Martyn Ruks & Nils present Security Testing 4G (LTE) Networks at 44CON 2012 in London, September 2012.

1. Security Testing 4G (LTE) Networks
44con
6th September 2012
Martyn Ruks & Nils
11/09/2012 1

2. Today’s Talk
• Intro to 4G (LTE) Networks
• Technical Details
• Attacks and Testing
• Defences
• Conclusions
11/09/2012 2

3. Intro to 4G (LTE) Networks
11/09/2012 3

4. Mobile Networks
A Brief History Lesson
• 1G – 1980s Analogue technology
(AMPS, TACS)
• 2G – 1990s Move to digital
(GSM,GPRS,EDGE)
• 3G – 2000s Improved data
services (UMTS, HSPA)
• 4G – 2010s High bandwidth data
(LTE Advanced)
11/09/2012 4

5. Mobile Networks
Historic Vulnerabilities
• Older networks have been the subject of
practical and theoretical attacks
• Examples include:
• Ability to man in the middle
• No perfect forward secrecy
• No encryption on the back-end
• LTE Advanced addresses previous attacks
11/09/2012 5

6. Mobile Networks
Current Status of 4G
• Lots of 4G networks running or
planned (eg Scandinavia, US)
• UK Trials have run in Cornwall,
London etc
• Spectrum auction is important
• EE services launches soon!
11/09/2012 6

7. Mobile Networks
Why is 4G Important?
• Digital Britain strategy
• Fixed line broadband expensive in
remote locations
• Provides high speed mobile data
services
• High level of scalability on the back-
end
11/09/2012 7

8. Technical Details
11/09/2012 8

9. Conceptual View 3G
Core
NodeB Network
RNC
User Base Station Back-End Internet
11/09/2012 9

10. Network Overview 3G
HSS AuC
NB
UE
NB RNC SGSN GGSN Internet
Core Network
11/09/2012 10

11. Conceptual View 4G
EPC
eNodeB
User Base Station Back-End Internet
11/09/2012 11

12. Network Overview 4G
eNB MME HSS
UE
eNB SGw PGw PCRF Internet
EPC
11/09/2012 12

13. The Components
User Equipment (UE)
• What the customer uses to
connect
• Mainly dongles and hubs at
present
• Smartphones and tablets will
follow (already lots in US)
11/09/2012 13

14. The Components
evolved Node B (eNB)
• The bridge between wired
and wireless networks
• Forwards signalling traffic to
the MME
• Passes data traffic to the
PDN/Serving Gateway
11/09/2012 14

15. The Components
Evolved Packet Core (EPC)
• The back-end core network
• Manages access to data
services
• Uses IP for all
communications
• Divided into several
components
11/09/2012 15

16. The Components
Mobile Management Entity (MME)
• Termination point for UE
Signalling
• Handles authentication
events
• Key component in back-end
communications
11/09/2012 16

17. The Components
Home Subscriber Service (HSS)
• Contains a user’s subscription
data (profile)
• Typically includes the
Authentication Centre (AuC)
• Where key material is stored
11/09/2012 17

18. The Components
PDN and Serving Gateways (PGw and SGw)
• Handles data traffic from UE
• Can be consolidated into a
single device
• Responsible for traffic routing
within the back-end
• Implements important filtering controls
11/09/2012 18

19. The Components
Policy Charging and Rules
Function (PCRF)
• Does what it says on the tin
• Integrated into the network
core
• Allows operator to perform
bandwidth shaping
11/09/2012 19

20. The Components
Home eNB (HeNB)
• The “FemtoCell” of LTE
• An eNodeB within your home
• Talks to the MME and
PDN/Serving Gateway
• Expected to arrive much later in
4G rollout
11/09/2012 20

21. Network Overview
Control and User Planes
11/09/2012 21

22. The Protocols
Radio Protocols (RRC, PDCP, RLC)
• These all terminate at the eNodeB
• RRC is only used on the control
plane RRC
• Wireless user and control data PDCP
RLC
is encrypted (some exceptions)
• Signalling data can also be
encrypted end-to-end
11/09/2012 22

23. The Protocols
Internet Protocol (IP)
• Used by all back-end comms
• All user data uses it
• Supports both IPv4 and IPv6 IP
• Important to get routing and
filtering correct
• Common UDP and TCP
services in use
11/09/2012 23

24. The Protocols
The Protocols - SCTP
• Another protocol on top of IP
• Robust session handling
• Bi-directional sessions SCTP
• Sequence numbers very IP
important
11/09/2012 24

25. The Protocols
The Protocols – GTP-U
• Runs on top of UDP and IP
• One of two variants of GTP
used in LTE GTP-U
• This transports user IP data UDP
• Pair of sessions are used IP
identified by Tunnel-ID
11/09/2012 25

26. The Protocols
The Protocols – GTP-C
• Runs on top of UDP and IP
• The other variant of GTP used
in LTE GTP-C
• Used for back-end data UDP
• Should not be used by the IP
MME in pure 4G
11/09/2012 26

27. The Protocols
S1AP
• Runs on top of SCTP and IP
• An ASN.1 protocol
• Transports UE signalling S1AP
• UE sessions distinguished by SCTP
IP
a pair of IDs
11/09/2012 27

28. The Protocols
X2AP
• Very similar to S1AP
• Used between eNodeBs for
signalling and handovers X2AP
• Runs over of SCTP and IP and SCTP
is also an ASN.1 protocol IP
11/09/2012 28

29. Potential Attacks
11/09/2012 29

30. Targets for Testing
What Attacks are Possible
• Wireless attacks and the baseband
• Attacking the EPC from UE
• Attacking other UE
• Plugging into the Back-end
• Physical attacks (HeNB)
11/09/2012 30

