SlideShare a Scribd company logo

Probing Mobile Operator Networks - Collin Mulliner

Duo Security, profile picture
Duo Security

This document summarizes a talk given by Collin Mulliner on probing mobile operator networks. Mulliner scanned public IP addresses assigned to mobile networks to identify devices connected to these networks. His scanning identified many devices beyond just mobile phones, including vehicle tracking systems, barcode scanners, and other industrial devices. Mulliner's analysis of banner data from devices identified specific products from companies like Digicore and Intermec that were commonly present on mobile networks.

TechnologyBusiness
1 of 81
Downloaded 11 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
Northeastern UniversityNortheastern University Systems Security Lab NEU SECLAB Probing Mobile Operator Networks Duo Tech Talks Collin Mulliner, May 2014, Ann Arbor, MI crm[at]ccs.neu.edu
2 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB $ finger collin@mulliner.org  Security Researcher – $HOME = Northeastern University, Boston, MA – specialized in systems security (applied research!)  cat .project – Android security – SMS and MMS security (on the phone side) – Mobile web usage and privacy – Some early work on NFC phone security – Bluetooth Security – Mobile and embedded software dev.
3 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Overview  History & Motivation  How to probe & what to probe for  Analysis Methods  Results  Results  Conclusions
4 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB History  I scanned public IPs of MNOs in 2009 – No talk because of Ikee  The Ikee.A/B worm + botnet – Targeted jailbroken iPhones • SSH installed • Default root password 'alpine' – Spread via scan of public IP ranges of MNOs – Active around November 2009 – Hijacked devices to ask for ransom see summary at: http://mtc.sri.com/iPhone/
5 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB My blog post on iPhone + SSH (end of 2008)
6 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Motivation  What kind of devices are on mobile networks today? – Number devices  Security of those mobile connected devices – They probably are not seen as being on the Internet  What devices are worth looking at? – Starting point for next project(s)  Forecast on mobile network usage in the future – People have strange ideas...
7 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Questions  Mobile Network Operators (MNOs) – Do they know what devices are on their network? – Maybe they don't want to know – liability if they know?  You, the audience: what do you expect? – Mobile phones?  Hint hint ... – Findings are way more interesting than mobile phones!
8 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Yes, this is a IP/port scanning talk!  I've always wanted to do one :-)  But I'm a “mobile” guy  So I scanned the IPs of mobile operators  No fancy super duper hot technique – But we get the data we want!
9 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Devices on Mobile Networks: ? ? ? ? ? ?
10 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Devices on Mobile Networks: some knowledge
11 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB There should be more, right? ? ? ? ? ?? ? ? ? ? ? ?
12 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Probing Mobile Networks: scan from within net ? ? ? ? ?? ? ? ? ? ? ? Hook up laptop to cellular network and scan IP range of mobile operator.
13 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Scanning from within the Mobile Network  Depends on Access Point Name (APN) configuration – Inter-client connections allowed? ← MOST IMPORTANT!  Need SIM card from each operator you want to scan – Costs + accessibility  Scanning will cost extensive amounts of money – Scanning foreign operators will cost even more • Roaming charges!
14 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Special case APNs  Special APNs for: – eBook readers (see my 2010 CanSec talk) – M2M (Machine-to-Machine) devices ← TOP TARGETS – Fancy toys  Access to hardware – Extract SIM card – Get APN name – Obtain APN username and password (if required)  Check if inter-client connections are possible – Scan...
15 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Probing Mobile Networks: from the Internet ? ? ? ? ?? ? ? ? ? ? ? Thats this talk!
16 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Acquiring IPs to scan...  Regional Internet Registry databases – ARIN (American) – RIPE NCC (Europe) – ...  Ikee.A/B's scan list – Europe + Australia  Web server logs (my web server) – I have a lot of mobile visitors  Search the “internetz”
17 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB RIPE NCC Database Search (my pick for now)  Can also can search AFRINIC and others, sadly not ARIN – ARIN search sucks!
18 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Search terms, IPs, Problems  RIPE Database searches – GPRS → 8.600.012 IPs – GGSN → 742.400 IPs – M2M → 27.904 IPs  Unique total IPs: 9.306.060 IPs – “Text” searches return overlapping ranges  Problems – Netblocks are not “marked” honestly/correctly • Subnet might be used for DSL/cable/etc... – Netblock might NOT be marked as GPRS • Will likely miss a lot of IPs
19 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB More Problems...  NAT (Network Address Translation) – Mobile phones often sit behind a NAT gateway (just check your own mobile phone) – NAT → devices unreachable from the Internet – Devices that don't sit behind NAT are interesting • Reason for being reachable?  Most mobile phones don't run services – No open ports, nothing to connect to – iOS iPhone/iPad are exception (iphone-sync service)
20 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB … even more Problems  GPRS is slow → scanning will take time – Bandwidth – Devices go into sleep mode when not active 'wakeup device when scanner connects'  Devices move, get disconnected, etc... → new IP address – Problems • Device will be scanned multiple times • Device will never be scanned at all  Scan blocked by operator because you light-up in his IDS
21 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB My Scanner  Python TCP socks-client – For using TOR  Connect to port – Send “string”, special “strings” for each port • Port 23: minimal telnet implementation • Port 80: “GET / HTTP/1.0rn” • … – Save port status and responds → classic banner grab  Randomized IP address list – Prevent to easily show up in operator's IDS
22 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Scanning using TOR  Anonymity – I kinda have a meaningful PTR record – AWS EC2 would be another way to solve this!  Scan from many different IPs – Yay for NOT being blocked halfway through the project!  But TOR is slow!  Sorry for sucking up a lot of TOR capacity! – TOR capacity is limited, you should run a TOR node!
23 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Ports / TCP only  Side effect if you use TOR – No real issue for identifying devices 21 FTP 22 SSH 23 TELNET 80 HTTP 443 HTTPS 62078 iphone-sync 5060 SIP 8082 TR-069 on some devices 161/162 SNMP
24 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB SSH Probe  If port 22 connects...  Try password(s) 'alpine' and 'dottie' for iOS devices  If we get shell, run: uname ­a; ps ax; ifconfig ­a; dmesg – This will generate a nice system fingerprint and a lot to lock at  This special probe of course has some ethical issues! – Hopefully no trouble for me!  You'd be surprised that this is actually quite useful ;-) – Especially non iOS stuff!
25 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Scanning... 1) Split up the IP address list 2) Run scanner on N machines 3) Check every few weeks – Do other research – From time-to-time: restart, fix, yell, look at data – Back to 2) – Decide to end project, goto 4) 4) Analyze data – Give talk & write paper ← still in progress
26 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Responsible “Data” Disclosure  So far I only talked to few people about this – Little to none pre notification – This talk should be kind of a wakeup call  Some of the stuff is a little scary – I don't want people to get hurt  I wont disclose some specific data – IP addresses and/or ranges for targets – Names of Mobile Network Operators – Specific stuff I found – Details of some targets (or where I omitted them)
