Mapping the Attack Surface of Telecommunication Networks from the Public Internet

Loading...
Thumbnail Image
Journal Title
Journal ISSN
Volume Title
Perustieteiden korkeakoulu | Master's thesis
Date
2023-08-21
Department
Major/Subject
Security and Cloud Computing
Mcode
SCI3113
Degree programme
Master’s Programme in Security and Cloud Computing (SECCLO)
Language
en
Pages
58
Series
Abstract
The telecommunications sector is increasingly connected to the Internet, resulting in an expanded attack surface accessible from the public Internet. This has increased the availability of information such as IP addresses, open ports, and other network details that anyone from the Internet can access. As a result, potential entry points for attackers have increased, making it essential to map the attack surface of telecommunication networks from the public Internet. While previous research has explored various tools and techniques for mapping the attack surface of the Internet of Things (IoT) and Industrial Control Systems (ICS), such techniques have not yet been extended to the telecommunications domain. This thesis aims to comprehensively map the attack surface of telecommunications operators from the public Internet. To achieve this, we conducted a thorough literature review and proposed a methodology for mapping the attack surface explicitly designed for the telecommunications sector. First, we devised a research workflow that outlines the steps involved in the methodology. Second, we developed a Python-based tool to automate the workflow. We used the tool for a particular mobile network operator. It successfully gathered DNS records, IP addresses, exposed ports, services, Autonomous System Numbers (ASN), server versions, and potential vulnerabilities. The collected data provides valuable insights into the network infrastructure of the operator, aiding in the understanding of potential security risks.
Description
Supervisor
Aura, Tuomas
Thesis advisor
Rao, Siddharth
Keywords
attack surface mapping, telecommunication, passive reconnaissance, mobile network operator, public internet
Other note
Citation