Newer Diameter Telephony Protocol Just As Vulnerable As SS7 (bleepingcomputer.com) 31
An anonymous reader writes: Security researchers say the Diameter protocol used with today's 4G (LTE) telephony and data transfer standard is vulnerable to the same types of vulnerabilities as the older SS7 standard used with older telephony standards such as 3G, 2G, and earlier. The vulnerabilities are happening because 4G operators are misconfiguring the Diameter protocol (a SS7 replacement) and using it in the same way as SS7.
The incorrect use of Diameter leads to the presence of several vulnerabilities in 4G networks that resemble the ones found in older networks that use SS7, and which Diameter was supposed to prevent. Researchers say that the Diameter misconfigurations they've spotted inside 4G networks are in many cases unique per each network but they usually repeat themselves to have them organized in five classes of attacks: (1) subscriber information disclosure, (2) network information disclosure, (3) subscriber traffic interception, (4) fraud, and (5) denial of service. Researchers warn that not fixing these vulnerabilities "could lead to sudden failure of ATMs, payment terminals, utility meters, car alarms, and video surveillance." This is because these types of devices often use 4G SIM card modules to connect to their servers when located in a remote area where classic Internet connections are not possible. Old SS7 attacks such as tracking users' location and intercepting SMS and phone calls are also possible via Diameter as well.
The incorrect use of Diameter leads to the presence of several vulnerabilities in 4G networks that resemble the ones found in older networks that use SS7, and which Diameter was supposed to prevent. Researchers say that the Diameter misconfigurations they've spotted inside 4G networks are in many cases unique per each network but they usually repeat themselves to have them organized in five classes of attacks: (1) subscriber information disclosure, (2) network information disclosure, (3) subscriber traffic interception, (4) fraud, and (5) denial of service. Researchers warn that not fixing these vulnerabilities "could lead to sudden failure of ATMs, payment terminals, utility meters, car alarms, and video surveillance." This is because these types of devices often use 4G SIM card modules to connect to their servers when located in a remote area where classic Internet connections are not possible. Old SS7 attacks such as tracking users' location and intercepting SMS and phone calls are also possible via Diameter as well.
Why not just use HTTPS? (Score:1)
Why don't they just use a tried and true protocol like HTTPS instead of rolling their own protocol?
Re:Why not just use HTTPS? (Score:4, Informative)
Why don't they just use a tried and true protocol like HTTPS instead of rolling their own protocol?
This is in fact what Diameter does for security it uses TLS just like HTTPS.
Re: Why not just use HTTPS? (Score:4, Informative)
The summary says:
"The incorrect use of Diameter leads to the presence of several vulnerabilities in 4G networks"
That's like saying:
"The incorrect use of HTTP (such as not requiring HTTPS, or permittting weak ciphers, or not protecting sensitive APIs from the internet with a firewall) leads to the presence of several vulnerabilities in corporate networks".
In other words, it's not that the protocol itself is vulnerable, but that misconfiguration and poorly architected deployments can result in installations that are vulnerable.
Just like HTTP(S).
Re: (Score:2)
Exactly. I love it when the summary refutes the /. headline, it lets me know the editors at /. are hard at work...
Re: (Score:2)
Uh, because routing and billing for phone calls is just a wee-bit different than serving up webpages...
Do you have any earthly idea what SS7 or Diameter actually do or did you just see the word "protocol" and say to yourself, "a protocol is a protocol, they are all interchangeable, so why not use HTTP?"
Computers somehow did useful work before Tim Berners-Lee "invented" HTTP [wikipedia.org] and Linus Torvalds got frustrated with the software available to fully utilize his then-new 80386-based desktop computer and "invented
NSA and GCHQ (Score:2)
Re: (Score:3)
Let me know... (Score:2)
Re: (Score:2)
Uh, you understand the difference between in-band call routing and out-of-band call routing, right? SS7 is an out-of-band call routing system, sending tones over the voice network is an example of in-band signaling.
Re: (Score:2)
Uh, you understand the difference between in-band call routing and out-of-band call routing, right?
Yes, sweetheart, I understand the difference. That's why what I said is a joke. Or, in the common vernacular: whoosh.
Re: (Score:2)
Right, because an air-gap between the computer and the internet can be bridged by the super-secret wifi/cellular data connections inside the CPU in your system. /SMH
Explain to me how the NSA can get into a computer that is not on the internet without physically accessing (as in "laying hands on")the computer?
Re: (Score:2)
Given the human tendency to plug USB sticks into things, there's a non-zero chance that dropping a stick in the parking lot will do it. And for exfiltrating info, you have seen the stories about use of audio outside human hearing range, yes?
I'm not saying it's likely at all. But it's not impossible.
Re: Actually, we have dotation-level backdoors now (Score:2)
So, a user takes a usb they found on the ground and plugs it into an air-gapped, stand-alone computer - how does the three-letter government agency actually get their hands on the data? How does the data cross the still in-place airgap?
And transmitting data via ultrasonic audio emissions? First your computer would need to have suitable transducers built into the computer, and second the three-letter agency would need to locate a suitable sensor within earshot of the computer in question.
To the best f my kno
it only works if you do it properly (Score:3)
Diameter and SS7 are diametrically opposed (Score:3, Informative)
Diameter replaces SS7? In what universe? SS7 is a control signalling protocol used for setting up calls. Diameter is a AAA (Authentication, Authorization & Accounting) protocol that's just a supercharged Radius (Diameter = twice the Radius, get it? ha ha). No doubt you can royally screw up the AAA setup and leak like a sieve, but it's got nothing to do with SS7.
Re: (Score:2)
This is what happens when... (Score:3)
This is what happens when the guys who were in chrage of the MSCs and SS7 STPs of yore are put in charge of the Newflanged Diameter Servers and Routers of 4G and 5G
Do not get me wrong, those guys are very smart and briliant guys. But just as the Slashdot crowd would have a hell of a day trying to configure the 67 E1s of an STM-1 in order to Set up a set of SS& links, an Old School Telco switch guy would have hell undertsnading the nuances of security on Diameter...
Me, I had a feet in each camp for 5 years (1999-2004), but now I am looking from above in my (OpenStack) cloud...
Re: (Score:2)
The vulnerabilities are happening because 4G operators are misconfiguring the Diameter protocol (a SS7 replacement) and using it in the same way as SS7.
Reminds me of IPv6.
Re: I've been using Signal recently. Works well. (Score:2)
Not one of those Signal data packets wouldâ(TM)ve gone anywhere without Diameter..... go study IMS.
"Vulnerable to vulnerabilities?" (Score:2)
Editor! We need help with this patient, stat!!!
Diameter? (Score:2)
I was trying to figure out how making the cable wider would affect security in any way? Nobody actually physically taps wires anymore.