How to hack a telecom and stay alive
•
10 likes•6,816 views
How to hack a telecom and stay alive Speaker: Sergey Gordeychik Penetration testing of telecommunication companies' networks is one of the most complicated and interesting tasks of this kind. Millions of IPs, thousands of nodes, hundreds of Web servers and only one spare month. What challenges are waiting for an auditor during the telecom network testing? What to pay attention on? How to use the working time more effectively? Why is the subscriber more dangerous than hacker? Why is contractor more dangerous than subscriber? How to connect vulnerability with financial losses? Sergey Gordeychik will tell about it and the most significant and funny cases of penetration testing of telecommunication networks in his report.
Report
Share
How to hack a telecom and stay alive
- 1. How to Hack a Telecommunication Company And Stay Alive Sergey Gordeychik Positive Technologies CTO
- 2. Ic Beo Sergey Gordeychik, Positive Technologies, CTO A “script writer” and a “director” of the Positive Hack Days forum Science editor of the SecurityLab.Ru portal Author of the Web Application Security course, and a book titled A Wireless Network Security and a namesake course A participant of WASC, RISSPA http://sgordey.blogspot.com
- 3. What Is It All About? What is so peculiar about telecoms? Attacks against subscribers/Attacks by subscribers Perimeter… Just a perimeter Partners and contractors Technology networks
- 5. Specific Features of Telecommunication Companies Large, large networks Unification of various services (broadband access, Wi-Fi, hosting, mobile communication) Great number of applications and systems on the perimeter Exotics inside and outside Lots of perimeters Most networks belong to third parties Forensics nightmare
- 6. How many perimeters do telecoms have? Internet Subscribers Partners Office Technology network
- 7. …and a bit more… Mobile communications Broadband Technological access network Wired broadband access Wireless broadband access VOIP Hosting Internet TV Hosting ...
- 8. …and a bit more… Vladivostok Moscow Roma Phnom Penh
- 9. Attack AGAINST Subscribers
- 10. Why Subscribers? Subscribers’ $ = telecoms’ $ DOS = - $$ - reputation - $$ PWN (100 000 PC) = Botnet Personal data!
- 11. Broadband Access Huge non-segmented networks Great number of end devices: • Various SOHO devices • Installed and unattended • Standard bugs configurations A manual on insecurity of network appliances SNMP/Telnet/HTTP/UPnP control protocols in the Internet Insecure/empty passwords Web attacks on Client’s side (Pinning, CSRF) Huge number of users • 1 out of1000, for 10 000 000 = 10 000 • Trivial passwords
- 12. Broadband Access. Attack Collecting information • Network scanning • Access layer error (BRAS) • Collecting information from internal forums and other resources • Self-service platform errors Invalid login or password vs Invalid username Preparing scenarios • Capturing devices • Guessing passwords $profit$
- 14. Pick a Task…
- 15. Examples of Risks Gaining access to a self-service portal • Cashout guessing password or stealing the router cfg files (vpn/pppoe) transferring money from a broadband access to a cell phone (integration!) Cashing out via PRS • It drives me NUTS!!! Guessing password or stealing the router cfg files (vpn/ppoe) Purchasing the available Balance =0 Performing a mass hacking of a router/PC Performing a mass changing of configurations
- 16. Attacks against Clients of Mobile Networks Faking Caller ID •self-service portal/USSD •voice mailbox •cash-out via PRS •direct money withdrawal Internet SS7 Taget GSM SIP-GW Tech FAKE ID Systems unauthorized access
- 17. Attacks against Clients of Mobile Networks Malware for mobile devices; Intercepting GSM – Not a ROCKET SCIENCE! • attacking A5/1 • MITM, switch to A5/0 • downgrading UMTS -> GSM Traffic, SMS, one-time passwords... • Self-service portals/USSD • Cash-out via PRS • Voice mailbox
- 18. Hosting Local network for collocated/dedicated servers • Attacks of a network/data link layer, attacks against network infrastructure • ARP Spoofing, IP Spoofing… old school • Intrasegment IPv6 attacks Attack against infrastructure (DNS…) Shared hosting (once having intruded into one of the sites…)
- 19. Pentester Tips & Tricks || ||
