https://videos.telcosec.net/videos/karsten-nohl-mobile-self-defense https://i.ytimg.com/vi/nRdJ0vaQt0o/maxresdefault.jpg Mobile self-defense Karsten Nohl discusses active defensive tactics against mobile network attacks. The talk introduces tools like SnoopSnitch to help users detect network-level anomalies, IMSI catchers, and SMS/SS7 exploits, shifting from vulnerability discovery to community-driven defense. 3839 2014-12-28 yes no no ss7-security imsi catcher detection ss7 firewall bypass telecom security training https://www.youtube.com/embed/nRdJ0vaQt0o Karsten Nohl https://videos.telcosec.net/videos/karsten-nohl-rooting-sim-cards https://i.ytimg.com/vi/scArc93XXWw/maxresdefault.jpg Rooting SIM cards A deep technical presentation on SIM card security architectures. Nohl explains how weak DES/3DES configurations in SIM applets allow remote attackers to crack keys over OTA SMS, execute arbitrary code on the SIM OS, and compromise the subscriber profile. 3512 2013-11-20 yes no no sim-security sim card hacking sim applet auditing ghost sim attack https://www.youtube.com/embed/R9U0O0y_K9E Karsten Nohl https://videos.telcosec.net/videos/chris-paget-practical-cellphone-spying https://i.ytimg.com/vi/fQSu9cBaojc/maxresdefault.jpg Practical Cellphone Spying A classic demonstration of physical layer cellular vulnerabilities. Chris Paget showcases a functional, DIY IMSI catcher using low-cost hardware and open-source base station software, showing how devices are forced to downgrade to GSM and route calls through a rogue tower. 3153 2013-11-08 yes no no imsi-catchers rogue base station attacks sdr over-the-air decoding imsi catcher detection https://www.youtube.com/embed/fQSu9cBaojc Chris Paget https://videos.telcosec.net/videos/forcing-a-targeted-lte-cellphone https://i.ytimg.com/vi/hNDChDM1hEE/maxresdefault.jpg Forcing A Targeted LTE Cellphone Into An Eavesdropping Network In this presentation, we will introduce a method which jointly exploits the vulnerabilities in tracking area update procedure, attach procedure, and RRC redirection procedure in LTE networks resulting in the ability to force a targeted LTE cellphone to downgrade into a malicious GSM network where an attacker can subsequently eavesdrop its voice calls and GPRS data. 2295 2016-06-23 yes no no https://www.youtube-nocookie.com/embed/hNDChDM1hEE Lin Huang https://videos.telcosec.net/videos/defcon-21-traffic-interception-and-remote-mobile-phone-cloning-with-a-compromised-cdma-femtocell https://i.ytimg.com/vi/gfcq8clu1RI/maxresdefault.jpg Defcon 21 - Traffic Interception and Remote Mobile Phone Cloning with a Compromised CDMA Femtocell Defcon 21 - Traffic Interception and Remote Mobile Phone Cloning with a Compromised CDMA Femtocell 2807 2013-11-16 yes no no https://www.youtube-nocookie.com/embed/gfcq8clu1RI Doug Deperry & Tom Ritter https://videos.telcosec.net/videos/defcon-21-the-secret-life-of-sim-cards https://i.ytimg.com/vi/31D94QOo2gY/maxresdefault.jpg Defcon 21 - The Secret Life of SIM Cards At DEF CON 21, Karl Koscher and Eric Butler presented an analysis of Universal Integrated Circuit Card (UICC) architecture, exposing how legacy cryptographic primitives and unauthenticated administrative interfaces leave mobile subscribers vulnerable to remote compromise. Their research focused on the Subscriber Identity Module (SIM) application execution environment, specifically Java Card implementations and the SIM Application Toolkit (STK) operating under 3GPP TS 31.115 and GSM 03.48 standards. 2556 2013-11-16 yes no no https://www.youtube-nocookie.com/embed/31D94QOo2gY Karl Koscher & Eric Butler https://videos.telcosec.net/videos/mobile-network-hacking-ip-edition-and-rcs https://i.ytimg.com/vi/3XUo7UBn28o/maxresdefault.jpg Mobile Network Hacking, IP Edition and RCS Mobile Network Exploitation: IP Core Architectures and RCS Attack Surfaces 2851 2020-01-15 yes no no https://www.youtube-nocookie.com/embed/3XUo7UBn28o Luca Melette https://videos.telcosec.net/videos/sccp-hacking-advanced-ss7-sigtran-attacks https://i.ytimg.com/vi/2ZTCj5qOW7s/maxresdefault.jpg SCCP Hacking: Advanced SS7 & SIGTRAN Attacks SCCP Hacking: Advanced SS7 & SIGTRAN Attacks 3430 2024-10-14 yes no no https://www.youtube-nocookie.com/embed/2ZTCj5qOW7s Philippe Langlois, https://videos.telcosec.net/videos/interception-risks-mobile-data-on-interconnection-links https://i.ytimg.com/vi/ljNBmHl6Ifg/maxresdefault.jpg Interception Risks: Mobile Data on Interconnection Links Interconnection networks operating over GPRS Roaming Exchange (GRX) and IP Exchange (IPX) transport cleartext user data across international borders. When a subscriber roams, the visited network routes their data traffic back to the home network through GPRS Tunneling Protocol User Plane (GTP-U) tunnels over the S8 or Gn interface, or processes it locally using Local Breakout. Historically, mobile operators assumed IPX transport networks were private, trusted, and isolated from the public Internet. Malicious actors, rogue IPX providers, and compromised carrier network elements routinely invalidate this trust model by monitoring, tapping, or injecting