SPARROW: A Novel Covert Communication Scheme Exploiting Broadcast Signals in LTE, 5G & Beyond

Presented at DEF CON 29 (2021), Aug. 7, 2021, 2 p.m. (45 minutes).

When researching methods for covert communications in the wireless space, we noticed most hackers are barely looking below the IP layer, and even the wireless guys are focused on creating their own radio (PHY layer) solutions rather than looking at what's already available to them. We discovered a sweet spot that takes advantage of MAC layer protocols in LTE and 5G, enabling long range communication using other people's networks, GSMA CVD-2021-0045. We can use SPARROW devices almost everywhere in a variety of scenarios, such as data exfiltration and command and control. Despite limited data rates, the new scheme can defeat known covert communication schemes with dedicated PHY in the following ways: - Maximum Anonymity: SPARROW devices do not authenticate with the host network while operating. This eliminates their exposure to network security and lawful intercept systems as well as spectrum scanners. Utilizing limited resources, they cause very minimal impact on the host network services. - More Miles per Watt: SPARROW devices can be several miles apart exploiting broadcast power of base stations or non-terrestrial technologies. The range can be further extended by deploying several of them in a geographically sparse mesh network. - Low Power & Low Complexity: SPARROW devices can utilize existing protocol implementation libraries installed on commodity SDRs. They can operate on batteries or harvest energy from the environment for long durations, just like real sparrows! REFERENCES: There are no direct references of prior study that I (Reza) have (aside from general knowledge of 5G standard and RF), however the following talks and items led me towards this discovery: - DEF CON Safe Mode - James Pavur - Whispers Among the Stars - https://www.youtube.com/watch?v=ku0Q_Wey4K0 - DNS Data Exfiltration techniques - My boss buying me a 5G base station emulator and saying "find something wrong with this!"

Presenters:

• Reza Soosahabi - Senior R&D Engineer, Keysight Technologies
  Reza Soosahabi is a lead R&D engineer with Application & Threat Intelligence Research Center (ATIRC) at Keysight Technologies. His current field of research includes RAN security, data exfiltration and ML / statistical algorithms. He has been a 5G system engineer prior to joining Keysight in 2018. He contributes in IEEE proceedings related to signal processing and information security. As a math-enthusiast, Reza often tries unconventional analytical approaches to discover and solve technically diverse problems. He also enjoys cutting boxes with Occam's Razor and encourages the others around him to do so. @darthsohos https://scholar.google.com/citations?user=SNFxK60AAAAJ&hl=en
• Chuck McAuley - Principal security researcher (ATIRC), at Keysight Technologies
  Chuck McAuley is a principal security researcher with the Application & Threat Intelligence Research Center (ATIRC) at Keysight Technologies. Chuck has a variety of interests that include 5G and LTE packet core vulnerabilities, reverse engineering botnets, finding novel forms of denial of service, and researching weird esoteric protocols for weaknesses and vulnerabilities @nobletrout

Links:

• https://defcon.org/html/defcon-29/dc-29-speakers.html#soosahabi
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Reza Soosahabi Chuck McAuley - SPARROW - A Novel Covert Communication Scheme Exploiting Broadcast Signals in LTE, 5G & Beyond - Demo.mp4
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Reza Soosahabi Chuck McAuley - SPARROW - A Novel Covert Communication Scheme Exploiting Broadcast Signals in LTE, 5G & Beyond.mp4
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Reza Soosahabi, Chuck McAuley - SPARROW - A Novel Covert Communication Scheme Exploiting Broadcast Signals in LTE, 5G & Beyond - Live.mp4
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 presentations/Reza Soosahabi Chuck McAuley - SPARROW - A Novel Covert Communication Scheme Exploiting Broadcast Signals in LTE, 5G & Beyond.pdf (slides)
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Reza Soosahabi Chuck McAuley - SPARROW - A Novel Covert Communication Scheme Exploiting Broadcast Signals in LTE, 5G & Beyond - Demo.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Reza Soosahabi Chuck McAuley - SPARROW - A Novel Covert Communication Scheme Exploiting Broadcast Signals in LTE, 5G & Beyond.srt (subtitles)
• https://www.youtube.com/watch?v=oaLIo9HwW-g

Similar Presentations:

• Black Hat USA 2019 / New Vulnerabilities in 5G Networks
• Black Hat USA 2021 / Over the Air Baseband Exploit: Gaining Remote Code Execution on 5G Smartphones
• DEF CON 30 (2022) / Defensive 5G Demo