3 ms·

Are GTP packets exchanged between peering providers? As in, would the C2 server have to be operated by a complicit telco in order to receive the packets? Or do

Are GTP packets exchanged between peering providers? As in, would the C2 server have to be operated by a complicit telco in order to receive the packets? Or do they make it to the public Internet somewhere? If it's the former, then it seems very un-stealthy. Like, if the GTP packets are making their way back to e.g. China Unicom, it's going to be hard to deny they were in on the operation. Which, maybe they don't care, but it seems like they're risking blacklisting.

haxrob 3y ago
Recommend taking a read of CrowdStrike's write up on this [1]. The threat actor maintains a presence on the roaming exchange through compromising "at least 13 telecommunication companies". > If it's the former, then it seems very un-stealthy In this article there is one example where the outbound connectivity to the Internet was via a "SGSN emulator in a loop, attempting to connect to a set of nine pairs of International Mobile Subscriber Identity (IMSI) and Mobile Subscriber Integrated Services Digital Network (MSISDN) numbers." In this example, the transit traffic before egress to the Internet would appear to be legitimate subscriber traffic - user payload encapsulated in a PDP context / GTP tunnel to another telco's GGSN / packet gateway. > Which, maybe they don't care, but it seems like they're risking blacklisting. By compromising so many telcos, there are many points of redundancy for persistence on the roaming exchange. This threat actor has remained on telco networks for many years undetected - their techniques are apparently are quite effective. [1] https://www.crowdstrike.com/blog/an-analysis-of-lightbasin-telecommunications-attacks/ https://www.crowdstrike.com/blog/an-analysis-of-lightbasin-t...
- danielwmayer 3y ago
  Thanks for the shout out Rob :) Great writeup yourself!
  - haxrob 3y ago
    For those wondering, danielwmayer is one of the authors of the CrowdStrike article linked in the parent.
- sterlind 3y ago
  holy mackerel, I had no idea their operation was so large. that's terrifying; I hope their network has been rolled up following Crowdstrike's article. in any event, it sounds like they don't have any shortage of outbound connectivity options.
numpad0 3y ago
I think, there being GTP traffic originating from victim S-GW through interface to GRX destined to P-GW at complicit/compromised foreign carrier should be normal. Although, there being no corresponding traffic towards the cell towers for the GTP packets would be weird, and initial port knocking on which victim carrier S-GW would initiate VPN over would be weird too. The diagram in the article is succinct but only a small part of complex full 3GPP architecture[1][2]. I kind of suspect it had probably been easy enough to chalk such traffic up to "a buggy implementation they're using over there" for a while. 1: https://yatebts.com/documentation/concepts/lte-concepts/ https://yatebts.com/documentation/concepts/lte-concepts/ 2: https://github.com/nickel0/3GPP-Overall-Architecture/blob/master/diagram/3GPP_Overall_Architecture_and_Specifications.pdf https://github.com/nickel0/3GPP-Overall-Architecture/blob/ma...

haxrob 3y ago

Recommend taking a read of CrowdStrike's write up on this [1]. The threat actor maintains a presence on the roaming exchange through compromising "at least 13 telecommunication companies". > If it's the former, then it seems very un-stealthy In this article there is one example where the outbound connectivity to the Internet was via a "SGSN emulator in a loop, attempting to connect to a set of nine pairs of International Mobile Subscriber Identity (IMSI) and Mobile Subscriber Integrated Services Digital Network (MSISDN) numbers." In this example, the transit traffic before egress to the Internet would appear to be legitimate subscriber traffic - user payload encapsulated in a PDP context / GTP tunnel to another telco's GGSN / packet gateway. > Which, maybe they don't care, but it seems like they're risking blacklisting. By compromising so many telcos, there are many points of redundancy for persistence on the roaming exchange. This threat actor has remained on telco networks for many years undetected - their techniques are apparently are quite effective. [1] https://www.crowdstrike.com/blog/an-analysis-of-lightbasin-telecommunications-attacks/ https://www.crowdstrike.com/blog/an-analysis-of-lightbasin-t...

danielwmayer 3y ago
Thanks for the shout out Rob :) Great writeup yourself!
- haxrob 3y ago
  For those wondering, danielwmayer is one of the authors of the CrowdStrike article linked in the parent.
sterlind 3y ago
holy mackerel, I had no idea their operation was so large. that's terrifying; I hope their network has been rolled up following Crowdstrike's article. in any event, it sounds like they don't have any shortage of outbound connectivity options.

numpad0 3y ago

I think, there being GTP traffic originating from victim S-GW through interface to GRX destined to P-GW at complicit/compromised foreign carrier should be normal. Although, there being no corresponding traffic towards the cell towers for the GTP packets would be weird, and initial port knocking on which victim carrier S-GW would initiate VPN over would be weird too. The diagram in the article is succinct but only a small part of complex full 3GPP architecture[1][2]. I kind of suspect it had probably been easy enough to chalk such traffic up to "a buggy implementation they're using over there" for a while. 1: https://yatebts.com/documentation/concepts/lte-concepts/ https://yatebts.com/documentation/concepts/lte-concepts/ 2: https://github.com/nickel0/3GPP-Overall-Architecture/blob/master/diagram/3GPP_Overall_Architecture_and_Specifications.pdf https://github.com/nickel0/3GPP-Overall-Architecture/blob/ma...