- 20. Pentester Tips & Tricks We are only searching for vulnerabilities We use only our own resources for demonstration We avoid information protected by the law A fickle client… C: Prove it! Enter the portal! P: No, thank you. Here is a password – enter it yourself…
- 22. Why Subscribers? AGAIN? Subscribers are WITHIN one of the perimeters Many attacks are easier if performed on subscriber’s side The number of subscribers of modern telecoms is quite large
- 23. General Problems Network access control weakness Intrasegment attacks Protection of the end equipment Web applications for subscribers
- 24. Network Access Control Errors A direct way does not always mean the most interesting one :) C:>tracert -d www.ru Tracing route to www.ru [194.87.0.50] over a maximum of 30 hops: 1 * * * Request timed out. 3 10 ms 13 ms 5 ms 192.168.5.4 4 7 ms 6 ms 5 ms 192.168.4.6
- 25. Per Aspera Ad…level 15 #sh run Using 10994 out of 155640 bytes ! version 12.3 ... ! username test1 password 7 <removed> username antipov password 7 <removed> username gordey password 7 <removed> username anisimov password 7 <removed> username petkov password 7 <removed> username mitnik password 7 <removed> username jeremiah password 7 <removed>
- 26. Network Access Control Errors GPRS/EDGE/3G, which traditionally stick to NAT Other clients are “invisible” This is not always true… GPRS: payment kiosks, ATMs, and etc., which can have: • A missing firewall; • Missing updates; • misconfigurations.
- 27. A Joke SNMP ‘private’ on a GGSN
- 28. A Joke Captive portal “Your balance is low” •Linux •Apache •MySQL •PHP
- 29. Intrasegment Attacks Subscribers of broadcast access and hosting
- 30. Web Portals and Services for Subscribers A good few of resources • forums, dating sites, video convertors, online games, statistics, online shopping, photo hosting, file hosting, online radio… A good few of loopholes • Old versions of applications and CMS, SQLi, LFI and so on… Single-Sign-On or the same passwords… Are often placed into the DMZ together with “ordinary” servers
- 31. Web Portals and Servers for Subscribers Games server* Proxima CMS, path traversal + SQLi + configuration error= root About 20 more sites on the host • Online broadcasting • Branded desktop applications •…
- 32. Pentester Tips & Tricks Resources on the subscriber networks are often SUBSCRIBER’s resources Getting approvals for every step of your work Many systems operate on a wing and a prayer They collapse all the time, but if you are online anyway… Avoiding (!) information protected by the law A fickle client…
- 34. Perimeter? Large, large networks! •Use clouds Great number of “third-party” resources Get ready for rarities Corporate web applications The Lord of The Net
- 35. Great Number of Third-Party Resources Quite a large number of perimeter hosts belong to partners/subscribers Quite often these hosts are “mixed” with those of the client Yet, they should not be disregarded • Imagine that you are already a level 15/root/admin on the host and you just entered the segment
- 36. Great Number of Third-Party Resources SQLi on the mobile content portal (Oracle, sys) private at the VoIP gateway Maintained by partners No hacking Are actually located at a flat DMZ together with client’s servers Enabling the billing Front-End
- 37. Rarities So many different things can be found on the perimeter • Technology “hardware” • VoIP • Old-school firewalls • Web cameras •Unusual control systems: ELOM, conditioners (!), UPS (!), etc. Keep in mind the momentous attacks (X-mas scan, UNIX RPC, Finger, and etc.) Don’t underrate the rarities
- 38. Rarities nc –P 20 xxx.xxx.xxx.xxx 8080 Wireless Access Point • Insecure password for web • Enabling Telnet • Compiling tcpdump/nc and others for the platform • Using them for traffic/tunnel interception Web camera • LFI via a web interface • Obtaining configuration files • Gaining an access password for the control system • Gaining access to the control system
- 41. Cobweb Lots of Web. For real. Enterprise web applications are often accessible • Terminal services (Citrix) • Email systems • Helpdesk systems • Ill-equipped for operating on the “wild web”
- 42. Support system We found and applied Path Traversal ManageEngine ServiceDesk Plus Gained the “encrypted” password for integration with AD The password fitted for VPN The password fitted for AD (Enterprise Admin) The password fitted for Cisco ACS So we finally got lucky!
