New Flaws In 4G, 5G Allow Attackers To Intercept Calls and Track Phone Locations (techcrunch.com) 46
An anonymous reader quotes a report from TechCrunch: A group of academics have found three new security flaws in 4G and 5G, which they say can be used to intercept phone calls and track the locations of cell phone users. The findings are said to be the first time vulnerabilities have affected both 4G and the incoming 5G standard, which promises faster speeds and better security, particularly against law enforcement use of cell site simulators, known as "stingrays." But the researchers say that their new attacks can defeat newer protections that were believed to make it more difficult to snoop on phone users. [Rafiul Hussain, one of the co-authors of the paper, along with Ninghui Li and Elisa Bertino at Purdue University, and Mitziu Echeverria and Omar Chowdhury at the University of Iowa are set to reveal their findings at the Network and Distributed System Security Symposium in San Diego on Tuesday.
The paper, seen by TechCrunch prior to the talk, details the attacks: the first is Torpedo, which exploits a weakness in the paging protocol that carriers use to notify a phone before a call or text message comes through. The researchers found that several phone calls placed and cancelled in a short period can trigger a paging message without alerting the target device to an incoming call, which an attacker can use to track a victim's location. Knowing the victim's paging occasion also lets an attacker hijack the paging channel and inject or deny paging messages, by spoofing messages like Amber alerts or blocking messages altogether, the researchers say. Torpedo opens the door to two other attacks: Piercer, which the researchers say allows an attacker to determine an international mobile subscriber identity (IMSI) on the 4G network; and the aptly named IMSI-Cracking attack, which can brute force an IMSI number in both 4G and 5G networks, where IMSI numbers are encrypted. AT&T, Verizon, Sprint and T-Mobile are all affected by Torpedo, "and the attacks can be carried out with radio equipment costing as little as $200," the report adds. One U.S. network is reportedly vulnerable to the Piercer attack, but the researcher wouldn't name which one.
The paper, seen by TechCrunch prior to the talk, details the attacks: the first is Torpedo, which exploits a weakness in the paging protocol that carriers use to notify a phone before a call or text message comes through. The researchers found that several phone calls placed and cancelled in a short period can trigger a paging message without alerting the target device to an incoming call, which an attacker can use to track a victim's location. Knowing the victim's paging occasion also lets an attacker hijack the paging channel and inject or deny paging messages, by spoofing messages like Amber alerts or blocking messages altogether, the researchers say. Torpedo opens the door to two other attacks: Piercer, which the researchers say allows an attacker to determine an international mobile subscriber identity (IMSI) on the 4G network; and the aptly named IMSI-Cracking attack, which can brute force an IMSI number in both 4G and 5G networks, where IMSI numbers are encrypted. AT&T, Verizon, Sprint and T-Mobile are all affected by Torpedo, "and the attacks can be carried out with radio equipment costing as little as $200," the report adds. One U.S. network is reportedly vulnerable to the Piercer attack, but the researcher wouldn't name which one.
Intercept calls and track locations (Score:2, Funny)
Hardly sounds like a "flaw".
Re: Intercept calls and track locations (Score:1)
Re: (Score:2)
Voice prints and locations.
5G? (Score:4, Funny)
Re: (Score:2)
Are we talking real 5G, or AT&T 5G?
Both, since the flaws are also in 4G.
Re: (Score:2)
Right letter 'F', wrong word, definitely not flaws but FEATURES, oh yeah, all those bugs by accident, yep uh huh. This crap has been going on for decades and they still can not check their code properly, or, do they?
Re: (Score:2)
This crap has been going on for decades and they still can not check their code properly, or, do they?
Fair point, but there's plenty of evidence for both malice and incompetence.
Re: (Score:2)
Its a feature (Score:1)
requested by .gov
Flaw, or feature? (Score:2)
Since the advent of the surveillance state, I just assume that speaking on a cell phone, texting on a cell phone, and carrying a cell phone with the battery in it is the technological equivalent of breadcrumbs... if anybody is highly motivated enough to want to track my movements.
The Stingray Tools [npr.org] are fairly easy for well-funded organisations to deploy, your cellie hits on towers it is closest to, and all manner of back doors for national security may be built in.
Don't take a knife to a gun fight, and do
It's all Huawei's fault! AndPutins! (Score:2)
Flaws? (Score:2)
Oh, you poor naive civilians ...
Re: (Score:2)
new security flaws in 4G and 5G (Score:2)
Just because you're paranoid doesn't mean that they aren't out to get you. That was my funny phrase in the 70's, it's not quite so funny now.
Luckily they're not trying to find or get me. But I'll ask Google Home about it just to make sure.
Late adopter (Score:2)
Re: (Score:1)
Don't bother bringing your phone to Australia, then.
We got rid of 2G a few years back.
911 phase II tracking (Score:2)