Mobile Network Challenges (and why LACSEC should care)

Transcription

1 Mobile Network Challenges (and why LACSEC should care) Joe Eggleston, Craig Labovitz Z. Morley Mao University of Michigan Scott Iekel-Johnson Arbor Networks

2 Observation Little discussion about mobile among operators 1,870 s about IPv6 in last year (Nanog) And 11 s about 3G / 4G (Nanog) 161 s about IPv6 in last year (LACNOG) And 0 s about 3G / 4G (LACNOG) Page 2 - Arbor Networks

3 Why no discussion of mobile security? Possibly because a) Mobile networks are just not that important Page 3 - Arbor Networks

4 Why no discussion of mobile security? Possibly because a) Mobile networks are just not that important b) 3G security and engineering are way better than wireline networks (i.e. no problems to discuss) Page 4 - Arbor Networks

5 Why no discussion of mobile security? Possibly because a) Mobile networks are just not that important b) 3G security and engineering are way better than fixed (i.e. no problems to discuss) c) Mobile core is another group s problem (and they don t subscribe to NANOG) Page 5 - Arbor Networks

6 Why LACNOG Should Care a) Fixed line traffic is growing quickly Observatory data pegs fixed inter-domain at 45-55% But mobile traffic growing % / year Users want to access your network via a mobile connection. b) 3G / 4G security is not better than fixed Likely far worse c) Organizational changes Mobile / fixed traditionally completely separate org Almost 1/3 now merged or will merge in next year Fixed-line security groups charged with securing mobile So if you don t care now, you probably soon will. Page 6 - Arbor Networks

7 Agenda Motivation Engineering Challenges Security Challenges Questions Page 7 - Arbor Networks

8 Why Mobile is Different 1. Spectrum, Cell-sites, Backhaul, Battery Much of the cost 2. Optimized for QoS, fine-grained billing, intelligence in the network Voice-centric assumptions (LTE vs. TD-LTE) Latency 3. Signaling load Incurs latency, strains infrastructure Weak link new attack vector 4. State tracking Intelligence in the network Easy to attack (imagine a syn flood disabling a router) 5. Complex, brittle protocols and stacks Massive specs, seldom used code paths, little scrutiny TLVs within TLVs within TLVs Result: buffer overrun cup runneth over Page 8 - Arbor Networks

9 Mobile Network Review RAN PSTN IuCS VLR E SMS-SC > AT+C... Baseband Node B (BTS) RNC (BSC) IuPS MSC C Circuit Switched Domain Gd HLR, AuC Internet IPsec IuH HNB-GW/ SecGW Gp SGSN SLR Gn GGSN Gi Packet Switched Domain Mobile Data Center HNB (Femtocell) Content Optimizers, Filters, etc. Firewall/ NAT GRX/IPX Other MNOs Internet Page 9 - Arbor Networks

10 Engineering Challenges Page 10 - Arbor Networks

11 Challenge: Heavy-weight Architecture R ref. point L2 L1 Relay PPP SNDCP LLC RLC MAC GSM RF Relay RLC BSSGP MAC GSM RF Network Service L1bis Relay SNDCP GTP-U LLC BSSGP L1bis IP L2 L1 GTP-U Um Gb Gn MT BSS SGSN GGSN GPRS Protocol Stacks Source: 3GPP TS Network Service UDP Relay PPP UDP IP L2 L1 E.g., L2TP or IP tunnel IP L2 L1 The mobile network contributes over 80% of the total latency from a mobile device to Internet landmark servers. See Huang et al. [1] Network and phone architectural decisions have significant impact on performance Complex interactions between Phone Network element buffering, retransmits TCP Page 11 - Arbor Networks

12 Challenge: Protocol/Network Interactions Transition from Idle to CELL_DCH Joe s iphone Channel-type Switching Remember TCP Tahoe, Reno, Vegas? Now add a network with (configurable) states, timers, QoS classes All of which affect the bandwidth and latency And can change underneath TCP Idle CELL/URA PCH Snd/ Rcv Idle Timer Idle Timer CELL FACH CELL DCH Qlen > Thresh Radio Resource Control protocol states See Qian et al. [2] and 3GPP TS Page 12 - Arbor Networks

13 Challenge: Signaling Load PDP-context Activation Even normal operation and vendor implementation decisions can create signaling load problems Control plane design provides broad attack surface Source: Tektronix Page 13 - Arbor Networks

14 Challenge: Mobile Traffic is Different 2:,74*,";,76,<14*,")=">74?6"!"#"$"%&'(")*+),%&"#%"&)-#'.$) '&" '%" '$" '#" '!" &" %" $" 5)C.+," ())*+," -./,-.*01" 234/4." 5.67)8)9" -./0" 123" 4%4"567889:;/6;<" (ATLAS data) 2-3 times as much Google, Microsoft and CDN traffic from mobile than fixed Fraction of P2P Makes sense 5x as much Xbox in mobile (due to 3g dongle?) Page 14 - Arbor Networks

15 Security Challenges Page 15 - Arbor Networks

16 State of Mobile Security Survey (!" '!" &!" %!" $!" #!"!" (!" '!" &!" %!" $!" #!"!" )*+,-./+0." 102/-0," I;+/F0"4L7-8"C7.G09," 345" ":;.0" <==)5">" )=)5?" 54C">"D/.0E7FF" )0.20.,"<15)A" )*+",-./01"2+"3/451617" 8**+"9" 8**+:" 3;:" :2+"9" <=2+"9" 2,:" :,*+" :,:" ;->1" 75% of MNOs say poor, bad, or non-existent mobile security / visibility More than half of mobile carriers have had outages in last year due to security event Broad range of attack targets within mobile network Mostly IP-level services targeted Suspicion security tools lacking elsewhere Page 16 - Arbor Networks

