Cathal Mc Daid Profile picture
Feb 15 11 tweets 4 min read Read on X
1/11
Today, we’re releasing details of a small but interesting mobile #vulnerability called MMS Fingerprint, reportedly used by #NSOGroup.

How this might work, and how we found it, is a bit unusual.

@EneaAB @josephfcox @rj_gallagher @campuscodi @lorenzofbenea.com/insights/dusti…
2/11
After a WhatsApp vulnerability exploited in 2019 #WhatsApp/#Facebook sued NSO Group. As part of its evidence there was a contract between a NSO Group reseller and a telecom regulator.

Within that contract was a list of features, including something called #MMSFingerprint Image
3/11
What is an MMS Fingerprint? NSO’s description says it can "reveal the target device and OS version by sending an MMS to the device".

Problem here is this attack wasn’t known in the industry. So I went to work trying to figure it out.
files.lbr.cloud/316009/whatsap…
Image
4/11
A complication in MMS, is that the MMS flow is not that straightforward, and some parts of an MMS delivery don’t actually use MMS. A MMS sequence flow between two opcos is below.

Keep an 👁️ on that MM1_notification.REQ and the subsequent MM1_retrieve.REQ Image
5/11
The MM1_notification tells the recipient that an MMS is waiting. However its not an MMS, but an SMS (a WSP Push binary SMS). The follow-up MM1_retrieve.REQ isn’t really a MMS either, it’s a HTTP GET to an URL in the MM1_notification.

Here is where things get interesting Image
6/11
This HTTP GET should normally go to the recipient’s “mms” APN, to retrieve the MMS from the MMSC. But within this HTTP GET, user device information is included.

This seemed to match how the MMS Fingerprint could work, but we needed to test to confirm.
7/11
We got some sample SIM cards, from a random western European operator, and after some trial and error, we sent our own custom MM1_notification (binary SMS) to a test handset with the SIM. This binary SMS had a field that pointed to a web server we controlled.

Did it work? Image
8/11
Success!

Sure enough, the test mobile did a GET to our server, and we could see the x-wap-profile and (MMS) User-Agent. This seems to match the MMS fingerprint attack described. But why would anyone want this info? Image
9/11
Probable main reason is that Device info is useful to tailor malicious payloads like #Pegasus. At basic level, you could find out if target uses Android or iOS.

Its also standard for attackers to want. Not same attack but 93% of #Simjacker attacks requested device info Image
10/11
Good news though is that we didn't observe any attackers using this technique in the operators we protect, this may be due to it being old. In addition it should be relatively easy to block these attacks. More suggestions on how to do this in the blog
11/11
Conclusion: certainly not the biggest or most impactful attack but the fact NSOGroup reportedly offered it shows it had some value. Binary SMS continues to be an area with a steady stream of vulnerabilities.

Also our first time finding an attack in legal documents!

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Cathal Mc Daid

Cathal Mc Daid Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @mcdaidc

Mar 6
1/12
It has been confirmed that the #Taurus interception was done via “a non-secure line”. Below is my opinion of one way in which it *might* have been done, taking into account the situation and #Russia's previous history.

Essentially it involves using #SS7 interception.
🧵 Image
2/12
First step is that we assume the call intercepted was generated by a German mobile device, roaming into Singapore. In the press release we are not told for certain it was a mobile. So could have been a mobile or a hotel line (or wifi)

theguardian.com/world/2024/mar…
Image
3/12
But as @RidT also states, this person gets added by another, so its probably not wifi.

And if i'm a German general abroad, would i use my "handy" or a strange hotel phone? I think I would use my mobile.

Read 12 tweets
Apr 25, 2022
1/10
3rd part of @adaptivemobile series on the mobile battlefield of #Ukraine

@RowlandCorr and I cover what may happen in the future. In particular we look at the little-known Russian separatist Mobile Operators Phoenix (Фенікс) and Lugacom (Лугаком)

blog.adaptivemobile.com/the-mobile-net…
2/10
The unlicensed Phoenix (Фенікс) & Lugacom (Лугаком) opcos were formed from the separatist seizure of Ukrainian Mobile Operator equipment after 2014 invasion of the #Donbas

They have been growing as the licensed Ukrainian Operators have pulled out

euobserver.com/investigations…
3/10
Since the new 2022 invasion started, there have been reports of them expanding into newly occupied areas of #Luhansk & #Donetsk

Plotting these reports against current frontlines shows this seems plausible. Credit to @nrg8000 for making the frontlines shapefiles available
Read 10 tweets
Mar 29, 2022
🧵A good recent example of #Ukraine contesting the Mobile Network / InfoSec battlespace.

Multiple #SIMBox seizures as part of an "enemy bot farm" network were announced yesterday by the Security Service of Ukraine. 1/6
ssu.gov.ua/novyny/z-pocha…
Technically this is a much bigger setup that the #SIMBox relay discovery from 2 weeks ago, (see my previous thread) which is not surprising as these are more traditional ‘bot farms’ used for signups for social media 2/6
According to the #SBU, the 5 enemy bot farms in the network used social media (including some banned in Ukraine) to “spread disinformation about a full-scale Russian invasion of our state and spread distorted news from the front”.

This network used 100,000 fake accounts 3/6
Read 6 tweets
Mar 15, 2022
1/5 Another significant capture in #Ukraine. Reported discovery today of a #SIMBox being used to relay Voice calls & SMS and other info to Russian forces (including top leadership of Russian army) & other individuals in #Ukraine. I will explain what this is and how it works.
2/5
First the system is comprised of 3 main parts,
1) the SIM Box server - in this case a Hypertone SMB-128 . This handles the control of up to 128 SIM Cards, cycles them when detected etc , and co-ordinates interaction with the #GSM Gateways
hybertone.com/en/pro_detail.… Image
3/5 Next the GSM Gateways, there are two Hypertone types being used here:
- There are 3x GoIP 8 - VoIP Gateway for 8 Channels being used,
- along with 1x GoIP-4 4 SIM VoIP GSM Gateway.
Both can be used for SMS or Voice ImageImage
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(