hi it's Mr Ali Abdullahi
thank you so much uh welcome ladies and
gentlemen
so today I'm gonna talking about the
metaverse not really about the matters
metaverse itself just gonna take a look
at the other side of metaverse
deployments
they
in place components and their
connectivities
because as far as you know now we have
different type of metaverse deployments
we have different vendors different
companies they have their own deployment
of metaverse but we are hearing too many
times since last two years about the
metaverse and different vendors
companies started to deploy their own
metaverse systems
and environments so
uh yeah
okay A bit about myself so I'm Ali I'm
uh security engineer at picnic
Technologies Netherlands so
um
security researcher for a decade and I'm
regularly participating as a speaker
trainer in different conferences across
the world
and I just want to
go a bit faster
too many slides so
let's talk about the agenda of this
presentation
so first of all we will take a look at
the metaverse itself different
components different layers and
connectivities and different
Technologies in use within the metaverse
deployments and after that we will try
to identify different security risks and
threats
and uh also this presentation is just
the starting points right now there are
too many security researchers around the
world that are working on metaverse
they're working on this kind of
Technologies nowadays and uh yeah
hopefully we can see more and more
research and papers around this kind of
Technologies and also do not expect to
cover all the things they are just a
couple of items that we are going to
talk about today and yeah let's get
started
so what actually made of Our Stars so
we heard that metaverse is gonna bring
gingo real life into digital one and uh
like we can do video games
entertainments we can do like a social
networking and remote working as well as
a like a investment as well and uh here
you can see the different components and
items within the metaverse like the
virtual reality mixed reality augmented
reality extended reality nfts and
digital assets crypto as well as web
free which is a very big part of that
and uh it's a separated topic if you
want to talk about
so what is the uh main metaverse impact
is actually the main impact is only on
our daily life you know real life
actually and uh also another impact is
on our daily work and as well as doing
education is possible as well throughout
the metaverse entertainment as well
which is a very very big item here uh
media and also investment and also I
hear like some sort of Ceremonies inside
metaverse as well as the wedding party
throughout metaverse etc etc
but it's still a black box so we don't
know much more about the the metaverse
itself so we just want to more about it
because we we are hearing different
definitions of metaverse from different
companies different deployments and
vendors around the world but it's still
a black box
even for me
okay uh
let's talk about a tangible example of a
simple architecture so we have different
layers here so starting with the basic
layer which is a uh including the
mathematical function SEC P 365k1 which
is the BTC uh public key serialization
as well we have core layer which is
responsible for algorithms hashing
databases networking as well model layer
containing the account credentials
Ledger addresses account addresses etc
etc and we have service layer including
the HTTP connections queries as well as
the subscription models and this is the
age level of the architecture which is
uh connected directly to the human
interface and in human interfaces we
have a different mediums like a mobile
applications web application etc etc
so right now we just want to starting
with the basic layer so
I said that we have a like a different
functions C C plus plus base functions
General functions and mathematical
libraries and uh if I want to mention
some some of the threats here we we can
like mentioning a freeze attack against
uh uh SEC p2c through 65 and uh buffer
overflow vulnerabilities brute forcing
against the mathematical function as
well as reverse engineering and uh yeah
I also just mentioned some CVS here as
well
so core layer
we have networking networking protocol
we have proof of work here and also we
are seeing the databases like sqlite
like level DB and the other uh also
threads like if I want to say well the
thirds in this layer it's a Erebus
attack Eclipse attack or CyberLink
attack which is some sort of node
isolation as well as a denial of service
attack against the networking part I
would say that IP backbone
infrastructure
so a bit in depth in the previous slide
like about talking about the Cyber
attack which is a like a it will lead to
this double spending and it's trying to
infecting uh honest communities uh and
also uh to to to be able to perform
falsifying uh files like a falsifying
digital files and also aerobus is uh
also the same but uh targeting uh
internet service providers and the isps
hosting and providing services to public
Bitcoin nodes
and eclipse is also uh it's some sort of
redirection attack and uh trying to
redirect victim connections to other
compromised other already compromised uh
nodes which which are infected
service layer so we have a blockchain
core notes Here we have HTTP connections
here as well as a client side so
you can see that we have a core notes we
have a connectivity between cover nodes