27 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Raw Data  IP, time stamp, port, status, banner 85.26.x.x 1327277970 22 0 SSH­2.0­moxa_1.0rn 85.26.x.x 1327277970 21 111  85.26.x.x 1327277970 23 0  xffxfbx01xffxfbx03xffxfbx00xffxfdx00OnCell  G3150_V2rx00nConsole terminal type (1: ansi/vt100 85.26.x.x 1327277970 80 0  85.26.x.x 1327277970 443 112  85.26.x.x 1327277970 62078 111  85.26.x.x 1327277970 5060 112  85.26.x.x 1327277970 8082 112  85.26.x.x 1327277970 161 112  85.26.x.x 1327277970 162 112 0 = open, 111 = closed, 112 = not scanned
28 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Data Analysis & Verification  By hand – Fun, needed to find some of the interesting devices – Not working for large scale analysis – grep for strings like: login, welcome, authenticate, ...  Automated – Criteria?  Verification – Web search for “product ID” – Connect to service (try default login/pass) • Very very few cases • We want to stay on the legal side!
29 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Automated Data Analysis  Find similar devices – Fuzzy cluster similar banners for each port • Stripping stuff like: versions, build, etc... → group/count devices  Type of IP address/range: dynamic vs. static – Device on same address across multiple scans – Devices on static IPs are a real catch!  Post Analysis : manual stuff again – Identify devices (lucky) – Identify software running on device (if unlucky)
30 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Banner Clusters - Statistics  Banner tells us what software is responding to our scan – Software tells us the kind of device  Ports – SSH (22), FTP (21), Telnet (23), HTTP (80), SIP (5060)
31 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Disclaimer!  These are all devices I found while scanning  These are just examples  This is not to blame or discredit manufacturers or operators!
32 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB SIP Banners Stats  Many devices with open ports  Just one banner – SIP not further discussed in this talk! SIP/2.0 200 OKnVia: SIP/2.0/TCP  127.0.0.1:5060;branch=1234567890nFrom:  sip:1234567890@127.0.0.1;tag=bad­012345nTo:  <sip:0987654321@127.0.0.1;user=phone>;tag=bad­012345nCall­ ID: 1348979872­797979222304855nCseq: 15 INVITEnContact:  sip:0987654321@127.0.0.1nContent­Length: 401nContent­Type:  application/sdpnnv=0nAnonymous 1234567890 9876543210 IN  IP4 127.0.0.1ns=SIGMA is the bestns=gotchanc=IN IP4  127.0.0.1nt=0 0nm=audio 36952 RTP/AVP 107 119 100 106 6 0  97 105 98 8 18 3 5 101na=rtpmap:107 BV32/160
33 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banners (popular but useless)
34 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banners Statistics
35 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 DigiCore SOLO CTP Server V2.2 – Devices: >200 – Networks: Germany, Finland, Belgium – Application: Vehicle Tracking  Online search on “DigiCore” – GPS Tracking company – They build trackers for everything • Delivery truck • Rental cars • Individuals http://www.digicore.com DigiCore Sole Device
36 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 Connected to Intermec IFTP server.  – Devices: ~150 – Networks: Turkey, Hungary, Portugal, Germany, Cezch – Application: Supply chain management devices • Barcode scanners, etc... – Details • Windows Mobile Devices http://www.intermec.com/products/computers/handheld_computers/index.aspx
37 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 Welcome to Mobile File Servicernrn – Devices: >150 – Application: Windows Mobile FTP  220­WindowsCE IVU FTP Server Version 1.xx – Devices: ~200 – Application: Windows Mobile FTP  Windows Mobile still seems popular – Also a lot of use in industrial applications
38 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 Imsys FTP server ready – Devices: ~50 – Networks: Germany – Application: unknown (www.imsystech.com/)  220  RT­IP FTP Server ready. – Devices: ~150 – Application: unknown (www.computer-solutions.co.uk)  Embedded SDKs – Probably worth taking a look at
39 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 Welcome to the Leica Geosystems FTP server – Devices: ~20 – Networks: France, Bulgaria, Portugal, – Application: Measurement Laser/GPS http://www.leica-geosystems.com/en/Products_885.htm
40 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 TAINY GMOD­V2 FTP­server ready. – Devices: 33 – Networks: Germany – Application: M2M communication device – Manufacturer: Dr. Neuhaus http://www.neuhaus.de/Produkte/M2M_Telemetrie/TAINY_GMOD-T1.php
41 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 ER75i FTP server (GNU inetutils 1.4.1) ready. – Devices: >500 – Networks: Sweden, Belgium, Romania, Switzerland, Turkey, Germany, Russia, Czech, – Application: Industrial GSM/GPRS router  Found several “ethernet” devices – Could be connected through on of these or similar Source: product site
42 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics: Results (and Telnet)  220­National Instruments FTPrn220 Service Ready – FTP, few hits only  Remote Connection.rnrnUsername:  – Telnet, many hits  Telnet + FTP → device Identification – Devices: +400 – Networks: Portugal, Germany, France, Turkey – Application: Industrial measurement (expensive stuff)
43 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Telnet Banner Statistics
44 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Telnet Banner Statistics: Results  SMCWBR11S­3GN login: – Networks: Portugal – Devices: >100 – Application: 3G Home router http://www.smc-asia.com/products03.php?Fullkey=210
45 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Telnet Banner: Special Finds (NDL485)  Telnet – NDL485­2545532156 login  FTP – 220 NDL485­2545532156 FTP server (GNU inetutils  1.4.2) ready.  Devices: ~50  Networks: France, Germany  IP ranges: Dynamic  Application: environmental sensor http://www.wilmers.com/html_en/html/dataloggers_en.html
46 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Telnet Banner: Special Find (TDS 821)  220­You are user number 1 of 5 allowed.rn220­ Setting memory limit to 1024+1024kbytesrn220­ Local time is now 15:28 and the load is  0.80.rn220 You will be disconnected after 1800  seconds of inactivity.rn  TDS 821 tds821rnrtds821 login:  Networks: Germany  Devices: ~20  IP ranges: static IP (multiple scans) – Not online anymore http://www.traffic-data-systems.net/en/traffic-monitoring-systems/tds-821rvdk900.html
47 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB HTTP Banners “Servers”  Generic “Server Strings” – small/minimal/generic HTTP servers (for embedded stuff)
48 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB HTTP Banners  Detailed HTTP Banners – We can “determine” the product from the banner
49 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB HTTP Banner Statistics  HTTP/1.0 200 OKrnServer: TAC/Xenta511 1.20  Device: TAC Xenta511  Application: building automation  Networks: Russia,  Devices: 8  IP ranges: static and dynamic http://www.tac.com/data/internal/data/05/00/1169146940063/xenta511_cont rollerviainternet.pdf
50 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB GPS Tracking Devices  Track stuff – cars, delivery trucks, individuals, valuable items, …  Found many different systems... – Earlier, FTP Banner “DigiCore SOLO”  Here is more ...
51 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Unknown Tracking Device  Telnet output  Only one hit ... RSI|353446030132219|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|358825031004961|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|353446030131690|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|358825031004912|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|000072798125797|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|00­10­F3­1B­3E­E5|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|353446030132219|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|358825031004961|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|353446030131690|2012­02­10:11:57:34|7000|010&W008.5845
52 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Unknown Tracking Device  Telnet output  Only one hint ... RSI|353446030132219|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|358825031004961|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|353446030131690|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|358825031004912|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|000072798125797|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|00­10­F3­1B­3E­E5|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|353446030132219|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|358825031004961|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|353446030131690|2012­02­10:11:57:34|7000|010&W008.5845 Coordinates match country of operator