17 State of Mobile Security Changing Landscape OS/malware Infrastructure Published Mobile Exploits Barriers to entry are falling Internet C.W. This is a good thing Closed to open Lots of SS7 interconnects and GRX peers Cheap hardware pico/femto cells, smart phones Increasing scrutiny More interesting target Data is cool, phone calls are boring Page 17 - Arbor Networks

18 Mobile Security Attack Surface > AT+C... Baseband HNB (Femtocell) Node B (BTS) Internet IPsec IuH RNC (BSC) HNB-GW/ SecGW GRX/IPX Other MNOs IuPS IuCS Gp SGSN SLR VLR MSC Gn Gd PSTN GGSN E Content Optimizers, Filters, etc. Gi SMS-SC C HLR, AuC Mobile Data Center Firewall/ NAT Internet Attack Surface 1. RF Channel exhaustion 2. GPRS, PDP, Gn 3. HLR Signaling DoS 4. GRX/IPX DDoS, toll fraud, protocol interop 5. Gi DDoS, worms, firewall evasion, state exhaustion, battery draining 6. Femtocells 7. SMS 8. SIGTRAN, SS7 9. Mobile to Mobile 10. Weak/broken crypto Page 18 - Arbor Networks

19 Threats: Gi PSTN IuCS VLR E SMS-SC > AT+C... Baseband Node B (BTS) RNC (BSC) IuPS MSC C Internet Sourced Attacks IuH FW/NAT State Exhaustion Internet IPsec HNB-GW/ SecGW GPRS Core State/Signaling RAN Bandwidth/Spectrum Mobile Users Malware, Battery Draining HNB (Femtocell) Mobile Data Center GRX/IPX Other MNOs Gp SGSN SLR Gn Gd GGSN Content Optimizers, Filters, etc. Gi HLR, AuC Mobile Data Center Firewall/ NAT Internet Page 19 - Arbor Networks

20 Threats: Signaling Attacks (RF) PSTN IuCS VLR E SMS-SC > AT+C... Baseband Node B (BTS) RNC (BSC) IuPS MSC C RACH flood Attack size 1 phone HNB (Femtocell) Internet Anonymous preauthentication IPsec IuH HNB-GW/ SecGW Affected users 10s to 1000 See Spaar [3] and Grugq [4] GRX/IPX Other MNOs Gp SGSN SLR Gn Gd GGSN Content Optimizers, Filters, etc. Gi HLR, AuC Mobile Data Center Firewall/ NAT Internet Page 20 - Arbor Networks

21 Threats: Femtocells, Rogue Base Stations Authorized, Unsecured Infrastructure Attack MS Remote, over-the-air, code injection Attack the > AT+C... Core Trusted Baseband environment? Node B (BTS) See Weinmann [5] RNC (BSC) IuPS IuCS VLR MSC PSTN E SMS-SC C Gd HLR, AuC Internet IPsec IuH HNB-GW/ SecGW Gp SGSN SLR Gn GGSN Gi Mobile Data Center HNB (Femtocell) Content Optimizers, Filters, etc. Firewall/ NAT GRX/IPX Other MNOs Internet Page 21 - Arbor Networks

22 Threats: Core Signaling PSTN IuCS VLR E SMS-SC > AT+C... Baseband Node B (BTS) RNC (BSC) IuPS MSC C Gd HLR, AuC HLR DoS AT+CCFC= HNB (Femtocell) IuH HNB-GW/ SecGW Attack size Internet 500 requests/s to halve performance IPsec 2500 requests/s to disable network Affected users 1 Million+ See Traynor et al. [6] GRX/IPX Other MNOs Gp SGSN SLR Gn GGSN Content Optimizers, Filters, etc. Gi Mobile Data Center Firewall/ NAT Internet Page 22 - Arbor Networks

23 Summary Mobile traffic is different from fixed-line Exhibits unique characteristics / trends Mobile security is vastly different from fixed line Especially with respect to maturity / tools Strong mismatch between mobile conventional security / engineering wisdom and emerging realities Still in the very early days of mobile Smart phones small percentage of market Only now seeing significant research and engineering evaluation of mobile security Page 23 - Arbor Networks

24 More Information 3GPP Mailing lists Focus on specs GSMA Proprietary participation requires (expensive) membership Osmocom Amazing open source project. Building all the pieces of a mobile network. Focus on developing Page 24 - Arbor Networks

25 Questions? Scott Iekel-Johnson Joe Eggleston Craig Labovitz Z. Morley Mao Page 25 - Arbor Networks

26 References [1] Anatomizing Application Performance Differences on Smartphones, Huang et al., Proceedings of ACM MobiSys, 2010 [2] Characterizing Radio Resource Allocation for 3G Networks, Qian et al., Proceedings of Internet Measurement Conference, 2010 [3] A Practical DoS Attack to the GSM Network, Spaar, Deepsec, [4] Base Jumping: Attacking GSM Base Station Systems and mobile phone Base Bands, Grugq, Blackhat USA, [5] The Baseband Apocalypse, Weinman, 27C3, [6] On Cellular Botnets: Measuring the Impact of Malicious Devices on a Cellular Network Core, Traynor et al., Proceedings of the 16th ACM Conference on Computer and Communications Security (CCS), Page 26 - Arbor Networks