0% found this document useful (0 votes)

144 views102 pages

Toward The HLR, Attacking The SS7 & SIGTRAN Applications.: Telecommunications Infrastructure Security

The document discusses security issues related to Signaling System 7 (SS7) and SIGTRAN protocols used in telecommunications networks. It provides an overview of SS7 architecture and components, describes reliability features of SS7, and covers important SS7 protocols like ISUP, SCCP, TCAP, and MAP. It also discusses the SIGTRAN evolution to transport SS7 over IP using protocols like Stream Control Transmission Protocol (SCTP). Potential entry points for attacks on SS7 networks are identified.

Uploaded by

Oscar Daza

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

144 views102 pages

Toward The HLR, Attacking The SS7 & SIGTRAN Applications.: Telecommunications Infrastructure Security

Uploaded by

Oscar Daza

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 102

Telecommunications Infrastructure Security

Toward the HLR, attacking the SS7 &

SIGTRAN applications.
one step further and mapping the phone system.

Philippe Langlois, P1 Security Inc.

[email protected]
SS7 Basics
Introduction to SS7 in the Phone System

P1 Security Inc, http://www.p1security.com

Why do we have SS7?

• Thanks to hackers!
Steve Jobs and Steve Wozniak in 1975 with a bluebox
• CCITT#5 in-band signalling sends control messages
over the speech channel, allowing trunks to be
controlled
• Seize trunk (2600) / KP1 or KP2 / destination / ST
• Started in mid-60’s, became popular after Esquire 1971
• Sounds produced by whistles, electronics dialers,
computer programs, recorded tones
P1 Security Inc, http://www.p1security.com 3
SS7 basic architecture

Text

 HLR/VLR Home Location Register, Visitor Location Register

 AuC : Authentication Center (within HLR)
 EIR : Equipment Identity Register
 MSC : Mobile Switching Center
 STP : Signaling Transfer Point (i.e. Router)
P1 Security Inc, http://www.p1security.com
SS7 network

P1 Security Inc, http://www.p1security.com

Main focus: reliability
To meet the stringent reliability requirements of public
telecommunications networks, a number of safeguards
are built into the SS7 protocol:

 STPs and SCPs are normally provisioned in mated pairs.

On the failure of individual components, this duplication
allows signaling traffic to be automatically diverted to an
alternate resource, minimizing the impact on service.
 Signaling links are provisioned with some level of
redundancy. Signaling traffic is automatically diverted to
alternate links in the case of link failures.
 The SS7 protocol has built-in error recovery mechanisms
to ensure reliable transfer of signaling messages in the
event of a network failure.
 Management messages (Link Status Signal Units) are
constantly sent over the links to monitor its status.

P1 Security Inc, http://www.p1security.com

Under the hood: SS7 stack

P1 Security Inc, http://www.p1security.com

Important SS7 protocols
 MTP (Message Transfer Part) Layers 1-3: lower level functionality at the
Physical, Data Link and Network Level. They serve as a signaling transfer
point, and support multiple congestion priority, message discrimination,
distribution and routing.
 ISUP (Integrated Services Digital Network User Part): network side protocol
for the signaling functions required to support voice, data, text and video
services in ISDN. ISUP supports the call control function for the control of
analog or digital circuit switched network connections carrying voice or
data traffic.
 SCCP (Signaling Control Connection Part): supports higher protocol layers
such as TCAP with an array of data transfer services including connection-
less and connection oriented services. SCCP supports global title
translation (routing based on directory number or application title rather
than point codes), and ensures reliable data transfer independent of the
underlying hardware.
 TCAP (Transaction Capabilities Application Part): provides the signaling
function for communication with network databases. TCAP provides non-
circuit transaction based information exchange between network entities.
 MAP (Mobile Application Part): provides inter-system connectivity between
wireless systems, and was specifically developed as part of the GSM
standard.
 INAP (Intelligent Network Application Part): runs on top of TCAP and
provides high-level services interacting with SSP, SCP and SDP in an SS7
network.
P1 Security Inc, http://www.p1security.com
MSU: Message Signal Unit

Scanning Vulnerability,
injection

P1 Security Inc, http://www.p1security.com

Entry points in an SS7
 Peer relationships between operators
 STP connectivity
 SIGTRAN protocols
 VAS systems e.g. SMSC, IN
 Signalling Gateways, MGW
 SS7 Service providers (GRX, IPX)
 GTT translation
 ISDN terminals
 GSM phones
 LIG (pentest & message relaying madness)
 3G Femtocell
 SIP encapsulation
P1 Security Inc, http://www.p1security.com
SS7 and IP: the SIGTRAN
evolution and problems
Basics of IP telephony
SIGTRAN protocols & SCTP scanning

P1 Security Inc, http://www.p1security.com

SIGTRAN network

P1 Security Inc, http://www.p1security.com

SIGTRAN evolution
 The SIGTRAN protocols specify the means by which
SS7 messages can be reliably transported over IP
networks (with SCTP).
 The architecture identifies two components: a
common transport protocol for the SS7 protocol
layer being carried and an adaptation module to
emulate lower layers of the protocol. For example:
 If the native protocol is MTP (Message Transport Layer) Level
3, the SIGTRAN protocols provide the equivalent
functionality of MTP Level 2.
 If the native protocol is ISUP or SCCP, the SIGTRAN protocols
provide the same functionality as MTP Levels 2 and 3.
 If the native protocol is TCAP, the SIGTRAN protocols
provide the functionality of SCCP (connectionless classes)
and MTP Levels 2 and 3.

