Hacker News Reader

Comment by rsync | Hacker News Reader

How did they get to these GSM stations from the infected windows systems ?

Do BSC/BTS typically have IP-accessible configuration ?

Regardless of how they connected (I thought SS7 ...) wouldn't there be a login to access the switch BSC controls ... how would the malware have that ?

I don't understand how the malware running on the windows system executed the commands on the BSC.

View on HN

The BSC has several interfaces. One of them is the APG, used for Operation & Maintenance. It's a Windows module, accessible by IP. The APG serves as a gateway to the node's core via MML (Man-Machine Language), the instructions to operate the node.

So if you're running heavy equipment in a nuclear refining operation, you use microsoft windows to run your heavy equipment (centrifuges).

If you're a mobile network operator, you use microsoft windows to access and administer the base stations out in the field.

Pray tell: how important or sensitive does something have to be before someone finally asks "hmm ... maybe we shouldn't use microsoft windows for this" ?

If you're a mobile network operator, you use microsoft windows to access and administer the base stations out in the field.

It doesn't change much because the base station software probably has more security bugs than Windows.

You don't normally browse random websites through the base station administration software, though.

My understanding is that those logs are of configuration commands[1] sent by operators from a compromised OSS management server running Windows to the BSCs it's managing.

[1]: http://www.academia.edu/6018279/Oss_commands_-_Win_Fiol

Reply on news.ycombinator.com