OHM2013: Rooting the HLRs: Mobile and critical infrastructure insecurity

Описание: For more information visit: http://bit.ly/OHM13_web
To download the video visit: http://bit.ly/OHM13_down
Playlist OHM 2013: http://bit.ly/OHM13_pl

Speaker: Philippe Langlois

Nothing's wrong with Telecom Security? No, not according to vendors, not according to some operators. Why? Because most of them benefit from the relative absence of awareness of its actual lack of security. SS7 is totally unauthenticated. Even Diameter, which is recent, doesn't show much in term of message authentication. Supporting systems are unpatched and using default. Telecom applications are developed without security in mind. Telecom protocol stacks are largely untested, or just at the IP level - and that applies even to the super recent S1 and X2 LTE EPC stacks from most of the vendor. IPsec is used as snake oil "patch all" remedy, which in reality is not really helping. Message reach and depth into the network shows how unadequate the security model is, enabling many peers to crash HLRs, HSSes, MMEs and MSCs. ATCA based systems make it even more hackable, from monolithic legacy stacks to now recent but outdated Linux distributions. There's something wrong in this domain.
One of the reason is the lack of expertise and the obscurity about security information from the vendor. How can we get away from this status quo?
We'll talk about professional disclosure on security vulnerability in Core Network elements, in billing systems, in Network Management Systems and OSS. We'll see how Vulnerability knowledge is key for operators, governments AND for vendors. We will also investigate the practical consequences of Telecom Security regulation from India Department of Telecommunications (DOT/TRAI) and see how this can go further. We will also speak about the emerging role of TCERT (Telecom CERT) compared to 3GPP SA3 and GSMA Security Group.