31. Targets for Testing
Wireless Attacks and the Baseband
• A DIY kit for attacking wireless
protocols is now closer (USRP
based)
• Best chance is using commercial
kit to get a head-start
• Not the easiest thing to attack
11/09/2012 31

32. Targets for Testing
Attacking the EPC from UE
• Everything in the back-end is IP
• You pay someone to give you IP access
to the environment 
• Easiest place to start
11/09/2012 32

33. Targets for Testing
Attacking other UE
• Other wirelessly connected
devices are close
• May be less protection if seen
as a local network
• The gateway may enforce
segregation between UE
11/09/2012 33

34. Targets for Testing
Wired network attacks
• eNodeBs will be in public locations
• They need visibility of components in the
EPC
• Very easy to communicate with an IP
network
• Everything is potentially in scope
11/09/2012 34

35. Targets for Testing
Physical Attacks (eNB)
• Plugging into management
interfaces is most likely attack,
except …
• A Home eNodeB is a different
story
• Hopefully we have learned from
the Vodafone Femto-Cell Attack
11/09/2012 35

36. What you can Test
11/09/2012 36

37. Tests to Run
As a Wirelessly Connected User
• Visibility of the back-end from UE
• Visibility of other UEs
• Testing controls enforced by Gateway
• Spoofed source addresses
• GTP Encapsulation (Control and User)
11/09/2012 37

38. Tests to Run
From the Back-End
• Ability to attack MME (signalling)
• Robustness of stacks (eg SCTP)
• Fuzzing
• Sequence number generation
• Testing management interfaces
• Web consoles
• SSH
• Proprietary protocols
11/09/2012 38

39. Tests to Run
Challenges
• Spoofing UE authentication is difficult
• Messing with radio layers is hard
• ASN.1 protocols are a pain
• Injecting into SCTP is tough
• Easy to break back-end communications
11/09/2012 39

40. Tests to Run
S1AP Protocol
• By default no authentication to the service
• Contains eNodeB data and UE Signalling
• UE Signalling can make use of encryption
and integrity checking
• If no UE encryption is used attacks against
connected handsets become possible
11/09/2012 40

41. Tests to Run
S1AP and Signalling
S1AP NAS
NAS
UE eNB MME
11/09/2012 41

42. Tests to Run
S1AP and Signalling
Spoofed Spoofed
UE eNB
MME
UE eNB
11/09/2012 42

43. Tests to Run
S1AP and Signalling
S1 Setup
S1 Setup Response
Attach Request
eNB MME
Authentication Request
Authentication Response
Security Mode
11/09/2012 43

44. Tests to Run
GTP Protocol
• Gateway can handle multiple
encapsulations
• It uses UDP so easy to have fun with
• The gateway needs to enforce a number of
controls that stop attacks
11/09/2012 44

45. Tests to Run
GTP and User Data
GTP IP
IP IP
UE eNB SGw Internet
11/09/2012 45

46. Tests to Run
GTP and User Data
IP
UE GTP
UDP
IP
GTP
eNodeB UDP
IP
11/09/2012 46

47. Tests to Run
GTP and User Data
GTP IP GTP
IP GTP IP GTP
UE eNB SGw Internet
11/09/2012 47

48. Tests to Run
GTP and User Data Destination IP
Address (IP)
GTP Tunnel
Source IP Invalid IP ID (GTP)
Address (IP) Protocols (IP)
Source IP
Address (GTP)
UE eNB SGw PGw
11/09/2012 48

49. Tests to Run
Old Skool
• Everything you already know can be
applied to testing the back-end
• Its an IP network and has routers and
switches
• There are management services running
11/09/2012 49

50. Defences
11/09/2012 50

51. Defences
The Multi-Layered Approach
• Get the IP network design right
• Protect the IP traffic in transit
• Enforce controls in the Gateway
• Ensure UE and HeNBs are secure
• Monitoring and Response
• Testing
11/09/2012 51

52. Defences
Unified/Consolidated Gateway
• The “Gateway” enforces some very
important controls:
• Anti-spoofing
• Encapsulation protection
• Device to device Routing
• Billing and charging of users
11/09/2012 52

53. Defences
IP Routing
• Architecture design and routing in the core
is complex
• Getting it right is critical to security
• We have seen issues with this
• This must be tested before an environment
is deployed
11/09/2012 53

54. Defences
IPSec
• If correctly implemented will provide
Confidentiality and Integrity protection
• Can also provide authentication between
components
• Keeping the keys secure is not trivial and
not tested
11/09/2012 54

55. Defences
Architecture Consideration
MME HSS
EPC Switch
Internet
eNodeB Gateway
Internet
Serving Gateway PDN Gateway
EPC
11/09/2012 55

56. Conclusions
11/09/2012 56

57. Conclusion 1
• There are 3 key protective controls that
should be tested within LTE environments
• Policies and rules in the Unified/Consolidated
Gateway
• The implementation of IPSec between all back-
end components
• A back-end IP network with well-designed
routing and filtering
11/09/2012 57

58. Conclusion 2
• Despite fears from the use of IP in 4G, LTE
will improve security if implemented
correctly
• The 3 key controls must be correctly
implemented
• Testing must be completed for validation
• Continued scrutiny is required
• Legacy systems may be the weakest link
11/09/2012 58

59. Conclusion 3
• Protecting key material used for IPSec is
not trivial
• The security model for IPSec needs careful
consideration
• Operational security processes are also
important
• Home eNodeB security is a challenge
11/09/2012 59

60. Conclusion 4
• More air interface testing is needed
• Will need co-operation from
vendors/operators
• “Open” testing tools will need significant
development effort
• Still lower hanging fruit if support for legacy
wireless standards remain
11/09/2012 60

61. Questions
@mwrinfosecurity
@mwrlabs
11/09/2012 61