Back to thefuture
Cross-protocol attacks inthe era of 5G

Sergey Puzankov

About the team

Pavel Novikov

Sergey Mashukov

Alexander Onegov

Sergey Puzankov

sergey.mashukov@positive-tech.com

alexandr.onegov@positive-tech.com

pavel.novikov@positive-tech.com

sergey.puzankov@positive-tech.com

The main point of interest is the securityof the Diameter protocol. Sergey
performs Diameter security audits forinternational MNOs and conducts
research on the protocol weaknesses.
Sergey is also the general developer of
the Telecom Vulnerability Scanner tooland member of the Telecom AttackDiscovery development team.

Alexander researched both SS7and Diameter signaling protocols
from security point of view anddeveloped algorithms for an
intrusion detection system. He
also performs security
assessments for mobile
operators and conducts researchon the network vulnerabilities.

Pavel researches GTP andDiameter protocols, security
issues on radio part of mobile
networks, and everything that isconnected with IoT devices.
Pavel is also active contributor tothe GSMA Fraud and Security
Group.

Sergey conducted researchof by-design vulnerabilities
in SS7 networks, discovered
a number of criticalvulnerabilities in mobile
network equipment, andshowed how an intruder
is able to bypass mobile
operators' protection means.

Signaling basics
SS7 (Signaling System No. 7) is a set oftelephony protocols used to set up and teardown telephone calls, send and receive SMS
messages, provide subscriber mobility, andmore.

Diameter is an authentication, authorization, andaccounting protocol for computer networks. RFC 5516
defines a set of IANA Diameter Command Codes to be
used in new vendor-specific Diameter applications
defined for the 3GPP Evolved Packet System (EPS).

GTP (GPRS Tunneling Protocol) is a group of IPbased communications protocols used to carry generalpacket radio service (GPRS) within GSM, UMTS andLTE networks.

The basic unit in signaling is a message.

Now what can a hacker do?
Intercept private data,
calls, and SMS messages

EasilyTrack location of VIPs
and public figures

From
anywhere
Perform massive denialof service attacks

Take control of yourdigital identity

Any mobile
operator
Get access to youremail and social media

No specialskills needed
Steal money

History of signaling security

SS7 developmentScope grows

Not trusted anymore

Trusted environment. No security
mechanisms in the protocol stack.
SIGTRAN (SS7 over IP) introduced.
Security is still missing

Growing number of SS7
connections, increasing
amount of SS7 traffic.
No security policies
or restrictions

Huge number of MNOs,
MVNOs, and VAS providers.
SS7 widely used, Diameter
added and spreading.
Still not enough security

Mobile operators and signaling security

Security
configuration

Security assessment
Signaling firewall

SMS Home Routing

Signaling IDS

Nodes and identifiers in GSM/UMTS
MSISDN — Mobile Subscriber IntegratedServices Digital Number

STP — Signaling Transfer Point

HLR — Home Location Register
IMSI — International Mobile SubscriberIdentity
GT — Global Title, address of a core nodeelement

MSC/VLR — Mobile Switching
Center and Visited Location Register
SGSN — Serving GPRS Support NodeSMS-C — SMS CenterSS7 protocol stack
MAP

Mobile Application Part

TCAP

Transaction Capabilities Application Part

SCCP

Signaling Connection Control Partis payload that contains an operation code and appropriate parameterssuch as IMSI, profile information, and location data.

is responsible for transactions and dialogues processing.

is responsible for the routing of a signaling message by Global Titles.

Nodes in LTE
DEA — Diameter Edge AgentHSS — Home Subscriber Server

MME — Mobile Management Entity

SGW — Serving Gateway

IMS — IP Multimedia System

Diameter protocol stack
Diameter
SCTPIP

Diameteris payload that contains a command code, application ID, andappropriate parameters within Attribute-Value Pairs (AVP) blocks.

Stream Control Transmission Protocol
is a transport protocol that provides some of the features of both
UDP and TCP.

Internet Protocol
is responsible for the node Internetworking at the Internet layer.

Protocol types and nodes and GTPGTP-C is control section of the GTP standard(signaling).
GTP-U is IP-based tunneling protocol whichpermits many tunnels between each set of endpoints.
GTP' transfers charging data.