- 43. VPN Lots of VPN, good and not so good Passwords, IPSec Aggressive Mode…
- 44. The Lords of the Net Administrator, the Lord of the Net A large network means many administrators Feudalism • Rules are for wimps • Enterprise IT infrastructure VS “my infrastructure” • Remote access systems • Amusing web servers and trail apps
- 45. “All animals are equal but…”
- 46. The Lords of the Rings TCP:1337 (SSL) – a web server of the system administration department Radio broadcasting (ShoutCast Server with a default password) Location: an administrator workstation With all the consequences…
- 47. Pentester Tips & Tricks Try not to miss a thing on the perimeter Keep in mind third-party hosts Get approvals for every step of your work Don’t disregard network rarities. Sometimes a web camera can pave the way to the network core! Pay special attention to Web Remember admins
- 49. Contractors? Requirements for system access (VPN) Standard accounts (in order to remember) No update management Employees
- 50. Contractors… Contractor in the technology network • Wireless interface on a laptop • Everyone, a shared folder • The folder contains an installer of a control system for xDSL modems/end routers • With an in-built SA password in DBMS • Who also has the same system? Applications for agents, sale and activation of communication services package • Fat-client application • Build-in access password for DBMS • … as SYSDBA
- 51. There Are Different Contractors... OMG?! HAVE I PWND THAT?
- 52. Pentester Tips & Tricks Contractors are never to be hacked Get approvals for every step of your work Many scenarios can be efficiently demonstrated by a “white box” method Suppose, I were a contractor But you are not a contractor …A fickle client…
- 54. Something special? Changes are highly dynamic in the network • New gadgets keep emerging • Contractors keep working • Configuration keeps changing Implemented components and protocols are standard • Threats typical for IP • Configuration errors • Platform vulnerabilities Some errors can cause failures and facilitate frauds
- 55. Technology Networks Are Networks First of All! Equipment vulnerabilities Test systems, contractors’ systems FORGOTTEN(!) systems Network management systems
- 56. Forgotten Systems Non-configured switch Uptime: 2 years!
- 57. Network Management Systems Such treasure •Network topology •Device configuration •Passwords and keys for VPN/Wi-Fi/SNMP/RADIUS/VPN… “They are behind the firewall” + Web password - OS, DBMS, Web updates + Standard passwords for DBMS + File(!) shares
- 58. That’s Tough! WPA-PSK for AP is found Where are the points located?!!
- 59. Backup Is Quite a Useful Thing! Especially on the Net!
- 60. VoIP Is a Honey Pie Call management Identity theft (fraud) Access to the enterprise network VoIP Attack against… Fraud or fraudulent infrastructure mispresentation gateways protocols i[P]Phone Wiretapping And more…
- 61. VoIP 1. VoIP Wi-Fi access (No WPA, so “slow”) 2. The nearest CISCO Call Manager a) SQLi, CVE-2008-0026 https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+SELECT+'','','',user,'',password+from+app licationuser;-- b) Collecting hash runsql select user,password from applicationuser c) Restoring passwords from the hash Компьютер нарушителя 3. Level 15 for the whole network 1 WEP ТОП ТОП 2 КЛВС Вне офиса Компании «А» PSTN IP PBX Компания «А» 3 SQL injection CVE-2008-0026
- 62. Mobile Networks – It’s So Banal Only the perimeter is secure Some weird hardware? • 3G SoftSwitch – Solaris 10 с CVE-2007-0882 (telnet -f) •…
- 63. Self-Service Platform WEB/USSD/WAP Interface with payment systems A possibility of money withdrawal No authentication (Caller ID) Weak authentication (PIN-код?) Vulnerable applications (Web, SQL Injection, XSS)
- 64. VAS platforms Someone’s application on the operator’s network Malicious content, WAP-provisioning Rich access via mobile stations (WAP/HTTP): • Web application vulnerabilities • Platform vulnerabilities Platforms for service development
- 65. Instead of a Conclusion
- 66. Forensic Nightmare Large networks make it extremely difficult to investigate incidents Lots of vectors, tons of hardware, a great deal of administrators A couple of hops on the internal network, and no one will make head or tail of it
- 67. Who is there?
- 68. Trying To Make Head or Tail…
- 70. Others Are Happy
- 71. Thank you for your attention! Sergey Gordeychik gordey@ptsecurity.com http://sgordey.blogspot.com http://ptresearch.blogspot.com http://phdays.com