Shinjo: Thank you very much for the introduction.
So I am Shinjo Park and today today with my friend Yongh yu Ban and we are
going to have a lecture on learning from the South Korean telco breaches.
So yeah I have a PhD on my on the cellular network security and I also have
an interest on the telco equipment and also various gadgets and I'm also
working as a Korean translator of various open source projects including KDE.
Well when I was still younger then I tried to translate quite a
lot of projects but well now I have a daily job and I've become
a bit older so I had to stop some of the translation work.
Yonghyu: And this is Yongh yu Ban and I'm just an embedded
engineer which do security research as a hobby.
Thank you.
Shinjo: So today's talk will be consisting into the following parts.
parts. So we are going to give
a background information to understand the South
Korean mobile market and some brief introduction
of how the LTE network is built up and I will cover
the HSS bridge of the SK Telecom which was earlier in
this year and the operator billing bridge of the KT
which has been happening in the later half of this
year and we are also covering the security issues
of the femtocells and also the voice over LTE
which facilitated the operator billing bridge of
KT and then we will conclude the presentation with
the assessments and recommendations. So the background information reaction to well have an
understanding about today's presentation. There are three operators in South Korean
mobile and mobile telecom market. The biggest one is SK Telecom and the second largest is KT
and the third largest one is LG U+. And their
market share is SK Telecom has about 39 .3 percent,
KT has about 23 .8 percent and LG U+ has 19.5%. And the
rest 17 .4 percent is consisting of the virtual operators.
These statistics have been collected in May of this year and due to the various incidents
and breaches and breaches happened in all of those
three operators in the Korean market. I guess the
statistics may have been changed in the later
or this year or maybe in the earlier next year.
So the Korean Telecom market has you will require
that you will need to pass a KYC procedure,
know your customer procedure, in order to open
a new cellular phone contract or even opening a
prepaid mobile phone contract. So the KYC is done
by validating personal IDs. Every South Koreans
will have their personal numbers aside from their
births and we will get a South Korean ID card when
we become adults. And validating the personal IDs
against the government database is a standard method
of the KYC when somebody wants to open a new
mobile phone contract. There was a government data
center fire in this year, September, and this actually
affected the KYC procedure of all the operators.
So for a temporary, for I don't remember the
exact amount of days, but they actually allowed to
opening a new cell phone contract without any KYC
procedure, given that the KYC procedure could be
done inside the later. And this is a fairly, fairly
new, fairly new updates. And starting from the
December 23rd, just, I think it is just one week
ago, the face information is also validated when you
are, you are opening the, opening a new cell phone
contract. And this has been never tried in South
Korean market. And I believe that there might, there
might be some, some, some troubles when the, when,
when the, the things are, are, are being implemented.
And the, the KYC procedure could be challenging for
non -Koreans since non -Koreans are not registered
in obviously in Korean databases. Most of the new
devices are often bought through the contract, like
not in Germany, where you can, you can go to the
Neural Saturn or, or, or Mediamarkt and just buy a
phone. But still quite a lot of, of Koreans prefer to
go to the operator store to buy, to buy a new cell
phone. And which means that operators can obtain
the mapping between the IMG and IMEI, and also
the personal identification when they are buying
unused new mobile phone for themselves. This is
also related to the, not... un popularity of the
eSIM in Korean market, because for the eSIM capable
devices, both IMEIs, when they are, they have a
physical SIM slot and an eSIM slot, they must be
registered to the operators. And both SIM cards also
need to be tied to the same person, which disallows
one personal SIM card and one corporate SIM card,
then the operator will reject the eSIM usage. And
SMS -based two -factor authentication is actually
widespread in as an authentication service, despite
there have been warnings of solely relying on the
SMS for two -factor authentication. And it is
frequently used for online personal identification
in various services. May, yeah, Koreans may be, may occur some to, to images like this,
then you need to pick on your, your operator, and
they will send them to FA, to BellPy, it is really
you. And this procedure is often cited as a barrier
for non -Koreans when they are trying to use,
use Korean online services, such as shopping malls,
or just even registering some bigger websites,
and so on. So, to understand some jargons appearing
today, this is a simplified structure of an LTE
network. The, the one, one in the left, the left, the
left side is user equipment , your, it is typically
your mobile phones, and it is connected to the, to your, your nearest space station,
shown by air, by , on air interface. Well, in the later part of the talk,
where will the FEMtocell will be mentioned, the
femtocell is connecting to the, to the operator to a
security gateway, and from the security gateway,
there will be a home in the gateway, and the
management, there will be a management system, and
the control and data plane will be, plane will be
connected to the S1MME and the S1U, and the home
subscriber server stores all your information
required to authenticate, authenticate a mobile, mobile
phone user. I had to, to, well, omit quite a lot of,
uh, other systems and other interfaces due to
the, the, the, due to the, the space constraints,
but this is a basic, but this is a, just a basic, basic structure, which will be required to
understand what, what I am going to present today.
