Slashdot Mirror
Newer Diameter Telephony Protocol Just As Vulnerable As SS7 (bleepingcomputer.com)
An anonymous reader writes: Security researchers say the Diameter protocol used with today's 4G (LTE) telephony and data transfer standard is vulnerable to the same types of vulnerabilities as the older SS7 standard used with older telephony standards such as 3G, 2G, and earlier. The vulnerabilities are happening because 4G operators are misconfiguring the Diameter protocol (a SS7 replacement) and using it in the same way as SS7.
The incorrect use of Diameter leads to the presence of several vulnerabilities in 4G networks that resemble the ones found in older networks that use SS7, and which Diameter was supposed to prevent. Researchers say that the Diameter misconfigurations they've spotted inside 4G networks are in many cases unique per each network but they usually repeat themselves to have them organized in five classes of attacks: (1) subscriber information disclosure, (2) network information disclosure, (3) subscriber traffic interception, (4) fraud, and (5) denial of service. Researchers warn that not fixing these vulnerabilities "could lead to sudden failure of ATMs, payment terminals, utility meters, car alarms, and video surveillance." This is because these types of devices often use 4G SIM card modules to connect to their servers when located in a remote area where classic Internet connections are not possible. Old SS7 attacks such as tracking users' location and intercepting SMS and phone calls are also possible via Diameter as well.
The incorrect use of Diameter leads to the presence of several vulnerabilities in 4G networks that resemble the ones found in older networks that use SS7, and which Diameter was supposed to prevent. Researchers say that the Diameter misconfigurations they've spotted inside 4G networks are in many cases unique per each network but they usually repeat themselves to have them organized in five classes of attacks: (1) subscriber information disclosure, (2) network information disclosure, (3) subscriber traffic interception, (4) fraud, and (5) denial of service. Researchers warn that not fixing these vulnerabilities "could lead to sudden failure of ATMs, payment terminals, utility meters, car alarms, and video surveillance." This is because these types of devices often use 4G SIM card modules to connect to their servers when located in a remote area where classic Internet connections are not possible. Old SS7 attacks such as tracking users' location and intercepting SMS and phone calls are also possible via Diameter as well.
Why don't they just use a tried and true protocol like HTTPS instead of rolling their own protocol?
Keep that telco collecting real time.
Domestic spying is now "Benign Information Gathering"
Just let me know when I can have fun with my old blue box again, and that whistle I keep in the junk drawer.
Diameter is just a protocol i.e. it's a guideline, there is no enforcement. Network operators are typically going to do whatever they need to do in order to just get stuff working. Apart from straight out abusing the protocol by making up their own session rules they can also simply neglect to make basic security considerations. In this ultra-competitive world where everyone is scrambling to build their next gen networks many will happily forgo extra testing or security design in order to just get something running so that customers can start paying for the service. That's not to mention even having the expertise in the first instance to be able to make those security considerations. Diameter is complicated and hard. If a provider gets it working and customers can use the service and be billed for that usage then that's often the end of the story.
Diameter replaces SS7? In what universe? SS7 is a control signalling protocol used for setting up calls. Diameter is a AAA (Authentication, Authorization & Accounting) protocol that's just a supercharged Radius (Diameter = twice the Radius, get it? ha ha). No doubt you can royally screw up the AAA setup and leak like a sieve, but it's got nothing to do with SS7.
This is what happens when the guys who were in chrage of the MSCs and SS7 STPs of yore are put in charge of the Newflanged Diameter Servers and Routers of 4G and 5G
Do not get me wrong, those guys are very smart and briliant guys. But just as the Slashdot crowd would have a hell of a day trying to configure the 67 E1s of an STM-1 in order to Set up a set of SS& links, an Old School Telco switch guy would have hell undertsnading the nuances of security on Diameter...
Me, I had a feet in each camp for 5 years (1999-2004), but now I am looking from above in my (OpenStack) cloud...
*** Suerte a todos y Feliz dia!
Editor! We need help with this patient, stat!!!
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
Not one of those Signal data packets wouldâ(TM)ve gone anywhere without Diameter..... go study IMS.
Right, because an air-gap between the computer and the internet can be bridged by the super-secret wifi/cellular data connections inside the CPU in your system. /SMH
Explain to me how the NSA can get into a computer that is not on the internet without physically accessing (as in "laying hands on")the computer?
Ken
Apparently it is. So here is the deal. I worked at several small-medium size businesses that owned their own phone systems. They would set up the phone system so that whichever line called out, the caller ID would show the 800 number. This is a legitimate use of overriding the Caller ID. The problem is that Telcos don't expend any effort whatsoever to validate that the number being sent is actually a legitimate number and is associated with the business/person in question. Really, there should be some sort of verification process similar to that for obtaining an SSL Certificate for a website where you validate that you own the number you are sending. Then you can only send that number and no some other number unless you go through the verification process again.
I was trying to figure out how making the cable wider would affect security in any way? Nobody actually physically taps wires anymore.
I'm a good cook. I'm a fantastic eater. - Steven Brust
Given the human tendency to plug USB sticks into things, there's a non-zero chance that dropping a stick in the parking lot will do it. And for exfiltrating info, you have seen the stories about use of audio outside human hearing range, yes?
I'm not saying it's likely at all. But it's not impossible.
So, a user takes a usb they found on the ground and plugs it into an air-gapped, stand-alone computer - how does the three-letter government agency actually get their hands on the data? How does the data cross the still in-place airgap?
And transmitting data via ultrasonic audio emissions? First your computer would need to have suitable transducers built into the computer, and second the three-letter agency would need to locate a suitable sensor within earshot of the computer in question.
To the best f my knowledge, no commercially-produced computers have appropriate ultrasonic transducers built-in - but then again, maybe that's what they want you to think!
Ken