Mobile Network Hacking, IP Edition
summary
Measurements show about 100 networks advertise RCS support (rough lower bound) and DNS scans find ~200 VoLTE and ~150 VoWiFi deployments. Custom tooling crafts SIP INVITE messages and a SIP invite crafting tool fools cores into spoofed caller‑IDs; a hotspot+JS provisioning exploit extracts RCS config files containing tokens and credentials. Two networks allow OTP brute‑force; stolen config enables SMS‑over‑IP interception, Gmail OTP takeover, TLS/DNS MITM via misvalidated certificates, and thumbnail‑triggered DDoS. Mitigations: SIM‑based auth, strict TLS name checks, rate limits, and SBC masking.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 4:30Why do we have this
- 7:49The map
- 8:28Results
- 10:12User Tracking
- 16:38RCS File Transfer
- 20:35RCS Provisioning
- 23:21Fake Access Point
- 27:37Brute Force
- 28:52How it works
- 32:47Another attack vector
- 37:24Best practices
- 40:12DNS mistrust
related talks
33mVoLTE Phreaking
54mExposing device features on 4G & 5G networks
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
40mWeaponizing Mobile Infrastructure: Are Politically Motivated Cyber Attacks a Threat to Democracy?
08mHacking 4G and how to get arrested in 10 minutes
44mLTE And IMSI Catchers: Then And Now
01h 01mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
33mHacking 5G From Radio Security To The Apis