So, let's start from the SK Telecom's HSS bridge.
The portal in here actually has some, some
meaningful context for the, for the Korean culture.
We are expecting, we are expecting the act of the bowing, not as, not as a, uh, just for,
just start for greeting, but also a just start
for a sincere apologies, and this picture has been
taken when the, when the, when the, when the, when
SK Telecom bridge happened, happened, and there had,
there has been a press release, and all of their
C level showed up on the camera, and they didn't
apologize. So, timeline of what happened, happened
in the SK Telecom. The initial infiltration and the
state of the lateral, lateral expansion had been
started in August 2021, and there was a BPF door
infection on the HSS site in December 2021. More,
more, more lateral expansion in SK Telecom happened
between 2022 and, and 2025, and this year, 18th
of April, around, around, around, around 11 p .m.,
there, SK Telecom have detected an abnormal outbound
traffic, which is supposedly carrying the, the entire
copy of their HSS device, uh, HSS database,
which means that their entire subscriber records.
Five days after, after the incident, in 23rd of
April, the investigation by a joint government
civic committee had been started, and they did an
audit on the complete infrastructure of an SK Telecom,
and they made three press releases, one in, in, in
29th of April, and the other one in the 19th of May,
and the final report has been released in 5th of
July. And as a, as a result of the, the breach,
the replacement of the SIM cards, and also there,
also some, some small customer -tomer compensation
have been followed. This is a summary of the
network structure of, uh, uh, inside the SK Telecom.
The external attacker could reach out to the,
some nodes in, in, inside the management network,
where they are, where they are, where the, where
some of the nodes are exposed to the public internet.
Some nodes, inside the management network, they
are connected to the coordinate, core network,
because the core network stores, uh, the critical information related to a, a, a cellular
user subscription, and the core network itself is not
directly exposed to the, to the external internet.
So, an external attacker must, must, must, must
infiltrate, infiltrate through a management network,
in order to go to the core network. So, the external
attack, an attacker, a current network did an
initial, initial implementation, and later, later,
later, expression to, throughout the management network,
and they, they managed to found that HSS credentials
were stored inside the clear text in one of their
management network network server, and they were able
to access to the core network and steal out all the
subscriber information, and throughout an intermediate
node inside the management network, it was
possible to exfiltrate the, the, the HSS record, but
the SK Telecom's firewall had managed to catch the,
catch the action, and the things get published. So,
the leaked information includes the, uh, the IMZ,
MSIS, Yen, K, and OPC number, and what SK Telecom
calls as more, but the information is, is, is,
is encompassing entire 26 million subscribers. The information itself, it is actually enough
to clone a SIM card, uh, a SIM card of a legitimate
subscriber, and it was later revealed, revealed, that it was,
the information was not encrypted on the storage. And luckily,
there, there is no evidence of the HSS data, which was
stolen from the SK Telecom, was, uh, being sold in the dark web
so far, but, well, SK Telecom did, uh, did, uh, did, uh, did, uh
did the mitigation, and, uh, I hope that, uh, that
no, no copy of the data will be, will be available,
even in the, even in the, in the, in the, the far future.
SK Telecom's mitigation was the binding between
the IMZ and the IMEI. So, because most of people
were, were going to buy, uh, points from, from the
SK Telecom themselves, so they know the IMZ, and they
know the IMEI, so they were, were advertising
something called as a using protection service,
which enforces the binding between the IMZ and IMEI.
