day1_Hacking-telco-equipment-The-HLR-HSS-Laurent-Ghigonis-p1sec

More documents

Recommendations

Info

Qemu/KVM qemu-system-x86_64 \ -machine type=pc,accel=kvm:tcg -pidfile ./myhlr.pid \ -m 7.2g -smp 4 -drive file=/dev/mapper/lvm-vm--myhlr,cache=none \ -vnc 127.0.0.1:2,password,tls,lossy -display curses -rtc base=localtime,driftfix=slew \ -net vde,vlan=1,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=1,macaddr=52:54:00:00:10:01 \ -net vde,vlan=2,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=2,macaddr=52:54:00:00:10:02 \ -net vde,vlan=3,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=3,macaddr=52:54:00:00:10:02 \ -net vde,vlan=4, sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=4,macaddr=52:54:00:00:10:02 \ -net vde,vlan=5,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=5,macaddr=52:54:00:00:10:02 \ -net vde,vlan=6,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=6,macaddr=52:54:00:00:10:02 \ -net vde,vlan=7,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=7,macaddr=52:54:00:00:10:02 \ -net vde,vlan=8,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=8,macaddr=52:54:00:00:10:02 \ -net vde,vlan=9,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=9,macaddr=52:54:00:00:10:02 \ -net vde,vlan=10,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=10,macaddr=52:54:00:00:10:02 \ -net vde,vlan=11,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=11,macaddr=52:54:00:00:10:02 \ -net vde,vlan=12,sock=/home/vm-kvm/myhlr/vde-myhlr.ctl -net nic,vlan=12,macaddr=52:54:00:00:10:02 • Physical partition for disk – Do not use disk file on host btrfs • super slow • ext4 is ok – http://www.linux-kvm.org/page/Tuning_KVM • Curses output • Improvements: serial terminal 2014, Hackito Ergo Sum - Security Conference
Qemu/KVM • Solaris 10 – Qemu/KVM ok for x64 – Fails for SPARC • Stock kernel – /kernel – /usr/kernel • Custom kernel modules – For Telecom Signaling [Signalware] • Uses grub • Failsafe mode 2014, Hackito Ergo Sum - Security Conference
Page 1 and 2: Hacking Telco equipment The HLR/HSS
Page 3 and 4: Mobile Operators • Conveys the ma
Page 5 and 6: Mobile Operators and governance •
Page 7 and 8: HLR/HSS in Mobile Core Network 2014
Page 9 and 10: HLR/HSS in Mobile Core Network 2014
Page 11 and 12: HLR/HSS in Mobile Core Network HLR/
Page 13 and 14: 2014, Hackito Ergo Sum - Security C
Page 15 and 16: HLR/HSS Virtualization No, it’s n
Page 17 and 18: An HLR/HSS is an ecosystem • HLR
Page 19 and 20: Where to start • Most exposed fro
Page 21 and 22: Virtualization of HLR/HSS Frontend
Page 23: Qemu/KVM • Faster than VirtualBox
Page 27 and 28: System Analysis 2014, Hackito Ergo
Page 29 and 30: The filesystem • ZFS offers good
Page 31 and 32: Some packages installed application
Page 33 and 34: Local roots • Of course, we often
Page 35 and 36: Example of Telco network stack: NSN
Page 37 and 38: Fuzzing SS7: M3UA • Example: Floo
Page 39 and 40: Fuzzing SS7: SCCP 2014, Hackito Erg
Page 41 and 42: Fuzzing Diameter • Process Crash
Page 43 and 44: Binaries reverse 2014, Hackito Ergo
Page 45 and 46: Signalware Kernel modules • Examp
Page 47 and 48: Signalware userland binaries • Pa
Page 49 and 50: • Misconceptions! So verdict ? -
Page 51 and 52: Consequences • Mobile Network cra
Page 53 and 54: Recommendations: securing the OS
Page 55 and 56: To be continued • Telecom Network
Page 57 and 58: References Governance literature on

day1_Hacking-telco-equipment-The-HLR-HSS-Laurent-Ghigonis-p1sec

Create successful ePaper yourself

Delete template?

Save as template?