database.
So if the attacker.
Can modify data in the MSE,
he can simply send a different address
to the message of his own,
his own global title.
You can say, OK, every
time that subscriber
does anything, contact me.
And he provides his own address.
So now the subscriber there on the left,
he wants to dial that number, the
subscriber on the right,
who he the number and
the switching center now contacts
the attacker.
So the attacker now already knows
the phone number of the subscriber wants
to dial.
And then he changes that phone number
to number to the number of his recording
proxy that he has somewhere,
I don't know it can be it doesn't even
have to have as as a seven X as it can
just be some asterisk
box on the Internet with with
a publicly reachable phone number.
OK, the call will be set up to the
to the recording proxy and
will be bridged to the original
subscriber
and then both subscribers can talk to
each other while the attacker is the man
in the middle and records the whole call.
So just a few days ago, I read about
that this is actually happening,
so I heard of an
Ukrainian network operator
who found out that, um,
that several of his subscribers
calls had been intercepted.
And those requests, um,
came from, uh, Russian.
It's a seven network.
So this is actually happening.
OK, so, um.
Now, we've seen a lot about, um,
the switching
center and their abilities.
But the home location register.
Uh.
Also has some vulnerabilities.
So first, let's look at how,
um, what
exactly happens if you travel
to another region or country?
So in this case, I said it's a different
country, but it's it's actually the same
if you are just traveling,
I don't know, from Berlin to Hamburg and
and you are a German subscriber.
So your phone sends the location
update and request to the to the
to the switching center.
And that sends an update location request
to the.
And what happens then is the aid
receives the address of the mother
switching center because it needs to know
where to hold your calls or incoming
calls and your incoming short messages
taste that errors and sends,
as I said before, a copy of the
subscriber data to the switching center.
So now, for example, some
somebody wants to send you a short
message there on the left, a short
message service sent off that network
asks your home location, had to sell
the home database.
Please give me routing
information
for that phone number and it gets
back the address of
that switching center there.
And the can then send
the short message to you.
But an attacker can also send
an update location request in your name.
So it will send the update location
request to your home database,
to your home location register
and then the home location register,
um, will save the attack US address.
That means that, for example,
can the bank sending
a one time password mobile transaction
number wants to
send you a short message.
That short message now gets routed to the
attacker without a subscriber
knowing about that.
So in the case, what I said earlier, that
there was the case of a criminal's
swapping SIM card, if they have had
seven exos, that would have been even
easier for them.
They wouldn't even have to have
to switch SIM cards.
They could have just said, OK, I'm a
subscriber now.
Sends a short message to me.
OK, another thing, US decodes
those star hash codes, you probably
know you have to enter in your phone
sometime.
They can also be executed
for other subscribers from an attacker.
So not in Germany, but in several
countries, carriers allow
Trents transfer of prepaid credit
via US courts.
So you could just empty
a victim's prepaid
account and send
all of his credit to to your own number,
for example, or to call
forwarding can be set and deleted.
Meaning if I
activate a call forwarding on your
phone to, for example, the premium
rate number and then
call your phone for just the normal fee,
you have to pay for the call to the
premium rate number.
That premium rate number would, of
course, also be controlled by the
attacker.
Yeah.
OK, so, um, and
you don't even have to what I wrote
before, where you tell the, uh, the
home data base that subscriber is not in
my network, the attacker does that.
The subscriber is not being served.
I mean, you don't even have to do that.
You can just, uh, if
the subscriber is a subscriber at home
and a German network, you can stay there.
You can, uh, there's still
the German home database will say,
OK, I will execute that USG
code for the subscriber or activated
that supplementary service for the
subscriber call forwarding or something
like that. So as you can see
here, uh, we
clarridge the balance of
a German prepaid card,
um, while it was logged into the German
network from a network on
the other side of the world.
So I guess this one's
Castner's going to talk about
Kosner, are you
hopeful, oswin
ok.
OK then.
You have to translated to English.
OK, so I
call it hybrid tax because, um,
uh.
OK, so I call it hybrid optics, because
you have two hybrid,
right, like like up there.
