Diameter Security: An Auditor's Viewpoint

Abstract

In this paper we share our experience in conducting security audits for several different mobile network operators and discuss the difficulties encountered in the process. We also describe successful attacks performed by us on Diameter equipment in these environments. Some of these attacks have not been published previously.

Mobile Subscriber Profile DataPrivacy Breach via 4GDiameter Interconnection

“…• Location tracking [20] • Denial of Service [21] • SMS interception [22] There is a constant evolution and fine tuning of those attacks ongoing e.g. in [28] and [29] many of the above attacks were refined and the Insert Subscriber Data command features exploited to modify and extract data. This article can be seen in the spirit of the further refinements and extensions of those attacks, where we will work out the details of [29].…”

“…Many of those items can be used for DoS against the user, basically changing the settings to something strange, so that the user would not have a properly working access. Since a simple DoS is possible using a Purge or Cancel Location message [21] or [28], we assume that the attacker had a more sophisticated attack in mind like changing the profile to obtain some fraud or similar things. The following items could be interesting for an attacker to modify.…”

Threat modeling framework for mobile communication systems

“…Diameter protocol, the successor of SS7 for interconnection in LTE networks, o ers be er security features than SS7. Despite that, many a acks that rely on SS7 can also be replicated using Diameter, e.g., due to improper deployment of the security features [104,122,138]. Also, SS7-based a acks can be translated into Diameter a acks using GSM-to-LTE inter-working functions [80] even if the adversary has limited knowledge of LTE networks.…”

“…Despite the odds, mobile communication systems have undergone a fair amount of scrutiny from the security research community. For example, internal components of a mobile device [71,74,101], radio communication between the phone and the cell towers [37,162], and mobile core network protocols [55,80,122] have been tested for security-critical issues. All these isolated research e orts are sca ered across underlying protocols and technologies, and, it has resulted in an obscure and complex view of mobile communication security.…”