[Music]
next session on open rand 5g hacking
just got a lot more interesting by
carson noll
so 5g has seen quite some evolutions at
least through telecom through every of
the generations the 2g
3g 4g and now 5g
and it's changing from an old school
monolithical system to a very open model
and openness and open models is
something that we dearly love at least i
do and now the hacking potential and a
lot more interfaces are coming about and
we can actually have some quite new
interactions with this
and i know that from myself from a
previous employer being a telecom
company that it's very interesting to
listen here and also see the new
technology emerge now carson no we know
from all kinds of ccc talks cool ones
even and each
every target was actually cool i call it
education to myself
and as a security researcher and
cryptographer he's now also the chief
scientist for sr labs in berlin
and
take it away please a big applause for
customer knowledge
thank you and thanks for entertaining
everyone for 10 minutes i've never seen
a herald work harder
um good to see you all again uh three
years of of everybody staying at home
hacking on their own things it's about
time to start sharing knowledge again
that's what i'm here for today
we'll be talking about
hacking in and taking down critical
infrastructure um
the irony that this talk was delayed by
10 minutes by the electricity going down
isn't lost on me um we'll make the best
out of the remaining time
um we're talking about open rand today
as a case study basically of technology
developments are happening
in basically every industry people are
going into the cloud they're
virtualizing things
processes get more and more automated
and
nowhere is that shift clearer than in
the telco industry and openran is a is a
great example of that so we'll be
touching on a lot of technology that you
encounter in your industries as well um
i'm just particularly fond of telco
hacking so at the end of this
presentation you'll know what open rain
is and the technologies involved around
virtualization and automation you'll
know how to find security issues in them
and if you happen to be in the business
of building telco networks or for that
matter any kind of cloud network
you'll take away some advice on how to
make those infrastructures more secure
um why am i talking about this well i've
i've experienced telco basically from
from both sides i've been
a hacker of critical infrastructures for
well over a decade now
and around halfway through that um
that journey i've been asked to help
secure telco network so i've seen both
the attacking and the defending side of
it and i can tell you well well hacking
telco networks might seem difficult
sometimes defending them is even harder
so if you're up for challenge
try that sometime
but why anyway are we still talking
about telco security
it's been
literally 13 years since i was standing
here and um
trying to get all of you to help me
compute a51 rainbow tables anybody
remember that
okay yeah that's exactly 13 years ago
this conference
and then you all came together and we
computed those tables we then released
them that year in december at the chaos
congress
and ever since then people know that 2g
is insecure
and nobody has ever found similar
weaknesses in in the other protocols so
on are we done when we're done 13 years
ago um well it turns out telco networks
are more complex than just singular
standards right the reality is always
more complex than the standards written
in theory but let's start at the
positives let's see what has actually
happened in in telco network evolution
um
so with the introduction of 5g pretty
much all the
um
the hacking vectors that were identified
in previous generations were closed and
not just hacking then vectors also
privacy features were added
for instance 5g is the um
the first standard where the mc
basically your your identity isn't
submitted in clear text over the air
anymore right so it took almost 30 years
of network standardization for people to
understand that it's a bad idea to send
identities in clear text right it will
probably take another 30 years for all
non-5g networks to die out and for us to
finally benefit from this um progress
but you know it's a step in the right
direction and there's many others i
won't go into the details here because
of course you all are only interested in
in how networks are broken not how they
have been fixed but
overall of course we have made good
progress or the people writing these
standards i should say have made good
progress um so that today we couldn't
just stick up an antenna and intercept a
5g conversation like we did 13 years ago
at the
chaos congress um
against 2g right um
but even though these network
generations have gotten more and more
secure on paper um we anyway or other
researchers have been able to find
vulnerabilities in each of those uh
standards usually digging a little bit
deeper going to
less obvious places and we want to
continue that today with 5g and again
using openran as a case study
um
what i'll show you now over over the
next
20 25 minutes uh um
kind of the building blocks towards four
hacks that that are a little straight um
spying on
people's communication
extracting their private data from a
mobile network
becoming an admin in that mobile network
controlling all the infrastructure and