GSM and UMTS
SGSN — Serving GPRS Support NodeGGSN — Gateway GPRS Support Node

LTE and 5G non-SA
SGW — Serving Gateway

PGW — Public Data Network Gateway

GTP-C protocol stack
GTP-C

GPRS Tunneling Protocol Control Plane

UDP

User Datagram ProtocolIP

is used within the GPRS core and EPC networks for signaling
between gateway and serving packet data nodes.

is a transport protocol for establishing low-latency and losstolerating connections between applications on the Internet.

Internet Protocol
is responsible for the node internetworking at the Internet layer.

Mixed-generation network
SS72GMSC/VLR

3GSTP

HLR

GTP

2G
SGSN

4G

3GDiameter

GGSN

SS7DEA

HSS
4G
5G

IMS

IWF
GTP

5G non SA
MME/SGWPGW

SS7 and Diameter firewall penetration*
SS7 firewall penetration growth

Diameter firewall penetration
This is the main reason why theintruders start using Diameter
protocol along with SS70%0%* Statistics based on Positive Technologies' SS7 and Diameter security assessment projects0%Cross-protocol attacks

Voice callinterception (MITM)

Voice callinterception (MITM)

Subscriptionfraud

Attack via VoLTE suppression
and SS7 firewall bypassing

Attack via packet dataservice disruption

Attack on SS7 andGTP-C protocols

Voice call interception (MITM)
on 2G/4G network with VoLTE
Attack via VoLTE
suppression andSS7 firewall
bypassingVoice call interception (MITM)
1. InsertSubscriberData Request: IMSI
Spoofed billing platform address

STP

1. InsertSubscriberData Request: IMSI
Spoofed billing platform address

MSC/VLR

Voice call interception (MITM)
1. InsertSubscriberData Request: IMSI
Spoofed billing platform address
2. InsertSubscriberData Response
3. TCAP End

STP

1. InsertSubscriberData Request: IMSI
Spoofed billing platform address
2. InsertSubscriberData Response
3. TCAP End

MSC/VLR

Voice call interception (MITM)
1. InitialDP: IMSI, A-Num, B-Num

STP

MSC/VLR
1. InitialDP: IMSI, A-Num, B-NumVoice call interception (MITM)
1. InitialDP: IMSI, A-Num, B-Num
2. Connect: PBX-NumSTP

MSC/VLR
1. InitialDP: IMSI, A-Num, B-Num
2. Connect: PBX-NumVoice call interception (MITM)
1. InitialDP: IMSI, A-Num, B-Num
2. Connect: PBX-Num
3. IAM: A-Num, B-Num

STP

MSC/VLR
1. InitialDP: IMSI, A-Num, B-Num
2. Connect: PBX-Num
3. IAM: A-Num, B-Num

SS7 FW against MITM attack
STP

MSC/VLR

1. InsertSubscriberData Request:
IMSI, Spoofed billing platform address

2. InsertSubscriberData
Request: IMSI, Spoofedbilling platform address

Switzerland ≠ Taiwan

The SS7 FW correlates the IMSI andsource address and blocks theInsertSubscriberData message

VoLTE against MITM attack
1. InsertSubscriberData Request: IMSI
Spoofed billing platform address

STP

MSC/VLR

2. InsertSubscriberData Response
3. TCAP End

DEA

MME

IMS

VoLTE service suppression
CLR – Cancel-Location Request
Diameter

SS7CLR

DEA

STP

PBX

SS7 FW

MME

IMS

MSC/VLRVoLTE service suppression
CLA – Cancel-Location Answer
Diameter

CLR

DEA

MME

IMS

CLA

SS7STPPBX

SS7 FW

MSC/VLRVoLTE service suppression
CLR – Cancel-Location Answer
Diameter

CLRDEAMMEIMS

CLASS7STPPBX

SS7 FW

MSC/VLR

TCAP protocol
TCAP Message Type — mandatory
Transaction IDs — mandatory
Dialogue Portion — optional
Component Portion — optional

Double MAP component
TCAP Message Type — mandatory
Transaction IDs — mandatory
Dialogue Portion — optional
Component Portion — optional

Component 1
Component 2

The SS7 FW
checks a
subscriber's ID in
the first component
considering theother data as along payload notmeant to beinspected

Double MAP in MITM attack
TCAP Begin
InsertSubscriberData_REQ

DEAMMEIMS

DeleteSubscriberData_REQ

SS7STP

MSC/VLR

PBX

Send the message tothe SS7 FW forinspection

SS7 FW

Inspect the firstcomponent only andforward themessage to thenetwork

Double MAP in MITM attack
TCAP Begin
Diameter
InsertSubscriberData_REQ

DEA

MME

IMS

DeleteSubscriberData_REQ

SS7STP

PBX

TCAP Continue
ReturnError

SS7 FW

MSC/VLR

Double MAP in MITM attack
TCAP Begin

TCAP Continue

InsertSubscriberData_REQ

DEA
MME
InsertSubscriberData_REQ

DeleteSubscriberData_REQ

InsertSubscriberData_REQ

SS7STPIMS

MSC/VLR

PBX

TCAP ContinueReturnError

SS7 FW

Inspect the firstcomponent only andforward themessage to thenetwork.