Sorry.
Is this an actual human doing the
translation or.
And.
OK, so I read the text,
meaning you can capture the
sort of
the air interface if the network wants to
reach you. So now really
at the base station, if the network wants
to reach you, it sends your paging
request to your phone.
And for that, it uses a temporary
mobile subscriber identifier that has
been introduced.
OK, that
identifier has to be transferred
unencrypted and the
temporary identifier has been introduced
so that you cannot find out who
is currently making a call.
So there's not being you're not being
paged by your phone number or by your
Amazigh.
It's a temporary identifier.
That should not be that.
There should not be possible to anonymize
it. But as it turns out, if
the attacker just captures
captures all the pattern requests all the
time, as is, for example, with Osmo
B or something like that, um,
he can then.
Simply ask the mother switching center
for, um, give me the
I am as I of that subscriber and then you
can do an update location request and
find out the ISDN,
the phone number.
So if you do that, I don't know,
in Berlin at the seat of
the government, I don't know how long
it takes until you get Angela Merkel's
phone number.
OK, contraception.
Castner's going to talk about that in a
minute, I'm sure.
Um, LTE
so, um, the Seven
Network is used by GSM and,
uh, UMTS.
Um, LTE is using a
different protocol, uh, the diameter
protocol for the for the network
for um.
Meaning S7 is becoming a legacy protocol.
But a lot of the
S7 design flaws have simply been ported
to diameter.
So, for example, there are still no end
to end authentication for subscriber's.
And also, GSM and UMTS
will still be around for a long time to
come.
Um, people say about 20
years S7 will still be
in use and also
there are interfaces from
diameter to S7 to be able
to make calls from LTE to
GSM or the other way around.
So, yeah, to sum it
up.
An attacker with only his victims phone
number can track his victims movements
in some networks, even with precision
precision,
he can intercept his victims calls and
text messages and
most likely also data connections.
Also, we didn't try that this way because
of some data reroute calls at the
victim's victim's expense
and more.
So, um.
Well, the operators can do against it.
Network operators, so
as I said
in the beginning, you have to find out
the Amazigh and the mobile switching
center to be able to manipulate
the mobile switching center.
And the
main reason for network operators to give
out that kind of information to
external networks is
for some routing.
So there has been a new
well, yeah, new way
around for quite some time now called
Smith's Home Reporting, where the
network operator uses an astrologer
in the subscribers home network
so that it doesn't have to give out the
actual address, the global
title of the switching center, but just
the address of the astrologer.
So some of the German
networks, for example, already use them
as home routing. So it's, uh, it
becomes a lot harder to figure
out that kind of information then some
don't yet.
I hope they will soon.
Um.
And also another another
source of that information is the central
information request for for voice calls.
Um, but if the network operators
don't use optimal routing, they can
also simply disable it for external
networks, which some of the
German networks, again, already did.
Some didn't do it.
So.
US, the subscriber, cannot really do
anything because this works for, um,
uh,
works for all phones
which are connected to the network no
matter what smart phone feature phone.
You can't do anything because it's
happening in the network.
OK, so now I have prepared
a small demo.
Let me just get that back to my screen
here.
OK, I hope it works and I hope you can
see something if you can switch to the.
Thank you.
Oh, it's OK.
That's.
So.
OK, so I'm,
um, so this is a
subscriber in a German network, and
I'm going to
he wants to call his friend on this
phone.
So and as you can see, it works,
the other phone rings as expected,
so so.
He had a phone call, it's worked great.
That wasn't the demo.
Yeah, very funny.
And
yeah, I know everybody has the number
now.
OK.
Now, I do some F7 magic,
so I sent an
email subscriber data.
I tried the same thing again.
I do have the same number.
And let me see if you can
get rid
it or can you
share that?
The Kondrat, OK,
it says for the for the diet, no
call baring has been activated.
So we call if you could
just stop for a second calling that
number,
the call simply doesn't go through
anymore.
So, um,
I can also.
Switch it back on again if I.
If I died again,
yes.