It is, well, I personally only think that this was a
temporary measure until the SK Telecom acquires
enough physical SIM cards to replace all of the
their, the 23 million subscribers, and they also offered something called the, uh, uh, using
reset service, which was, in turn, it was just an
IMZ reset service, and to do this, uh, customer need
to visit the SK Telecom store to trigger on, uh,
on, uh, over -the -air updates or reprogramming of the
SIM card on, on site, and the IMZ will be, will
be changed, so the, changed, so one part of the
HS data leaked will be, will be, will be, will
be invalidated. We also proved that the key had,
key was not changed during this procedure by replaying on authentication token before the,
before the SIM reset, and we visited SK Telecom
and do, did the SIM reset, and replayed the same
authentication token after the SIM reset, and we
checked that the, the both tokens were working,
so, which implies that the key itself has, had not
been changed. The graphic here has been, and has been
copied from the SK Telecom's website, but interestingly, when we checked, uh, checked their
website today, the webpage containing this, this
graphic has been taken down, so I searched for the
web archive, and there is, there still is, so please,
SK Telecom, you should not, you should, you should not,
you cannot really delete, delete out what you have,
what you have been, um, have done in, in the wrong,
from the internet, as long as the archive .org is still alive.
Another mitigation implemented by them, it was a
double authentication. Usually, when a mobile phone
is, is authenticating against the network, the
authentication is done only once, but we found
that the authentication is done twice in, twice in
Korean networks. We found that the first authentication
request is coming with a smaller number of SQN, and there will be a synchronization failure,
and the second authentication, which is the real one,
it will continue only when the sequence number is
within the expected range, and the second
authentication will continue as just, just normally
as the other operators. It looks like that the
sequence number, it has, has not been, being breached,
and the, and the number itself changes quite frequently, depending on the cellular activity,
and cloned SIMs cannot have the exact same as SQN
numbers, and although the CGPP's authentication
procedure mentioned that the retrieval of the
sequence number is done throughout the authentication,
but I think this is a proprietary implementation
to always retrieve the SQN, regardless of the
rest values, and we checked that this kind of
mitigation is also implemented in all three mobile
network operators. SK Telecom was relatively
clear link in communication regarding the breach,
and the attack model was clear, and the damage was clear from the very beginning, and
and throughout the, throughout the, throughout the, throughout the time, and SIM replacement
became a standard in the political circle, so they
are, they are also demanding the other operators
when the similar kind of incident had been happened,
and there have been some compensations made,
and SK Telecom is increasing the investment on the information security in general,
and our personal information protection commission
fined SK Telecom about 134 billion Korean won,
which is about 82 million euros in, in this August,
and SK Telecom is actually, is considering a lawsuit,
citing that, citing that the fine is to, is abit to hash for us.
So, the next one is the KTS operator billing,
billing breach, and, and again, the C, and the C,
C level, made a public apology after the breach. Late in August 2025,
KT users in southwestern part of Seoul reported
some unauthorized operator billings, and in 9th of
September, the, the, the, the, the investigation
by, by government had been started, and in 16th of
the September, two of the suspects had been, had
been arrested. So, KT had done press conferences in
11th and 18th of September, and 17th of October, and
they made the, they made the initial press release
in 6th of November, and just before we have, we
have, we are here, they made a final press, press
release, so we had to, we had, we had to, to digest
what, what had been presented, and also we need to,
to update the presentation accordingly. So, there
was an initial unclarity in the attack model,
there, then it could be a malware, but both Android
and iOS users were affected, and affected regions
were geographically close. So, it was actually
not a malware activity. Also, some news reports
suggested that it could be an event of SMS blaster or,
or Indie catcher, but the two -factor authentication,
SMS was hijacked, the SMS was not injected, and
billing fraud was reported during the night times,
and the KTCDR found some unknown cell ids, which
is actually a contradict of a contradictory of what
the typical indicator or SMS blaster does. So, it was also not an SMS blaster activity.
And initially, the attack model was not, not so clear, unlike the SK Telecom's breach,
and every press releases reported some, some
different numbers of damages, where their official,
official excuse was that the investigation had
been, had been widened throughout the investigation,
but public, the general public lost the patience
on what KT was reporting, and, and what initially,
what initially exactly was an unidentified cell tower
was not disclosed, and also for the word illegal
base station, I don't know how and what is exactly
illegal, and it was later found out as a modified
femtocell. They found that they decommissioned
femtocell from 2019, which was used in a military
installation, but, but has been decommissioned, and
it was used as a donor portal certificate for the,
for the further attacks, and about 22k subscribers
were connected at least once to the modified femtocell,
and their identifiers had been compromised.
There have been 777 operator billing fraud cases,
which is connected to 368 people, and the total fraud amount was 243 million Korean won,
it is about 150k euro, which some, some people
can think it is a big, which some people can think
it is a smaller amount, given that the sophisticated, anything of the, of the attack.
We initially, we initially thought that the attack model is eavesdropping through a modified
KTS femtocell, or third -party femtocell, to
connect, to be configured to use the KTS network,
and there might be some voice over LTE implementation
weaknesses, which facilitates the hijacking of the
SMS and voice payload, and it was our hypothesis
months ago, and which was actually proven right,
according to the, the, the government press release,
this in today, and parliament will, will, will give the
details on what one, what kind of actual attack has been happened. *APPLAUSE*
Yonghyu: Yeah, so let's look into the femtocell. So back, for the
background, femtocells are used as a band -aid for the
service coverage. Like, in South Korea, there is no
working Vo WiF i set up on all operators, and the operators
usually have trouble with the landlord, with the
utility bill, and the space occupation, and etc.,
and other people also complain about the macrocell
installation, about their EMR concern, and its ugly
appearances, etc. As a result, Korea Telecom deployed it, 232
,000 femtocells, and among them, 33 ,000 units are inactive.
Let's look into the femtocell. Femtocell is a home E -node
B. It means E -node B in the most untrustworthy place.
Let's look, what if the E -node B falls into the malicious
person's hand? Usually, home E -node Bs are locked down
hard because of their nature. Let's look into the Korea Telecom's femtocell.
Yeah, they don't have a root password. *LAUGHTER* And also, their
system image is stored in the clear text. No surprise, right?
And they hard -coded bootstrapping IPsec certificate in the init RAM disk.
Also, they included, as a bonus, they included handy debugging tool for the diagnosis.
Like, you can, can you even imagine that Wireshark libraries are included in the femtocell?
Their only protection is the anti -tempering seal, which is clearly not. *LAUGHTER*
And also, it is theoretically not meant to be for
sale, but in reality, in the surplus market,
in the surplus market or the second -hand market in
South Korea, it is actively, it was actively traded.
So, now let's look into the what can malicious person can do with that.
They can access to IPsec tunnel directly, directly coming to the EPC.
It means they can, they can access to the S1 user plane
link and the S1 MME link to the Evolve Packet Core.
And it means malicious person can access the clear text S1 user plane content.
And also, each femtocell certificate was failed for, you know, decades.
And it was reduced to one month in this September.
And their IPsec certificate management policy became
stricter and including switching down the older
certificate management system and allowing only the
active femtocells can get a new certificate, etc.
And, however, we were able to get a fresh IPsec certificate for the device. *APPLAUSE*
And, of course, KT was, it was done in front of the Korea Telecom.
They told us, oh, they fixed, oh, we fixed the vulnerability,
so let me, so please test it on the, our network.
And I say, oh, sure, I'll test it.
And after just 30 minutes, oh, I found you again.
And they also claim they, also claim they, you know, they fixed
it again and it needs to be verified after I back to home.
And, so, everything is, so, nowadays, we are in the encrypted world.
Everything is inside of TLS and quick protocol calls nowadays.
And VoLTE is the usually wrapped in the IPsec tunnel, so nothing should happen, right?
Right? So, we are launching a workforce VoLTE. Are they IPsec ready, really?
Answer is no.
And in the Qualcomm modern configuration of the some Xiaomi phones, the old Xiaomi
phones, they have no cyphering and integrity protection for the SIP was applied.
And we are not, actually, we are not the first ones to discover it.
