SecurityofWirelessNetworks

SrdjanČapkunDepartmentofComputerScience

ETHZurich

Some material adapted from Hubaux, Buttyan, “Security and Cooperation in Wireless Networks”

NetworkAccess GSM/UMTS

SecurityofWirelessNetworks,AS2010

GSM

GSM(GlobalSystemforMobileCommunica?ons)iss?llthemostwidelyusedcellularstandard• >600millionusers,mostlyinEuropeandAsia;limited

coverageandsupportinUSA• BasedonTDMAradioaccessandPCMtrunking• UseSS7signallingwithmobile-specificextensions• Providesauthen?ca?onandencryp?oncapabili?es• Thirdgenera?on(3G)andfuture(4G)

SecurityofWirelessNetworks,AS2010

GSM

900MHz(or1800MHz)band• uplinkfrequencyband890-915MHz• downlinkfrequencybandis935-960MHz• 25MHzsubdividedinto124carrierfrequencychannels,

each200kHzapartTimedivisionmul?plexing(TDMA)• allows8speechchannelsperradiofrequencychannel• Channeldatarateis270.833kbps• Voicetransmi`edat13kbpsHandsetpowermax.2wa`sinGSM850/900and1wa`inGSM1800/1900Cellsizeupto35km

SecurityofWirelessNetworks,AS2010

GSMArchitecture

Mobile Stations Base Station Subsystem

Exchange System

Network Management

Subscriber and terminal equipment databases

BSC MSC VLR

HLR

EIR

AUC

OMC BTS

BTS

BTS

EIR - Equipment Identity Register AC = Authentication center

HLR = Home Location Register VLR = Visitor Location Register

MSC (Mobile Switching Center) sets up and releases the end-to-end connection, handles mobility and hand-over requirements during the call and takes care of charging and real time pre-paid account monitoring.

SecurityofWirelessNetworks,AS2010

GSMSecurityGoals

Operators• Billsrightpeople• Avoidfraud• ProtectServicesCustomers• Privacy• AnonymityMakeasystematleastsecureasPSTN?

SecurityofWirelessNetworks,AS2010

GSMSecurityGoals

ConfidenIalityandAnonymityontheradiopathStrongclientauthen*ca*ontoprotecttheoperatoragainstthebillingfraudPreven?onofoperatorsfromcompromisingofeachothers’security• Inadvertently• Compe??onpressure

SecurityofWirelessNetworks,AS2010

mygrandgrandma...

Twoissues:• Talkingforfree:Howdoyouprovethatyouarethe

costumerofanetwork?• Talkingonsomeoneelse’sexpense:Howdoyoudiffer

betweentwocostumers?

=>weneedawaytodis?nguishbetweenusers(authenIcaIon)

SecurityofWirelessNetworks,AS2010

SIM(SubscriberIden?fica?onModule)

SubscriberIden?fica?onModule(SIM)• SmartCard–asinglechipcomputercontainingOS,File

System,Applica?ons• Ownedbyoperator(i.e.trusted)

SecurityofWirelessNetworks,AS2010

SIMCards

Typicalspecifica?on• 8bitCPU• 16KROM• 256bytesRAM• 4KEEPROM• Cost:$5-50SmartCardTechnology• BasedonISO7816defining• Cardsize,contactlayout,electricalcharacteris?cs• I/OProtocols: byte/blockbased• FileStructure

SecurityofWirelessNetworks,AS2010

GSMMobile

MobileEquipment(ME)• Physicalmobiledevice• Iden?fiers

• IMEI–Interna?onalMobileEquipmentIden?tySubscriberIden?tyModule(SIM)• SmartCardcontainingkeys,iden?fiersandalgorithms• Iden?fiers

• Ki–SubscriberAuthen?ca?onKey• IMSI–Interna?onalMobileSubscriberIden?ty• TMSI–TemporaryMobileSubscriberIden?ty• MSISDN–MobileSta?onInterna?onalService

DigitalNetwork• PIN–PersonalIden?tyNumberprotec?ngaSIM• LAI–loca?onareaiden?ty

SecurityofWirelessNetworks,AS2010

TheKeyisintheCard

Ki–SubscriberAuthen?ca?onKey• Shared128bitkeyusedforauthen?ca?onofsubscriber

bytheoperator

KeyStorage• Subscriber’sSIM(ownedbyoperator,i.e.trusted)• Operator’sHomeLocatorRegister(HLR)ofthe

subscriber’shomenetwork

SecurityofWirelessNetworks,AS2010

GSMUserAuthen?ca?on

A3

Mobile phone Radio Link GSM Operator

A8

A5

A3

A8

A5

Ki Ki

Challenge RAND

Kc Kc

mi Encrypted Data mi

SIM

Signed response (SRES) SRES SRES

Fn Fn

Authentication: are SRES values equal?

