Long Term Evolution (LTE) mobile networks are currently deployed through the world. These LTE mobile networks make use of full packet switching and the IP protocol, unlike previous iterations of the mobile network. This change from circuit switching to packet switching allows new attacks not previously possible. Some implementations of LTE networks and mobile applications are currently vulnerable to several issues which may result in loss of privacy, incorrect billing, and data spoofing.
Current LTE networks rely on packet switching, rather than the circuit switching of previous generations of the mobile network. The use of packet switching and the IP protocol (particularly the SIP protocol) may allow for new types of attacks not possible on previous generation networks. Such types of attacks are well-known in the security community; for example, see previous attacks against Voice over IP (VoIP).
The following is a list of vulnerabilities discovered by the security researchers in some current implementations of LTE networks. Note that every carrier has its own implementation, and may not be vulnerable to every issue listed below.
CWE-732: Incorrect Permission Assignment for Critical Resource
The Android operating system does not have appropriate permissions model for current LTE networks; the CALL_PHONE permission can be overruled with only the INTERNET permission by directly sending SIP/IP packets. A call made in such a manner would not provide any feedback to the user. Continually making such calls may result in overbilling or lead to denial of service.
Apple reports that iOS uses a different permission model and is not affected by this particular issue.
CWE-284: Improper Access Control
Some networks allow two phones to directly establish a session rather than being monitored by a SIP server, thus such communication is not accounted for by the provider. This may be used to either spoof phone numbers or obtain free data usage such as for video calls.
CWE-287: Improper Authentication
Some networks do not properly authenticate every SIP message, allowing spoofing of phone numbers.
CWE-384: Session Fixation
Some networks allow a user to attempt to establish multiple SIP sessions simultaneously rather than restricting a user to a single voice session, which may lead to denial of service attacks on the network. An attacker may also use this to establish a peer-to-peer network within the mobile network.
Each provider/implementation of LTE may be vulnerable to one or more of the above issues.
More information is provided by Kim et. al. in their paper "Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-Implementations" presented at ACM CCS 2015.
A remote attacker on the provider's network may be able to establish peer-to-peer connections to directly retrieve data from other phones, or spoof phone numbers when making calls. A malicious mobile app for Android may be able to silently place phone calls without the user's knowledge.
The CERT/CC is currently unaware of a practical solution to these problems.
Each provider must apply updates to their own network as necessary to resolve these issues. However, each provider is vulnerable to a different subset of these issues, so the exact fixes and timelines vary between providers. Concerned customers should contact their service provider for more information.
Vendor| Status| Date Notified| Date Updated
Google| | -| 19 Aug 2015
Apple| | 31 Aug 2015| 25 Sep 2015
AT&T;| | 21 May 2015| 19 Oct 2015
TMobile| | 21 May 2015| 16 Oct 2015
Verizon| | 21 May 2015| 19 Oct 2015
If you are a vendor and your product is affected, let us know.
Group | Score | Vector
Base | 5.5 | AV:N/AC:L/Au:S/C:N/I:P/A:P
Temporal | 4.7 | E:POC/RL:U/RC:UR
Environmental | 4.7 | CDP:ND/TD:H/CR:ND/IR:ND/AR:ND
Thanks to Hongil Kim_, Dongkwan Kim, Minhee Kwon, Hyungseok Han, Yeongjin Jang, Dongsu Han, Taesoo Kim, _and Yongdae Kim for reporting this vulnerability and coordinating with vendors.
This document was written by Garret Wassermann.