TAG | TROOPERS
This year the TelcoSecDay will take place on March 15th. For those of you who does not know about: the TelcoSecDay it is a sub-event of Troopers bringing together researchers, vendors and practitioners from the telecommunication / mobile security field.
While searching for some photos for my last blog post on Thinkst Canary I found a couple more from our recent trip to Black Hat USA and DEF CON, which I consider worth sharing. Nothing too technical, just some visual impressions and comments from my side. Let’s get it on!
This year’s PacketWars contest at Troopers was a blast! Under the topic of “Connected Car” the teams faced several different challenges, which we will describe (as a debriefing) here.
Luca Bruno: Through the Looking-Glass, and What Eve Found There
Synopsis: Traditionally, network operators have provided some kind of public read-only access to their current view of the BGP routing table, by the means of a “looking glass”.
In this talk we inspect looking glass instances from a security point of view, showing many shortcomings and flaws which could let a malicious entity take control of critical devices connected to them. In particular, we will highlight how easy it is for a low-skilled attacker to gain access to core routers within multiple ISP infrastructures.
Markus Vervier: Borrowing Mobile Network Identities – Just Because We Can
Synopsis: This talk features an attack that enables active cloning of mobile identities.
It is shown how to patch a baseband firmware for Android devices to implement a virtual SIM card. Additionally different methods enabling access to the SIM card on unmodified Android devices are presented. Running a mobile network authentication algorithm on a SIM card in a first device and forwarding the result to a patched baseband on a second device allows the second device to retrieve valid authentication tokens. The second device can use these tokens to authenticate to the mobile network without having permanent access to the SIM card.
This results in taking over mobile network identities of others as well as in possibilities to evade surveillance by rapidly changing network identities.
Bio: Markus Vervier is a security researcher from Germany. Having more than 10 years of experience in penetration testing, source code auditing and network security, he was involved in finding vulnerabilities in banking systems as well as operating system features such as BSD Securelevels.
Tobias Engel: Securing the SS7 Interconnect
Synopsis: Recent disclosures made public a reality long known to telco network operators: Once an attacker gains access to SS7, there are almost no barriers against spying on subscribers and committing billing fraud. sternraute is currently developing an SS7/MAP application level firewall to be deployed by operators. This talk will look at the different approaches our firewall employs to detect and filter illegitimate traffic and what operators can do beyond that to protect their customers and networks.
Bio: Tobias Engel, born in 1974, is founder and managing partner of Berlin-based sternraute GmbH, which develops security products for mobile networks. As an active member of Germany’s Chaos Computer Club,he repeatedly called attention to security vulnerabilities in ICTsystems. For many years, Engel has been a consultant and software developer for various companies in the IT and telecommunications sector.
We’ll finalize the agenda in the upcoming days and publish details as for the other talks then, too. Stay tuned…
Have a good one
0 Comments | Posted by Christopher Werny
Given that Enno and I are network geeks, and that I am responsible for setting up the Troopers Wifi network I was curious which components might be used at Cisco Live and which IPv6 related configuration was done for the Wifi network to ensure a reliable network and reduce the chatty nature of IPv6. Andrew Yourtchenko (@ayourtch) already did an amazing job last year at Cisco Live Europe explaining in detail (at the time session BRKEWN-2666) the intricacies of IPv6 in Wifi networks, and how to optimize IPv6 for these networks. He was also a great inspiration for me when setting up the Troopers Wifi network a couple of weeks later. Thank You!
Happy new year and all the best for 2015 to everybody!
Here’s the next round of Troopers15 talks (all the others can be found here):
As we promised some days ago here’s the fourth round of Troopers15 talks (the first three can be found here). We really can’t wait for the con ourselves 😉 !
As we promised some days ago when we published the first round, here we go with the second: