4 ms·
This is really not much of a story, despite the exciting headline. The claim is that IPSec core networks can be subjected to a denial of service, and that this
by debatem1 10y ago
This is really not much of a story, despite the exciting headline.
The claim is that IPSec core networks can be subjected to a denial of service, and that this will result in a DoS for the users. That's correct but not very interesting.
The researchers then go on to note that a DoS on 4G specifically can put users into a vulnerable position by shoving them over onto 2G networks, which are very vulnerable. But at the end of the day it's still only a DoS on LTE-- what you've switched to after that is not LTE's problem.
That's not to say the LTE isn't vulnerable, of course. Breaking data plane crypto at the ENB means that limited physical penetrations convert them into very effective surveillance tools. And the data plane crypto isn't great (lacks integrity protection). I've suspected in the cold quiet of my heart that some operators run EIA0 in production. Etc.
So, yay for DoS, but I wish people would use the word "hacked" a bit more clearly, or drop it all together.
- azernik 10y agoDowngrade attacks are actually very serious. The issue here being not with 4G/LTE in general, but with the strategy of downgrading to insecure networks after failing to connect with a secure one. It's like browsers falling back to insecure ciphers in HTTPS after failing to negotiate secure ones - a serious problem for the system as a whole.
- debatem1 10y agoI agree that a true downgrade attack would be a very serious vulnerability in 4G, particularly one like I alluded to that could take the RRC down to EIA0-- but that isn't what's being discussed here, and calling it a vulnerability in LTE is inappropriate, just as calling HTTP fallback in browsers a vulnerability in HTTPS would be inappropriate. The vulnerability, to the extent it exists at all, is on the client, in this case mobile devices and in your example the browser.
- Buge 10y agoHTTP fallback is a vulnerability in websites. It can be solved by using HSTS, or partially solved with secure cookies and redirecting to https. If a browser disobeys these principles and uses HTTP anyway, that's a serious vulnerability. Same if a phone downgrades to insecure stuff.
- tdkl 10y ago> people would use the word "hacked" a bit more clearly It gets more clicks though nowadays. Bad password discipline ? It's a hack ! > shoving them over onto 2G networks Wonder why Android doesn't have a setting to lock on LTE/4G as it does for 3G, maybe in the future when LTE is more widespread.
- debatem1 10y agoI remember this being worked on some time ago, but don't recall what happened to it. Might be a switch buried somewhere.
- digi_owl 10y agoCould be that by default LTE is only a data carrier. Until you can be reasonably sure that there is VoLTE support everywhere, restricting the phone to LTE service means you lose out on call capability. And that is likely to be a big nono for emergency reasons. After all, a phone without a SIM can still call the national emergency numbers around the world.
- tdkl 10y agoThat's a great point and probably the reason, thanks.
- Dylan16807 10y agoI can't imagine it would be hard to connect to other networks only in the case of emergency dialing.
- kalleboo 10y ago> After all, a phone without a SIM can still call the national emergency numbers around the world This is actually not true in every country
- stephen_g 10y agoI'd like at least a switch to completely disable 2G (on iPhone as well). In Australia, the last 2G networks will all have shut down by the end of next year. So even now, unless you phone only supports 2G there's absolutely no reason to use it (the 2G is thoroughly redundant at this point so you should never need to drop down to it).