53 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Unknown Tracking Device … further investigation 2011/10/05 07:13:08.453 85|ThreadObject.cp{MTU  } 0x0714 Created  thread: 0x07d4 rn2011/10/05 07:13:08.453 85|hreadObject.cp{MTU   } 0x0714 Created thread: 0x0a6c rn2011/10/05 07:13:08.453  146|ThreadObject.c{MTU  } 0x0a6c Set ThreadName  'CTcpTraceEndpoint S:xx.xx.xx.xx:xxxx'rn2011/10/05  07:13:08.453 146|ThreadObject.c{MTU  } 0x07d4 Set ThreadName  'Tcp Trace Listener thread'rnRSI|353446030136186|2011­10­ 05:07:13:08|7000|013&0x130  Lets search for “RSI” … only one more hit...  ...but TcpTraceEndpoint looks good – about 100 hits total  All IPs seem dynamic – Turkey (90% of the hits), Portugal
54 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Tracking Device: C4-D  Telnet prompt Welcome on console  Networks: Portugal, Turkey  Device: ~ 180  IP ranges: dynamic  Security: none! – No login/password required
55 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Tracking Device: C4-D (Console)
56 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Tracking Device C4-D
57 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB GPS Tracking Devices: conclusions  Really common application – No surprise to find these  Security – Not really a thing here – Often no access restrictions  Detailed study would be interesting – Find devices at “interesting” locations
58 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB SSH Banners
59 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Moxa - OnCell  Devices: ~70  Networks: Turkey, Portugal, France, Hungary, Germany, Russia  Application: power system automation  Services – SSH, Telnet, FTP  Security – sometimes root shell w/o login/password
60 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Moxa - OnCell  Linux Moxa 2.6.9­uc0 #142 Fri Jun 19 15:13:00 CST  2009 armv4tl unknown  Banners: OnCell G3150­HSDPArnConsole terminal type (1: ansi/vt100 OnCell G3111rnConsole terminal type (1: ansi/vt100 OnCell G3110_V2rnConsole terminal type (1: ansi/vt100 OnCell G3151rnConsole terminal type (1: ansi/vt100
61 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Moxa - OnCell  Telnet
62 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Moxa - OnCell
63 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Arctic Viola  uClinux ViolaArctic 2.4.19­uc1 #356 Mon Nov 13  14:59:46 EET 2006 m68knommu unknown  Security – root w/o password  Networks: Germany  Devices: 3  Application: M2M router/gateway http://www.violasystems.com
64 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB 3G “Professional” Routers  LANCOM – Models: 3550, 1780, 3850, 1751 – Networks: Germany, Belgium, Spain – Devices: ~200  Telnet – LANCOM 3850 UMTSrn| Ver. 7.70.0100Rel /  18.08.2009rn| SN.  171731800xxx
65 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Smart meters  Found just a few devices on networks in – Germany • 6 devices, dynamic IPs – Turkey • 3 devices, static IPs
66 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Smart Meter (Dr. Neuhaus)  Devices: DNT8166 and DNT8172  Run Linux  Telnet prompts DNT8166 login: DNT8172 login:  Security – SSH root w/o login/password http://www.neuhaus.de/Produkte/Smart_Metering/ZDUE-GPRS-MUC.php
67 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Smart Meter (ENDA) http://www.enda.com.tr/ENG/Products/Default.aspx?UrunGrupID=39  Actually is an Ethernet device – Guess: hooked up to some GPRS M2M gateway  Telnet prompt – Welcome to ENDA Administration Terminal  Security – Admin password is: 1234
68 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Smart Meter (ENDA)
69 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Smart Meters: conclusions  Most likely test installations – Lets really hope this are not production units – Small number of units  Full Linux OS system makes these interesting – Smart meter botnet?  Smart meters are just being deployed – We will see a lot more of these in the near future!
70 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB WIRMA  Linux wirma000245 2.6.13.2­1.13 #501 Mon Apr 28  09:08:00 CEST 2008 armv4tl unknown  Application – General purpose M2M platform – GPS tracking, telemetry, ...  Security – root w/o password on 41 devices  Networks: France http://www.kerlink.com/rubrique.php5?SiteID=1&LangueID=2&RubriqueID=141
71 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB iOS Devices (iPhone + iPad)  Identify by open port 62078 (iphone-sync)  “Jailbreak” identification → open ports – 62078 (iphone-sync) and 22 (SSH) (need ssh installed of course!)  Devices: ~500k – Jailbroken: 2000
72 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Jailbroken iOS Devices  Not that many devices in my target search netblocks – Netblocks from my RIPE search  Many more iOS devices in other netblock I scanned – Quite a lot with default root password 'alpine' – Probably NOT enough for a 2nd worm, but I wouldn't bet!  Hazard waiting to happen – Easy SMS and call fraud – Private data: photos, SMS, ...  If I ever needed a way to send SMS anonymously – TOR + jailbroken iPhones!
73 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Strange Finds  Beagleboards – Devices: +20 – SSH: root w/o password – Application: development? – Networks: Turkey  Cameras...
74 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Camera Network (AXIS)  Overall found plenty of AXIS cameras  Subnet filled with AXIS stuff is a find :) – 38 cams and 1 cam server – Network: Turkey  x.x.192.29 1328757036 21 0 220 AXIS 214 PTZ Network Camera 4.40   x.x.192.41 1328712454 21 0 220 AXIS 213 PTZ Network Camera 4.35   x.x.192.4 1328893766 21 0 220 AXIS 214 PTZ Network Camera 4.40   x.x.192.44 1328216505 21 0 220 AXIS 213 PTZ Network Camera 4.35   x.x.192.57 1328483890 21 0 220 AXIS 213 PTZ Network Camera 4.35  x.x.192.61 1328931661 21 0 220 AXIS 214 PTZ Network Camera 4.40   x.x.192.63 1328000826 21 0 220 AXIS 213 PTZ Network Camera 4.35   x.x.192.66 1328768193 21 0 220 AXIS 214 PTZ Network Camera 4.40   x.x.192.68 1328736105 21 0 220 AXIS 213 PTZ Network Camera 4.35   x.x.192.69 1328596002 21 0 220 AXIS 241Q Video Server 4.47.2  x.x.192.8 1328387937 21 0 220 AXIS 214 PTZ Network Camera 4.40  AXIS 213 PTZ
75 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Devices on Mobile Networks: ? ? ? ? ? ?
76 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Devices on Mobile Networks: result! ? ? ? ? ?
77 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Device Summary  Professional – GPS Tracking – Smart meters – Traffic monitoring (as in streets and cars) – 3G routers – Industrial control stuff – Supply chain management stuff (barcode scanner) – M2M devices, routers, ...  Personal – iPhones and iPads – 3G routers
78 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Why we don't see stuff  Operator didn't tag their netblock as “GPRS” – Big drawback for this kind of research  Operator uses IP address not handled by RIPE  Netblock is used for NAT only – Large portions of our scans terminated in HTTP proxies  Devices don't have open ports – Most mobile phones don't run network services  I made a mistake!
79 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB What we Learned  “Embedded software” that is used in the field – Stacks – Platforms – “single” application  Check them out for... – Features and behavior – Default credentials – Vulnerabilities  Probably a lot of really easy targets – Pick the hard ones for next research project!
80 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Conclusions  Mobile networks are full with interesting devices – A lot of industrial/enterprise devices  Public IPs mostly for M2M devices – Static address assignment seems rare  Many different M2M devices – Security doesn't seem to be a strong aspect here – Root shells on everything!  Mobile networks and GPRS hardware is a real commodity – All devices go mobile → connected to the Internet – Big problem if you have to fix 0wnd stuff in the field!
Northeastern UniversityNortheastern University Systems Security Labs NEU SECLAB Thank you! Any Questions ? twitter: @collinrm crm[at]ccs.neu.edu http://mulliner.org/security/pmon/ EOF