Yeah, as
you can see, it works, it works now,
so and another thing.
So the friend wants to call back,
wants to call back.
So he dials the number.
Guys, stop calling for a certain.
So he's calling footrest.
And the of the phone call forwarding is
still activated. OK, so the
call arrives on that phone.
OK.
I will switch it off, OK, so and
I do the call again.
Oh, really?
OK, so
the phone rings nicotrol.
And.
I will I will show you again, because
that was, of course, no the the
wrong way around.
I will show you.
Can you read that?
And.
OK, so there's no call forwarding.
Activated, so if I activate it now
and to the same
request again.
OK, now you can see the number four call
forwarding that has been activated.
OK.
Yeah, that's it for the demo.
That's it for me.
Thank you very much.
Everyone, if you have any questions,
please do line up at the microphones.
If you're planning to leave,
please do so.
Now, get up quietly and leave
the room to make room for people
who want to enjoy the next talk.
Right now, you're only allowed to leave.
So please do this now quickly
and quietly.
So we have a question from microphone
number two.
Thank you for the talk.
In the beginning, you said that
government agencies will be using
S7
for so-called lawful
interception.
And you said you wouldn't trust
the governments of some countries
just for completeness.
Could you name the country, you country
you would trust?
I'm afraid I can't.
Thank you.
If you're leaving, please do so quietly
so we can still record the questions and
answers. Thank you.
Microphone number one, please.
How did you gain access
to this as a seven at four p.m.?
I guess I'd rather not say.
OK, well, no, it's actually so
it's a yeah,
it's an exercise
that has been brought to us for
the purpose of of security
research.
Microphone number four, please.
Hello, thank you for the talk.
My question goes into the
finding out the location.
I mean, the cell location probably is
at no cost to the operator to
give that information out.
But about the triangulation.
Is there a cost?
Can this be done at scale for
lots of subscribers or.
I don't really know how many how many
are you thinking, but.
Well, of course, it's
so it's been implemented for
emergency services.
So I guess there's always a lot
of emergency calls coming in.
And I think it can be
done for for a lot of customers.
I don't know what would happen if you do
it, if
all the subscribers, if you would do it
for all the subscribers.
But I think it can be done for a lot of
subscribers.
We also have a few questions from our
Signal Angel relaying questions from Iasi
Signal Angel, please test.
OK, so the first question
is how much would the
whole setup cost to track somebody's
phone?
Um,
well, I would say a few hundred
euros for the S7 access if
you buy it and
then you need somebody to
call it the software or
you write it yourself and if you write
the software yourself and
somehow I don't know, find somebody
who hacked S7 access
with wire femtocell or something like
that, it wouldn't even cause to think.
Another question from our signal angel,
please.
OK, that's a question.
If you require direct S7 access,
are would it be like enough to
have like a hacked base then mobile
device, something, you know, so
S7 is really only used
in the core network, so
meaning the phones don't have anything
to do with S7, so
the phones use the radio network and
that that isn't S7.
It's only used in the core network,
meaning the switching centers are
S.A.C.
GMT and so they use a
seven microphone
number to please.
Thank you.
So I have another question regarding us
D then you were saying
it's completely possible to spoof
users to messages as they are always
targeted directly towards the.
Ah, so
from what I dimly remember about that,
there are two different
fields that actually carry the the
the request issue.
Can you spoof the entire message.
Like can you spoof all fields.
Um, I'm not really
sure, but
uh, you don't need an answer back.
You can spoof anything you like.
So that's that's also a thing for
all the for all the messages.
Very modify something where you just
don't want data back.
You can put em in any sender you
like because you don't need the
answer back. And the the new data
gets activated or the request gets
executed as soon as
it arrives at its destination.
I'm not asking because of
protocol compliance.
I'm asking because of verification,
because from what I know, users d
not only use for, like,
you know, your own, uh,
subscriber account
of credit level, but
it's also used for payment solutions.
And I really see a massive
problem. If you could spoof the entire
message.
Um, yeah.
Yeah, yeah.
OK, thanks
for that.
It's really done over users.
Yeah I think so, yeah.