SecurityofWirelessNetworks,AS2010

GSMUserAuthen?ca?on

AuC–Authen?ca?onCenter• Providesparametersforauthen?ca?onandencryp?on

func?ons(RAND,SRES,Kc)HLR–HomeLoca?onRegister• ProvidesMSC(MobileSwitchingCenter)withtriples

(RAND,SRES,Kc)• HandlesMSloca?onVLR–VisitorLoca?onRegister• StoresgeneratedtriplesbytheHLRwhenasubscriber

isnotinhishomenetwork• Oneoperatordoesn’thaveaccesstosubscriberkeysof

theanotheroperator.

SecurityofWirelessNetworks,AS2010

A3andA8(Authen?ca?onandSessionKey)BothA3andA8algorithmsareimplementedontheSIM• Operatorcandecide,whichalgorithmstouse.• Algorithmimplementa?onisindependentofHWand

operators.• A8wasnevermadepublic

A3

RAND (128 bit)

Ki (128 bit)

SRES (32 bit)

A8

RAND (128 bit)

Ki (128 bit)

KC (64 bit)

COMP128

RAND (128 bit)

Ki (128 bit)

128 bit output SRES 32 bit and Kc 54 bit

LogicalimplementaIonofA3andA8

COMP128isakeyedhashfuncIon

SecurityofWirelessNetworks,AS2010

A5(Confiden?ality)A5isastreamcipher• ImplementedveryefficientlyonhardwareDesignwasnevermadepublic• LeakedtoRossAndersonandBruceSchneierVariants:A5/1–thestrongversion,A5/2–theweakversion,A5/3GSMAssocia?onSecurityGroupand3GPPdesignBasedonKasumialgorithmusedin3Gmobilesystems

A5

Kc (64 bit) Fn (22 bit)

114 bit

XOR Data (114 bit)

A5

Kc (64 bit) Fn (22 bit)

114 bit

XOR Ciphertext (114 bit) Data (114 bit)

Mobile Station BTS

SecurityofWirelessNetworks,AS2010

A`ackHistory(Authen?ca?onandConfiden?ality)

1991:FirstGSMimplementa?on.April1998• TheSmartcardDeveloperAssocia?on(SDA)togetherwith

U.C.BerkeleyresearcherscrackedCOMP128algorithmstoredinSIMandsucceededtogetKiwithinseveralhours.TheydiscoveredthatKcusesonly54bits.

August1999• TheweakA5/2wascrackedusingasinglePCwithin

seconds.December1999• AlexBiryukov,AdiShamirandDavidWagnerhavepublished

theschemebreakingthestrongA5/1algorithm.Withintwominutesofinterceptedcallthea`ack?mewasonly1second.

May2002

SecurityofWirelessNetworks,AS2010

A`ack:Extrac?ngtheKeyfromtheSIMcard

A`ackGoal• KistoredonSIMcard• KnowingKiit’spossibletocloneSIMCardinalPrinciple• Relevantbitsofallintermediatecyclesandtheirvalues

shouldbesta?s?callyindependentoftheinputs,outputs,andsensi?veinforma?on.

A`ackIdea• Findaviola?onoftheCardinalPrinciple,i.e.side

channelswithsignalsdoesdependoninput,outputsandsensi?veinforma?on

• Trytoexploitthesta?s?caldependencyinsignalstoextractasensi?veinforma?on

SecurityofWirelessNetworks,AS2010

A`ack:Extrac?ngtheKeyfromtheSIMcard

Traditional Cryptographic

Attacks

Input Crypto Processing

Sensitive Information

Output

SecurityofWirelessNetworks,AS2010

A`ack:Extrac?ngtheKeyfromtheSIMcard

Side Channels • Power Consumption • Electromagnetic radiation • Timing • Errors • Etc.

Side Channel Attacks

Input Crypto Processing

Sensitive Information

Output

SecurityofWirelessNetworks,AS2010

A`ack:FakeBS

• IMSIcatcherbyLawEnforcement• Interceptmobileoriginatedcalls• Canbeusedforover-the-aircloning

Usedtobe...