traffic into international link exchanges. GPRS Tunneling Protocol User Plane (GTP-U) lacks native encryption or cryptographic integrity verification. A GPRS Tunneling Protocol User Plane header contains a 32-bit Tunnel Endpoint Identifier (TEID) followed by unencrypted inner IP packets carrying subscriber web browsing, unencrypted Voice over IP (VoIP) calls, or application payloads. An adversary with passive access to an IPX peering point, such as a compromised border gateway or tap on an optical cross-connect, extracts raw subscriber data by filtering packets matching the destination IP address of the Serving Gateway (SGW) or Packet Data Network Gateway (PGW) on User Datagram Protocol (UDP) port 2152. An attacker can also execute active injection attacks over IPX links using GPRS Tunneling Protocol Control Plane (GTP-C). By transmitting forged GTP-C Create PDP Context Request or Update PDP Context Request (for 3G) or Create Session Request and Modify Bearer Request (for 4G Long Term Evolution (LTE)) messages on UDP port 2123, an attacker overwrites the stored Tunnel Endpoint Identifier and Fully Qualified Tunnel Endpoint Identifier (FTEID) Information Elements inside the home network Packet Data Network Gateway. This forces the Packet Data Network Gateway to duplicate or redirect outbound GTP-U streams toward an attacker-controlled IP address, exposing the entire user plane stream to man-in-the-middle interception without disrupting the subscriber session. To mitigate user plane traffic interception, operators must implement strict perimeter security measures: - Enforce GSM Association (GSMA) FS.11 and FS.34 GTP security guidelines on all GPRS Roaming Exchange and IP Exchange border firewalls. - Drop unexpected GTP-C context creation and modification requests originating from non-whitelisted IPX IP addresses. - Validate that incoming GTP-U Tunnel Endpoint Identifiers match active GPRS Tunneling Protocol Control Plane sessions recorded in the local network state table. - Implement IPsec Encapsulating Security Payload (ESP) tunnels across IPX interconnect links to encrypt roaming traffic between security gateways. - In 5G Standalone (5G SA) architectures, deploy Security Edge Protection Proxy (SEPP) nodes running Protocol for N32 Interconnect Security (PRINS) over the N32-c and N32-f interfaces to enforce end-to-end application layer encryption, mutual Transport Layer Security (mTLS), and cryptographic payload integrity checking for all inter-Public Land Mobile Network (PLMN) signaling exchanges. 2899 2024-10-14 yes no no https://www.youtube-nocookie.com/embed/ljNBmHl6Ifg Silke Holtmanns https://videos.telcosec.net/videos/4g-to-5g-new-attacks https://i.ytimg.com/vi/BmuZokI-i7U/maxresdefault.jpg 4G To 5G: New Attacks 4G To 5G: New Attacks 3441 2019-09-30 yes no no https://www.youtube-nocookie.com/embed/BmuZokI-i7U Altaf Shaik https://videos.telcosec.net/videos/hacking-5g-is-no-rocket-science https://i.ytimg.com/vi/D_nbfcdRzeQ/maxresdefault.jpg Hacking 5G Is No Rocket Science Hacking 5G Is No Rocket Science by Altaf Shaik & Matteo Strada | Nullcon Goa 2022 3298 2022-11-21 yes no no https://www.youtube-nocookie.com/embed/D_nbfcdRzeQ Altaf Shaik https://videos.telcosec.net/videos/2022-openran-5g-hacking-just-got-a-lot-more-interesting https://i.ytimg.com/vi/LRQsFTmWa2w/maxresdefault.jpg OpenRAN – 5G hacking just got a lot more interesting Many 5G networks are built in fundamentally new ways, opening new hacking avenues. Mobile networks have so far been monolithic systems from big vendors. Networks are rapidly changing to an "open" model that mixes software from specialized vendors, hosted in cloud environments. 2678 2022-07-24 yes no no https://www.youtube-nocookie.com/embed/LRQsFTmWa2w Karsten Nohl https://videos.telcosec.net/videos/4g-to-5g-evolution-in-depth-security-perspective https://i.ytimg.com/vi/DeTASrRYalE/maxresdefault.jpg 4G to 5G Evolution: In-Depth Security Perspective 4G to 5G Evolution: In-Depth Security Perspective 2806 2019-03-08 yes no no https://www.youtube-nocookie.com/embed/DeTASrRYalE Altaf Shaik https://videos.telcosec.net/videos/5g-imsi-catchers-mirage5g-imsi-catchers-mirage https://i.ytimg.com/vi/Bg1HVaw1Sm4/hqdefault.jpg 5G IMSI Catchers Mirage5G IMSI Catchers Mirage 5G IMSI Catchers Mirage5G IMSI Catchers Mirage 2611 2021-12-06 yes no no https://www.youtube-nocookie.com/embed/Bg1HVaw1Sm4 Ravishankar Borgaonkar https://videos.telcosec.net/videos/ss7-how-they-bypass-all-security-measures https://i.ytimg.com/vi/Wlric0itKwM/hqdefault.jpg Trojans In SS7 - How They Bypass All Security Measures Trojans In SS7 How They Bypass All Security Measures 2038 2022-08-31 yes no no https://www.youtube-nocookie.com/embed/Wlric0itKwM Sergey Puzankov https://videos.telcosec.net/videos/hidden-agendas-bypassing-gsma-recommendations-on-ss7-networks https://i.ytimg.com/vi/IHE9QBjG6Qw/maxresdefault.jpg Hidden Agendas Bypassing GSMA Recommendations On SS7 Networks Hidden Agendas Bypassing GSMA Recommendations On SS7 Networks Kirill Puzankov 3298 2022-08-18 yes no no https://www.youtube-nocookie.com/embed/IHE9QBjG6Qw Kirill Puzankov