7 ms·

President Speaking: Spoofing Alerts in 4G LTE Networks (2019) [pdf]

112 points by gammarator 3y ago

talonx 3y ago
(PDF)
- dang 3y ago
  Added. Thanks! (...ach those pdfs...)
ggm 3y ago
Interesting use of the concept of "false alert" -the Hawaii Missile alert was valid, well formed and conformed to protocol in the Layer1 and Layer2 senses. It was a message which was capable of being sent and acted on by software systems. The problem was, it wasn't initiated through the auspices of the channels which are permitted to approve a message. So, it was "false" in the higher layer senses, not in the actual formal structure, more in the process chains. Ronald Reagan hot-microphone "I declared war on Russia" as a sound check is a bit more in the "false" space. Or, that txt message Abraham Lincoln sent about trust on the internet. To me, the falsity begs a layer question. If the lower layers are well formed, the falsity has to lie in the higher layer processes. It was a falsely authorised message. It was sent over the correct channels, injected by the correct endpoints. It just wasn't what had been approved to be sent. (if approved at all) -Thats not "false" thats "unapproved" The problem is as much with the name, as with the formalisms around sending. If you want this to really be a presidential alert then wire it to some MFA which is bound to the current occupant of the role. If its just that guy getting his guy to call some guy who approves a tech at AT&T sending a message, then it shouldn't have been called a presidential message. (hats off to the authors of the paper who did some stellar work on spoofing a send event, and show how it would work in a small radius of a transmitter in an event like a football game)
- ThePowerOfFuet 3y ago
  >That's not false, that's unapproved. I get your point, but — it was not true, therefore it was false.
  - ggm 3y ago
    Yea, I'm sniping on the side about language, the core message is "it shouldn't have been sent as-is"
  - j16sdiz 3y ago
    not, if you take he law of excluded fourth https://en.m.wikipedia.org/w/index.php?title=Law_of_excluded_fourth&redirect=no https://en.m.wikipedia.org/w/index.php?title=Law_of_excluded...
- thakoppno 3y ago
  > My fellow Americans, I'm pleased to tell you today that I've signed legislation that will outlaw Russia forever. We begin bombing in five minutes. https://en.m.wikipedia.org/wiki/We_begin_bombing_in_five_minutes https://en.m.wikipedia.org/wiki/We_begin_bombing_in_five_min...
- atoav 3y ago
  Avoiding such false messages on the human layer is all about interface design and we know how to do that in principle. The problem is just that it isn't done always when it is needed. In case of the Hawaii missle alert there are multiple sources describing the UI as being two similar looking buttons right next to each other: https://www.theguardian.com/technology/2018/jan/15/hawaii-missile-false-alarm-design-user-interface https://www.theguardian.com/technology/2018/jan/15/hawaii-mi... Just make the actual missle alert button big and red and have users confirm a prompt after clicking. In Reagans case it is also about the "interface". If footage that leaved the set is not checked, because there is no delay, well then unchecked footage goes out.
- w1nst0nsm1th 3y ago
  > Or, that txt message Abraham Lincoln sent about trust on the internet. Abraham Lincon is still alive ?
  - wizerdrobe 3y ago
    Yes, I am. Or if you’re asking in earnest there’s a meme of the format: “You can’t trust quotes on the internet - Abraham Lincoln” - the joke being Lincoln couldn’t have written the joke for the internet was not yet invented at the time of his passing. https://knowyourmeme.com/photos/1952141-abraham-lincoln https://knowyourmeme.com/photos/1952141-abraham-lincoln
waterproof 3y ago
> Fixing this problem will require a large collaborative effort between carriers, government stakeholders, and cell phone manufacturers. Do we know if any of this has been patched since the paper in 2019? One could hope…
- ticoombs 3y ago
  HA! In a serious note, this will most likely never be patched. SS7 vulnerabilities have been know for even longer but the sheer effort needed to collaborate between every single company, manufacturer and policy makers make it a non starter. Also having the possibility of making it so all old phones no longer get these messages could also be an accessibility problem that gets whomever tries to run with it kicked out of office. With current climates being 3/4 years max in office with the possibility the next person will scrap whatever you do... makes it a hard problem to solve.
  - vlovich123 3y ago
    You could build a more secure version and mandate it’s the only one used for new devices / in all future SW updates for phones. Over time it would supplant the old one and the vast majority of people would get the secure alert today. During an emergency you’d send both but spoofs would only be able to hit old phones that don’t receive software updates / don’t support the secure variant. Securing is also pretty simple since the government could just publish the public key they’ll use for signing these alerts and OS vendors could refresh that key on a regular basis.
    - seszett 3y ago
      > Securing is also pretty simple since the government could just publish the public key they’ll use for signing these alerts and OS vendors could refresh that key on a regular basis. That would mean hundreds of keys to manage and regularly update, with various entities at various levels of government needing their own keys, etc. It's not impossible, but it certainly wouldn't be pretty simple for OS vendors.
callalex 3y ago
(Context: today there was rare a pre-scheduled test of the emergency broadcast system that buzzed every phone and radio in the entire United States. It seems to have generally been successful, and it’s genuinely amazing to think about the sheer scale and reach of this system.)
- INTPenis 3y ago
  What weird timing because I just got my first ever "Presidential alert" in Croatia because a plastics factory was burning south of my city. Luckily there was a northernly wind all day.
  - genericacct 3y ago
    Same here in italy, they're testing the alert system. Only my huawei called it "presidential" though, the xiaomis just called it an alert. However i am assuming that the european alert standard is based on an earlier protocol than LTE, does anyone have any info?
    - INTPenis 3y ago
      I have a pixe 6 so maybe this "Presidential" thing is from the US.
    - deepserket 3y ago
      Right after the IT-alert the quality of my mobile internet connection plummeted for almost an hour, my ping from Italy to Netherlands was between 100 and 600ms (usually it's 30-55ms). My guess is that some people weren't aware of the test and started calling their relatives asking questions.
    - asdfjhsdfjklh 3y ago
      same in germany around the 1st. was at a store with friends from the US and china. Everyone one's phones started to ping. Even the US and china ones on roaming (or local sim cards? don't really know)
- 3y ago
z991 3y ago
Summary: https://pdf2gpt.com/?summary=3ade1d183ee74c0aa8fff901e892dc57 https://pdf2gpt.com/?summary=3ade1d183ee74c0aa8fff901e892dc5...
aftbit 3y ago
Why on earth are these messages not signed with a key that is distributed to the phones by the carriers?
- supertrope 3y ago
  Key management is challenging when scaled to an entire nation. Also the trust model in broadcasting is not end to end. On cellular networks especially before 4G the phones trust the network implicitly.
myvoiceismypprt 3y ago
[dead]

