Article Detail

Description

Customer is concerned that GTPDOOR Malware could be allowed through Juniper SRX firewall even when GTP inspection is enabled. More details here: https://thehackernews.com/2024/02/gtpdoor-linux-malware-targets-telecoms.html

Symptoms

Based on testing the below packet, SRX is dropping GTPDOOR malware:

Logs on SRX after sending the packet through SRX with GTP inspection enabled:

user@srx> show security gtp counters all 

Tunnel counters:
                 Total      GTPv0    GTPv1-c    GTPv1-u    GTPv2-c    GTPv2-u
Allocated      0          0         0         0          0           0         
Freed          0          0         0         0          0           0          

Packet counters:
                 Total      GTPv0      GTPv1      GTPv2       GTP'
Received       1          0           0          0           0       
Passed         0          0           0          0           0       
Dropped        1          0           0          0           0        

Error counters:
        Total error                   : 1
        Exception                     : 0
        Invalid header                : 1

GTP flowtrace:

Mar 18 12:09:41 12:09:41.447069:CID-0:THREAD_ID-01:LSYS_ID-00:RT:FLOW:gtp_pkt_handler(1424): pkt_id(19) Unsupported packet, alg id 74, udp data len 38, flag octet 0x0

Solution

Need to enable GTP Inspection for GTP-C (UDP port 2123). More details on enabling GTP inspection can be found here: https://www.juniper.net/documentation/us/en/software/junos/gtp-sctp/topics/topic-map/security-gprs-gtpv1-overview.html

Modification History

2024-04-10 : Article Created