In the 2014, ET News reported the same issue.
And Telcos told, we fixed the encryption.
And the SK Telecom and the LG U Plus told most
parties to enable the IPsec on the user requirement.
But KT didn't.
They only told some Korean vendors to turn on the IPsec, and
iOS carrier profile did not enable for IPsec for a decade.
KT later notified Apple to enable IPsec on IMS, and
their carrier profile was updated for iOS 18 and 26.
So, problem solved, right? Let's look into the deeper.
Now, let's strip the IPsec from the VoLTE.
Actually, in the Korean VoLTE standard, the TTA, the
Telecommunication Technology Association VoLTE standard, is broken.
In their revision, too, user requirements should not use
IPsec when IPsec negotiation failed, for some reason.
In contrast, in the 3GPP Technical Specification 33203, Section 7 .2, if these
checks are not successful, the registration process procedure is aborted.
This statement is still present in the last TTA document, Revision 5.
Here is the downgrade scenario we used and tested.
First, user equipment tries to enable the IPsec using that encryption
algorithm, AESCBC, and hacked eNodeB sends that back to SIP 401 with,
oh, we don't speak the AESCBC, let's speak with some bogus algorithm.
And the user equipment thinks, oh, the IPsec negotiation
failed, and let's just do it with the clear text.
And you can see the clear text channel is opened as a result.
Here is our test setup.
The SYN client is running an Evolve Packet Core, and the laptop is running
a SRS eNodeB, and using the software radio with the clock compensation,
we will attach commercial UIS to the SRS eNodeB and do our test.
So here is our test result.
For the vendor A, we are not disclosing vendor name for here.
The vendor A's Korean model with the Korean SIM card is blue number two IPsec downgrade.
And the vendor A's, in some telecom operator SIM card, the
vendor A's rest of the world or American variant of the device,
when you put the Korean, some tech host Korean SIM card
in there, it just does not enable the IPsec at all.
We were unable to find other vendors in the same problem.
And also, some vendor implemented the explicit downgrade vector.
When they received the SIP 406 message, they just turned it off the IPsec completely.
And as an experimental result, we are, as per se, we are injecting
the crafted 401 response with the bogus encryption algorithm.
And you can see in this packet trace, you can clearly
see the SIP communication is done in the clear text.
And, of course, the possible mitigations exist.
First, the TTA VoLTE standard must be revised to be clear on their weakness on the standard.
And the second, the vendor A should deploy updates to their user equipments.
And also remember, a single weak point of the chain can break the entire system.
And from now on, here is, peremen will do that. Thank you.
Okay. So, the aftermath of the breaches happening in South Korea.
I also want to give some problems on the media.
Yeah, Korean media often uses some just sensational
terms without any kind of technical insights.
For example, for the SK Telecoms breach, everyone mentioned the phone cloning.
And for the KT breach, they mentioned the indicators and also SMS blasters.
And some of the media even also mentioned 2G -only attacks.
I want to give a reminder that there was no 2G GSM networks in South Korea.
And everything was CDMA when they were back in the 2G era.
So, the GSM -only attacks do not have any meanings in South Korean territory.
The extent of the phone cloning can depend on the context.
Like, when we are just using all the feature phones, then receiving
your phone calls and SMS will be counted as a phone cloning.
But inside the smartphone world, where just receiving phone calls
or your data communication, usually do not take as a phone cloning.
And most of the users will likely be expecting that
your user data should be cloned into a cloned device.
And I think it is only to cause fear, uncertainty, or doubt.
And the media in general focuses too much on the speed of the report.
This is actually often criticized as a problem of the media in general,
not only the Korean media, but also from other countries, I guess.
And they just relay what operator or government says.
And as far as I know, there are not so many specialists in
our media culture who does do the hard work by analyzing what
exactly has been happening regarding the operator's speech.
And, well, as I'm also a translator, I'm kind of picky on what kind of terms have been used.
And I believe that the government press release
should be easily understandable for everyone.
And it also needs to be accurate on the facts.
One of the things I want to criticize is that they are
describing the CDR as a call data record rather than the
charging data record as defined in the CGPP technical standards.
