1/11
Today, we’re releasing details of a small but interesting mobile #vulnerability called MMS Fingerprint, reportedly used by #NSOGroup.
How this might work, and how we found it, is a bit unusual.
@EneaAB @josephfcox @rj_gallagher @campuscodi @lorenzofbenea.com/insights/dusti…
Today, we’re releasing details of a small but interesting mobile #vulnerability called MMS Fingerprint, reportedly used by #NSOGroup.
How this might work, and how we found it, is a bit unusual.
@EneaAB @josephfcox @rj_gallagher @campuscodi @lorenzofbenea.com/insights/dusti…
2/11
After a WhatsApp vulnerability exploited in 2019 #WhatsApp/#Facebook sued NSO Group. As part of its evidence there was a contract between a NSO Group reseller and a telecom regulator.
Within that contract was a list of features, including something called #MMSFingerprint
After a WhatsApp vulnerability exploited in 2019 #WhatsApp/#Facebook sued NSO Group. As part of its evidence there was a contract between a NSO Group reseller and a telecom regulator.
Within that contract was a list of features, including something called #MMSFingerprint
3/11
What is an MMS Fingerprint? NSO’s description says it can "reveal the target device and OS version by sending an MMS to the device".
Problem here is this attack wasn’t known in the industry. So I went to work trying to figure it out.
files.lbr.cloud/316009/whatsap…
What is an MMS Fingerprint? NSO’s description says it can "reveal the target device and OS version by sending an MMS to the device".
Problem here is this attack wasn’t known in the industry. So I went to work trying to figure it out.
files.lbr.cloud/316009/whatsap…
4/11
A complication in MMS, is that the MMS flow is not that straightforward, and some parts of an MMS delivery don’t actually use MMS. A MMS sequence flow between two opcos is below.
Keep an 👁️ on that MM1_notification.REQ and the subsequent MM1_retrieve.REQ
A complication in MMS, is that the MMS flow is not that straightforward, and some parts of an MMS delivery don’t actually use MMS. A MMS sequence flow between two opcos is below.
Keep an 👁️ on that MM1_notification.REQ and the subsequent MM1_retrieve.REQ
5/11
The MM1_notification tells the recipient that an MMS is waiting. However its not an MMS, but an SMS (a WSP Push binary SMS). The follow-up MM1_retrieve.REQ isn’t really a MMS either, it’s a HTTP GET to an URL in the MM1_notification.
Here is where things get interesting
The MM1_notification tells the recipient that an MMS is waiting. However its not an MMS, but an SMS (a WSP Push binary SMS). The follow-up MM1_retrieve.REQ isn’t really a MMS either, it’s a HTTP GET to an URL in the MM1_notification.
Here is where things get interesting
6/11
This HTTP GET should normally go to the recipient’s “mms” APN, to retrieve the MMS from the MMSC. But within this HTTP GET, user device information is included.
This seemed to match how the MMS Fingerprint could work, but we needed to test to confirm.
This HTTP GET should normally go to the recipient’s “mms” APN, to retrieve the MMS from the MMSC. But within this HTTP GET, user device information is included.
This seemed to match how the MMS Fingerprint could work, but we needed to test to confirm.
7/11
We got some sample SIM cards, from a random western European operator, and after some trial and error, we sent our own custom MM1_notification (binary SMS) to a test handset with the SIM. This binary SMS had a field that pointed to a web server we controlled.
Did it work?
We got some sample SIM cards, from a random western European operator, and after some trial and error, we sent our own custom MM1_notification (binary SMS) to a test handset with the SIM. This binary SMS had a field that pointed to a web server we controlled.
Did it work?
8/11
Success!
Sure enough, the test mobile did a GET to our server, and we could see the x-wap-profile and (MMS) User-Agent. This seems to match the MMS fingerprint attack described. But why would anyone want this info?
Success!
Sure enough, the test mobile did a GET to our server, and we could see the x-wap-profile and (MMS) User-Agent. This seems to match the MMS fingerprint attack described. But why would anyone want this info?
9/11
Probable main reason is that Device info is useful to tailor malicious payloads like #Pegasus. At basic level, you could find out if target uses Android or iOS.
Its also standard for attackers to want. Not same attack but 93% of #Simjacker attacks requested device info
Probable main reason is that Device info is useful to tailor malicious payloads like #Pegasus. At basic level, you could find out if target uses Android or iOS.
Its also standard for attackers to want. Not same attack but 93% of #Simjacker attacks requested device info
10/11
Good news though is that we didn't observe any attackers using this technique in the operators we protect, this may be due to it being old. In addition it should be relatively easy to block these attacks. More suggestions on how to do this in the blog
Good news though is that we didn't observe any attackers using this technique in the operators we protect, this may be due to it being old. In addition it should be relatively easy to block these attacks. More suggestions on how to do this in the blog
11/11
Conclusion: certainly not the biggest or most impactful attack but the fact NSOGroup reportedly offered it shows it had some value. Binary SMS continues to be an area with a steady stream of vulnerabilities.
Also our first time finding an attack in legal documents!
Conclusion: certainly not the biggest or most impactful attack but the fact NSOGroup reportedly offered it shows it had some value. Binary SMS continues to be an area with a steady stream of vulnerabilities.
Also our first time finding an attack in legal documents!
• • •
Missing some Tweet in this thread? You can try to
force a refresh
