0

Just listened to a bit of the Darknet Diaries podcast episode on NotPetya. It’s insane just the damage it was able to cause even if it was only able to infect one machine initially. Which got me wondering: how could a similar large-scale attack happened?

Then I thought about cell towers. Our phones blindly connect to them every day. In fact, attackers can set up rogue towers that trick phones into connecting to them instead in order to perform a MITM attack. They just have to broadcast a stronger signal. That’s crazy.

So I was wondering: aren’t cell towers basically routers? If so, if an attacker was able to take control of one, and if they had some sort of iOS/Android 0-day in how devices receive packets or whatever, could an attacker essentially spread such a wide-scale attack like NotPetya launched?

3

Relevant talk: https://media.ccc.de/v/36c3-10737-sim_card_technology_from_a-z


Our phones blindly connect to them every day.

Wrong, towers need to authenticate; if you're not using obsolete 2G ciphers, that auth can and will be relatively secure.

In fact, attackers can set up rogue towers that trick phones into connecting to them instead in order to perform a MITM attack. They just have to broadcast a stronger signal. That’s crazy.

and not the case. The average stingray just gets the phone far enough to register with its unique ID.

Not saying that you can't build a malicious cell interceptor, but it'll require cryptographic cooperation with the mobile network operator. (Or a really old phone that accepts downgrade attacks to insecure ciphers, but I think these have become rather rare.)

So I was wondering: aren’t cell towers basically routers?

No, not really; the infrastructure behind is. However, you control the base station, you define what backend phones connect to.

If so, if an attacker was able to take control of one, and if they had some sort of iOS/Android 0-day in how devices receive packets or whatever, could an attacker essentially spread such a wide-scale attack like NotPetya launched?

No, because every software distribution system I can think of uses TLS, and/or software signatures.

and if they had some sort of iOS/Android 0-day in how devices receive packets or whatever, could an attacker essentially spread such a wide-scale attack like NotPetya launched?

It's impossible to discuss the functionality of hypothetical 0-days, since their capabilities are undefined. If there's a weakness that allows the operator of an MNO to execute code locally, well, then it can. Otherwise it can't.

  • Oh thank you for your corrections! I have to ask, though, what does implementing TLS and/or software signatures have to do with not being able to distribute malware/0-day exploit? Don’t regular old servers use TLS? – Min Jun Kim Jan 1 at 15:09
  • who uses regular old servers without TLS to download software? Under which circumstances do you see that happening? – Marcus Müller Jan 1 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.