ultimately taking down a mobile network
right um these are not singular hex
anymore uh like what we discussed let's
say around 2g um but draws a series of
of building blocks so i'll have to do a
little bit of a build up towards that um
they are also not easily done within
what is what was it less than one minute
for the 2g stuff right we're talking
about weeks here weeks of somebody
penetrating a network and and moving
deeper and deeper and deeper until they
can finally take down the network
um but i'm sure you can imagine many
organizations that would be willing to
spend several weeks to then either
ransom um somebody or do other criminal
activities or for purely strategic
purposes we're talking state sponsored
actors right so it takes weeks to break
into a 5g network and while that might
seem like a long time compared to uh
what what hackers usually show at
conferences like this it's definitely
worth uh worthwhile for um too many
people in the world for this to be
ignored
so
why are networks still vulnerable
of course
they are built from many different
technologies some of them newer like
let's say the 5g standards some of them
older but still mandatory if you're
building a 5g network from scratch today
you would still have to connect it to an
engine technology called ss7 for
instance right won't be talking much
about ss7 today um but there's of course
previous research from years ago that
still to today applies to virtually all
networks in the world because of the
network effect if you want to be part of
this global community if you want to
exchange text messages if you want to
support global roaming you have to
support ss7 or maybe a little bit more
avant-garde supporting diameter well
tough luck it has the same security
vulnerability so
mobile networks are just complex beasts
and today we're going to talk about none
of this stuff
but look one level below to the it
infrastructure
every telco network of course needs to
be built on something right it's not
just software and this used to be
proprietary boxes that you would source
from some scandinavian vendor or let's
say from china
um there was 4g
this moved all onto linux um everything
became ip in in mobile networks so it
already felt a lot more familiar to a
pen tester or red teamer
testing mobile networks and with 5g now
we're going even further down to to get
basically cloudify these networks um and
today we're going to talk about um about
exactly that development um where
networks become much more virtualized
and much more automated okay
so all the hacking i'll be talking about
today is going to be from the it domain
that mobile networks are built on right
very important we're not going to
mess with any of these standards because
they're not the weakest link of mobile
networks anymore as far as i can tell
okay
um
a bit of nomenclature to get that out of
the way so today we're talking about
open rain what's open range first of all
ran what's ram radio access network is
one of three parts that make up a mobile
network does the radio access network
which is basically 90 of the mobile
network actually it's the antenna it's a
cable that connects antenna to some
local switching center another cable to
something more regional another cable to
connect us to a big central data center
and that central data center is then
considered the network core so that's
separate and then different network
cores are connected through interconnect
um for instance to connect different
companies or different countries right
but almost everything that you consider
as a mobile network is the radio access
network part basically the country-wide
infrastructure right
and even though it's 90 of a mobile
network at least it hasn't received much
attention so i certainly haven't looked
at anything ran related since 13 years
ago the 2g stuff because i considered
it's secure and it's basically just
cables right and that was true for most
of these 13 years up until now
was 5g and open ram
there's big changes underway where uh
the radio access network gets a lot i
guess people call it smarter right so a
lot more complex there's much more
technology put into the ran and that's
why after many years of neglecting it uh
we revisited it and um found really
interesting stuff right um so that's ran
so what is open ran open ran is
basically a movement you could say um
loosely defined as as combining three
things only two of which are really
relevant for our discussion today the
third thing is that mobile networks are
now built on commodity hardware to make
them cheaper right so instead of getting
a box from scandinavia or china that
combines hardware and software you get
your own hardware
and then you put whatever vendor
software on it right not so relevant for
us
what's more relevant for the security
discussion is that
everything is virtualized or i guess
containerized is the more appropriate
term we're talking kubernetes here most
of the time um and processes are
automated to a very high in fact scary
degree right um so that's open ram
basically these three things put
together and it's extremely popular um
among telcos right now because it's
cheaper the commodity hardware part is
what they find interesting of course we
find the other two are a lot more
interesting
so in in summary the changes between
kind of how mobile networks used to be
