6 ms·
Regin: Nation-state ownage of GSM networks
- rsync 12y agoHow did they get to these GSM stations from the infected windows systems ? Do BSC/BTS typically have IP-accessible configuration ? Regardless of how they connected (I thought SS7 ...) wouldn't there be a login to access the switch BSC controls ... how would the malware have that ? I don't understand how the malware running on the windows system executed the commands on the BSC.
- lovelearning 12y agoMy understanding is that those logs are of configuration commands[1] sent by operators from a compromised OSS management server running Windows to the BSCs it's managing. [1]: http://www.academia.edu/6018279/Oss_commands_-_Win_Fiol http://www.academia.edu/6018279/Oss_commands_-_Win_Fiol
- gurtwo 12y agoThe BSC has several interfaces. One of them is the APG, used for Operation & Maintenance. It's a Windows module, accessible by IP. The APG serves as a gateway to the node's core via MML (Man-Machine Language), the instructions to operate the node.
- rsync 12y agoSo if you're running heavy equipment in a nuclear refining operation, you use microsoft windows to run your heavy equipment (centrifuges). If you're a mobile network operator, you use microsoft windows to access and administer the base stations out in the field. Pray tell: how important or sensitive does something have to be before someone finally asks "hmm ... maybe we shouldn't use microsoft windows for this" ?
- paralelogram 12y agoIf you're a mobile network operator, you use microsoft windows to access and administer the base stations out in the field. It doesn't change much because the base station software probably has more security bugs than Windows.
- rdl 12y agoYou don't normally browse random websites through the base station administration software, though.
- lotophage 12y agoThe module names "legspin" and "willischeck" refer to the sport of Cricket.
- AlyssaRowan 12y agoI don't think any of this is strictly cricket :-) I didn't know about that relation for "willischeck", but since both NSA and GCHQ have used this, while I don't recognise those covernames, I'm guessing therefore those may well be Cheltenham's, whereas U_STARBUCKS (UNITEDSTARBUCKS?) is probably Fort Meade's. Newbies need a reminder about meaningless covernames. :-)
- gadders 12y agoI know what Leg Spin is but what is a "Willis Check"?
- deleted 12y ago[deleted]
- pbsd 12y agoCurious; Symantec's report said the RC5 encryption was performed in CFB mode, but this is not the case. Instead, we have a weird combination of CBC and CFB, with CFB being used solely for the last block (instead of padding or ciphertext-stealing). This has the look of seriously legacy code. This seems to be a very old mode: I have trouble finding references to it with less than 20 years. This mode is in [1, pg. 151] and [2, pg. 77], as far as I can find, both of which were published in 1982. [2] also introduced ciphertext stealing, albeit a bugged version [3, §6]. [1] http://faculty.nps.edu/dedennin/publications/Denning-CryptographyDataSecurity.pdf http://faculty.nps.edu/dedennin/publications/Denning-Cryptog... [2] http://www.amazon.com/Cryptography-Dimension-Computer-Security-A-Implementation/dp/0471048925 http://www.amazon.com/Cryptography-Dimension-Computer-Securi... [sorry, no PDF link] [3] http://web.cs.ucdavis.edu/~rogaway/papers/steal.pdf http://web.cs.ucdavis.edu/~rogaway/papers/steal.pdf
- willvarfar 12y agoI am surprised that the data files that are meant to be sent to the C&C aren't encrypted with a public key so only the intended recipients can decrypt them. This would thwart discovering what information had already been extracted after an infection was discovered.
- deleted 12y ago[deleted]
- crishoj 12y agoThe remarkable delay in reporting these findings is deliberate?
- rurban 12y agoSo according to the timestamps it's pretty clear it's only the US, not UK nor Israel, who developed this software.
- k-mcgrady 12y agoCould you explain how you're coming to that conclusion?
- AlyssaRowan 12y agoTimezones, if accurate, don't seem to necessarily rule out UK contractors working afternoons-evenings for some of it. GCHQ have definitely used it, I know that much. I see nothing that looks Israeli to me in this one? Are you thinking about Myrtus?
- k-mcgrady 12y agoNormally reading something like this wouldn't interest me as it would be over my head but I found this fascinating. Thanks for posting it. It sounds like it's been known about for several years - why is it only being talked about now?
- peterwwillis 12y ago> "Finally, the word 'shit' appears in many places throughout the code and modules." Someone's boss is gonna be peeved! (Also, this would be a good indicator of a native English speaker developing the software; I doubt most developers put curse words into their code in a non-native language) I don't find the GSM attacks unusual or interesting. Sure, it might be new for an Internet worm, but government-sponsored orgs have been pushing attacks on infrastructure like GSM networks since the L0pht days (though back then I think satellites were more in vogue), and they're constantly looking for new ways to infiltrate foreign networks of any type. This just shows someone's pet research project from a decade ago made it out of the lab. It's also interesting to note that while this is useful for nation-states, they're not necessarily developed directly by a nation-state, and there could be multiple organizations using the same malware package. One way to see multiple independent actors using the same package would be to look for different cryptographic keys, C&C servers, and discrete distributed victim-networks.