GUTI Reallocation Demystified: Cellular Location Tracking with Changing Temporary Identifier

Size: px

Start display at page:

Download "GUTI Reallocation Demystified: Cellular Location Tracking with Changing Temporary Identifier"

Loren Gordon
6 years ago
Views:

1 SysSec System Security Lab. GUTI Reallocation Demystified: Cellular Location Tracking with Changing Temporary Identifier Byeongdo Hong, Sangwook Bae, Yongdae Kim KAIST SysSec Feb. 19, 2018

2 Paging Area in Cellular Network Tracking Area (radius < 10 km) Yongdae Paging: A method to find specific subscriber How? By using subscriber s identifier 2

3 Paging Area in Cellular Network Tracking Area (radius < 10 km) Paging Request Yongdae Paging: A method to find specific subscriber How? By using subscriber s identifier 3

4 Paging Area in Cellular Network Tracking Area (radius < 10 km) Paging Request Paging Response Yongdae Paging: A method to find specific subscriber How? By using subscriber s identifier 4

5 Identifiers in Cellular Networks v Permanent/Unique identifier IMSI (International Mobile Subscriber Identity) Provisioned in the SIM card v Temporary identifier Used to hide subscriber TMSI (Temporary Mobile Subscriber Identity) Used in 2G/3G GUTI (Globally Unique Temporary Identity) Used in LTE 5

6 Location Tracking in Cellular Network Location Area 1 Victim Yongdae TMSI: 0xDEADBEEF 0xDEADBEEF = Yongdae? Attacker Location Area 2 0xDEADBEEF User B User C Kune et al. NDSS

7 Location Tracking in Cellular Network Location Area 1 Victim A TMSI: 0xff xff = A I found A!! Attacker Location Area 2 User B Temporary ID Issue: Unchanged User Identifier C GSM: NDSS 12, LTE: NDSS 16 Repeat dialing 7

8 Phone number-temporary ID mapping v Traffic analysis to find the same TMSI (Kune et al. NDSS 12) Find intersects of identifier s sets Attacker Call trigger Observation Call trigger Call trigger dt dt dt Paging Channel Time v Using Silent Call Terminating call before ringing v Same vulnerability in LTE - unchanged GUTI (Shaik et al. NDSS 16) 8

9 Defense of Location Tracking v Temporary Identifier Reallocation GUTI Reallocation in LTE To prevent between subscriber and ID mapping Q. Is GUTI Reallocation the solution to existing attacks? A. It is Yes But simply changing is not a solution! 9

Experiment Setup Device Analysis Broadcast Channel Analysis srslte

Analysis Tool (SCAT) [1] USRP B210 Broadcast Channel Receiver [1] B.

10 Experiment Setup Device Analysis Broadcast Channel Analysis srslte (Open source) Antenna Diagnostic Monitor Signaling Collection and Analysis Tool (SCAT) [1] USRP B210 Broadcast Channel Receiver [1] B. Hong, S. Park, H. Kim, D. Kim, H. Hong, H. Choi, J.P. Seifert, S. Lee, Y. Kim, Peeking over the Cellular Walled Gardens - A Method for Closed Network Diagnosis -, IEEE Transactions on Mobile Computing. 10

11 Worldwide Data Collection Country # of OP. # of USIM # of signalings Country # of OP. # of USIM U.S.A K U.K K Austria K Spain K Belgium K Netherlands K Switzerland K Japan K Germany K South Korea M France K OP: operator, USIM: Universal Subscriber Identity Module, Signaling: control plane message 11 # of signalings Data summary Collection Period: ~ # of countries: 11 # of operators: 28 # of USIMs: 78 # of voice calls: 58K # of signalings: 6.4M

12 Same vs. Fingerprintable IDs NDSS 12, 16: Same ID à Location Tracking!! This work: ID Fingerprinting à Location Tracking!! 12

13 Fixed Bytes in GUTI Reallocation v 19 operators have fixed bytes Allocation Pattern Assigning the same GUTI Three bytes fixed Two bytes fixed One bytes fixed Operators BE-III, DE-II, FR-II, JP-I CH-II, DE-III, NL-I, NL-II BE-II, CH-I, CH-III, ES-I, FR-I, NL-III AT-I, AT-II, AT-III, BE-I, DE-I AT: Austria, BE: Belgium, CH: Switzerland, DE: Germany, ES: Spain, FR: France, JP: Japan, NL: Netherlands 13

14 Case I: Netherlands (NL-I) 14 Hexadecimal value Hexadecimal value FF 192 C FF 192 C (a) 1st byte # of call (c) 3rd byte # of call Hexadecimal value Hexadecimal value F 12 C (b) 2nd byte # of call FF 192 C (d) 4th byte # of call