built and how they're being built right
now um a mobile network used to be built
okay you start with an antenna that part
hasn't changed the future will still
have antennas in mobile network just
everything after that changes so it used
to be you connect this antenna to one of
those proprietary boxes appliances you
could say that you get from let's say
scandinavia
and um you you you connect them
throughout the entire country somebody
manually looks locks into each of these
boxes configures them and then basically
you have your network that will stay
virtually the same for the next say 15
to 20 years until it's replaced by
another network generation right there's
sometimes upgrades that the vendor will
ship to you maybe once a year at most
twice a year um
and then you manually install these
upgrades on each of the boxes and that's
it it's very static networks with very
little interference
right now switch over to openran or
really any future mobile network i i
would imagine um instead of getting
appliances you get shipments of software
and you have to install them in your own
cloud environment
and it's not going to be just a few
cloud environments because of 5g's
latency requirements they'll be in a
country like germany several hundred
data centers okay so in several hundred
places you install kubernetes clouds and
then on each of those kubernetes clouds
you have to put dozens of docker
containers right just the complexity of
that the sheer numbers involved do not
allow for anybody to do this manually
one by one anymore right it needs to be
automated uh the whole deployment and
once it's automated um people think of
this as a great benefit because now we
can keep changing the network pretty
dynamically so instead of having people
lock into boxes once once a year and
changing a little bit now you have
scripts running all the time that try to
optimize the network that keep
reconfiguring everything so it's kind of
a living organism almost style network
that is self-optimizing and to me that's
very scary right knowing that it
continuously changes how are you going
to test it and say okay for the next few
years i know it's secure i mean you test
it and even five minutes later it has a
different state so security testing
becomes a lot more complex right now
maybe silver lining
at least we remove the the human error
source from operations right if
everything is software nobody can fat
finger or get fished anymore but of
course we introduced another um maybe
more serious human error source in that
many developers are now involved that
through some magical cicd pipelines
create and push down these scripts and
that's what we want to focus on today
these two developments that everything
gets virtualized
and that everything gets automated okay
and again i'm using this as a case study
to illustrate developments that you
encounter in other industries as well
just nowhere else as as quickly as a
step function as in the telco industry
right because any kind of cloud
environment would be built
similarly so let's start with
virtualization hacking or again to be
more specific containerization hacking
i'm not talking about vmware virtual
machines i'm talking about very scalable
cloud scale virtualization
and as i said telcos have several
hundred
clouds distributed throughout the
country
to host all kinds of functionality and
in theory because all of everything is
virtualized
you actually have a possible security
upside
because once everything is the the
software is virtualized it's nicely
segregated the networks become software
defined so you can basically through
configuration settings create any kind
of segregation that you want on the
network level on the on the hardware
level
most deployments that we have seen do
not make much use of this very fine
grained uh configurability and in fact
go the opposite way creating new areas
in which
devices share resources right and in
mobile networks of course availability
is very important you need your network
to be to be up right and if you have
different different
functional components share the same
hardware if one of them
overloads the system so to speak the
others can suffer as well right so with
virtualization the jury is a little bit
out this is security gain or loss but
certainly if you configure it badly it's
definitely a loss and now we're going to
look at the cases in which we find
these environments to be badly
configured
so the the assumption is that there are
different pieces of software all running
in the same cloud right it could be an
amazon cloud could be google cloud or in
our case a telco cloud
and some of them are trusted and really
secure and very critical other ones uh
maybe test instance somebody trying
something out something unimportant
different security levels okay now the
big question is if something less secure
gets hacked
can a heck a break out of that
environment and influence something more
secure so can either hack the kubernetes
underneath or influence some neighboring
docker containers um and it turns out
that there's multiple paths for doing
this kind of container break out and uh
here i'm listing the ones that we find
most commonly in telco environments
right there's probably other ones but um
these are the ones that we do encounter
and actual assessments so the way to
read this is on the left you have a