More Related Content

PPT
DC4420 2014 - NFC - The Non-Radio Bits
Tom Keetch
 
PPTX
Near field communication
Nagesh Mishra
 
PDF
Near field communication and RFID - opening for new business
Josef Noll
 
PDF
Introduction à l'écosystème de l'Internet des Objets
Geeks Anonymes
 
PPTX
NFC Bootcamp Seattle Day 2
traceebeebe
 
PDF
Designing low costs sensor system for the Internet of Things
Andreas Schaller
 
PPTX
NFC
Konica Arora
 
PDF
Ask Contactless Terminals
claren65
 
DC4420 2014 - NFC - The Non-Radio Bits
Tom Keetch
 
Near field communication
Nagesh Mishra
 
Near field communication and RFID - opening for new business
Josef Noll
 
Introduction à l'écosystème de l'Internet des Objets
Geeks Anonymes
 
NFC Bootcamp Seattle Day 2
traceebeebe
 
Designing low costs sensor system for the Internet of Things
Andreas Schaller
 
NFC
Konica Arora
 
Ask Contactless Terminals
claren65
 

What's hot (10)

PPTX
Near field communication ppt
Prandeep Shekhawat
 
PPT
Near Field Communication NFC
Mehvish Mushtaq
 
PDF
NXP NFC Android Porting Guide_2017.Jun
Daniel Chiu
 
PDF
Extracting the Painful (Blue)Tooth - Presentation
Opposing Force S.r.l.
 
PPTX
NEAR FIELD COMMUNICATION (NFC)
mahima28
 
PPTX
Weaponizing the Nokia N900 -- TakeDownCon, Dallas, 2011
shawn_merdinger
 
PDF
Near field communication - NFC
Sudhakar Kumar
 
PDF
Nfc technology
manasvi sarkar
 
PDF
Embedded systems security news mar 2011
AurMiana
 
PPTX
Near Field Communication by Mohammed Mudassir
Mohammed Mudassir
 
Near field communication ppt
Prandeep Shekhawat
 
Near Field Communication NFC
Mehvish Mushtaq
 
NXP NFC Android Porting Guide_2017.Jun
Daniel Chiu
 
Extracting the Painful (Blue)Tooth - Presentation
Opposing Force S.r.l.
 
NEAR FIELD COMMUNICATION (NFC)
mahima28
 
Weaponizing the Nokia N900 -- TakeDownCon, Dallas, 2011
shawn_merdinger
 
Near field communication - NFC
Sudhakar Kumar
 
Nfc technology
manasvi sarkar
 
Embedded systems security news mar 2011
AurMiana
 
Near Field Communication by Mohammed Mudassir
Mohammed Mudassir
 
Ad

Viewers also liked (9)

PPTX
Hunky Dory iPhone 5 Tear Down and Repair Guide
Marc Mourning
 
PPTX
Hunky Dory Repair iPhone 4 Tear Down and Repair Guide
Marc Mourning
 
PPTX
Hunky Dory Repair iPhone 4s Tear Down and Repair Guide
Marc Mourning
 
PDF
[HES2013] Hacking apple accessories to pown iDevices – Wake up Neo! Your phon...
Hackito Ergo Sum
 
PDF
iPhone Apple iOS backdoors attack-points surveillance mechanisms
Mariano Amartino
 
KEY
Jailbreaking iOS
Kai Aras
 
PDF
CNIT 128 Ch 3: iOS
Sam Bowne
 
PPT
Course on Ehtical Hacking - Introduction
Bharat Thakkar
 
PDF
Hacking ios-on-the-run-using-cycript-viaforensics-rsa-conference-2014
viaForensics
 
Hunky Dory iPhone 5 Tear Down and Repair Guide
Marc Mourning
 
Hunky Dory Repair iPhone 4 Tear Down and Repair Guide
Marc Mourning
 
Hunky Dory Repair iPhone 4s Tear Down and Repair Guide
Marc Mourning
 
[HES2013] Hacking apple accessories to pown iDevices – Wake up Neo! Your phon...
Hackito Ergo Sum
 
iPhone Apple iOS backdoors attack-points surveillance mechanisms
Mariano Amartino
 
Jailbreaking iOS
Kai Aras
 
CNIT 128 Ch 3: iOS
Sam Bowne
 
Course on Ehtical Hacking - Introduction
Bharat Thakkar
 
Hacking ios-on-the-run-using-cycript-viaforensics-rsa-conference-2014
viaForensics
 
Ad

Similar to Probing Mobile Operator Networks - Collin Mulliner (20)

PPTX
Using network traffic to verify mobile device forensic artifacts
SongchaiDuangpan
 
PDF
Telecom security from ss7 to all ip all-open-v3-zeronights
P1Security
 
PDF
Philippe Langlois - 3G and LTE insecurity from the radio to the core network ...
DefconRussia
 
PDF
Intercoms presentation OSSIR - IoT Hacking
📡 Sebastien Dudek
 
PDF
Luiz eduardo. introduction to mobile snitch
Yury Chemerkin
 
PDF
D1 t1 t. yunusov k. nesterov - bootkit via sms
qqlan
 
PDF
Hack.lu 2016 - 2G and 3G intercom hacking
📡 Sebastien Dudek
 
PDF
Troopers NGI 2019 - Modmobtools and tricks
📡 Sebastien Dudek
 
PPTX
Module-4 Short notes.pptx
AzmiNizar1
 
PPTX
Root via sms. 4G security assessment
Sergey Gordeychik
 
ODP
Mobile Miner Installation
kingsBSD
 
PPTX
Why cant all_data_be_the_same
Skyler Lewis
 
PDF
Troopers TelcoSec day 2019 - Modmobtools internals
📡 Sebastien Dudek
 
PDF
HackerHalted_Yury_Chemerkin_2014_Conference.pdf
Yury Chemerkin
 
PDF
Hacker Halted 2014 - EMM Limits & Solutions
EC-Council
 
PPTX
Virtue Security - The Art of Mobile Security 2013
Virtue Security
 
PDF
33c3 - 2G and 3G intercom attacks
📡 Sebastien Dudek
 
PPTX
128-ch2.pptx
HiraAshfaqSubhan
 
PDF
Defcon 22-paul-mcmillan-attacking-the-iot-using-timing-attac
Priyanka Aash
 
PPTX
Dafgjgghhghfhjgghjhgy06-Footprinting.pptx
AlfredObia1
 
Using network traffic to verify mobile device forensic artifacts
SongchaiDuangpan
 
Telecom security from ss7 to all ip all-open-v3-zeronights
P1Security
 
Philippe Langlois - 3G and LTE insecurity from the radio to the core network ...
DefconRussia
 