And the thing which turned me angry was they were describing the HSS
as voice call authentication rather than the home subscriber server.
Because of a small twist inside the translation, the importance
of each network entities and the actual role of the core
network entities could be lost inside the translation.
As an expert, we need the usage of the exact technical terms to evaluate the incident.
And I also want to say that please do not twist the meaning inside the translation.
And you can check the following snippet in the diagram below.
I checked it through the Google Translate late today.
And you can check whether what I told is right or not.
And there was also a PRAC report regarding on the South Korean operators.
And the PRAC number 72 mentions the breaches inside the KTS remote support service
and the LGU plus multi -factor authentication and credential management services.
And we also got informed that there will be another talk which
is related to this topic, the ATT down and the mystery of the
burning data center, which will be held in 4 p .m. in Saal Zero.
And KT claimed that the server in question was decommissioned in the 1st of August.
But in reality, they really decommissioned the decommissioning
was continuing after the officially mentioned dates.
And there was actually two more times in August for the decommissioning of the server.
And they also hide the existence of the backups until the 18th of September.
And because of this result, the government initiated a police
investigation since October 2025, whether KT had destructed
the data just in order to hinder the government inspection.
Also, in LG U+ , they also initially denied the breach, and
they even reinstalled the server, which was mentioned as
hacked once, just one day before reporting to the government.
Meanwhile, the subcontractor who actually built out the
system, they admitted that they were hacked, and they reported
the hacking incident even earlier than what LGU plus did.
And the investigation had been started in October 24th, and LG U+ kind of
denied the breach in September, but they later changed their position in
October after the vulnerabilities and the weaknesses had been disclosed.
And the police investigation is also initiated.
There is an unrelated breach, though.
There is an LG U+ AI code transcription service, because the recording
of the voice calls are actually quite common practice in South Korea,
and usually iPhones do not support the voice recording services.
So operators act as a machine in the middle, and they
do provide an AI transcription of the voice cores.
And in one day, they misconfigured the cache server, which was
exposing the metadata of the voice calls for about 36 persons.
And an investigation on this issue is also ongoing, as far as I know.
So to close our talk today, 2025 was a nightmare in the South Korean mobile network market.
Every operators were affected by more or less the similar kind of data leaks and breaches.
And we also want to highlight that the server network security
depends on not only the security of the equipment itself,
but also how to configure, and how to operate, and how to integrate them.
As in case of SK Telecom, the lateral exploration
was enabled through improper access control.
And for the case of the KT, inadequate f emtocell security
and inadequate implementation of the technical standards
actually allowed the, well, the inadequate security or
inadequate voiceover might be a part of the exploit chain,
but when they are combined into one, then there
will be things like the operator building breach,
which was kind of a big event to the KT.
And last but not least, let's be transparent in the security incident.
Otherwise, everyone will turn against you.
And as a result of the breach, South Korean politics
have lost their patience in the network operators.
And I really hope that, well, our government and maybe
the government and the regulators will act accordingly
if the network operators are doing some shady things against the people.
Thank you for listening . *APPLAUSE*
Host: Thank you for this amazing and scary talk, a deeper look into the Korean networks.
Is there any questions? There's microphone one and two down in the center lane.
If you have any questions, please just come up to the microphones.
Signal Angel has a question from the Internet.
Signal: Thank you for the talk.
The Internet wants to know that given these breaches and vulnerabilities,
which telco provider would you now suggest in South Korea?
Shinjo: *LAUGHTER* Well, the Internet asks which operator will be the safest operator.
But, well, from judging from my own perspective, there are actually none.
And we Koreans are saying that our personal private
information will be traded in just less than one euro.
So, everyone just gave up on the security of the personal information.
And I really don't think that the status quo will be improved
unless there are some stronger measurements from the regulator side
or some technical standards from CGPP or GSMA have been
revised to import the stricter security on the operators.
Okay. Thank you. There's a question. Microphone, too, please.
Audience: Yeah, you had one slide where you showed A, B, and C.
Was it the operators or was this the telecom infrastructure providers?
Because you mentioned that they have in the rest of the world.
Yonghyu: This one?
Audience: Yeah, this one.
