Diameter protocol has been introduced to replace in many aspects SS7/SIGTRAN in the LTE and VoLTE networks, and such as these 2G/3G networks, Diameter also has its dedicated global roaming network named IPX (IP eXchange) that allows international roaming for LTE users..
Back in the days Diameter was already used by the PCRF in 2G/3G networks for charging purposes, but its usage has been extended to completely replace the signalization role of SS7/SIGTRAN in LTE networks. SS7/SIGTRAN security flows are now public after several publications, but what about Diameter security ? By replacing old and insecure protocols, does Diameter come with built-in security?
During the presentation, we will study how the IPX infrastructure operates and how security is taken into account nowadays regarding the newest 4G telecom technologies. Getting into different point of view allowed us to find major Diameter vulnerabilities via the IPX, which affect almost all the network elements HSS, MME, GMLC, PCRF, PDN GW, including DNS serving telecom TLDs. Understanding the mistakes that led to a former generation of telecom networks we came out with insecure protocols will maybe help us to push security by design in the future.
Nevertheless, as a telecom provider we will provide recommendations to secure LTE infrastructures and share technical countermeasures we have implemented against different Diameter attacks and fraud scenarios to protect our network and customers. Along with recommendations, we will present some ways on how to self audit and do self monitoring of your network, as we consider that telecom providers need to take back the control of their networks!
As telecom security researcher, Alexandre De Oliveira is part of the POST.lu CSE Red Team. Previously coming from P1 Security were he provided security expertise around SS7/SIGTRAN and LTE technologies and infrastructures for major telecom networks, he has always been looking for new security challenges around unknown & proprietary technologies that telecom networks cherish so much. Speaker at different conferences about telecom security, Alexandre has been part of the SS7map project, presented at the 31C3, and he also talked about Worldwide SS7/SIGTRAN security flows during Hackito Ergo Sum 2014. He started since 2014 giving telecom security training for private corps and during international conferences (HITB, HITB GSEC).