3 ms·

Don't suppose you have any more details on 4G being hacked? My understanding is that the authentication phase is actually better/more secure than 3G.

TeMPOraL 11y ago
I always thought that hacking 4G (and/or 3G) was done by jamming the signal and thus forcing the phone to switch to older, already cracked protocol.
- zobzu 11y ago
  yes, that's how its done
  - tedunangst 11y ago
    So what makes 3G more resilient to downgrades than 4G?
    - jpollock 11y ago
      I understand that 4G devices don't always use the 4G network for voice, they may either use 2 radios, or drop the 4G connection. The 4G network is used for data, and a 2G network for voice/SMS. Eventually they will all start sending voice over the data link, but it isn't guaranteed.
      - BuildTheRobots 11y ago
        As far as I know, none of the UK macro operators support Voice Over LTE yet, so yes, if you receive a phone call on 4G you get a paging message telling you to fall back to 2/3G circuit switched and answer the damn thing. I'm assuming this is my stock S5 won't let me choose 4G only (calls become impossible), where as I can lock it to _just_ 3G. I don't feel this fully addresses the original statement of "no 4G, hacked", though. If the downgrade-to-2G attack is the worry then 3G & 4G should be perfectly fine. edit: grammar: supported->support.
peterwwillis 11y ago
In 2011, both AT&T and Sprint were hit with a man-in-the-middle on 4G GSM & CDMA bands. https://www.reddit.com/r/netsec/comments/jeis7/full_disclosure_def_con_19_hackers_get_hacked/ https://www.reddit.com/r/netsec/comments/jeis7/full_disclosu...
- BuildTheRobots 11y ago
  Interesting reading; thank you. Though after following the threads for a while and going through the original fulldisclosure posts, I've come to the following thoughts: Generally seems a bit of a grandiose story with no real evidence backing it up and likes of which have never been repeated, either (though if you know of other 3/4G hacks please say). This was also the same year Karsten Nohl was cracking GPRS [1] (which was extremely novel) and I wonder if the these two events have gotten conflated. The little bit of evidence given on the FD post [2] and the comments on your reddit link seem to imply this was very much a hack against WiMAX, which whilst called a 4th Generation technology, bears little or no resemblance (or history) to the 3GPP standard known as LTE/4G. I think this is where the confusion comes about and the reason why 3G wasn't broken as a side-effect. We're both using the term "4G"/"LTE" but we mean different technologies. [1] http://www.itproportal.com/2011/08/11/gprs-can-be-hacked-easily-claims-german-researcher/#ixzz1UkPeNdiE http://www.itproportal.com/2011/08/11/gprs-can-be-hacked-eas... [2] http://seclists.org/fulldisclosure/2011/Aug/92 http://seclists.org/fulldisclosure/2011/Aug/92

TeMPOraL 11y ago

I always thought that hacking 4G (and/or 3G) was done by jamming the signal and thus forcing the phone to switch to older, already cracked protocol.

zobzu 11y ago
yes, that's how its done
- tedunangst 11y ago
  So what makes 3G more resilient to downgrades than 4G?
  - jpollock 11y ago
    I understand that 4G devices don't always use the 4G network for voice, they may either use 2 radios, or drop the 4G connection. The 4G network is used for data, and a 2G network for voice/SMS. Eventually they will all start sending voice over the data link, but it isn't guaranteed.
    - BuildTheRobots 11y ago
      As far as I know, none of the UK macro operators support Voice Over LTE yet, so yes, if you receive a phone call on 4G you get a paging message telling you to fall back to 2/3G circuit switched and answer the damn thing. I'm assuming this is my stock S5 won't let me choose 4G only (calls become impossible), where as I can lock it to _just_ 3G. I don't feel this fully addresses the original statement of "no 4G, hacked", though. If the downgrade-to-2G attack is the worry then 3G & 4G should be perfectly fine. edit: grammar: supported->support.

peterwwillis 11y ago

In 2011, both AT&T and Sprint were hit with a man-in-the-middle on 4G GSM & CDMA bands. https://www.reddit.com/r/netsec/comments/jeis7/full_disclosure_def_con_19_hackers_get_hacked/ https://www.reddit.com/r/netsec/comments/jeis7/full_disclosu...

BuildTheRobots 11y ago
Interesting reading; thank you. Though after following the threads for a while and going through the original fulldisclosure posts, I've come to the following thoughts: Generally seems a bit of a grandiose story with no real evidence backing it up and likes of which have never been repeated, either (though if you know of other 3/4G hacks please say). This was also the same year Karsten Nohl was cracking GPRS [1] (which was extremely novel) and I wonder if the these two events have gotten conflated. The little bit of evidence given on the FD post [2] and the comments on your reddit link seem to imply this was very much a hack against WiMAX, which whilst called a 4th Generation technology, bears little or no resemblance (or history) to the 3GPP standard known as LTE/4G. I think this is where the confusion comes about and the reason why 3G wasn't broken as a side-effect. We're both using the term "4G"/"LTE" but we mean different technologies. [1] http://www.itproportal.com/2011/08/11/gprs-can-be-hacked-easily-claims-german-researcher/#ixzz1UkPeNdiE http://www.itproportal.com/2011/08/11/gprs-can-be-hacked-eas... [2] http://seclists.org/fulldisclosure/2011/Aug/92 http://seclists.org/fulldisclosure/2011/Aug/92