Today: USRP,OpenBTS

SecurityofWirelessNetworks,AS2010

SignalingSecurity

MobilenetworksprimarilyuseSignalingSystemno.7(SS7)forcommunica?onbetweennetworksforsuchac?vi?esasauthen?ca?on,loca?onupdate,andsupplementaryservicesandcallcontrol.Themessagesuniquetomobilecommunica?onsareMAPmessages.

ThesecurityoftheglobalSS7networkasatransportsystemforsignalingmessagese.g.authen?ca?onandsupplementaryservicessuchascallforwardingisopentomajorcompromise.

TheproblemwiththecurrentSS7systemisthatmessagescanbealtered,injectedordeletedintotheglobalSS7networksinanuncontrolledmanner

SecurityofWirelessNetworks,AS2010

LowTechFraud

Frauds• Callforwardingtopremiumratenumbers• Bogusregistra?ondetails• Roamingfraud• Terminalthep• Mul?pleforwarding,conferencecallsCountermeasures:• Mul?plecallsatthesame?me,• Largevaria?onsinrevenuebeingpaidtootherpar?es,• Largevaria?onsinthedura?onofcalls• Changesincustomerusage• Monitortheusageofacustomercloselyduringa

'proba?onaryperiod'

NetworkAccess GSM/UMTS

SecurityofWirelessNetworks,AS2010

UMTS

UMTS(UniversalMobileTelecommunica?onsSystem)UsesW-CDMA,• 1885-2025MHzforthemobile-to-base(uplink)and

2110-2200MHzforthebase-to-mobile(downlink)• supportsupto14Mbps(intheory)(withHSDPA),• usersindeployednetworkscanexpectupto384kbit/s

forR99handsets,and3.6Mbit/sforHigh-SpeedDownlinkPacketAccess(HSDPA)handsets

SecurityofWirelessNetworks,AS2010

UMTSSecurity

Reuseof2ndgenera?onsecurityprinciples(GSM):• Removablehardwaresecuritymodule

• InGSM:SIMcard• In3GPP:USIM(UserServicesIden?tyModule)

• Radiointerfaceencryp?on• LimitedtrustintheVisitedNetwork• Protec?onoftheiden?tyoftheenduser• Correc?onofthefollowingweaknessesoftheprevious

genera?on:• ATacksfromafakedbasestaIon• CipherkeysandauthenIcaIondatatransmiTedin

clearbetweenandwithinnetworks• EncrypIonnotusedinsomenetworks• Dataintegritynotprovided

SecurityofWirelessNetworks,AS2010

UMTSAuthen?ca?on(withaVisitedNetwork)

Generation of cryptographic material

Home Environment Visited Network Mobile Station Sequence number (SQN) RAND(i)

Authentication vectors

K: User’s secret key

IMSI/TMSI User authentication request

Verify AUTN(i) Compute RES(i)

User authentication response RES(i)

Compare RES(i) and XRES(i)

Select CK(i) and IK(i)

Compute CK(i) and IK(i)

K

K

RAND(i)||AUTN(i)

SecurityofWirelessNetworks,AS2010

Genera?onofAuthen?ca?onVectors (bytheHomeEnvironment)

Generate SQN

Generate RAND

f1 f2 f3 f4 f5

K

AMF

MAC (Message Authentication

Code)

XRES (Expected

Result)

CK (Cipher Key)

IK (Integrity

Key)

AK (Anonymity

Key)

AMF: Authentication and Key Management Field

Authentication token: AUTN = (SQN⊕AK)|| AMF|| MAC

Authentication vector: AV = RAND|| XRES ||CK || IK || AUTN

SecurityofWirelessNetworks,AS2010

UserAuthen?ca?onFunc?onsinUSIM

USIM: User Services Identity Module

f1 f2 f3 f4

K

XMAC (Expected MAC)

RES (Result)

CK (Cipher

Key)

IK (Integrity

Key)

f5

RAND

AK

SQN

AMF MAC

AUTN

•  Verify MAC = XMAC •  Verify that SQN is in the correct range

SecurityofWirelessNetworks,AS2010

MoreAboutAuthen?ca?onandKeyGenera?on

Inaddi?ontof1,f2,f3,f4andf5,twomorefunc?onsaredefined:f1*andf5*,usedincasetheauthen?ca?onproceduregetsdesynchronized(detectedbytherangeofSQN).

f1,f1*,f2,f3,f4,f5andf5*areoperator-specificHowever,3GPPprovidesadetailedexampleofalgorithmset,calledMILENAGE

MILENAGEisbasedontheRijndaelblockcipherInMILENAGE,thegenera?onofallsevenfunc?onsf1…f5*isbasedontheRijndaelalgorithm