Intercoms presentation OSSIR - IoT Hacking
📡 Sebastien Dudek
 
Luiz eduardo. introduction to mobile snitch
Yury Chemerkin
 
D1 t1 t. yunusov k. nesterov - bootkit via sms
qqlan
 
Hack.lu 2016 - 2G and 3G intercom hacking
📡 Sebastien Dudek
 
Troopers NGI 2019 - Modmobtools and tricks
📡 Sebastien Dudek
 
Module-4 Short notes.pptx
AzmiNizar1
 
Root via sms. 4G security assessment
Sergey Gordeychik
 
Mobile Miner Installation
kingsBSD
 
Why cant all_data_be_the_same
Skyler Lewis
 
Troopers TelcoSec day 2019 - Modmobtools internals
📡 Sebastien Dudek
 
HackerHalted_Yury_Chemerkin_2014_Conference.pdf
Yury Chemerkin
 
Hacker Halted 2014 - EMM Limits & Solutions
EC-Council
 
Virtue Security - The Art of Mobile Security 2013
Virtue Security
 
33c3 - 2G and 3G intercom attacks
📡 Sebastien Dudek
 
128-ch2.pptx
HiraAshfaqSubhan
 
Defcon 22-paul-mcmillan-attacking-the-iot-using-timing-attac
Priyanka Aash
 
Dafgjgghhghfhjgghjhgy06-Footprinting.pptx
AlfredObia1
 

More from Duo Security (11)

PDF
Security Fact & Fiction: Three Lessons from the Headlines
Duo Security
 
PDF
Securing Access to PeopleSoft ERP with Duo Security and GreyHeller
Duo Security
 
PDF
How To Stop Targeted Attacks And Avoid “Expense In Depth” With Strong Authent...
Duo Security
 
PDF
Forrester and Duo Security Webinar - 5 Signs You're Doing Authentication Wrong
Duo Security
 
PDF
A Place to Hang Our Hats: Security Community and Culture by Domenic Rizzolo
Duo Security
 
PDF
Internet of Fails: Where IoT Has Gone Wrong and How We're Making it Right by ...
Duo Security
 
PDF
Security For The People: End-User Authentication Security on the Internet by ...
Duo Security
 
PDF
Making Web Development "Secure By Default"
Duo Security
 
PDF
The Real Deal of Android Device Security: The Third Party
Duo Security
 
PDF
No Apology Required: Deconstructing BB10
Duo Security
 
PDF
The Internet of Things: We've Got to Chat
Duo Security
 
Security Fact & Fiction: Three Lessons from the Headlines
Duo Security
 
Securing Access to PeopleSoft ERP with Duo Security and GreyHeller
Duo Security
 
How To Stop Targeted Attacks And Avoid “Expense In Depth” With Strong Authent...
Duo Security
 
Forrester and Duo Security Webinar - 5 Signs You're Doing Authentication Wrong
Duo Security
 
A Place to Hang Our Hats: Security Community and Culture by Domenic Rizzolo
Duo Security
 
Internet of Fails: Where IoT Has Gone Wrong and How We're Making it Right by ...
Duo Security
 
Security For The People: End-User Authentication Security on the Internet by ...
Duo Security
 
Making Web Development "Secure By Default"
Duo Security
 
The Real Deal of Android Device Security: The Third Party
Duo Security
 
No Apology Required: Deconstructing BB10
Duo Security
 
The Internet of Things: We've Got to Chat
Duo Security
 

Recently uploaded (20)

PDF
A Day in the Life of Location Data - Turning Where into How.pdf
Precisely
 
PDF
Chapter 2 Digital Image Fundamentals.pdf
Getnet Tigabie Askale -(GM)
 
PDF
CIFDAQ's Token Spotlight: SKY - A Forgotten Giant's Comeback?
CIFDAQ
 
PDF
Smarter Business Operations Powered by IoT Remote Monitoring
Rejig Digital
 
PDF
CIFDAQ's Teaching Thursday: Moving Averages Made Simple
CIFDAQ
 
PDF
Event Presentation Google Cloud Next Extended 2025
minhtrietgect
 
PPTX
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
PPTX
Telecom Fraud Prevention Guide | Hyperlink InfoSystem
danielle hunter
 
PPTX
CroxyProxy Instagram Access id login.pptx
Orage technologies
 
PDF
CIFDAQ's Market Wrap: Ethereum Leads, Bitcoin Lags, Institutions Shift
CIFDAQ
 
PPTX
Belt and Road Supply Chain Finance Blockchain Solution
cyy111112
 
PDF
Dell Pro 14 Plus: Be better prepared for what’s coming
Principled Technologies
 
PPTX
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
AVTRON Technologies LLC
 
PDF
solutions_manual_-_materials___processing_in_manufacturing__demargo_.pdf
AbdullahSani29
 
PDF
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
PDF
Transforming Manufacturing operations through Intelligent Integrations
TGH Software Solutions Pvt. Ltd.
 
PDF
Top Generative AI Tools for Patent Drafting in 2025.pdf
Content Swap
 
PDF
Modernizing your data center with Dell and AMD
Principled Technologies
 
PDF
Google’s NotebookLM Unveils Video Overviews
SOFTTECHHUB
 
PDF
How AI Agents Improve Data Accuracy and Consistency in Due Diligence.pdf
Bluebash
 
A Day in the Life of Location Data - Turning Where into How.pdf
Precisely
 
Chapter 2 Digital Image Fundamentals.pdf
Getnet Tigabie Askale -(GM)
 
CIFDAQ's Token Spotlight: SKY - A Forgotten Giant's Comeback?
CIFDAQ
 
Smarter Business Operations Powered by IoT Remote Monitoring
Rejig Digital
 
CIFDAQ's Teaching Thursday: Moving Averages Made Simple
CIFDAQ
 
Event Presentation Google Cloud Next Extended 2025
minhtrietgect
 
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
Telecom Fraud Prevention Guide | Hyperlink InfoSystem
danielle hunter
 
CroxyProxy Instagram Access id login.pptx
Orage technologies
 
CIFDAQ's Market Wrap: Ethereum Leads, Bitcoin Lags, Institutions Shift
CIFDAQ
 
Belt and Road Supply Chain Finance Blockchain Solution
cyy111112
 
Dell Pro 14 Plus: Be better prepared for what’s coming
Principled Technologies
 
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
AVTRON Technologies LLC
 
solutions_manual_-_materials___processing_in_manufacturing__demargo_.pdf
AbdullahSani29
 
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
Transforming Manufacturing operations through Intelligent Integrations
TGH Software Solutions Pvt. Ltd.
 
Top Generative AI Tools for Patent Drafting in 2025.pdf
Content Swap
 
Modernizing your data center with Dell and AMD
Principled Technologies
 
Google’s NotebookLM Unveils Video Overviews
SOFTTECHHUB
 
How AI Agents Improve Data Accuracy and Consistency in Due Diligence.pdf
Bluebash
 