Yonghyu: For this one, for the vendor A, the mobile phone vendors,
the Korean, they produce the three variant of the model.
For the Korean model and the American model and the rest of the world.
Audience: Okay.
Yonghyu: Yeah.
Audience: So, it means that for the Korean market, they
had a version where this IPsec was switched off.
Yonghyu: Yeah, it is for the Korean, when you put the Korean SIM card in the Korean
model, the IPsec is enabled, but it can be downgraded to no security.
Audience: Thank you.
Host: Another question from the internet, please.
Signal: The internet wants to know, how common is it to find abandoned femtos?
And is the one you showed especially bad, or are they all like this around the world?
Okay. So, the internet wants to know about abandoned femtos cells. Yeah.
perillamint mentioned that in the case of KT, there was about 43K of abandoned femtos.
And after the incident had happened, the KT
wants to actively recollect the abandoned femtos.
And from what I heard from today, about 12K of the femtos has been recollected.
And we also, well, some of our friends also received the
message that the KT wants to collect all the femtos cells.
So, I think that the femtos cells may be decreasing the number in the future.
But I still think that, well, there might be some hideouts.
And could you please repeat the second question?
Signal: The second part is, is this a global phenomenon, or is
this a Korean part about the security of the femtos cells?
Yonghyu: Okay.
The security of the femtos cells, the certificate
management part, or I really didn't get the question.
Signal: So, I think the question is in general, if the sort of femtos cell configuration is found.
Yonghyu: Ah, yes.
So, when I was still in Korea about 10 years ago, my research team
had reported the security of the femtos cells even back in then,
when the security was quite lax compared to today's standard.
But I personally believe that they just patched what we have told in 10 years ago,
and they might not be updated throughout the modern security standards.
And this is, unfortunately, I also need to attribute to the
standard practices of the Korean small and medium -sized companies.
They are, and they may not have enough human
resources to think about the security implications.
And, yeah, I am, I might be pessimistic on how the security
will be improving in, let's say, next five years or next decade.
Host: Okay, and then there's another question at microphone one, please.
Audience: In the context of the SKT case, you mentioned that
the HSS data was found in the management network.
I want to confirm that this was the case.
And the actual question is, was SKT asked why this data
was in the management network and unencrypted there?
Shinjo: Okay, so the HSS data was stored inside the core network, and it was pushed
into the, it was actually copied into the, to the management network.
And, yeah, and it was, and the data, and the copy, and the copy,
and the copying attempt from the, from the management network to the
outside world was actually detected by the SK Telecom's firewalls.
So that's how they got to know about the breach.
Okay, any further questions? Okay, there's another question at microphone one.
Go ahead, please.
Audience: So, my question is, based on what you said now, they, basically, did, these
threat actors, they were into the system for at least four years in one case.
And, I mean, I understand some control failed in
Telco, so probably they were not monitoring and so.
However, once they identified, let's say, the attack, they
were able to backward look into data and see that certain data
was exfiltrated, when it was exfiltrated, what was the amount.
Are there any details, like, basically, what actually, what control failed there?
Like, they were actually recording data, they had audio
flow for everything, but they were not looking into it,
or, like, do you have any additional information in there?
Shinjo: Okay, from what we have heard, the KT's femtocell case, they do have a
femtocell management system, and the system is supposed to make some alerts.
But, for, I don't know, I don't know the reason, or I don't, I,
because I'm not from KT, so I am not, I cannot, I cannot answer,
answer clearly, whether it was just ignored, just, just ignored
by some, and some negligence, or it was systematically ignored.
But, but there is, there is a monitoring system, and the monitoring system raises
some, is capable of, of raising the, the flags, or, let's say, the femtocell was
activated in an unexpected area, or a new cell ID has been appearing, but, but, but,
but, I, but I, I need to, I guess that the indicators for the, for the further, the
breaches have been ignored, which led to, which led to a long, long persistent attack.
Host: Okay, I believe there's another question, microphone two, please.
Audience: Yes, my understanding is that there has been no bounties, or such,
for this research, but it looks like it takes a lot of effort,
and it's personally stressful, or even risky, to carry it out.
So, what helps you perform this research?
