Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

11/7/2016
11:00 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

4G Cellular Networks At Risk Of DoS Attacks

Black Hat Europe researcher shows how hackers can conduct denial-of-service attacks on 4G cellular devices around the world.

Just because you're on a 4G/LTE mobile network doesn't mean you're immune to security issues.

A researcher last week at Black Hat Europe detailed how denial-of-service (DoS) attacks can be waged against 4G/LTE users. In her session "Detach Me Not - DOS Attacks Against 4G Cellular Users Worldwide From Your Desk," Dr. Silke Holtmanns, security specialist at Bell Labs Nokia, explained the state of security in 4G/LTE mobile networks.

Following the revelation of global surveillance and exploits targeting the backend of mobile communication, mobile network operators rushed to upgrade their 2G and 3G networks to 4G/LTE.

The misuse of technical features in mobile networks, like Signaling System 7 (SS7), led to the disclosure of several ways to locate, follow, and manipulate users' cellular activity. Some SS7 incidents included eavesdropping, SMS interception, fraud, credential theft, and data session hijacking.

Diameter protocol, the successor to SS7 used to send signals in LTE networks, promised more protection for networks and users. Many mobile network operators were under the impression that all their security problems would be fixed with LTE/diameter-based protocol.

But security problems still exist; they're just different ones, according to Holtmanns. The diameter protocol includes several functionalities and characteristics of the SS7 network.

Holtmanns explained how hackers can abuse shared traits between diameter and SS7 to conduct DoS attacks like location tracking through the diameter-based interconnection. Some of these attacks can cut mobile phone users from their networks and interfere with network nodes.

Dark Reading's all-day virtual event Nov. 15 offers an in-depth look at myths surrounding data defense and how to put business on a more effective security path. 

 

Holtmanns described several types of DoS attacks that can affect any platform or device on mobile LTE networks: phones, tablets, and gadgets connected to the IoT like connected cameras. Researchers explored different options for DoS attacks using a test setup.

These are a few of the attack methods they discovered:

  • DoS using Cancel Location Request (CLR): This is sent by the home subscriber service (HSS) to the mobile management entity (MME) to wipe a user from the network.
  • DoS using Insert Subscriber Data Request (IDR): These are sent from the HSS to the MME to update and/or request user data like location and/or state information. This attack on the MME, which covers a broad area (for context, Holtsmann noted that London has two), has an impact on any users located in the affected region.
  • DoS using Update Location Request (ULR): This is sent by the MME to the HSS to inform of a user's change in location. The user may be kicked outside the network, but there are no major side effects. Users can fix the problem by switching off their phone and reconnecting.

Holtsmann noted that IPSec for diameter is standardized, so many security pros will assume this is the best protective route to take. It's not that easy, however, she said, and there are a few practical considerations to bear in mind.

Not all traffic is IP, for starters, as some is part of SS7 or work with it. There is also the question of who will host or create root certificates, and there is no interconnection service provider; only hop-by-hop security. IPSec also doesn't protect against hacked nodes, bribed employees, governmental ties, or partners renting out to "service companies," according to Holtsmann.

Preparation is "an important part of the puzzle," she noted, because there is a good chance these DoS attacks will occur.

"Diameter attacks will come as tech moves on in a major way," she explained. "Now is the time to prepare for diameter attacks. You need to investigate potential weaknesses and countermeasures before they happen."

Bearing in mind that DoS attacks are likely, she continued, but there are several countermeasures to mitigate the risk. These include monitoring network traffic, tenant equipment, and firewalls.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16863
PUBLISHED: 2019-11-14
STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.
CVE-2019-18949
PUBLISHED: 2019-11-14
SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended JavaScript execution via a chain of webpage redirections targeted to the user's browser configuration.
CVE-2011-1930
PUBLISHED: 2019-11-14
In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.
CVE-2011-1145
PUBLISHED: 2019-11-14
The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.
CVE-2011-1488
PUBLISHED: 2019-11-14
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent withi...