Probing Mobile Operator Networks - Collin Mulliner

  • 1. Northeastern UniversityNortheastern University Systems Security Lab NEU SECLAB Probing Mobile Operator Networks Duo Tech Talks Collin Mulliner, May 2014, Ann Arbor, MI crm[at]ccs.neu.edu
  • 2. 2 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB $ finger [email protected]  Security Researcher – $HOME = Northeastern University, Boston, MA – specialized in systems security (applied research!)  cat .project – Android security – SMS and MMS security (on the phone side) – Mobile web usage and privacy – Some early work on NFC phone security – Bluetooth Security – Mobile and embedded software dev.
  • 3. 3 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Overview  History & Motivation  How to probe & what to probe for  Analysis Methods  Results  Results  Conclusions
  • 4. 4 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB History  I scanned public IPs of MNOs in 2009 – No talk because of Ikee  The Ikee.A/B worm + botnet – Targeted jailbroken iPhones • SSH installed • Default root password 'alpine' – Spread via scan of public IP ranges of MNOs – Active around November 2009 – Hijacked devices to ask for ransom see summary at: http://mtc.sri.com/iPhone/
  • 5. 5 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB My blog post on iPhone + SSH (end of 2008)
  • 6. 6 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Motivation  What kind of devices are on mobile networks today? – Number devices  Security of those mobile connected devices – They probably are not seen as being on the Internet  What devices are worth looking at? – Starting point for next project(s)  Forecast on mobile network usage in the future – People have strange ideas...
  • 7. 7 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Questions  Mobile Network Operators (MNOs) – Do they know what devices are on their network? – Maybe they don't want to know – liability if they know?  You, the audience: what do you expect? – Mobile phones?  Hint hint ... – Findings are way more interesting than mobile phones!
  • 8. 8 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Yes, this is a IP/port scanning talk!  I've always wanted to do one :-)  But I'm a “mobile” guy  So I scanned the IPs of mobile operators  No fancy super duper hot technique – But we get the data we want!
  • 9. 9 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Devices on Mobile Networks: ? ? ? ? ? ?
  • 10. 10 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Devices on Mobile Networks: some knowledge
  • 11. 11 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB There should be more, right? ? ? ? ? ?? ? ? ? ? ? ?
  • 12. 12 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Probing Mobile Networks: scan from within net ? ? ? ? ?? ? ? ? ? ? ? Hook up laptop to cellular network and scan IP range of mobile operator.
  • 13. 13 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Scanning from within the Mobile Network  Depends on Access Point Name (APN) configuration – Inter-client connections allowed? ← MOST IMPORTANT!  Need SIM card from each operator you want to scan – Costs + accessibility  Scanning will cost extensive amounts of money – Scanning foreign operators will cost even more • Roaming charges!
  • 14. 14 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Special case APNs  Special APNs for: – eBook readers (see my 2010 CanSec talk) – M2M (Machine-to-Machine) devices ← TOP TARGETS – Fancy toys  Access to hardware – Extract SIM card – Get APN name – Obtain APN username and password (if required)  Check if inter-client connections are possible – Scan...
  • 15. 15 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Probing Mobile Networks: from the Internet ? ? ? ? ?? ? ? ? ? ? ? Thats this talk!
  • 16. 16 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Acquiring IPs to scan...  Regional Internet Registry databases – ARIN (American) – RIPE NCC (Europe) – ...  Ikee.A/B's scan list – Europe + Australia  Web server logs (my web server) – I have a lot of mobile visitors  Search the “internetz”
  • 17. 17 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB RIPE NCC Database Search (my pick for now)  Can also can search AFRINIC and others, sadly not ARIN – ARIN search sucks!
  • 18. 18 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Search terms, IPs, Problems  RIPE Database searches – GPRS → 8.600.012 IPs – GGSN → 742.400 IPs – M2M → 27.904 IPs  Unique total IPs: 9.306.060 IPs – “Text” searches return overlapping ranges  Problems – Netblocks are not “marked” honestly/correctly • Subnet might be used for DSL/cable/etc... – Netblock might NOT be marked as GPRS • Will likely miss a lot of IPs
  • 19. 19 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB More Problems...  NAT (Network Address Translation) – Mobile phones often sit behind a NAT gateway (just check your own mobile phone) – NAT → devices unreachable from the Internet – Devices that don't sit behind NAT are interesting • Reason for being reachable?  Most mobile phones don't run services – No open ports, nothing to connect to – iOS iPhone/iPad are exception (iphone-sync service)
  • 20. 20 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB … even more Problems  GPRS is slow → scanning will take time – Bandwidth – Devices go into sleep mode when not active 'wakeup device when scanner connects'  Devices move, get disconnected, etc... → new IP address – Problems • Device will be scanned multiple times • Device will never be scanned at all  Scan blocked by operator because you light-up in his IDS
  • 21. 21 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB My Scanner  Python TCP socks-client – For using TOR  Connect to port – Send “string”, special “strings” for each port • Port 23: minimal telnet implementation • Port 80: “GET / HTTP/1.0rn” • … – Save port status and responds → classic banner grab  Randomized IP address list – Prevent to easily show up in operator's IDS
  • 22. 22 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Scanning using TOR  Anonymity – I kinda have a meaningful PTR record – AWS EC2 would be another way to solve this!  Scan from many different IPs – Yay for NOT being blocked halfway through the project!  But TOR is slow!  Sorry for sucking up a lot of TOR capacity! – TOR capacity is limited, you should run a TOR node!
  • 23. 23 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Ports / TCP only  Side effect if you use TOR – No real issue for identifying devices 21 FTP 22 SSH 23 TELNET 80 HTTP 443 HTTPS 62078 iphone-sync 5060 SIP 8082 TR-069 on some devices 161/162 SNMP
  • 24. 24 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB SSH Probe  If port 22 connects...  Try password(s) 'alpine' and 'dottie' for iOS devices  If we get shell, run: uname ­a; ps ax; ifconfig ­a; dmesg – This will generate a nice system fingerprint and a lot to lock at  This special probe of course has some ethical issues! – Hopefully no trouble for me!  You'd be surprised that this is actually quite useful ;-) – Especially non iOS stuff!
  • 25. 25 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Scanning... 1) Split up the IP address list 2) Run scanner on N machines 3) Check every few weeks – Do other research – From time-to-time: restart, fix, yell, look at data – Back to 2) – Decide to end project, goto 4) 4) Analyze data – Give talk & write paper ← still in progress
  • 26. 26 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Responsible “Data” Disclosure  So far I only talked to few people about this – Little to none pre notification – This talk should be kind of a wakeup call  Some of the stuff is a little scary – I don't want people to get hurt  I wont disclose some specific data – IP addresses and/or ranges for targets – Names of Mobile Network Operators – Specific stuff I found – Details of some targets (or where I omitted them)
  • 27. 27 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Raw Data  IP, time stamp, port, status, banner 85.26.x.x 1327277970 22 0 SSH­2.0­moxa_1.0rn 85.26.x.x 1327277970 21 111  85.26.x.x 1327277970 23 0  xffxfbx01xffxfbx03xffxfbx00xffxfdx00OnCell  G3150_V2rx00nConsole terminal type (1: ansi/vt100 85.26.x.x 1327277970 80 0  85.26.x.x 1327277970 443 112  85.26.x.x 1327277970 62078 111  85.26.x.x 1327277970 5060 112  85.26.x.x 1327277970 8082 112  85.26.x.x 1327277970 161 112  85.26.x.x 1327277970 162 112 0 = open, 111 = closed, 112 = not scanned
