Hackers Can Spoof Phone Numbers, Track Users Via 4G VoLTE Mobile Technology (bleepingcomputer.com) 38
An anonymous reader writes: "A team of researchers from French company P1 Security has detailed a long list of issues with the 4G VoLTE telephony, a protocol that has become quite popular all over the world in recent years and is currently in use in the US, Asia, and most European countries," reports Bleeping Computer. Researchers say they identified several flaws in the VoLTE protocol (a mixture of LTE and VoIP) that allow an attacker to spoof anyone's phone number and place phone calls under new identities, and extract IMSI and geo-location data from pre-call message exchanges. These issues can be exploited by both altering some VoLTE packets and actively interacting with targets, but also by passively listening to VoLTE traffic on an Android device. Some of these flaws don't even need a full call/connection to be established between the victim and the target for the data harvesting operation to take place. Additionally, another flaw allows users to make calls and use mobile data without being billed. The team's research paper, entitled "Subscribers remote geolocation and tracking using 4G VoLTE enabled Android phone" was presented last week at SSTIC (Symposium sur la Securite des Technologies de l'Information et des Communications), a security conference held each year in Rennes, France.
Comment removed (Score:3)
Re: (Score:1, Funny)
"InterestING timing"
FTFY.
In keeping with Slashdot commentary protocols, your minor spelling error has rendered your entire comment, including but not limited to any reasoning contained therein, null and void. Any and all conversational contributions you had hoped to make, whether with good intentions or mischievous, must now be expunged from your plans.
Regards, AC
Re: (Score:3)
you can buy ~$20 pre registered sims in Poland. You can also register them yourself using "third party", all you need is a street bum and a bottle of vodka.
Re:Interested timing (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2)
You can buy SIMs now in America? Welcome to the 90s. When you catch up with the rest of the world you'll be registering them with IDs too ;-) And yes rest of the world. This policy isn't EU specific. It's scattered through countries but it's growing in popularity all over.
Some governments things security is making sure terrorists need to hand over IDs when buying a SIM card. Others think it means checking-in laptops and taking off shoes.
It would seem that no country is quite immune from stupid.
Re: (Score:2)
Just now in the EU you need to register your pre-paid.It used to be that you could go any store, buy a card and be done with it.
Back in 2001 I had need to buy a pre-paid cell phone while working in Italy. This requited an Italian resident to show his ID and effectively co-sign for the phone with me. And I can still remember all the paperwork that had to be filled out.
Re: (Score:1)
VoLTE (Score:1)
SS7 (Score:1)
Re:SS7 (Score:5, Interesting)
LTE uses Diameter, but most SS7 attacks are also viable since they underlying messages and commands have identical functions (they have to, otherwise you can't interact with large parts of the telephone network).
This paper describes something else. When you do a call over VoLTE you normally get a dedicated bearer (sort of like a VLAN over LTE) assigned to you to guarantee QoS. On many android phones (same holds for USB LTE modems) this interface becomes visible as a virtual IP based network interface. The VoLTE stack will then setup IPSec on this interface if requested by the network, and finally initiate a SIP/RTP session through it for handling the actual call. They say that a use with root access can run for example run tcpdump on this inferface and eavesdrop on the call. This in itself is not surprising and cause for concern, with root access to the phone you can record directly from the microhpone after all.
More surprising is that they tested some of the SIP servers and that they were poorly secured, being vulnerable to well known SIP attacks: user enumeration, source spoofing and data tunneling (clever...). They also discovered a lot of data leakage in optional headers and protocol ids, including the IMEI and serving cell of the remote party.
I have heard, but have no direct information, that many of these IP bearer based services are almost directly connected to the operators IP core network (firewalling is not supported by many access network components, you would need to add it externally), and thus that traditional software exploitation may work.
"Hackers Can Spoof Phone Numbers" (Score:2, Flamebait)
No shit, Sherlock. They have been doing that for decades, not only this way.
3G elements no TLS (Score:5, Informative)
so basically VoLTE spec don't see the point in protecting the SIP call correctly and allow anyone on their network to place SIP calls
"Depending on the network operator’s architecture, IPsec tunnels between the UE and the IMS core network will be set up. In this case, we
need to inject data directly into this existing IPsec tunnel, typically, when we want to test active vulnerabilities and replay traffic. The easiest way
to achieve this is to reuse an existing socket used by a legitimate IMS service on Android. Reusing this socket will permit to inject traffic inside
the IPsec tunnel, as the association already was established by the Linux Kernel IPsec stack (Netkey)."
At least they use IPSec but honestly they do not check the keys... deploying all the keys is going to be a major headache, and you have to trust a CA not to screw up...
The solution is to deploy your keys using DANE and DNSsec, most operators are using IPv6 and DNSsec so its not much of a deployment stretch
they also complain that the " utran-cell-id-3gpp value of UE-victim received in SIP 183 Session Progress response" honestly yes if you secured the tunnel then it would not matter
So in conclusion what they are saying is they can do MITM attacks because the operator does not authenticate correctly the IPsec tunnel and trusts all data sent...
the old Russian Proverb "trust but verify" no problem with the SIP just the verification plus tunnel and keys...
I wonder how much money consulting these guys make for setting up a MITM attack... good luck to them
regards
John Jones
How's this news? (Score:3)
You still are going to require a valid SIM card and/or the carrier's encryption keys to get on their network....
But this is not in any way new...
1. Cloning a phone/SIM has been done for decades and is a common way of "stealing" services.
2. Messing with the SS7 ISUP portion of a call setup allows the spoofing of callerID information, again a technique that's been used nearly as long as SS7 has.
3. Remember those "Stinger" devices the government uses to intercept phone calls? Everything you need to spoof a call is in there, and you are not foolish enough to think only the government has them right?
So how's this news? It's like somebody trying to protect a patent for a rectangular handheld computing device with rounded corners.... Well Duh? How's that innovative or new?
Re: (Score:2)
So how's this news? It's like somebody trying to protect a patent for a rectangular handheld computing device with rounded corners.... Well Duh? How's that innovative or new?
Something that is news is that you can capture the IMEI of the remote devices that you're calling, without even completing a call. That's something that shouldn't be leaking out of a carrier's network. An attacker could bulk dial many numbers on a network to gather their IMEIs which, since they know what number they called to get each IMEI, could be sold together for nefarious purposes.
If it hurts profits... (Score:1)
"Additionally, another flaw allows users to make calls and use mobile data without being billed."
Free use of services by customers is what keeps telecom execs up at night. Well, that and being vampires.