property a capability basically that you
can assign to kubernetes as a pot or um
or docker container um and if and the
the the dark red ones are the ones that
we find all the time
they're kind of pseudo defaults not
really defaults where people love to set
those settings and then the lighter
shaded ones um we don't find them quite
as often but but still
enough to be concerned right and so you
start from one of these capabilities the
middle then says how the hacker would
abuse it on the right hand side uh says
the outcome could be in a mobile network
anything from running your own code kind
of crypto miner style it's probably the
least concern to accessing data so
ransomware of course
would be
a relevant threat here two ultimately
this is uh certainly the worst for
mobile networks taking down the systems
right basically disconnecting people
from their critical infrastructure
and just to take the first two perhaps
as an example um so if those
capabilities are set how does a hacker
do this so the first two here privilege
container and sysadmin so if
if either of those capabilities are
assigned to the docker container that
basically means that from inside the
docker you can communicate with the
linux kernel of the host machine right
in less constrained ways than a
non-privileged container and
i mean the linux hackers in the room of
course already have 100 ideas um how to
abuse this right and and it's a long
list i'll just give you two examples
here um you can um abuse a kernel
feature around c groups c group is
basically a way to handle processors you
don't have to use it it's just easier um
if you if you execute multiple processes
basically as one batch
kubernetes door definitely uses this so
if you're inside a
a docker container on kubernetes you
know that the host machine uses c groups
right that's important to know and
basically there's a kernel feature where
you can tell the kernel please
let me know when uh when a c group com
completes and i want to execute a little
bit of code at the end
right with root level uh permissions and
basically you see it here this is
basically a ps with root privileges you
can execute any code you want right so
you just
notify the kernel to please um execute
this snippet of code um at the end of a
c group and you you basically have root
level access right very straightforward
and yeah no surprise right however
people don't think about it like this
when they assign this privilege to
attribute to their containers most of
the time
another way is if you have access to the
host pid namespace again that's that's
given if either of those properties is
set you can basically just just enter um
the part of the name space that gives
you the equivalent to root shell right
so um really very straightforward
exploits and these are just two of the
examples the the other ones on the list
are maybe a little bit more interesting
because they're less intuitive so if you
don't have a privileged container but
still this host pid
namespace access this is very commonly
found
you can't really access those processes
running on the host machine but you can
kill them
and if you can kill everything that's
running in the kubernetes on top of you
you can take down the mobile network of
course right um obvious right so um if
you're building kubernetes environments
look how often the host pid is set for
your containers you'd be surprised right
and then if you combine the host pid
with another benign looking capability
this is p trace you cannot just see
those processes but you can inject code
into the process in any process running
on your host again that's root level
access right that's basically root cell
equivalent two benign looking things um
are combined to basically full exploit
um
access to the file system is uh pretty
dangerous as well i mean obviously if
you have right access to the file system
you can just overwrite configuration
files you can add your ssh key what not
but even read only access to the host's
file system
virtually always when we encounter this
game over because you can find tokens so
tokens are yeah as the name would
suggest just strings
that are used to access kubernetes
infrastructure they're found in all
kinds of configuration files so reading
them is enough to then access kubernetes
infrastructure
also very popular finding passwords um a
bunch of the utilities that you use to
administer environments like this that
take a username and a password as
command line arguments
so where do you find it in bash history
right so if you have read only access to
the file system often there's the
password that you need to to go forward
right
the last one is the one that surprised
me the most i don't know if everybody
can see it from here it's basically
network um network access right
the reason it surprised me the most is
of course i'm old school i know virtual
machines more than docker containers
right and if in a virtual machine if you
give it network access that's not
usually considered a security risk right
i mean how could you run a virtual
machine without network access
it's basically a separate computer
popping up on the same network right
in docker it's not like that if you if
you design a host network attribute it's
sharing the same network interface right
so imagine you have some services tied
to localhost and localhost only right if
