Warning: Magnitude 10 Earthquake Is Coming in One Minute
Weiguang Li examines public warning system (PWS) based on mobile communication system is used to alert the public to emergency events such as earthquakes, tsunamis, hurricanes, etc.
Summary
Architecture and Background
Public warning system (PWS) based on mobile communication system is used to alert the public to emergency events such as earthquakes, tsunamis, hurricanes, etc. We carefully study the PWS in LTE network and uncover the vulnerability of PWS in LTE air interface, i.e., the warning messages of the PWS are not encrypted or signed when they are transmitted over the air. Thus, it is possible that malicious PWS warning messages can be transmitted.
Vulnerability Analysis
We simply use a low cost soft define radio (SDR) device and modify not much code of the LTE open source project srsLTE in order to forge the warning messages. Both Apple and Android test mobile phones are affected by our forged warning messages. Fake PWS warning messages will cause serious panics among the population, they also could be used to send advertising or spam messages.
Exploitation and Demonstrations
The public warning system may become paralyzed and useless under the threat of the abuse of fake warning messages. Weiguang Li is a mobile network security researcher from UnicornTeam of 360 Technology Co. Ltd in China.
Remediation and Defensive Strategies
He mainly focuses on GSM and LTE security, He is also interested in NB-IOT baseband reverse engineering and software-defined radio development. WeChat: ColorLight Yuwei Zheng is a senior security researcher from 360 technology. He focuses on the security issues of embedded hardware and IOT systems. He was the speaker of DEFCON, HITB and BlackHat. JingLi Hao is a researcher of 360 Security Research Institute, member of Unicorn Team, satellite hacker
Related talks
Main Stage·24 min
Cooper Quintin
Cooper Quintin details how 4G IMSI catchers operate and introduces open-source software with low-cost hardware to detect rogue base stations in real time.
Main Stage·23 min
Shupeng
Baidu Security Lab researcher Shupeng demonstrates constructing test GSM and LTE base stations to intercept 2G/3G/4G traffic and execute machine-in-the-middle attacks on connected smart devices.
Main Stage·31 min
Haoqi Shan · Wanqiao Zhang
Haoqi Shan and Wanqiao Zhang demonstrate protocol manipulation attacks that force modern LTE smartphones to downgrade to insecure 2G and 3G networks.