15 Case I: Netherlands (NL-I) 15 Hexadecimal value Hexadecimal value FF 192 C FF 192 C (a) 1st byte # of call (c) 3rd byte # of call Hexadecimal value Hexadecimal value F 12 C (b) 2nd byte # of call FF 192 C (d) 4th byte # of call

16 Case II: Belgium (BE-II) Hexadecimal value 192 C (a) 1st byte # of call Hexadecimal value (b) 2nd byte # of call 16 Hexadecimal value FF 192 C # of call (c) 3rd byte Hexadecimal value FF 192 C (d) 4th byte # of call

17 Case II: Belgium (BE-II) Hexadecimal value 192 C (a) 1st byte # of call Hexadecimal value (b) 2nd byte # of call 17 Hexadecimal value FF 192 C # of call (c) 3rd byte Hexadecimal value FF 192 C (d) 4th byte # of call

18 Fixed Bytes in GUTI Reallocation v 19 operators have fixed bytes Allocation Pattern Assigning the same GUTI Three bytes fixed Two bytes fixed One bytes fixed Operators BE-III, DE-II, FR-II, JP-I CH-II, DE-III, NL-I, NL-II BE-II, CH-I, CH-III, ES-I, FR-I, NL-III AT-I, AT-II, AT-III, BE-I, DE-I AT: Austria, BE: Belgium, CH: Switzerland, DE: Germany, ES: Spain, FR: France, JP: Japan, NL: Netherlands 18

19 Stress Testing v No noticeable rule of GUTI Reallocation for some operators v Invoking voice call continuously with a short time Two types of test Weak stress testing Hard stress testing Calls at shorter intervals than weak stress test 19

20 Stress Testing Result v Force the network to skip the GUTI reallocation Perform experiments on US and Korean operators Two US and two Korean operators FF Network skips GUTI Reallocation End weak stress testing Operator Weak Stress Testing Hard Stress Testing KR-I O O KR-II X O US-I X O US-II O O O: Reuse GUTI X: No noticeable change Hexadecimal value 192 C # of call 1st Byte 2nd Byte 3rd Byte 4th Byte 20

21 Success Rate of our Attack v Required number of calls covering 99% success rate Call Trial paging / sec 88 paging / sec 160 paging / sec 1 byte fixed 2 bytes fixed 3 bytes fixed

22 Location Tracking with GUTI v Observation of broadcast channels after call invocation Pattern matching (fixed bytes, assigning same GUTI) Location tracking (Tracking Area, Cell) OpenSignal (at KAIST) 22

23 Defenses + Requirements v Frequent refreshing of temporary identifier Per service request v Unpredictable identity allocation Cryptographically secure pseudorandom number generation Hash_DRBG can be used v Collision avoidance v Stress-testing resistance v Low cost implementation 23

24 Conclusion v Predictable reallocation logic GUTI reallocation pattern Fixed bytes (19 operators) Same GUTI By stress test (4 test cases) Assigning same GUTI v Location tracking is still possible in cellular network! v Secure GUTI reallocation mechanism is required 24

25 Thank you Q & A 25

26 BACK UP SLIDES

27 27 GUTI Format

28 Dataset Release? v Our dataset includes somewhat sensitive information. Name of telcos è Vulnerabilities can be linked to telcos. Some IMSIs v Not clear if releasing this dataset may cause any legal issues. v B. Hong, et. al, Peeking over the Cellular Walled Gardens - A Method for Closed Network Diagnosis -, IEEE Transactions on Mobile Computing. Finding performance bugs by comparative analysis of call flows v Should we build open-source dataset using crowdsourcing? May help customers to push telcos to build secure and better cellular network! 28

29 29 Stress Testing Result: US-I

30 Probability with Fixed Bytes

31 Attack Flow Obtain target information (Phone number, carrier) Perform GUTI Reallocation? 31

32 Attack Flow Perform GUTI Reallocation? Yes No Find the target (MME area, Tracking area, Cell) Analysis of rules for ID reallocation 32

33 Attack Flow Analysis of rules for ID reallocation Have fixed bytes? No Stress test Yes Find the target (MME area, Tracking area, Cell) 33

34 Paging Distribution in Korea (KR-I) # of paging / sec Max: 88 pagings / sec :10 22:50 2:30 6:10 9:50 13:30 Min: 5 pagings / sec Time of day 34

Peeking over the Cellular Walled Gardens

Peeking over the Cellular Walled Gardens A Method for Closed Network Diagnosis Byeongdo Hong 1, Shinjo Park 2 Hongil Kim 1, Dongkwan Kim 1 Hyunwook Hong 1, Hyunwoo Choi 1 Jean-Pierre Seifert 2, Sung-Ju