Hello, welcome to the Tuesday, July 3, 2018 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from New York City, New York.

Over the last few days, Guy noticed some interesting hits to his honeypot, and we have really no idea what vulnerability they're actually looking for here.

It looks like they're testing for a fairly simple to exploit code inclusion vulnerability.

They're trying to run a die command that will then output a string.

Probably they're looking for that string then in order to

identify systems that are vulnerable. The string they're using is Hello Pepper, followed

by an explanation mark, and then it should display nine times the number nine because they're

taking a string that is nine times the number one and

then multiply it by nine. So if you have any idea what they're trying to exploit here, take a look

at Gies' diary post for further details. And positive security came out with their diameter vulnerability's exposure report for 2018.

Now, diameter is a protocol that's heavily used in signaling for LTE, and it replaces the good old SS7 protocol, which of course has been the root cause

of many problems in 3G and earlier networks. As a quick summary in their report positive

technologies states that diameter does solve a lot of these problems, but the problem is that a lot

of the features, in particular encryption in diameter, isn't always enabled by providers, which

then again leads to much of the same issues that we had with SS7.

In some cases, also, diameter isn't actually used.

For example, when you're using voice over LTE, you're essentially doing voice over IP or using

protocols like SIP, and with that you inherit some of the problems that these signaling protocols like SIP

are exposed to. Also, if you're sending an SMS message, you're actually downgrading usually

to 3G and again SS7 is used as a protocol for signaling and you're exposing yourself to the good old SS7

vulnerabilities. So in short, if well configured then diameter can certainly solve many of the

problems that we are having with SS7, but in itself it's not of the end of all cell phone vulnerabilities.

...