LTEInspector A Systematic Approach for Adversarial Testing of
- Slides: 37
LTEInspector: A Systematic Approach for Adversarial Testing of 4 G LTE Syed Rafiul Hussain*, Omar Chowdhury†, Shagufta Mehnaz*, Elisa Bertino* Purdue University*, University of Iowa†
Critical Infrastructure using Cellular Network 2
Security and Privacy Threats on Cellular Network IMSI = International Mobile Subscriber Identity No Service 3
Limitations of Existing Attack Finding Strategies for Cellular Networks No Systematic Approach No adversary, just analyze the performance, and reliability q Is it possible to build a Systematic framework for adversarially analyzing the cellular network specification in order to find security and privacy related problems? 4
Scope Attach Detach Paging Man-in-the-Middle Attacker SMS Vo. LTE Handover Spurious billing Life threatening risks
1 Challenges Preliminaries 2 3 LTEInspector 4 Findings & Attack Validation 5 Responsible Disclosure and Impact 6 Conclusion Future Work 7 6
Challenges q Stateful procedures and multiple participants q 4 G LTE lacks formal specification üwritten in natural language q Closed system üProprietary q Legal barrier üLicensed spectrum 7
1 Challenges Preliminaries 2 3 LTEInspector 4 Findings & Attack Validation 5 Responsible Disclosure and Impact 6 Conclusion Future Work 7 8
Background: LTE Architecture Evolved Packet Core (EPC) HSS e. Node. B UE PCR F MME e. Node. B SGW PGW e. Node. B Internet
Background (Attach) Identification Authentication Security algorithm negotiation e. Node B UE TMSI Exchange Core Network Connection Setup Attach Request (IMSI/IMEI, UE’s Security Capabilities) Select Security Algorithm (LTE: Security Mode Command) Challenge (LTE: Authentication Request) Network accepts the attach and allocates temporary identity (LTE: Attach Accept) Confirm Attach and new temporary identity(LTE: Attach Complete) Response (LTE: Authentication Response) Confirm Security Algorithm (LTE: Security Mode Complete) 10
Background (Paging & Detach) UE e. Node B MME paging_request Paging detach_request detach_accept 11
1 Challenges Preliminaries 2 3 LTEInspector 4 Findings & Attack Validation 5 Responsible Disclosure and Impact 6 Conclusion Future Work 7 12
Adversary Model q Dolev-Yao model Ø Eavesdrop Ø Drop or modify Ø Inject Ø Adheres to cryptographic assumptions q Why Dolev-Yao model? Ø Powerful adversary Ø Automatic tools (Pro. Verif, Tamarin) can leverage 13
Insight q Property characteristics § Temporal ordering of events § Cryptographic constructs § Linear integer arithmetic and other predicates q Intuition: ü Model checker ü Cryptographic protocol verifier temporal trace property & Linear integer arithmetic Cryptographic Constructs How can we leverage reasoning power of these two? 14
LTEInspector UE state machine Adversarial model Core network state machine Crypto. protocol verifier Testbed Attacks Domain knowledge Threat instrumented abstract LTE ecosystem model Model checker Counterexample Desired properties from standard
Abstract LTE Model 6 2 Standard UE disconnected 4 q Specification Model for NAS layer (UE-MME) interactions § Propositional logic level § Model message types only, not message data § Abstract away cryptographic constructs § Two unidirectional channels UE waits for auth_request 1 MME disconnected 3 UE authenticates MME 5 5 MME waits for auth_response 1 8 3 2 9 7 4 MME authenticates UE 6 16
Adversarial Model Instrumentor attach_request Dolev Yao Attacker adversary_turn auth_response sec_mode_command attach_complete UE auth_request sec_mode_command attach_accept MME paging_request 17
Model Checker q Temporal trace properties Ø Liveness – something good eventually happens Ø Safety – nothing bad happens Victim UE MME q Nu. SMV 6 attach_request authentication_reject 2 UE disconnected 4 UE UE waits for waits auth_request 1 7 8 UE authenticates MME 5 Emergency calls only 9 3 18
Cryptographic Protocol Verifier q Injective-correspondence (authentication) Every authentication_reject message received by UE must be sent by the core network q Pro. Verif § Secrecy § Authenticity § Observational equivalence 19
Testbed Validation q Malicious e. Node. B setup (USRP, Open. LTE, srs. LTE) q Malicious UE setup (USRP, srs. UE) q COTS smartphones q SIM cards of four major US carriers q Custom-built core network q. USRP, Open. LTE, srs. LTE, and USIM 20