you're sharing a network interface the
guest can now access your localhost and
it used to be that even the
kubernetes api the api to basically
configure anything in kubernetes was
often bound to localhost and didn't have
authentication switched on right so
that's game over right there at least
the authentication is now switched on um
in more recent versions but depending on
how how old your kubernetes environment
is this is a big concern but at the very
least i mean given that that this this
interface is shared between host and
guest now um that the gas can tcp dump
everything that's coming in and out of
the host right so that by itself is
already a problem unless they use ssl
for everything
but now guess how they build kubernetes
classes right they say oh everything
that happens within a kubernetes cluster
is trusted it never goes over physical
cable we don't need ssl right everything
unencrypted so
giving network level access to a guest
usually means the host gets hacked right
so just
a whole collection of things that can go
go wrong and again this is just the
stuff that we see in real assessments
there's more stuff that can go wrong
in theory
so um
that was that was a part on
virtualization hacking um let's talk
about automation and the
the implications of of basically this
development
um that instead of having
people
typing in configuration like old school
linus admin type right um you have some
um you have some scripts and an
uncountable number of scripts that are
that are created by all kinds of uh
developers that are pushed through all
kinds of crcd tools right so what's the
implication of that for security um well
of course that um some threads that we
had before amplified some new threats
are introduced and then i guess the
third category would be stuff that
should never uh happen happens anyway
because it's becoming so complex now let
me give you one example of each of those
categories
the threat that was already there that's
being amplified is phishing on or social
engineering in general right so instead
of five linux sys admin types
you now can fish
hundreds of people across various
companies that are all somehow
contributing code into the configuration
of this mobile network right um if you
get to fish any one of them
um
there's a good chance that ultimately
you can adversely affect the mobile
network right so that threat is
amplified threats that are completely
new it's a whole ecosystem of basically
software development tools that are now
part of the operation of your mobile
network right somebody somewhere commits
something to github
it goes through all kinds of ci cd it
becomes packaged somewhere it gets
downloaded into an image that image gets
deployed through another csd
any part of that chain gets hacked your
mobile network is at risk
right and then there's stuff that should
never happen but of course you know you
have hundreds of people working on this
stuff
people posting questions on let's say
stack overflow saying oh can you look at
this piece of code what am i doing wrong
and they're leaking internal secrets
right hundreds of people are involved
one of them will do that for sure right
but you see how the attack service now
becomes really hard to capture right
like there's hundreds of people across
different companies using all of these
tools all of this in theory would need
to be tested now to know whether or not
your network is secure so kind of the
pen testing that we used to do doesn't
apply anymore you don't even know what
the scope is right so instead of course
this needs to be tested through red
teaming everybody knows what red teaming
is right yeah so basically an open
invitation to to hack a company any way
you want and then explain them how he
did it so they can learn from it and
then there's iterations where based on
what you find they get better and then
it's a little bit harder next time or a
little bit more fun if you ask my team
and then you know it's these iterations
right and what i'll show you next is
kind of the best off of the red teaming
that we've done so we do dozens of red
teams but um a handful of them against
5g telcos so what have we found in
actual 5g telcos that allowed us to
achieve all of these hacking goals that
i listed in the beginning and i should
say this is the best of kind of a mashup
of different so
it's not one network that's affected by
all of these i wouldn't disclose uh
client information like this but it's
kind of a yeah
a collage
um
so their first hacking journey um
starts from the internet and we find
some developer put up a website
something unauthenticated they're just
playing around with something that they
probably mean to take it down a day or
so later they know it's probably not
secure which is why it's completely
isolated in their network okay we get to
hack it and it's basically that end
right this has no access to anything on
the internal network it's just some
boring website however
it's running in a docker container on
the kubernetes so if any of those
capabilities we looked at earlier is set
we break out of the docker container and
now we're on the kubernetes layer right
and sure enough of course one of these
capabilities was set so we did break out
and now in the kubernetes layer which
means we're not constrained anymore the
kubernetes has access to everything that