Double MAP in MITM attack
TCAP Begin

TCAP Continue

InsertSubscriberData_REQ

DEA
MME
InsertSubscriberData_REQ

DeleteSubscriberData_REQ

InsertSubscriberData_REQ

SS7STP

PBX

TCAP Continue

SS7 FW
TCAP Continue

ReturnError

ReturnResultLast

IMS

MSC/VLR

Double MAP in MITM attack
TCAP Begin

TCAP Continue

InsertSubscriberData_REQ

DEA
MME
InsertSubscriberData_REQ

DeleteSubscriberData_REQ

InsertSubscriberData_REQ

SS7STP

PBX

TCAP Continue

SS7 FW
TCAP ContinueReturnError

ReturnResultLastIMSMSC/VLRDouble MAP in MITM attack
TCAP Begin

TCAP Continue

InsertSubscriberData_REQ

DEA
MME
InsertSubscriberData_REQ

DeleteSubscriberData_REQ

InsertSubscriberData_REQ

SS7STP

PBX

TCAP Continue

SS7 FW
TCAP Continue

ReturnError

ReturnResultLast

TCAP EndIMS

MSC/VLR

Double MAP in MITM attack
TCAP Begin

TCAP Continue

InsertSubscriberData_REQ

DEA
MME
InsertSubscriberData_REQ

DeleteSubscriberData_REQ

InsertSubscriberData_REQ

SS7STP

PBX

TCAP Continue

SS7 FW
TCAP Continue

ReturnError

ReturnResultLast

TCAP EndIMS

MSC/VLR

Double MAP in MITM attack
TCAP Begin

TCAP Continue

InsertSubscriberData_REQ

InsertSubscriberData_REQ MME

DeleteSubscriberData_REQ

InsertSubscriberData_REQ

SS7STP

PBX

TCAP Continue

SS7 FW
TCAP Continue

ReturnError

ReturnResultLast

TCAP EndIMS

MSC/VLR

Double MAP in MITM attack
TCAP Begin

TCAP Continue

InsertSubscriberData_REQ

InsertSubscriberData_REQ MME

DeleteSubscriberData_REQ

InsertSubscriberData_REQ

SS7STP

PBX

TCAP Continue

SS7 FW
TCAP Continue

ReturnError

ReturnResultLast

TCAP EndIMS

MSC/VLR

Voice call interception (MITM)
on 4G/5G network
Attack via packet dataservice disruption

Fake registration on 2G/3G

A
4G/5G

PBX

IMS

HSS/HLR

UpdateLocation

B

SS7MME/SGW

DEA

IWF

Voice
Data

DiameterFake registration on 2G/3G

A
4G/5G

PBX

IMS

HSS/HLR

UpdateLocation

B

SS7

MME/SGW

DEA

IWF

Voice
Data

DiameterOriginating traffic redirection
LIR – Location Information Request

LIR

A
4G/5G

PBX

IMS

HSS/HLR

ProvideRoamingNumber (IMSI)

B

SS7MME/SGW

DEA

IWF

Voice
Data

DiameterOriginating traffic redirection
LIR – Location Information Request
LIA – Location Information Answer

INVITE (A, PBX)LIA (PBX)
LIR

A
4G/5G

PBX

IMS

HSS/HLR

ProvideRoamingNumber (IMSI)

B

ProvideRoamingNumber (PBX)

MME/SGW

DEA

SS7

IWF

Voice
Data

DiameterWhat's the next?
LIR – Location Information Request
LIA – Location Information Answer

INVITE (A, PBX)LIA (PBX)
LIR

A

PBX

IMS

HSS/HLR

4G/5G

INVITE (A, B)

ProvideRoamingNumber (IMSI)

B

ProvideRoamingNumber (PBX)