Shinjo: Okay, in, well, in my case, well, I am a KT's customer, since I was, I was
still at high school, and my parents, and my, and my sister, they are, they
are still using the KT's users, and, well, I, I graduated, I got my PhD on
the cellular network security, and, well, KT's, KT's breach has been happened,
so, I acted for, for myself, I wanted to protect my, me and my family.
Yonghyu: Yeah, for, for, for me, that, when I was, when I was thinking
that, that the, oh, the, the VoLTE is not, I was discover
the VoLTE is not wrapped in IPsec of, about a year ago,
and, and I think, oh, it is passing through the telecom, telecom, telecom
network, so it will be fine, and, I noticed a breach, and, suddenly,
oh, oh, oh, dang, it is, it is not meant to be that, and that, only
that, from them, I was, tried to, digging into it, and, reached here.
Host: Okay, another question, microphone one, please.
Audience: Thank you for your talk, um, uh, in, in the first case, you
mentioned, uh, that, uh, BPF door was being used for exfil, and,
uh, it had taken quite a long time, um, to discover the attackers.
Shinjo: Yes.
Audience: Um, I, um, have looked into BPF door, and, uh, when the story broke earlier
this year, I was, uh, wondering, well, uh, BPF door is, uh, quite easy to detect
if you do any kind of, uh, host -based, host -based monitoring on Linux systems.
Now, doing host -based monitoring, uh, is, at scale, is actually
hard, but, uh, I was wondering, um, did the operator not do
any of this, and, uh, do you have any insights into that?
Shinjo: Yeah, yeah, the, the, the operator did, as far as I, I, I know, the operator
did some, in, their, their, their, their internal security audit, audit,
even in, in, in, in, 2022, or, 2023, but, well, as, from my understanding,
they might have, have skipped some, some, some of the nodes, which turned,
turned out to be impacted at, inside the, as, as, as a, as a BPF door.
So, yeah, there are oversight, maybe, maybe, it may have been
skipped, that there, they have been, being impacted with the BPF door.
Audience: So, this sounds that, they didn't do any continuous, uh, security monitoring of the devices.
Shinjo: I cannot say, say, definite, definite answers, but, but, but, probably.
Yeah, okay, thanks. Yeah.
Host: Okay, we have another question from the internet, please.
Signal: Uh, one internet user says, uh, if I'm not mistaken, there
was a mention of an external clock hooked up to the femto cell.
What was the purpose of that, exactly?
Shinjo: Um.
Yonghyu: Yeah, that, that, our test setup.
Shinjo: Ah, wait, pass it.
Yonghyu: Stripping IPsec, page 45.
Shinjo: Uh -huh.
Yonghyu: Yeah, that, if, if, if, if, if it is meaned, yeah, that, it is from
our, our test setup, and, since the software radio, since the software
radio, since the software radio's internal clock is quite unstable for
the, some, quite unstable, so, some user equipments are refusing to
attach to it, even if it is, uh, if it is broadcasting legit signals.
So, so to fix that, I need, uh, we need a, we need a, more precise clock to
feed into the software radio to compensate the clock drift and lock the clock.
Shinjo: Yes, and, and from our testing experiences, certain baseband manufacturers
are much more tolerant into the, into the inaccurate clock, while some
baseband manufacturers are not so tolerant in the inaccurate clock.
So, yeah, to do the similar experiment by yourself.
And if you want to go deeper and serious,
then we would recommend to have even basic devices like a GPS deal.
Yonghyu: Yeah.
Host: We have another question from the internet.
Signal: How possible is it that these issues are present in the other cells as well?
Shinjo: Okay.
So, yeah, we try to collect various open -source
information from various Korean media outlets.
And also we try to digest the official government reports regarding the incident.
And, well, I studied telecommunications,
and I tried to match the puzzles between what is vaguely present in the media highlights
and also some keywords of the government press release.
And then, yeah, it was basically finding out the missing puzzles.
And, yeah, throughout the preparing of this presentation,
one reporter had been actually contacting us.
And a part of this presentation is already on a South Korean media.
Okay. It doesn't seem like there are any further questions.
Then thank you again for the talk.