any of the container needs access to
right so these combinators environment
it's very hard to kind of dm set them
away right um so we can
we we start looking on the internal
network third step um
very slowly right there's always a blue
team that's looking on what's happening
on the network so you do this space out
over days if not weeks you find
different servers you find different
apis in fact you'll find hundreds of
apis mobile networks today a lot of
a lot of what i do is microservice based
right so just apis everywhere and you
know mistakes are being made so um
completely by accident i believe um one
of these apis if you send wrong stuff to
them it sends you back debug information
and in the debug information that's the
credentials of one of the developers who
knows right mistakes are being made
those credentials they allow us to to
access some systems not necessarily
production system in the sense of mobile
network we're still on the i.t side
right where the websites live but
there's kind of a data lake
equivalent right an elastic search that
includes a lot of information to do
statistical analysis and so enough we
find the customer text messages in there
right
so this is a multi-week hacking journey
to basically
achieve the equivalent that in 2g took
one minute right sticking up an antenna
um
capturing the text messages around
you however now we get the text messages
of an entire country right so maybe it's
worth spending a few weeks on this
certainly for somebody who wants to
break two-factor authentication or any
of the things that are attached to text
messaging today right
so that that's one hacking journey and
you see how none of this actually
targeted telco
standards right it
doesn't even matter that this is a 5g
network what matters is that this is a
highly virtualized
network with lots of automation
fragments floating around and the same
will be true for for the other hacking
journeys so second one um
so it shares some of the same steps so
i'm not going to repeat those uh but
then basically once we're on in internal
network we look around more and more and
more of course we find development um
fragments right in this case a gitlab um
somebody has um basically shadowfile
equivalent so um
hash passwords that they deploy as part
of some configuration update who knows
right um one of these passwords is
crackable we crack it and that password
now gives us access to wherever this
configuration shadow file was deployed
to right i mean it's the whole point
right um including um the the database
that has all the registration
information of all of the customers of
this telco right so bank accounts
addresses and whatnot right again we we
didn't touch anything telco specific to
be able to break in very very thoroughly
third and last hacking journey um this
one is is uh finally getting into the
telco domain so again we reused some of
the building blocks especially uh this
credential um we found earlier but we
also need one one other bit of
information and that is a description of
of an internal api which you know
usually an api isn't self-explanatory
right so you somehow need to understand
how to communicate with these apis and
in this particular case this was shared
on the internet and you can argue
whether this is a security issue because
you know believers in open source
software of course say the source code
can be open that's not a security issue
as long as your credentials are uh
protected
i'm not sure if that's if there's you
know many eyes make bugs go away
argument uh applies to software that's
really only used in one or two companies
because you post it on internet people
don't start looking for bugs in it it's
just the hacker will use that
information so some level of obscurity
sometimes helps in and protecting apis
in an event this was uh on the internet
leaked we already have the access so we
can finally access something in the
telco network in the rand network right
um in fact not just one this intelligent
controller is kind of an optimization
piece of software that's deployed in
each one of these hundreds of data
centers okay so we can access a software
component in hundreds of different
dockers deployed on hundreds of
different kubernetes
and sure enough again
they didn't configure the docker
sufficiently so we can break out into
all of these hundreds of kubernetes
environments and basically take down the
entire mobile network
right so you see how few steps are
actually required um to take control of
an entire network or then take it down
the os to the whole network
and again
none of this is telco specific and in
fact if this went a presentation on
telco networks you could explain
something very similar about most of the
private cloud environments that
companies are building basically
everybody is working on something
similar right now
so let's talk a little bit about uh how
to build those infrastructures better
telco open ran whatever infrastructure
you have right
um obviously you know configure your
kubernetes better or not the kubernetes
itself the pods and the docker
containers running in your kubernetes
kubernetes gives you all of these
different configuration settings make
good use of them and and be considerate
and be
and acknowledge that it's not virtual
machines running in vmware anymore that
uh that um
that are much tighter mesh together