P1 Security Inc, http://www.p1security.com

SCTP Specs & Advantages

 RFC4960
 SCTP: Stream Control Transmission
Protocol
 Advantages
 Multi-homing
 DoS resilient (4-way handshake, cookie)
 Multi-stream
 Reliable datagram mode
 Some of TCP & UDP, improved
P1 Security Inc, http://www.p1security.com 14
SCTP association
Client Server
socket(), connect() socket(), bind(), listen(),
accept()

P1 Security Inc, http://www.p1security.com 15

SCTP association
Client Server
socket(), connect() socket(), bind(), listen(),
accept()

INIT

P1 Security Inc, http://www.p1security.com 15

SCTP association
Client Server
socket(), connect() socket(), bind(), listen(),
accept()

INIT

INIT-ACK

P1 Security Inc, http://www.p1security.com 15

SCTP association
Client Server
socket(), connect() socket(), bind(), listen(),
accept()

INIT

Not TCP:
INIT-ACK
4 way
handshake

P1 Security Inc, http://www.p1security.com 15

SCTP association
Client Server
socket(), connect() socket(), bind(), listen(),
accept()

INIT

Not TCP:
INIT-ACK
4 way
handshake

COOKIE-ECHO

P1 Security Inc, http://www.p1security.com 15

SCTP association
Client Server
socket(), connect() socket(), bind(), listen(),
accept()

INIT

Not TCP:
INIT-ACK
4 way
handshake

COOKIE-ECHO

COOKIE-ACK

P1 Security Inc, http://www.p1security.com 15

SCTP Packets
SCTP packet Format (ascii art straight from RFC4960)

0 1 2 3

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

| Common Header |

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

| Chunk #1 |

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

| ... |

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

| Chunk #n |

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

P1 Security Inc, http://www.p1security.com 16

SCTP Chunk types
ID Value Chunk Type

----- ----------

0 - Payload Data (DATA)

1 - Initiation (INIT)

2 - Initiation Acknowledgement (INIT ACK)

3 - Selective Acknowledgement (SACK)

4 - Heartbeat Request (HEARTBEAT)

5 - Heartbeat Acknowledgement (HEARTBEAT ACK)

6 - Abort (ABORT)

7 - Shutdown (SHUTDOWN)

8 - Shutdown Acknowledgement (SHUTDOWN ACK)

9 - Operation Error (ERROR)

10 - State Cookie (COOKIE ECHO)

11 - Cookie Acknowledgement (COOKIE ACK)

12 - Reserved for Explicit Congestion Notification Echo (ECNE)

13 - Reserved for Congestion Window Reduced (CWR)

14 - Shutdown Complete (SHUTDOWN COMPLETE)

P1 Security Inc, http://www.p1security.com 17

SCTP Header
 SCTP Common Header Format

0 1 2 3

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

| Source Port Number | Destination Port Number |

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

| Verification Tag |

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

| Checksum |

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

P1 Security Inc, http://www.p1security.com 18

SCTPscan: Mapping SIGTRAN

 SCTPscan
 Linux, BSD, MacOS X, Solaris, ...
 IP scan, portscan, fuzzing, dummy server,
bridge
 Included in BackTrack
 SCTP Tricks: port mirroring, instreams
connections
 NMAP new SCTP support (-Y), lacks tricks
 SIGTRAN usually requires peer config
 This is not the average TCP/IP app
P1 Security Inc, http://www.p1security.com 19
From RFC...
Attacker Servers

P1 Security Inc, http://www.p1security.com 20

From RFC...
Attacker Servers

INIT

P1 Security Inc, http://www.p1security.com 20

From RFC...
Attacker Servers

INIT

Port 100

P1 Security Inc, http://www.p1security.com 20

From RFC...
Attacker Servers

INIT

INIT Port 100

P1 Security Inc, http://www.p1security.com 20

From RFC...
Attacker Servers

INIT

INIT Port 100

Port 101

P1 Security Inc, http://www.p1security.com 20

From RFC...
Attacker Servers

INIT

INIT Port 100

Port 101
INIT

P1 Security Inc, http://www.p1security.com 20

From RFC...
Attacker Servers

INIT

INIT Port 100

Port 101
INIT

INIT-ACK

P1 Security Inc, http://www.p1security.com 20

From RFC...
Attacker Servers

INIT

INIT Port 100

Port 101
INIT

Port 102
INIT-ACK

P1 Security Inc, http://www.p1security.com 20

From RFC...
Attacker Servers

INIT

INIT Port 100

Port 101
INIT

Port 102
INIT-ACK

Closed? Packet loss? Delay? Re-xmit?

P1 Security Inc, http://www.p1security.com 20
Improved SCTPscan: stealth scan
Attacker Servers