議程
09:00
報到時間
10:00
Opening 開幕
10:10
English
Red
Exploit Development
Fuzzing
Advancements in JavaScript Engine Fuzzing
Carl Smith
11:00
Break
11:20
Mandarin
🍊
Red
Exploit Development
A 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learned
Orange Tsai
English
Red
Communication
How to hijack a VoLTE network
Pavel Novikov
Mandarin
Blue
Crypto
打造公平的遊戲轉蛋:在不洩漏原始碼的前提下驗證虛擬轉蛋的機率
Jing Jie Wang、李安傑
12:00
Lunch
13:00
English
Red
Exploit Development
Ghosts of the Past: Classic PHP RCE Bugs in Trend Micro Enterprise Offerings.
Poh Jia Hao
Mandarin
Red
Communication
Reverse Engineering
從硬體攻擊手段來解開機殼下的美麗祕密:網路通訊設備安全分析
Ta-Lun Yen
Mandarin
Red
Exploit Development
BYOVD
直搗核心:探索 AMD 驅動程式中的資安漏洞
Zeze
13:40
Break
14:00
Mandarin
Red
Exploit Development
Endpoint Security or End of Security? Exploiting Trend Micro Apex One
Lays、Lynn
English
Red
Electron
ELECTRONizing macOS privacy - a new weapon in your red teaming armory
Wojciech Reguła
Mandarin
Red
Exploit Development
Fuzzing
搭配模糊測試對Linux核心遠端檔案系統進行漏洞挖掘
Pumpkin
麋鹿在芝麻街 - ELK x BERT 資安分析實戰
Sheng-Shan Chen、Yuki Hung
14:40
Tea Time
15:10
Mandarin
Red
BYOVD
LPE
現代內核漏洞戰爭 - 越過所有核心防線的系統/晶片虛實混合戰法
馬聖豪
English
Red
Exploit Development
Electron
Virtual
What You See IS NOT What You Get: Pwning Electron-based Markdown Note-taking Apps
Li Jiantao
協會時間
Allen Own、CK
15:50
Break
16:00
Lightning Talk
freetsubasa & Hazel、沒有人
16:30
Closing
17:20
收場
English
Red
Communication
How to hijack a VoLTE network
R1
地點
11:20 ~ 12:00
8月19日 週六
一般議程
類型

Mobile networks are continuously evolving. While new 5G networks are just getting started, the most popular mobile technology is still LTE with VoLTE extension for voice communications. The VoLTE service is based on the IMS core. Moreover, the IMS becomes the only standard for the voice communications on the 4G/5G mobile networks. The VoLTE was always considered as a highly secure network because it was assumed the IMS is isolated from the public networks. However, our research demonstrates that an intruder is able not only execute attacks on VoLTE subscribers but also hijack the whole network. Having the hijacked VoLTE network, the intruder can provide their own mobile services using the LTE radio coverage of the victim mobile operator. Unlike attacks on signaling protocols such as SS7, Diameter, and GTP, the VoLTE hack does not require any specific expensive connections to IPX/GRX providers. Apart from a computer with open-source software, the intruder needs to use an LTE-dongle only. This additional equipment costs not more than $50. In this presentation, we will describe how the intruder is able to get access to the IMS network. Having this access, the intruder can obtain information about VoLTE subscribers and get access to these mobile devices. Developing the attack, intruder can deploy the IMS core open-source software to provide voice call service bypassing the operator's IMS core and billing system. The results of this research have not been published previously.

Pavel Novikov

10 years in telecom security, co-author of GSMA FS.20 Document. Head of telecom security research in SecurityGen Focused on telecom vulnerabilities: RAN, VoLTE, VoWiFi, GTP, Diameter, 5G SA and NSA. Conducting telecom security assessments for mobile operators for many years.

© 2023 HITCON, All Rights Reserved.