  • 28. 28 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Data Analysis & Verification  By hand – Fun, needed to find some of the interesting devices – Not working for large scale analysis – grep for strings like: login, welcome, authenticate, ...  Automated – Criteria?  Verification – Web search for “product ID” – Connect to service (try default login/pass) • Very very few cases • We want to stay on the legal side!
  • 29. 29 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Automated Data Analysis  Find similar devices – Fuzzy cluster similar banners for each port • Stripping stuff like: versions, build, etc... → group/count devices  Type of IP address/range: dynamic vs. static – Device on same address across multiple scans – Devices on static IPs are a real catch!  Post Analysis : manual stuff again – Identify devices (lucky) – Identify software running on device (if unlucky)
  • 30. 30 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Banner Clusters - Statistics  Banner tells us what software is responding to our scan – Software tells us the kind of device  Ports – SSH (22), FTP (21), Telnet (23), HTTP (80), SIP (5060)
  • 31. 31 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Disclaimer!  These are all devices I found while scanning  These are just examples  This is not to blame or discredit manufacturers or operators!
  • 32. 32 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB SIP Banners Stats  Many devices with open ports  Just one banner – SIP not further discussed in this talk! SIP/2.0 200 OKnVia: SIP/2.0/TCP  127.0.0.1:5060;branch=1234567890nFrom:  sip:[email protected];tag=bad­012345nTo:  <sip:[email protected];user=phone>;tag=bad­012345nCall­ ID: 1348979872­797979222304855nCseq: 15 INVITEnContact:  sip:[email protected]­Length: 401nContent­Type:  application/sdpnnv=0nAnonymous 1234567890 9876543210 IN  IP4 127.0.0.1ns=SIGMA is the bestns=gotchanc=IN IP4  127.0.0.1nt=0 0nm=audio 36952 RTP/AVP 107 119 100 106 6 0  97 105 98 8 18 3 5 101na=rtpmap:107 BV32/160
  • 33. 33 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banners (popular but useless)
  • 34. 34 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banners Statistics
  • 35. 35 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 DigiCore SOLO CTP Server V2.2 – Devices: >200 – Networks: Germany, Finland, Belgium – Application: Vehicle Tracking  Online search on “DigiCore” – GPS Tracking company – They build trackers for everything • Delivery truck • Rental cars • Individuals http://www.digicore.com DigiCore Sole Device
  • 36. 36 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 Connected to Intermec IFTP server.  – Devices: ~150 – Networks: Turkey, Hungary, Portugal, Germany, Cezch – Application: Supply chain management devices • Barcode scanners, etc... – Details • Windows Mobile Devices http://www.intermec.com/products/computers/handheld_computers/index.aspx
  • 37. 37 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 Welcome to Mobile File Servicernrn – Devices: >150 – Application: Windows Mobile FTP  220­WindowsCE IVU FTP Server Version 1.xx – Devices: ~200 – Application: Windows Mobile FTP  Windows Mobile still seems popular – Also a lot of use in industrial applications
  • 38. 38 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 Imsys FTP server ready – Devices: ~50 – Networks: Germany – Application: unknown (www.imsystech.com/)  220  RT­IP FTP Server ready. – Devices: ~150 – Application: unknown (www.computer-solutions.co.uk)  Embedded SDKs – Probably worth taking a look at
  • 39. 39 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 Welcome to the Leica Geosystems FTP server – Devices: ~20 – Networks: France, Bulgaria, Portugal, – Application: Measurement Laser/GPS http://www.leica-geosystems.com/en/Products_885.htm
  • 40. 40 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 TAINY GMOD­V2 FTP­server ready. – Devices: 33 – Networks: Germany – Application: M2M communication device – Manufacturer: Dr. Neuhaus http://www.neuhaus.de/Produkte/M2M_Telemetrie/TAINY_GMOD-T1.php
  • 41. 41 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics : Results  220 ER75i FTP server (GNU inetutils 1.4.1) ready. – Devices: >500 – Networks: Sweden, Belgium, Romania, Switzerland, Turkey, Germany, Russia, Czech, – Application: Industrial GSM/GPRS router  Found several “ethernet” devices – Could be connected through on of these or similar Source: product site
  • 42. 42 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB FTP Banner Statistics: Results (and Telnet)  220­National Instruments FTPrn220 Service Ready – FTP, few hits only  Remote Connection.rnrnUsername:  – Telnet, many hits  Telnet + FTP → device Identification – Devices: +400 – Networks: Portugal, Germany, France, Turkey – Application: Industrial measurement (expensive stuff)
  • 43. 43 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Telnet Banner Statistics
  • 44. 44 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Telnet Banner Statistics: Results  SMCWBR11S­3GN login: – Networks: Portugal – Devices: >100 – Application: 3G Home router http://www.smc-asia.com/products03.php?Fullkey=210
  • 45. 45 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Telnet Banner: Special Finds (NDL485)  Telnet – NDL485­2545532156 login  FTP – 220 NDL485­2545532156 FTP server (GNU inetutils  1.4.2) ready.  Devices: ~50  Networks: France, Germany  IP ranges: Dynamic  Application: environmental sensor http://www.wilmers.com/html_en/html/dataloggers_en.html
  • 46. 46 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Telnet Banner: Special Find (TDS 821)  220­You are user number 1 of 5 allowed.rn220­ Setting memory limit to 1024+1024kbytesrn220­ Local time is now 15:28 and the load is  0.80.rn220 You will be disconnected after 1800  seconds of inactivity.rn  TDS 821 tds821rnrtds821 login:  Networks: Germany  Devices: ~20  IP ranges: static IP (multiple scans) – Not online anymore http://www.traffic-data-systems.net/en/traffic-monitoring-systems/tds-821rvdk900.html
  • 47. 47 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB HTTP Banners “Servers”  Generic “Server Strings” – small/minimal/generic HTTP servers (for embedded stuff)
  • 48. 48 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB HTTP Banners  Detailed HTTP Banners – We can “determine” the product from the banner
  • 49. 49 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB HTTP Banner Statistics  HTTP/1.0 200 OKrnServer: TAC/Xenta511 1.20  Device: TAC Xenta511  Application: building automation  Networks: Russia,  Devices: 8  IP ranges: static and dynamic http://www.tac.com/data/internal/data/05/00/1169146940063/xenta511_cont rollerviainternet.pdf
  • 50. 50 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB GPS Tracking Devices  Track stuff – cars, delivery trucks, individuals, valuable items, …  Found many different systems... – Earlier, FTP Banner “DigiCore SOLO”  Here is more ...
  • 51. 51 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Unknown Tracking Device  Telnet output  Only one hit ... RSI|353446030132219|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|358825031004961|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|353446030131690|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|358825031004912|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|000072798125797|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|00­10­F3­1B­3E­E5|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|353446030132219|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|358825031004961|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|353446030131690|2012­02­10:11:57:34|7000|010&W008.5845
  • 52. 52 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Unknown Tracking Device  Telnet output  Only one hint ... RSI|353446030132219|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|358825031004961|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|353446030131690|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|358825031004912|2012­02­10:11:57:34|7000|009&N41.20213&|rn RSI|000072798125797|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|00­10­F3­1B­3E­E5|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|353446030132219|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|358825031004961|2012­02­10:11:57:34|7000|010&W008.58452&|rn RSI|353446030131690|2012­02­10:11:57:34|7000|010&W008.5845 Coordinates match country of operator