we're gonna go go through this in detail
this is more a
take home list in case you are working
on any technology like this now for
mobile networks more generally we've
been giving um kind of these generic
pieces of advice for years now and again
it just
traverses
telco networks
all of these are easily set and in fact
um you know in our community here we
always wonder why do networks
not do this by default right the whole
security by design i mean i don't know
who coined that term but it's definitely
older than my interest in security so
people 20 30 years ago would have used
that concept and yet today it's not yet
found everywhere and uh i wanted to just
alert you to the complexity of acting
even on simple advice um with two
examples to to conclude what i'm
presenting today
um
the first example of where
um
the reality is just much more
complicated uh than you would imagine is
patching on hardening right come to base
security processes if you don't patch
yourself you don't you don't harden your
stuff you might just as well not do any
security at all it's really absolute
baseline and why do mobile networks not
get hardened i mean for different
reasons in kind of the closed
architectures that were deployed up
until today and is open including open
ran architectures that are running on
clouds so traditionally i mean there's
really no excuse why they don't patch
other than
the way they deploy these networks where
they say once we deploy it we don't
touch it anymore the vendor in china in
sweden wherever they first have to go
through
months long test procedures before they
can say that a new release is ready and
can be deployed i mean if the test
procedure takes several months and then
deployment takes several months you
might just as well not be patching i
mean you're months behind on the
patching right so usually you get
security patches about once a year these
are standard linux boxes that are one
year outdated every cve in the world
applies to them right so it's just an
ecosystem breakdown the way that these
things are procured uh just doesn't
allow for patching that excuse goes away
in these cloud environments right um
in a cloud you control everything you uh
you in fact you're changing stuff so
often you might just as well
redeploy it with new patches
netflix had an interesting strategy
around it netflix had basically in each
of their virtual machines or docker
containers they have a
self-destruct timer that runs out at 72
hours so each each docker destroys
itself after 72 hours then it's rebuilt
from a cicd pipeline and the clcd
pipeline of course has all the latest
patches built in so
netflix doesn't have patch management
they only have basically suicide of
virtual machines right um
but
now the complication in mobile networks
is who would be able to pull together
your patches because each of those
dockers is a in an individual an
individually stripped down version of
linux so nobody even knows what uh what
packages you would have to apply and how
this is not coming from red ted or
debian this is just a custom linux and
if you run your own custom linux you are
responsible for patch management and
there's dozens of vendors involved and
of course
they don't run linux distros for
business so patching is just so hard in
telcos and i mean it breaks my heart
right years later still very little
progress similar and this is the final
example that i'll leave you with um
standard security tools like an edr
system right we do a lot of red teaming
and when we encounter an edr it usually
sets us back by about a week takes like
a week to find a way to circumvent it
it's you know a good slowdown measure
for hackers right do we encounter them
in mobile networks no
well for basically the same reasons
because
um the the old-school network vendors do
not really allow uh you to deploy
anything on the linux boxes and they
don't come with an edr so there is no
idea sometimes you can force us onto
there if you you know sign it if the edr
breaks the availability of the network
you're actually responsible so we have
seen cases where this is done but only
ever was false against the vendor
in the kubernetes docker environment
again same question these are
stripped-down versions of linux no edr
system will work on this out of the box
these are basically uh embedded linux
you could call it right ida just isn't
made for that right so we're basically
in a situation now where telco networks
have become cloud environments but where
the standard security process is like
patching hardening and the standard
security tools like edr do not readily
apply them right big protection gap and
um
i i hope you all
consider this a challenge right either
to to become more of a telco hacker no
matter what part of hacking you're
coming from i'm sure you saw some
commonality today where basically
hackers uh telco networks have grown
into your area of expertise but also if
you're building uh networks and if
you're securing networks um i'd really
like to invite you to to uh consider
securing telco networks in the future we
all rely on them for our digital
lifestyles right so it's important to
keep those networks secure like we're
already keeping cloud infrastructure
secure right um yeah and with that i'm
i'm at the end all this left to me is
thank you for for sitting here in this
