Attacking NextGen Roaming Networks
summary
Explains how Diameter replaces SS7 for roaming, highlights S6A messages (notably Diameter S6A authentication information request returns SIM crypto keys) and how routing uses origin host/realm plus hop-by-hop/end-to-end IDs so answers return without IP knowledge. Shows easy host/realm spoofing, topology-hiding limits, IDR-based location leaks and a DSR reset that enables DoS; billing fraud looks plausible but not demonstrated. Releases diameter enum (Python) probes applications via a DRA/IPX, requires a diameter router, and urges visibility, cross-checking PLMN vs origin and tighter access controls.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 2:28Signaling between providers
- 4:19Security research
- 6:12SAS7 tool
- 7:51Properties of 4G
- 8:55Diameter
- 16:46Interfaces
- 17:49Diameter Protocol
- 20:32Device Watchdog Request
- 22:37Diameter Messages
- 25:45Diameter vs SS7
- 28:04Tracking subscribers
- 28:55Data transport
- 30:55Billing fraud
- 31:38Denial of service
- 32:29Host origin
- 35:13Host Names
- 37:58Spoofing
- 38:47Crosschecking messages
- 39:46Diameter enum
- 43:25Demo
- 47:24A quick comment
- 50:38Diameter enum tool
- 53:27Conclusions
- 55:06QA
related talks
26mBack to the Future. Cross-Protocol Attacks in the Era of 5G
24mEnhancing Physical Perimeter Defense Using SDR
55mHidden Agendas: Bypassing GSMA Recommendations On SS7 Networks
48mMobile Network Hacking, IP Edition
40mWeaponizing Mobile Infrastructure: Are Politically Motivated Cyber Attacks a Threat to Democracy?
17mCellDAM: User-Space, Rootless Detection and Mitigation for 5G Data Plane
39mSecure Your Data
25mAttacking Mobile Broadband Modems Like a Criminal Would