LTEInspector: A Systematic Approach for Adversarial Testing of 4G LTE

Hussain, Syed Rafiul; Chowdhury, Omar; Mehnaz, Shagufta; Bertino, Elisa

doi:10.14722/ndss.2018.23313

Cited by 155 publications

(108 citation statements)

References 37 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An overview of various attack vectors against the LTE air interface is given in [6], estimating potential jammer to signal power ratios. Hussain et al propose LTEInspector [7], which combines a symbolic model checker with a cryptographic protocol verifier. It is applied to analyze several different attacks, most of which are validated using a testbed set-up.…”

Section: Related Workmentioning

confidence: 99%

Towards Resilient 5G: Lessons Learned from Experimental Evaluations of LTE Uplink Jamming

Girke

Kurtz

Dorsch

et al. 2019

2019 IEEE International Conference on Communications Workshops (ICC Workshops)

View full text Add to dashboard Cite

Energy, water, health, transportation and emergency services act as backbones for our society. Aiming at high degrees of efficiency, these systems are increasingly automated, depending on communication systems. However, this makes these Critical Infrastructures prone to cyber attacks, resulting in data leaks, reduced performance or even total system failure. Beyond a survey of existing vulnerabilities, we provide an experimental evaluation of targeted uplink jamming against Long Term Evolution (LTE)'s air interface. Primarily, our implementations of smart attacks on the LTE Physical Uplink Control Channel (PUCCH), the Physical Uplink Shared Channel (PUSCH) as well as on the radio access procedure are outlined and tested. In exploiting the unencrypted resource assignment process, these attacks are able to target and jam specific UE resources, effectively denying uplink access. Evaluation results reveal the criticality of such attacks, severely destabilizing Critical Infrastructures, while minimizing attacker exposure. Finally we derive possible mitigations and recommendations for 5G stakeholders, which serve to improve the robustness of mission critical communications and enable the design of resilient next generation mobile networks.

show abstract

Section: Related Workmentioning

confidence: 99%

Towards Resilient 5G: Lessons Learned from Experimental Evaluations of LTE Uplink Jamming

Girke

Kurtz

Dorsch

et al. 2019

2019 IEEE International Conference on Communications Workshops (ICC Workshops)

View full text Add to dashboard Cite

show abstract

“…In general, protocol exploits like the ones disclosed in [7], [10], [16] are, as of Release 15, Version 1.0.0, still possible in 5G.…”

Section: A Pre-authentication Message Exploitsmentioning

confidence: 99%

“…Threat Impact on 5G IMSI catching Privacy threat, location leaks, SS7 leaks, etc. [6], [7], [10], [27] Potential for IMSI/SUPI catching in some protocol edge cases, such as when an operator does not implement optional security features or when an unauthenticated emergency call is maliciously triggered. Attach/ Tracking Area Update (TAU) request DoS [6], [7], [10] DoS of 5G mobile devices exploiting pre-authentication messages with rogue base station broadcasting a valid Mobile Country and Network Code (MCC-MNC) combination for network with no public key provisioned in the USIM.…”

Section: Lte Protocol Exploitmentioning

confidence: 99%

“…[6], [7], [10], [27] Potential for IMSI/SUPI catching in some protocol edge cases, such as when an operator does not implement optional security features or when an unauthenticated emergency call is maliciously triggered. Attach/ Tracking Area Update (TAU) request DoS [6], [7], [10] DoS of 5G mobile devices exploiting pre-authentication messages with rogue base station broadcasting a valid Mobile Country and Network Code (MCC-MNC) combination for network with no public key provisioned in the USIM. Silent downgrade to GSM Man in the middle attacks, phone call and SMS snooping [6], [7], [10] Silent downgrade to GSM exploiting pre-authentication messages with rogue base station broadcasting an MCC-MNC of a network with no public key provisioned in the USIM.…”

Section: Lte Protocol Exploitmentioning

confidence: 99%

See 1 more Smart Citation

Security and Protocol Exploit Analysis of the 5G Specifications

Jover

Marojevic

2019

IEEE Access

View full text Add to dashboard Cite

The Third Generation Partnership Project (3GPP) released its first 5G security specifications in March 2018. This paper reviews the proposed security architecture, its main requirements and procedures, and evaluates them in the context of known and new protocol exploits. Although security has been improved from previous generations, our analysis identifies unrealistic 5G system assumptions and protocol edge cases that can render 5G communication systems vulnerable to adversarial attacks. For example, null encryption and null authentication are still supported and can be used in valid system configurations. With no clear proposal to tackle pre-authentication messages, mobile devices continue to implicitly trust any serving network, which may or may not enforce a number of optional security features, or which may not be legitimate. Moreover, several critical security and key management functions are left outside of the scope of the specifications. The comparison with known 4G Long-Term Evolution (LTE) protocol exploits reveals that the 5G security specifications, as of Release 15, Version 1.0.0, do not fully address the user privacy and network availability challenges.

show abstract

“…4G/LTE mobile communication was considered to be notably more secure than its precursors, GSM and UMTS. However, with the wide availability of open source tools for various experimentations, an increasing number of security and privacy vulnerabilities existing in LTE [12][13][14][15][16][17] can precisely locate an LTE device by using an LTE rogue station [17]. Jover exploited the unencrypted and noneintegrity protected LTE protocols, e.g., Attach Reject and TAU Reject messages, and uncovered the vulnerabilities of denying service to an LTE device and downgrading it to the more insecure GSM network [14].…”

Section: Related Workmentioning

confidence: 99%

LTE Phone Number Catcher: A Practical Attack against Mobile Privacy

Chen

Cai

2019

Security and Communication Networks

View full text Add to dashboard Cite

Phone number is a unique identity code of a mobile subscriber, which plays a more important role in the mobile social network life than another identification number IMSI. Unlike the IMSI, a mobile device never transmits its own phone number to the network side in the radio. However, the mobile network may send a user’s phone number to another mobile terminal when this user initiating a call or SMS service. Based on the above facts, with the help of an IMSI catcher and 2G man-in-the-middle attack, this paper implemented a practicable and effective phone number catcher prototype targeting at LTE mobile phones. We caught the LTE user’s phone number within a few seconds after the device camped on our rogue station. This paper intends to verify that mobile privacy is also quite vulnerable even in LTE networks as long as the legacy GSM still exists. Moreover, we demonstrated that anyone with basic programming skills and the knowledge of GSM/LTE specifications can easily build a phone number catcher using SDR tools and commercial off-the-shelf devices. Hence, we hope the operators worldwide can completely disable the GSM mobile networks in the areas covered by 3G and 4G networks as soon as possible to reduce the possibility of attacks on higher-generation cellular networks. Several potential countermeasures are also discussed to temporarily or permanently defend the attack.

show abstract

LTEInspector: A Systematic Approach for Adversarial Testing of 4G LTE

Cited by 155 publications

References 37 publications

Towards Resilient 5G: Lessons Learned from Experimental Evaluations of LTE Uplink Jamming

Towards Resilient 5G: Lessons Learned from Experimental Evaluations of LTE Uplink Jamming

Security and Protocol Exploit Analysis of the 5G Specifications

LTE Phone Number Catcher: A Practical Attack against Mobile Privacy

Contact Info

Product

Resources

About