Slashdot Mirror
Newer Diameter Telephony Protocol Just As Vulnerable As SS7 (bleepingcomputer.com)
An anonymous reader writes: Security researchers say the Diameter protocol used with today's 4G (LTE) telephony and data transfer standard is vulnerable to the same types of vulnerabilities as the older SS7 standard used with older telephony standards such as 3G, 2G, and earlier. The vulnerabilities are happening because 4G operators are misconfiguring the Diameter protocol (a SS7 replacement) and using it in the same way as SS7.
The incorrect use of Diameter leads to the presence of several vulnerabilities in 4G networks that resemble the ones found in older networks that use SS7, and which Diameter was supposed to prevent. Researchers say that the Diameter misconfigurations they've spotted inside 4G networks are in many cases unique per each network but they usually repeat themselves to have them organized in five classes of attacks: (1) subscriber information disclosure, (2) network information disclosure, (3) subscriber traffic interception, (4) fraud, and (5) denial of service. Researchers warn that not fixing these vulnerabilities "could lead to sudden failure of ATMs, payment terminals, utility meters, car alarms, and video surveillance." This is because these types of devices often use 4G SIM card modules to connect to their servers when located in a remote area where classic Internet connections are not possible. Old SS7 attacks such as tracking users' location and intercepting SMS and phone calls are also possible via Diameter as well.
The incorrect use of Diameter leads to the presence of several vulnerabilities in 4G networks that resemble the ones found in older networks that use SS7, and which Diameter was supposed to prevent. Researchers say that the Diameter misconfigurations they've spotted inside 4G networks are in many cases unique per each network but they usually repeat themselves to have them organized in five classes of attacks: (1) subscriber information disclosure, (2) network information disclosure, (3) subscriber traffic interception, (4) fraud, and (5) denial of service. Researchers warn that not fixing these vulnerabilities "could lead to sudden failure of ATMs, payment terminals, utility meters, car alarms, and video surveillance." This is because these types of devices often use 4G SIM card modules to connect to their servers when located in a remote area where classic Internet connections are not possible. Old SS7 attacks such as tracking users' location and intercepting SMS and phone calls are also possible via Diameter as well.
Why don't they just use a tried and true protocol like HTTPS instead of rolling their own protocol?
Keep that telco collecting real time.
Domestic spying is now "Benign Information Gathering"
Just let me know when I can have fun with my old blue box again, and that whistle I keep in the junk drawer.
"a SS7 replacement"
an! an! an!
They can blow you up in broad daylight and blame guys in a cave on the other side of the planet. But as long as you sheeple feel safe I guess everything is OK. Duh!
If you want a 100% secure computer you'll need to encase it in concrete and deep six it to the bottom of the sea.
ae911truth dot org
Diameter is just a protocol i.e. it's a guideline, there is no enforcement. Network operators are typically going to do whatever they need to do in order to just get stuff working. Apart from straight out abusing the protocol by making up their own session rules they can also simply neglect to make basic security considerations. In this ultra-competitive world where everyone is scrambling to build their next gen networks many will happily forgo extra testing or security design in order to just get something running so that customers can start paying for the service. That's not to mention even having the expertise in the first instance to be able to make those security considerations. Diameter is complicated and hard. If a provider gets it working and customers can use the service and be billed for that usage then that's often the end of the story.
Diameter replaces SS7? In what universe? SS7 is a control signalling protocol used for setting up calls. Diameter is a AAA (Authentication, Authorization & Accounting) protocol that's just a supercharged Radius (Diameter = twice the Radius, get it? ha ha). No doubt you can royally screw up the AAA setup and leak like a sieve, but it's got nothing to do with SS7.
Just fix Caller-ID so that it can't be forged. Is that too much to ask?
This is what happens when the guys who were in chrage of the MSCs and SS7 STPs of yore are put in charge of the Newflanged Diameter Servers and Routers of 4G and 5G
Do not get me wrong, those guys are very smart and briliant guys. But just as the Slashdot crowd would have a hell of a day trying to configure the 67 E1s of an STM-1 in order to Set up a set of SS& links, an Old School Telco switch guy would have hell undertsnading the nuances of security on Diameter...
Me, I had a feet in each camp for 5 years (1999-2004), but now I am looking from above in my (OpenStack) cloud...
*** Suerte a todos y Feliz dia!
Diameter is (as you might guess from the name), a replacement for RADIUS.
Some of the Diameter applications overlap with some of the functions that parts of SS7 provided though (e.g call billing etc).
Surprisingly, Signal calls work pretty well even on not perfect mobile data or wifi connections. I can use it just like a normal call. It barely uses any data by today's standards, so the data cap lasts me much longet than the call minutes I have on my measly XS-sized prepaid card.
The audio quality is insanely better. But of course the proper real-time encryption heats the SoC quite a bit and drains the battery quicker. That audio quality though! And even video chat works.
So with 4G, where the "real" phone calls are als just packets, there is no real point to using that crap anymore. Ergo Diameter can kiss my ass.
They can't even be detected with a microscope. And can do whatever they want.
Short of making your own chip, with your own machines, without anyone sneaking into your workshop, and from sources that have been thoroughly checked for underhanded backdoors *post*-routing, and *after* the mask data leaves the last chip, there is no chance in hell to avoid being snooped on, if the NSAssholes really want to.
Editor! We need help with this patient, stat!!!
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
I was trying to figure out how making the cable wider would affect security in any way? Nobody actually physically taps wires anymore.
I'm a good cook. I'm a fantastic eater. - Steven Brust
So, a user takes a usb they found on the ground and plugs it into an air-gapped, stand-alone computer - how does the three-letter government agency actually get their hands on the data? How does the data cross the still in-place airgap?
And transmitting data via ultrasonic audio emissions? First your computer would need to have suitable transducers built into the computer, and second the three-letter agency would need to locate a suitable sensor within earshot of the computer in question.
To the best f my knowledge, no commercially-produced computers have appropriate ultrasonic transducers built-in - but then again, maybe that's what they want you to think!
Ken