hot tent with me and and bringing back
so many good memories to to the series
of conferences um i'll be around if you
have any questions on telco on cloud on
red teaming already missing berlin so if
you ever want to do some project with us
i love to do that and yeah now over to
your questions please thank you
[Music]
thank you carson um we we have a few
minutes for
questions if you have a question please
walk over to the microphone in the
middle there are two microphones in the
middle please line up
[Music]
first question here you go
hey first of all thanks a lot um we've
had similar situations with industrial
devices with medical devices and
stuff that should be expected like fact
management and everything that was
clearly not a given and we've seen some
certification efforts and some
initiatives that were going to the right
direction so i guess my question boils
down to
do you see a way out whether through
incentives or just we're waiting for a
doomsday scenario how do you see things
evolving
uh very good question so
certainly the
both the industry and different
governments are pushing towards more uh
security um the government's more than
the industry very much based on the
checklist approach where they say we
want to we want you to prove that your
network is secure at one point in time
what happens after that we're not so
concerned with so um certification is is
good and meaningful to to introduce a
guideline or baseline rather i just
haven't seen the one certification that
would address problems like these right
i'm seeing certifications more around
you know you have to prove that you're
not from china that's basically a big
part of the certification now basically
protecting yourself from political
influence i mean yeah that might be
important i don't care i mean i wanted
this to to to be secure from hackers
from anywhere in the world not just from
china right um other parts of the
certification lets you uh prove that
your cryptography is configured
correctly those things great but
cryptography hasn't been a problem
basically since 3g people haven't broken
the cryptography anymore so
um yeah i wouldn't hold my breath for
certification to solve this i think that
it'd be individual companies going
forward saying you know um we are we we
have an i.t history and we we make uh
our telco networks secures our t
networks all big telcos have cloud
environments and they make their cloud
environments more secure than the telco
environment and that to me is a weird
situation
next question please thank you
hello
i may have slightly misunderstood this
but is the
what does open ran in what's the open
mean are there
open source platforms or freely
available platforms that we can
run ourselves if we want to experiment
with this kind of things yeah no that's
an excellent question and um i think
that the naming is very unfortunate in
open ran so um
basically what summarizes openran is a
push from the telcos against to tell the
vendors to say we're not going to buy
your hardware anymore we install our own
hardware and you need to ship a software
that's an umbrella the open comes from
the the interfaces between hardware and
software need to be open so that
different pieces of software fit on
different different vendors hardware in
its openness it does not include open
source it does not even include open
standards you have to pay to access
those open standards so it's very
different from what this community would
call open but you know baby steps in the
right direction yeah
thank you good question
uh thank you for your talk uh so quick
question so does the law um
lawful intercept components also run in
kubernetes
oh that's a very good question so um no
um so far not um
but that's just because those vendors
they're they're behind the curve i'm
sure you know the few vendors i'm not
gonna name them but it's basically
monopolies per country uh that just say
you know why why do we need to change we
have a monopoly market you build our
appliance into your uh network no matter
how and they might use just ss7 for that
uh yeah a quick other yes or no question
sorry next question because we have
really no time i'll be around later just
find me later so i
i just wanted to understand how it is
moving to cloud infrastructure that
mobile telecom infrastructure
yeah i mean
if if
if you have to deploy stuff in hundreds
of places around the country and you
already know that it's going to change
every week cloud is the only answer
logical answer so basically
cloudifying telco networks is a
consequence of 5g's desire to have low
latency let's say your car wants to
signal to the car behind you that you're
braking you don't have time to send that
signal off to telco network send it to
some central location get the signal
back get it sent to that other car the
crash will have happened right we're
looking at single-digit milliseconds
delays from car to car and that only
happens if each little region each city
basically has their own cloud
environment um that's why everything
intelligence in the future will be cloud
and i hope that answers your question
yeah and we're out of time no
sorry it's actually exactly 10 4 so we
have to move over and make space for the
next talk which is also a very
interesting talk about how we moved out
of the pandemic but first yeah please
have a great thanks for carsten
[Applause]
you