  • 53. 53 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Unknown Tracking Device … further investigation 2011/10/05 07:13:08.453 85|ThreadObject.cp{MTU  } 0x0714 Created  thread: 0x07d4 rn2011/10/05 07:13:08.453 85|hreadObject.cp{MTU   } 0x0714 Created thread: 0x0a6c rn2011/10/05 07:13:08.453  146|ThreadObject.c{MTU  } 0x0a6c Set ThreadName  'CTcpTraceEndpoint S:xx.xx.xx.xx:xxxx'rn2011/10/05  07:13:08.453 146|ThreadObject.c{MTU  } 0x07d4 Set ThreadName  'Tcp Trace Listener thread'rnRSI|353446030136186|2011­10­ 05:07:13:08|7000|013&0x130  Lets search for “RSI” … only one more hit...  ...but TcpTraceEndpoint looks good – about 100 hits total  All IPs seem dynamic – Turkey (90% of the hits), Portugal
  • 54. 54 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Tracking Device: C4-D  Telnet prompt Welcome on console  Networks: Portugal, Turkey  Device: ~ 180  IP ranges: dynamic  Security: none! – No login/password required
  • 55. 55 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Tracking Device: C4-D (Console)
  • 56. 56 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Tracking Device C4-D
  • 57. 57 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB GPS Tracking Devices: conclusions  Really common application – No surprise to find these  Security – Not really a thing here – Often no access restrictions  Detailed study would be interesting – Find devices at “interesting” locations
  • 58. 58 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB SSH Banners
  • 59. 59 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Moxa - OnCell  Devices: ~70  Networks: Turkey, Portugal, France, Hungary, Germany, Russia  Application: power system automation  Services – SSH, Telnet, FTP  Security – sometimes root shell w/o login/password
  • 60. 60 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Moxa - OnCell  Linux Moxa 2.6.9­uc0 #142 Fri Jun 19 15:13:00 CST  2009 armv4tl unknown  Banners: OnCell G3150­HSDPArnConsole terminal type (1: ansi/vt100 OnCell G3111rnConsole terminal type (1: ansi/vt100 OnCell G3110_V2rnConsole terminal type (1: ansi/vt100 OnCell G3151rnConsole terminal type (1: ansi/vt100
  • 61. 61 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Moxa - OnCell  Telnet
  • 62. 62 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Moxa - OnCell
  • 63. 63 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Arctic Viola  uClinux ViolaArctic 2.4.19­uc1 #356 Mon Nov 13  14:59:46 EET 2006 m68knommu unknown  Security – root w/o password  Networks: Germany  Devices: 3  Application: M2M router/gateway http://www.violasystems.com
  • 64. 64 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB 3G “Professional” Routers  LANCOM – Models: 3550, 1780, 3850, 1751 – Networks: Germany, Belgium, Spain – Devices: ~200  Telnet – LANCOM 3850 UMTSrn| Ver. 7.70.0100Rel /  18.08.2009rn| SN.  171731800xxx
  • 65. 65 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Smart meters  Found just a few devices on networks in – Germany • 6 devices, dynamic IPs – Turkey • 3 devices, static IPs
  • 66. 66 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Smart Meter (Dr. Neuhaus)  Devices: DNT8166 and DNT8172  Run Linux  Telnet prompts DNT8166 login: DNT8172 login:  Security – SSH root w/o login/password http://www.neuhaus.de/Produkte/Smart_Metering/ZDUE-GPRS-MUC.php
  • 67. 67 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Smart Meter (ENDA) http://www.enda.com.tr/ENG/Products/Default.aspx?UrunGrupID=39  Actually is an Ethernet device – Guess: hooked up to some GPRS M2M gateway  Telnet prompt – Welcome to ENDA Administration Terminal  Security – Admin password is: 1234
  • 68. 68 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Smart Meter (ENDA)
  • 69. 69 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Smart Meters: conclusions  Most likely test installations – Lets really hope this are not production units – Small number of units  Full Linux OS system makes these interesting – Smart meter botnet?  Smart meters are just being deployed – We will see a lot more of these in the near future!
  • 70. 70 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB WIRMA  Linux wirma000245 2.6.13.2­1.13 #501 Mon Apr 28  09:08:00 CEST 2008 armv4tl unknown  Application – General purpose M2M platform – GPS tracking, telemetry, ...  Security – root w/o password on 41 devices  Networks: France http://www.kerlink.com/rubrique.php5?SiteID=1&LangueID=2&RubriqueID=141
  • 71. 71 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB iOS Devices (iPhone + iPad)  Identify by open port 62078 (iphone-sync)  “Jailbreak” identification → open ports – 62078 (iphone-sync) and 22 (SSH) (need ssh installed of course!)  Devices: ~500k – Jailbroken: 2000
  • 72. 72 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Jailbroken iOS Devices  Not that many devices in my target search netblocks – Netblocks from my RIPE search  Many more iOS devices in other netblock I scanned – Quite a lot with default root password 'alpine' – Probably NOT enough for a 2nd worm, but I wouldn't bet!  Hazard waiting to happen – Easy SMS and call fraud – Private data: photos, SMS, ...  If I ever needed a way to send SMS anonymously – TOR + jailbroken iPhones!
  • 73. 73 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Strange Finds  Beagleboards – Devices: +20 – SSH: root w/o password – Application: development? – Networks: Turkey  Cameras...
  • 74. 74 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Camera Network (AXIS)  Overall found plenty of AXIS cameras  Subnet filled with AXIS stuff is a find :) – 38 cams and 1 cam server – Network: Turkey  x.x.192.29 1328757036 21 0 220 AXIS 214 PTZ Network Camera 4.40   x.x.192.41 1328712454 21 0 220 AXIS 213 PTZ Network Camera 4.35   x.x.192.4 1328893766 21 0 220 AXIS 214 PTZ Network Camera 4.40   x.x.192.44 1328216505 21 0 220 AXIS 213 PTZ Network Camera 4.35   x.x.192.57 1328483890 21 0 220 AXIS 213 PTZ Network Camera 4.35  x.x.192.61 1328931661 21 0 220 AXIS 214 PTZ Network Camera 4.40   x.x.192.63 1328000826 21 0 220 AXIS 213 PTZ Network Camera 4.35   x.x.192.66 1328768193 21 0 220 AXIS 214 PTZ Network Camera 4.40   x.x.192.68 1328736105 21 0 220 AXIS 213 PTZ Network Camera 4.35   x.x.192.69 1328596002 21 0 220 AXIS 241Q Video Server 4.47.2  x.x.192.8 1328387937 21 0 220 AXIS 214 PTZ Network Camera 4.40  AXIS 213 PTZ
  • 75. 75 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Devices on Mobile Networks: ? ? ? ? ? ?
  • 76. 76 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Devices on Mobile Networks: result! ? ? ? ? ?
  • 77. 77 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Device Summary  Professional – GPS Tracking – Smart meters – Traffic monitoring (as in streets and cars) – 3G routers – Industrial control stuff – Supply chain management stuff (barcode scanner) – M2M devices, routers, ...  Personal – iPhones and iPads – 3G routers
  • 78. 78 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Why we don't see stuff  Operator didn't tag their netblock as “GPRS” – Big drawback for this kind of research  Operator uses IP address not handled by RIPE  Netblock is used for NAT only – Large portions of our scans terminated in HTTP proxies  Devices don't have open ports – Most mobile phones don't run network services  I made a mistake!
  • 79. 79 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB What we Learned  “Embedded software” that is used in the field – Stacks – Platforms – “single” application  Check them out for... – Features and behavior – Default credentials – Vulnerabilities  Probably a lot of really easy targets – Pick the hard ones for next research project!
  • 80. 80 Collin Mulliner – DuoTechTalk 2014 “Probing Mobile Networks” NEU SECLAB Conclusions  Mobile networks are full with interesting devices – A lot of industrial/enterprise devices  Public IPs mostly for M2M devices – Static address assignment seems rare  Many different M2M devices – Security doesn't seem to be a strong aspect here – Root shells on everything!  Mobile networks and GPRS hardware is a real commodity – All devices go mobile → connected to the Internet – Big problem if you have to fix 0wnd stuff in the field!
  • 81. Northeastern UniversityNortheastern University Systems Security Labs NEU SECLAB Thank you! Any Questions ? twitter: @collinrm crm[at]ccs.neu.edu http://mulliner.org/security/pmon/ EOF