and HTTP server and the connection
between HTTP and client and in between
we have apis we have websocket we have
Json RPC etc etc and the threads could
be like a remote code execution URL URI
injection uh API vulnerabilities like
the sensitive
sensitive data disclosure and uh through
the apis and web sockets uh
vulnerabilities like a sniffing
injection and uh also some maybe some
specific vulnerabilities regarding the
specific Technologies like a 0mq here uh
which is some sort of a messaging
Library
and
so the the other part and which is a
very very critical is communication and
the connectivity so we just want to use
metaverse we just want to use this kind
of technology so the main part of the
usage of the technology is the
connectivity between my equipment my
device like my mobile phone and uh other
equipments within the core Network
within the service provider so basically
you can see cellular communication like
a 3G to 6G communication but we are
already dealing with mostly with 4G and
5G communication nowadays and also
another vital part is a radio part or
radio access networks which is the most
accessible part of this connectivity
because my phone my device is connected
through the radio frequencies within the
cell tower or the base station and what
are the use cases here so basically for
end-to-end communication for the best
user experience and best rendering
experience uh Spectrum capacity uh low
latency and also having a better
Handover experience
throughout the radio Access Network
slicing and serious level agreement so
in 5G we have we are dealing with
network slicing and nowadays too many
researchers and universe diversities
institutions they're working on slicing
security as well
and also we were dealing with apis Json
SDK and some other networking platforms
so here is a an overview so
starting from the like for an example
like a extended reality device so we
have a wireless chipset of Wi-Fi chipset
and we have a OS level and Hardware
level and Hardware platform there and
there is a connectivity through the
radio Access Network
towards the core Network
as well as the apis and softwares and
the rest of Technologies in the core
Network so starting from the from the
user points so we can mentioning
baseband exploitation the exploitation
and vulnerabilities and the baseband
side on a chipset so nowadays we know
that too many zero day vulnerabilities
one day vulnerability is trading and on
dark webs and criminal forums regarding
the exploiting uh different kind of Base
bands with different vendors
so the second item is uh
the OS exploitation remote code
execution and remote jailbreak
exploitation on iOS systems which is
very very interesting here and uh
and the next one is Sim swapping as an
optional item here I will talk about all
of those uh in the next slides
so a bit further we have a radio access
part so in this area we can mention the
user equipment information gathering but
for performing man in the middle as well
as deploying a fake uh station or fake
BTS or fake a cell tower
and a bit more in inside the core
Network we can mention that deploying a
rogue node a rock node and a rock
function inside the core Network or a
fake node I would say denial of service
and a function and a core function as
well as a denial of service on a user by
making disruption on a normal user
session flow as well as a sniffing
so it's more about the apis because for
example in 5G that I'm going to talk
about it so we are going to deal with
too many apis calls and also HTTP
connection because 5G will open the
doors new doors to hackers and attackers
around the world because it will be
based on software-defined networking
Network function virtualization and it's
a bit more software rather than secret
switching or radio part
let's talk about OS and software so I
said that remote code execution on
Android devices and remote jailbreak uh
exploitation and iOS systems use after
free vulnerabilities and exploitation
and data extracted extraction even
locally or remotely and also one click
kernel code execution or rje which is a
part of RJ which is one of the most
valuable zero days nowadays
here's a the radio Access Network
architecture but this one is uh for LTE
part so we have different cell towers
like different enote bees here they're
connected together using the H2
interfaces and also they're connected to
the core Network the left-hand side you
can see the mobile
Mobility management entity which is
responsible for handling the subscribers
uh information as well as a serving
Gateway and packet Gateway they're
acting as a edge router and dealing with
the subscribers data
and let's talk about the radio right now
uh so one of the most important part of
the radio exploitation is the
ability to downgrade uh subscribers in a
specific area to lower Technologies like
if we are using 5G or 4G right now if uh
a criminal or an attacker could be able
to downgrade our cell phone to like a 2g
or 3G Technologies by performing jamming
as you can see here it would be a very
very good environment for them to
perform
Manning the middle attack because there
there is less security mechanisms in 2G
and 3G Networks
also nowadays maybe you you are using 5G
we are using 4G LTE and uh in uh next
couple of years we will use a 6G
technology as well but uh mobile network
operators and service providers still
using traditional Technologies they're
still using 2G they're still using 3G so