112 points by gammarator 3y ago

talonx 3y ago

(PDF)

dang 3y ago
Added. Thanks! (...ach those pdfs...)

ggm 3y ago

Interesting use of the concept of "false alert" -the Hawaii Missile alert was valid, well formed and conformed to protocol in the Layer1 and Layer2 senses. It was a message which was capable of being sent and acted on by software systems. The problem was, it wasn't initiated through the auspices of the channels which are permitted to approve a message. So, it was "false" in the higher layer senses, not in the actual formal structure, more in the process chains. Ronald Reagan hot-microphone "I declared war on Russia" as a sound check is a bit more in the "false" space. Or, that txt message Abraham Lincoln sent about trust on the internet. To me, the falsity begs a layer question. If the lower layers are well formed, the falsity has to lie in the higher layer processes. It was a falsely authorised message. It was sent over the correct channels, injected by the correct endpoints. It just wasn't what had been approved to be sent. (if approved at all) -Thats not "false" thats "unapproved" The problem is as much with the name, as with the formalisms around sending. If you want this to really be a presidential alert then wire it to some MFA which is bound to the current occupant of the role. If its just that guy getting his guy to call some guy who approves a tech at AT&T sending a message, then it shouldn't have been called a presidential message. (hats off to the authors of the paper who did some stellar work on spoofing a send event, and show how it would work in a small radius of a transmitter in an event like a football game)