SecurityofWirelessNetworks,AS2010

Authen?ca?onandKeyGenera?on Func?ons(f1...f5*)

rotate by r4

OPc

c4

EK

OPc

rotate by r2

OPc

c2

EK

OPc

rotate by r3

OPc

c3

EK

OPc

rotate by r5

OPc

c5

EK

OPc

rotate by r1

OPc

c1

EK

OPc

EK

SQN||AMF OPc EK OP OPc

f1 f1* f5 f2 f3 f4 f5*

RAND

OP: operator-specific parameter r1,…, r5: fixed rotation constants c1,…, c5: fixed addition constants

EK : Rijndael block cipher with 128 bits text input and 128 bits key

SecurityofWirelessNetworks,AS2010

SignalingIntegrityProtec?on

f9

MAC-I

IK

SIGNALLING MESSAGE

COUNT-I

FRESH

DIRECTION

Sender (Mobile Station or

Radio Network Controller)

f9

XMAC-I

IK

SIGNALLING MESSAGE

COUNT-I

FRESH

DIRECTION

Receiver (Radio Network Controller

or Mobile Station)

FRESH: random input

SecurityofWirelessNetworks,AS2010

f9integrityfunc?on

COUNT || FRESH || MESSAGE ||DIRECTION||1|| 0…0

KASUMI IK KASUMI IK KASUMI IK KASUMI IK

KASUMI IK KM

PS0 PS1 PS2 PSBLOCKS-1

MAC-I (left 32-bits)

•  KASUMI: block cipher (64 bits input, 64 bits output; key: 128 bits) •  PS: Padded String •  KM: Key Modifier

SecurityofWirelessNetworks,AS2010

Encryp?on

48

f8

KEYSTREAM BLOCK

CK

BEARER

COUNT-C

LENGTH

DIRECTION

PLAINTEXT BLOCK

f8

KEYSTREAM BLOCK

CK

BEARER

COUNT-C

LENGTH

DIRECTION

PLAINTEXT BLOCK

CIPHERTEXT BLOCK

Sender (Mobile Station or

Radio Network Controller)

Receiver (Radio Network Controller

or Mobile Station)

BEARER: radio bearer identifier COUNT-C: ciphering sequence counter

SecurityofWirelessNetworks,AS2010

f8keystreamgenerator

KASUMI KASUMI KASUMI KASUMI KASUMI CK KASUMI CK KASUMI CK KASUMI CK

KASUMI CK KM

KS[0]…KS[63]

Register

KS[64]…KS[127] KS[128]…KS[191]

BLKCNT=0 BLKCNT=1 BLKCNT=2 BLKCNT=BLOCKS-1

COUNT || BEARER || DIRECTION || 0…0 KM: Key Modifier KS: Keystream

SecurityofWirelessNetworks,AS2010

ConclusiononUMTSSecurity

Someimprovementwithrespectto2ndgenera?onCryptographicalgorithmsarepublishedIntegrityofthesignalingmessagesisprotectedQuiteconserva?vesolu?on2nd/3rdgeneraIoninteroperaIonwillbecomplicatedandmightopensecuritybreachesAllthatcanhappentoafixedhostaTachedtotheInternetcouldhappentoa3GterminalPrivacy/anonymityoftheusernotcompletelyprotected:IMSIissentincleartextwhentheuserisregisteringforthefirst?meintheservingnetwork(trustedthirdpartycanbeasolu?on)Ausercanbeen?cedtocamponafalseBS.OncetheusercampsontheradiochannelsofafalseBS,theuserisoutofreachofthepagingsignalsofSNHijackingoutgoing/incomingcallsinnetworkswithdisabledencryp?onispossible.Theintruderposesasaman-in-the-middleanddropstheuseroncethecallisset-up

SecurityofWirelessNetworks,AS2010

OtherTopics

• DoSa`acks,SMSsecurity,...• Reference:

P.Traynor,P.McDanielandT.LaPorta,SecurityforTelecommunicaIonsNetworks.Springer,Series:AdvancesinInformaIonSecurity,August,2008.ISBN:978-0-387-72441-6.) FreelyavailableviatheETHlibrary(Springer)

• ModernMobilePhoneSystemSecurity(Android/iOS/Symbian,...)

SecurityofWirelessNetworks,AS2010

SS7security

https://www.sans.org/reading-room/whitepapers/critical/fall-ss7--critical-security-controls-help-36225

SecurityofWirelessNetworks,AS2010

SS7security