MME/SGWDEA

SS7IWF

Voice
Data

DiameterCase 1. Packet data disruption
On SS7 network

A
4G/5G

PBX

IMS

HSS/HLR
CLR

UpdateGPRSLocation

CLAB

SS7MME/SGW

DEA

IWF

Voice
Data

DiameterService restoration
ULR – Update Location Request
ULA – Update Location Answer

A
4G/5G

PBX

IMS

HSS/HLR
ULR
ULA

B

SS7MME/SGW

DEA

IWF

Voice
Data

DiameterTerminating traffic initiation

INVITE (A, B)

LIA
LIR

A
4G/5G

PBX

IMS

HSS/HLRB

SS7MME/SGW

DEA

IWF

Voice
Data

DiameterCase 2. Packet data disruption
On Diameter network

A

CLR – Cancel Location Request
CLA – Cancel Location Answer

4G/5G

PBX

IMS

HSS/HLR
CLR

B

MME/SGW

CLA

SS7
DEA

IWF

Voice
Data

CLA

CLR

DiameterService restoration

A
4G/5G

PBX

IMS

HSS/HLR
ULR
ULA

B

SS7

MME/SGW

DEA

IWF

Voice
Data

DiameterTerminating traffic initiation

INVITE (A, B)

LIA
LIR

A
4G/5G

PBX

IMS

HSS/HLRB

SS7

MME/SGW

DEA

IWF

Voice
Data

DiameterSubscription fraud

Attack on
SS7 and GTP
networks

Subscription fraud via SS7/GTP
Web server

GTP

GGSN
UpdateLocation (IMSI)

UpdateLocation (IMSI)

HLR

STP

SS7Subscription fraud via SS7/GTP
Web server

GTP

GGSN

HLR

UpdateLocation (IMSI)

UpdateLocation (IMSI)

InsertSubscriberData (MSISDN)

InsertSubscriberData (MSISDN)

STP

SS7

Subscription fraud via SS7/GTP
Web server

GTP

GGSN

HLR

UpdateLocation (IMSI)

UpdateLocation (IMSI)

InsertSubscriberData (MSISDN)

InsertSubscriberData (MSISDN)

STP

SS7

Subscription fraud via SS7/GTP
Web server
CreatePDPContext Request (IMSI, MSISDN)

GTP

GGSN

HLR

UpdateLocation (IMSI)

UpdateLocation (IMSI)

InsertSubscriberData (MSISDN)

InsertSubscriberData (MSISDN)

STP

SS7

Subscription fraud via SS7/GTP
Web server
CreatePDPContext Request (IMSI, MSISDN)
CreatePDPContext Response (GSN IP)

GTP

GGSN

HLR

UpdateLocation (IMSI)

UpdateLocation (IMSI)

InsertSubscriberData (MSISDN)

InsertSubscriberData (MSISDN)

STP

SS7

Subscription fraud via SS7/GTP
Web server
CreatePDPContext Request (IMSI, MSISDN)
CreatePDPContext Response (GSN IP)
HTTP request

GTP

GGSN

HLR

UpdateLocation (IMSI)

UpdateLocation (IMSI)

InsertSubscriberData (MSISDN)

InsertSubscriberData (MSISDN)

STP

SS7

Contribution to GSMA
 Information about discovered cross-protocol vulnerabilities has been reported
on the GSMA FASG meeting in February 2020.
 SS7 firewall bypass techniques were reported to GSMA FASG* group in April
2019. This information is published in the "SS7 Interconnect Security
Monitoring and Firewall Guidelines."
 GSMA Coordinated Vulnerability Programme registered this issue with thenumber CVD-2018-0015.

* FASG is Fraud and Security GroupMain issues in signaling security
Architecture flaws

Configuration errors

Software bugs

Protectionmeasures

Continual real time monitoringis essential to measure network
security efficiency and provide
rapid detection and mitigation

Monitor2

Use an intrusion detection solution along with an
SS7 and Diameter firewalls in order to detectthreats promptly and block a hostile source.

3

Configure your STP, DEA, and signaling firewall
carefully. Do not forget about reported
vulnerabilities such as malformed Application
Context Name and double MAP encapsulation.

Protect

1

Check if your security tools are
effective against new vulnerabilities.

AssessAuditing provides the essential
visibility to fully understand yourever changing network risks

Completely secure
your network byaddressing bothgeneric
vulnerabilities(GSMA) and thethreats that actuallyeffect you as anongoing processThankyou
Sergey Puzankov
sergey.puzankov@positive-tech.com