and the most vulnerable part of the
those traditional Technologies from a
signaling point of view is usage of ss7
networks So within the ss7 networks also
you're able to uh like
extracting the very valuable information
regarding the SIM cards and subscribers
like the rant sris and KC which is
responsible for the confidentiality of
my UCM and the cell tower and if you are
not able to do it in radio access part
it's easy to extract it from the core
Network functions inside the core
Network while taking advantage and
exploiting the traditional Technologies
so here is an example of uh performing a
denial of service and a metaverse user
so for example we can assume that that
user is a XR device or a mixed reality
device Etc and in this example you can
see that the hacker will try to run a
rook and a fake cell tower
to be able to lure the victim lure the
using on that device to pretend that hey
I'm a legit cell tower and after that
because it's kind of cloning the
configuration of the legit legit SL
Tower here and the traffic area update
which is a necessary part of the
attachment of my device to the cell
tower and to the core Network
will be sent to the illegal cell tower
which is a fake one now and after that
it will respond with the Tau reject to
the user and after that it will cause a
touch reject then I will not be able to
to attach to the network and it will be
inside a loop and uh like a in a
specific area it would because A
disruption and a denial of service so a
bunch of subscribers a couple of
subscribers in a specific area uh they
can't attached to the core Network
so I mentioned about uh Sim swapping
actually uh so
it's some sort of account takeover
actually
uh it's a mix of impersonation and
Insider attack so hackers try to like uh
perform a social engineering uh as well
as some initial information gathering on
victims data like the name address etc
etc and it will try to pretend that I'm
gonna changing my seam and the number
the actual msisdn or phone number will
transfer to the illegal and fake SIM
card or a hacker SIM card and after that
uh the hacker will try to perform uh
request the 2fa or uh and after that
unauthorized access to an account and
account will be compromised and uh
hacker will try to actually gain
unauthorized access to that account
so there are some other radio threads
like a
exploiting the blockchain mutual
authentication or a mass denial of
service by taking advantage of very big
Jammers equipments but it's not really
technical so I'm gonna skip those
and talking a bit about the 5G as well
5G coordinate work which is acting a
vital role in connectivity and
connection of metaverse as well
so as you can see here uh we have a user
equipment yeah I said that there is a
connectivity between user equipment our
cell phone our XR devices etc etc within
the cell tower and these nodes are those
big big equipments Telecom equipments
nowadays but there are mostly software
based and they're virtualized nowadays
and we call them different functions so
we have a user plane function we have a
session management function application
function and what PCF is responsible for
policy charging then also
SMF is responsible for managing the
sessions and also some sort of
of data of different functions different
core functions and uh yeah
so if I want to mention some some sort
of uh exploitation let's talk about the
denial of service or tampering gonna
murderers Telco infrastructure or user
so to do this uh regardless of usage of
traditional Technologies and only
focusing on 5G core Network So within an
initial access to the network regardless
of Insider hacker or even a remote
access to the one of the core Network
a hacker will try to set up a rogue
function or a rogue SMF here or even
compromising SMF instead of set up a new
one so and we will try to send the HTTP
2 request containing the network
function node information like the
function ID and function configuration
to the user plane function
and after that a new rogue node B which
is uh here is SMF we'll try to send the
modification request to modify a
function actually to compromise a
function or even in another scenario it
is possible to send a session deletion
request
to UPF to actually delete a legitimate
user session and it will cause a denial
of service and disruption to to the
normal user flow to through through the
network and UPF is responsible for Mike
and uh handling my connection from my
equipment to the network to the public
network like the internet
so another one will be uh the Nyla
series and
infant user and another perspective so
like a user traffic redirection example
here so again we have a rook node uh
here like a SMF and a connection to UPF
and attacker will try to abusing the PF
CPU or packet forward and control
protocol to send the session
modification request to UPF
and changing the destination address and
changing the destination address to
another address which is a like an
interception point and we have two
different scenarios in case of a null or
invalid destination it will be cause a
denial of service attack and if the
session the node is available and
already compromised by the hacker it
will be redirecting for the interception
and the sniffing will be possible in
this scenario
so
that's a pretty much of it uh if you
have any questions
uh it will be available
questions anyone
you saw your Valley
thank you thank you ladies and gentlemen
uh for your time I appreciate it
[Applause]