Microphone number one please.
Uh, I have to question the first
one was, uh, when
you did location through PSA
for The Washington
Post, it was done, uh,
from an access that you paid,
like an access to websites that you paid
for to do it on your own access.
And if it was your own accessed, it was
addressed.
I mean, trusted,
contained into the, uh, regs.
Uh, I r21
list on it was it was not
in twenty one.
OK, so it was your own
that you control, but it was not into
the regs I ultimately to twenty
one list.
Exactly. So I had twenty
one by the way is a
set of documents by the GSM, a
um the GSM Association,
um that um
every operator puts this document
there that lists all
his global titles, all the.
Addresses to traffic where
the arrows are and so on and so on,
and so usually you would say
or would think that if an
if a global title or a senator address is
not listed in the age of 21, then you
could simply discarded if you receive
messages from it.
But in practice, that's not
the case for most.
Most of the time, requests
get also routed and answered.
If your address is not in
the area 21 document
things.
Microphone number four, please.
Right. I thank you for your talk.
And I want to be interested
that you looked also in the modified
versions for
emergency calls when I don't have
an M.C.
like a zoom in my phone or for the
upcoming Ekwall, which is used in cars.
Does that tie have some amplifications
to that as well?
Is there a trick or something?
I didn't look into that.
I don't know.
OK, thanks.
Another question from our signal Angel
on Iasi.
Yeah, actually for quite a bit.
A few questions, so I don't know.
But one question is if there are
any numbers about which countries
are like doing the most tracking
which which countries do the most
tracking. Yeah, that's a question
if you have any numbers about that.
No I don't.
I also would be very interested in those
numbers. If anybody has them.
I would be very interested.
Microphone number two, please.
Yeah, I'm I have the question.
If I have a working based
transceiver station which
worked for and a
GSM network, is the
S7 assess information
in this based transceiver station?
No, no. So that's in the base
station subsystem. And that's that's not
S7 seven will only
be used from the
switching center on inward
to the core network.
OK, thank you.
Microphone number four, please.
Hello. Uh, did your summary
slide with, uh, TMJ
requesting also show that you
could decrypt the sniffs
message, the phone call?
Sorry, I didn't understand that.
Uh, one of your summary slides was
about how you could, uh, request
an EMT after you present the
time that you sniffed off the air.
Yeah. Yeah. Uh, did that also
say you could then, uh, decrypts
the whole phone call by
sniffing? Yeah, yeah, yeah, yeah.
But, uh, Castner's going to talk about
that in a minute and the next talk, so
stay for the next talk and you will
learn more about that.
OK, we have time for two more questions.
Microphone number five, please.
Hi. Uh, thank you for your talk.
Uh, I don't know if you have any virtual
operators in Germany, but
do they have access to the SS seven?
And if so,
does the blocking that you mentioned
in your talk also apply to them?
Sorry again, please.
Uh, virtual operators.
Yeah, OK.
Do they have access to a seven.
Yes.
Uh, well, if they are
real, uh, Maggiano's, then
they do have access to as I said, even if
they are just resellers then they're
not. But, um, for example,
I think one of the very few, uh,
Ambien in Germany is, uh, zip code
them quite hard and they, for example,
operate their own.
Ah.
Microphone number six, please.
Do you see this as a possible
vector to trigger a phone to update
the basement firmware?
Well, as you saw
in the beginning, you cannot only request
the I.D.
You can also request IMEI
of the phone. So the serial number, so
you can you can also figure out
what type of phone somebody is using, if
it's an iPhone or a
galaxy as something.
I don't know. So if you want to
install a remotely install
and exploit on the phone,
that's of course also easier
if you already know what type of phone
the person your victim is using.
But are you aware of any API
functions that
are maybe part of Map or Camil
that can be used to directly instruct the
phone to call firmware from
from there or there?
Uh, no. I think that would happen
on a different layer. Not not in as a
seven.
Thank you.
OK, that's it.
If you have any further questions for
Tobias, please catch up with him after
the talk.
Please give a warm round of applause to
Toby Azango.