Mobile Network Hacking, IP Edition

The talk discusses the security shortcomings of integrating IT protocols into mobile networks, focusing on IMS and RCS technologies. The vulnerabilities include intercepting calls and SMS, impersonation, user tracking, fraud, and DoS attacks. The middle part of the mobile network, including IMS, has not been fully analyzed for security. The recent deployment of RCS technology by Google and mobile operators has not yet solved the security issues. The talk suggests possible mitigation measures.

• Mobile networks have undergone security improvements but have also become more complex with the integration of IT technologies.
• IMS and RCS technologies have vulnerabilities in intercepting calls and SMS, impersonation, user tracking, fraud, and DoS attacks.
• The middle part of the mobile network, including IMS, has not been fully analyzed for security.
• The recent deployment of RCS technology has not yet solved the security issues.
• Possible mitigation measures should be implemented to address the vulnerabilities.

The talk mentions that the recent deployment of RCS technology by Google and mobile operators was supposed to fix some of the issues of previous technologies. However, the technology has already been found to have vulnerabilities, such as intercepting calls and SMS, impersonation, and user tracking. The talk emphasizes the need to address these vulnerabilities before it's too late.

Mobile networks have gone through a decade of security improvements ranging from better GSM encryption to stronger SIM card and SS7 configurations. These improvements were driven by research at this and other hacking conferences. Meanwhile, the networks have also mushroomed in complexity by integrating an ever-growing number of IT technologies from SIP to WiFi, IPSec, and most notably web technologies. This talk illustrates the security shortcomings when merging IT protocols into mobile networks. We bring back hacking gadgets long thought to be mitigated, including intercepting IMSI catchers, remote SMS intercept, and universal caller ID spoofing. We explore which protection measures are missing from the mobile network and discuss how to best bring them over from the IT security domain into mobile networks.