1 Challenges Preliminaries 2 3 LTEInspector Findings & Attack Validation 4 5 Responsible Disclosure and Impact 6 Conclusion Future Work 7 21
Findings q Uncovered 10 new attacks Attack Procedures Responsible Notable Impacts Auth Sync. Failure Attach 3 GPP Do. S Traceability Attach carriers Coarse-grained location tracking Numb using auth_reject Attach 3 GPP, smartphones Do. S Authentication relay Attach 3 GPP Location spoofing Paging Channel Hijacking Paging 3 GPP Do. S Stealthy Kicking-off Paging 3 GPP Do. S, coarse-grained location tracking Panic Paging 3 GPP Artificial chaos for terrorist activity Energy Depletion Paging 3 GPP Battery depletion/Do. S Linkability Paging 3 GPP Coarse-grained location tracking Targeted/Non-targeted Detach 3 GPP Do. S q Identified 9 prior attacks: IMSI-catching, Do. S, Linkability, Mit. M in 3 G and 2 G, etc. 22
Authentication Synchronization Failure Attack q. Assumption: Ø Victim UE’s IMSI Ø Malicious UE setup Malicious UE Victim UE Core Network attach_request (IMSI) …. attach_request (MSI) UE and CN sequence numbers get desynchronized 23
Panic Attack ( g n W T E S) i g a p paging (ETWS) 24
Attack Chaining (Authentication Relay or Mafia Attack) Indiana Connected Authentication_response Authentication_request Attach_request NID Authentication_response Attach_request Authentication_re Authentication Attach_request sponse _request Indiana California 25
1 Challenges Preliminaries 2 3 LTEInspector Findings & Attack Validation 4 Responsible Disclosure and Impact 5 6 Conclusion Future Work 7 26
Responsible Disclosure and Impacts q Mobile network operators q Resolved the issue of using EEA 0 (no encryption) q Other issues are in progress 27
1 Challenges Preliminaries 2 3 LTEInspector Findings & Attack Validation 4 Responsible Disclosure and Impact 5 6 Conclusion Future Work 7 28
Future Work UE 1 MME NAS RRC 2 e. Node. B RRC RRC PCCH-Message : : = SEQUENCE +-message : : = CHOICE [c 1] +-c 1 : : = CHOICE [paging] +-paging : : = SEQUENCE [0110] +-paging. Record. List : : = SEQUENCE OF OPTIONAL: Omit +-system. Info. Modification : : = ENUMERATED [true] OPTIONAL: Exist +-etws-Indication : : = ENUMERATED [true] OPTIONAL: Exist +-non. Critical. Extension : : = SEQUENCE OPTIONAL: Omit 3 29
1 Challenges Preliminaries 2 3 LTEInspector Findings & Attack Validation 4 Responsible Disclosure and Impact 5 6 Conclusion Future Work 7 30
Conclusion Proposed a systematic approach for analyzing the specification Uncovered 10 new attacks and 9 prior attacks Validated most of the attacks in a testbed https: //github. com/relentless-warrior/LTEInspector 31
Questions 32
LTEInspector: A Systematic Approach for Adversarial Testing of 4 G LTE Syed Rafiul Hussain*, Omar Chowdhury†, Shagufta Mehnaz*, Elisa Bertino* Purdue University*, University of Iowa†
Cryptographic Protocol Verifier q Injective-correspondence (authentication) Every authentication_reject message received by UE must be sent by the core network q Pro. Verif § Secrecy § Authenticity § Observational equivalence (hyper-properties) q Why not Pro. Verif only? § Rich temporal trace properties § Constraints on linear integer arithmetic 34
Traceability attack q. Assumption: Ø Victim UE’s IMSI Ø Malicious UE setup Ø secutity_mode_command attach_request …. security_mode_command (MAC, nonce) security_mode_command security_mode_reject security_mode_command attach_complete …. security_mode_complete 35
Numb Attack q. Assumption: malicious e. Node. B setup • Learn from System. Information. Block messages authentication_reject NID Connected tracking_area_update_request Emergency calls only
Background (Attach) Identification Authentication Security algorithm negotiation e. Node B UE TMSI Exchange MME Connection Setup Attach Request (IMSI/IMEI, UE’s Security Capabilities) Select Security Algorithm (LTE: Security Mode Command) Challenge (LTE: Authentication Request) Network accepts the attach and allocates temporary identity (LTE: Attach Accept) Confirm Attach and new temporary identity(LTE: Attach Complete) Response (LTE: Authentication Response) Confirm Security Algorithm (LTE: Security Mode Complete) Time 37