ThePowerOfFuet 3y ago
>That's not false, that's unapproved. I get your point, but — it was not true, therefore it was false.
- ggm 3y ago
  Yea, I'm sniping on the side about language, the core message is "it shouldn't have been sent as-is"
- j16sdiz 3y ago
  not, if you take he law of excluded fourth https://en.m.wikipedia.org/w/index.php?title=Law_of_excluded_fourth&redirect=no https://en.m.wikipedia.org/w/index.php?title=Law_of_excluded...
thakoppno 3y ago
> My fellow Americans, I'm pleased to tell you today that I've signed legislation that will outlaw Russia forever. We begin bombing in five minutes. https://en.m.wikipedia.org/wiki/We_begin_bombing_in_five_minutes https://en.m.wikipedia.org/wiki/We_begin_bombing_in_five_min...
atoav 3y ago
Avoiding such false messages on the human layer is all about interface design and we know how to do that in principle. The problem is just that it isn't done always when it is needed. In case of the Hawaii missle alert there are multiple sources describing the UI as being two similar looking buttons right next to each other: https://www.theguardian.com/technology/2018/jan/15/hawaii-missile-false-alarm-design-user-interface https://www.theguardian.com/technology/2018/jan/15/hawaii-mi... Just make the actual missle alert button big and red and have users confirm a prompt after clicking. In Reagans case it is also about the "interface". If footage that leaved the set is not checked, because there is no delay, well then unchecked footage goes out.
w1nst0nsm1th 3y ago
> Or, that txt message Abraham Lincoln sent about trust on the internet. Abraham Lincon is still alive ?
- wizerdrobe 3y ago
  Yes, I am. Or if you’re asking in earnest there’s a meme of the format: “You can’t trust quotes on the internet - Abraham Lincoln” - the joke being Lincoln couldn’t have written the joke for the internet was not yet invented at the time of his passing. https://knowyourmeme.com/photos/1952141-abraham-lincoln https://knowyourmeme.com/photos/1952141-abraham-lincoln

waterproof 3y ago

> Fixing this problem will require a large collaborative effort between carriers, government stakeholders, and cell phone manufacturers. Do we know if any of this has been patched since the paper in 2019? One could hope…

ticoombs 3y ago
HA! In a serious note, this will most likely never be patched. SS7 vulnerabilities have been know for even longer but the sheer effort needed to collaborate between every single company, manufacturer and policy makers make it a non starter. Also having the possibility of making it so all old phones no longer get these messages could also be an accessibility problem that gets whomever tries to run with it kicked out of office. With current climates being 3/4 years max in office with the possibility the next person will scrap whatever you do... makes it a hard problem to solve.
- vlovich123 3y ago
  You could build a more secure version and mandate it’s the only one used for new devices / in all future SW updates for phones. Over time it would supplant the old one and the vast majority of people would get the secure alert today. During an emergency you’d send both but spoofs would only be able to hit old phones that don’t receive software updates / don’t support the secure variant. Securing is also pretty simple since the government could just publish the public key they’ll use for signing these alerts and OS vendors could refresh that key on a regular basis.
  - seszett 3y ago
    > Securing is also pretty simple since the government could just publish the public key they’ll use for signing these alerts and OS vendors could refresh that key on a regular basis. That would mean hundreds of keys to manage and regularly update, with various entities at various levels of government needing their own keys, etc. It's not impossible, but it certainly wouldn't be pretty simple for OS vendors.

callalex 3y ago

(Context: today there was rare a pre-scheduled test of the emergency broadcast system that buzzed every phone and radio in the entire United States. It seems to have generally been successful, and it’s genuinely amazing to think about the sheer scale and reach of this system.)

INTPenis 3y ago
What weird timing because I just got my first ever "Presidential alert" in Croatia because a plastics factory was burning south of my city. Luckily there was a northernly wind all day.
- genericacct 3y ago
  Same here in italy, they're testing the alert system. Only my huawei called it "presidential" though, the xiaomis just called it an alert. However i am assuming that the european alert standard is based on an earlier protocol than LTE, does anyone have any info?
  - INTPenis 3y ago
    I have a pixe 6 so maybe this "Presidential" thing is from the US.
  - deepserket 3y ago
    Right after the IT-alert the quality of my mobile internet connection plummeted for almost an hour, my ping from Italy to Netherlands was between 100 and 600ms (usually it's 30-55ms). My guess is that some people weren't aware of the test and started calling their relatives asking questions.
  - asdfjhsdfjklh 3y ago
    same in germany around the 1st. was at a store with friends from the US and china. Everyone one's phones started to ping. Even the US and china ones on roaming (or local sim cards? don't really know)
3y ago

z991 3y ago

Summary: https://pdf2gpt.com/?summary=3ade1d183ee74c0aa8fff901e892dc57 https://pdf2gpt.com/?summary=3ade1d183ee74c0aa8fff901e892dc5...

aftbit 3y ago

Why on earth are these messages not signed with a key that is distributed to the phones by the carriers?

supertrope 3y ago
Key management is challenging when scaled to an entire nation. Also the trust model in broadcasting is not end to end. On cellular networks especially before 4G the phones trust the network implicitly.

myvoiceismypprt 3y ago

[dead]