Altaf Shaik & Matteo Strada

Designation:

Talk Title:

Hacking 5G Is No Rocket Science

Abstract:

The integration of telcos with the mainstream technologies like virtualization, SDN, cloud, and big data open mobile networks to offer endless use cases and connect billions of devices. That being said, the internals of a new 5G core network makes heavy use of the commonly-known HTTP and REST API protocols, and hacking them is as easy as hacking the web. Especially, the new interface to power and connect the sensors, cars, cities, and smart factories to the mobile networks, is a sweet spot for the attackers.

In this talk, we explore how to gain access to this sweet spot and illustrate how API attacks unfold in the latest 4G/5G IoT mobile networks. We share our hands-on experiences across several countries/networks with surprising results, that allow a remote attacker to take over the underlying IoT infrastructure and cause serious damage to businesses that are starting to benefit from the mobile IoT networks. The ground reality is that there are sheer discrepancies between the standard security practices and implementations in the production environment. We highlight such issues and conclude with our disclosure stories and defense strategies for the mobile networks planning to roll out.

Bio:

Dr. Altaf Shaik, is currently a senior researcher at the Technische Universität Berlin in Germany. He conducts advanced research in telecommunications, esp., 6G architecture, openRAN, and 5G radio access and core network security. He holds more than 10 years of experience in telecom security and combines a professional background in embedded programming, wireless communications, and offensive network security. His renowned research exposed several vulnerabilities in the commercial 4G and 5G specifications and commercial networks that allow attackers to perform powerful attacks affecting millions of base stations, handsets, M2M, and NB-IoT devices.

Altaf is a frequent speaker at various prestigious international security conferences such as Blackhat USA & Europe, T2, SECT, Nullcon, Hardware.io and HITB, and many others. His accomplishments landed him in the hall of fame of Google, Qualcomm, Huawei, and GSMA. He also trains various companies and organizations in exploit development and also building secure mobile networks including their testing and security assessment.

Want to connect with Altaf Shaik?

Matteo Strada is a penetration tester and security researcher at Net Studio S.p.A in Italy. He is a graduate with a dual master's degree from the both University of Trento and the University of Berlin. His research interests include web/API technologies, cellular communications, microstrip antenna design, and synthesis. He holds several security certifications and is a passionate CTF player.

Want to connect with Matteo Strada?