[radext] Re: [saag] Cyber Official Speaks Out, Reveals Mobile Network Attacks in U.S.

[John Mattsson <[e-mail]>]

Hi Alan,

5G completely replaced DIAMETER with signaling over HTTP/2. DIAMETER is only used in legacy systems that has not yet been updated. Early 5G can be deployed as Non-standalone (NSA) or standalone (SA). NSA means a 4G core with 5G radio while SA means both 5G core and 5G radio. NSA has a lot of severe limitations. Many networks are already SA and the rest are working on rolling out SA.

I don’t think there are any interest in updating DIAMETER, DIAMETER should be replaced with mutually authenticated HTTP/2. 6G will likely introduce HTTP/3.

I would assume that all problems with DIAMETER also exists for RADIUS.

I agree that all traffic should be encrypted without exceptions, even inside enterprise networks. As NIST requires in SP 800-207, this entails actions such as authenticating all connections and encrypting all traffic.

I think the future solution for almost everything is QUIC. A problem that I have encountered is that people think that they need to spend time on PKI to start using or even testing QUIC. I typically tell them that QUIC with a self-signed server cert not checked by the client is already that a big security improvement over TCP/UDP and that they can start testing QUIC like that and deploy a PKI later. Maybe IETF should provide some migration guidance on how to migrate to QUIC. The risk is of course that people use opportunistic QUIC instead of the end-goal of properly authenticated QUIC.

Cheers,
John

From: Alan DeKok <[e-mail]>
Date: Thursday, 16 May 2024 at 22:35
To: [e-mail] <[e-mail]>, [e-mail] <[e-mail]>
Subject: [saag] Cyber Official Speaks Out, Reveals Mobile Network Attacks in U.S.
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.404media.co%2Fcyber-official-speaks-out-reveals-mobile-network-attacks-in-u-s%2F&data=05%7C02%7Cjohn.mattsson%40ericsson.com%7Cd09227825d6e49c77e8908dc75e77baa%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C638514885067017366%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=vb7Rt%2Fi3MNTYpKX3CKEt1ASoqnuDpa51oYoHA7yqw%2Bw%3D&reserved=0<https://www.404media.co/cyber-official-speaks-out-reveals-mobile-network-attacks-in-u-s/>

 After providing specific details related to the attacks, the official wrote in a public filing with the FCC that he thinks the examples “are just the tip of the proverbial iceberg of SS7 and Diameter based location and monitoring exploits that have been used successfully against targeted people in the USA.” The official is Kevin Briggs, who is CISA’s senior advisor for telecommunications, program lead, according to a CISA report posted online.

  Archive version: https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Farchive.ph%2Ft9oco&data=05%7C02%7Cjohn.mattsson%40ericsson.com%7Cd09227825d6e49c77e8908dc75e77baa%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C638514885067025502%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=w5s8e9GENKm3ku4yWHVhMQK1mLNSOsc5OCx%2Fwfz9wd8%3D&reserved=0<https://archive.ph/t9oco>

  Full report:

https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.cisa.gov%2Fsites%2Fdefault%2Ffiles%2F2023-03%2FCISA_Resilient_Power_Best_Practices_for_Critical_Facilities_and_Sites_508c.pdf%3Fref%3D404media.co&data=05%7C02%7Cjohn.mattsson%40ericsson.com%7Cd09227825d6e49c77e8908dc75e77baa%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C638514885067030700%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=DiqF25KHgTh%2B0TXYRafcXd9R5SjP4XcSLmiTy1nD0P4%3D&reserved=0<https://www.cisa.gov/sites/default/files/2023-03/CISA_Resilient_Power_Best_Practices_for_Critical_Facilities_and_Sites_508c.pdf?ref=404media.co>

  Substantial amounts of Diameter traffic is sent over the Internet in the clear, which doesn't help with privacy issues.

  The good news is that the report doesn't mention RADIUS, despite it being a common practice to send RADIUS/UDP traffic over the Internet in the clear.  It's not clear if they're aware that RADIUS exists, but perhaps that's good news, hmm?

  This report reinforces my comments in Brisbane at the last SAAG meeting: all of these protocols must move to TLS.  Unencrypted traffic must be forbidden.

  The RADEXT WG is publishing a document which deprecates this practice, along with many other insecure practices:  https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-radext-deprecating-radius%2F&data=05%7C02%7Cjohn.mattsson%40ericsson.com%7Cd09227825d6e49c77e8908dc75e77baa%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C638514885067034920%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=3%2F%2FnG3lb7cKSXkq0PBbX5wO75kWpJAdv%2FFSddCpZssw%3D&reserved=0<https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/>

  Unfortunately the DIME WG has concluded, so there is no clear avenue for updating Diameter to forbid this kind of behavior.

  Alan DeKok.

_______________________________________________
saag mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]