3 ms·
The attack is a combination of multiple "vulnerabilities": 1. the data link layer is not protected, so an attacker can perform a relay attack (forward the encr
by ge0rg 8y ago
The attack is a combination of multiple "vulnerabilities":
1. the data link layer is not protected, so an attacker can perform a relay attack (forward the encrypted radio packets between the phone and the actual cell tower).
2. from watching the encrypted traffic patterns, it is possible to guess which websites the user is surfing by comparing the traffic fingerprints.
3. the packets are not integrity-protected, so it's possible to change bits of data, if you can guess which packet you have and how it's constructed. This is used to manipulate DNS requests to redirect traffic.
I'm not sure about the significance of #1 and #2. A passive attacker might be able to obtain the same information simply by monitoring the physical layer traffic patterns emitted by the phone. Additionally, mobile operators are typically monitoring their frequencies for abuse, so an active attack might not stay under the radar for long.
Regarding #3, this is a complicated way to achieve what you can do with a fake WiFi hotspot, and gives you control over unencrypted communications, which hopefully is only a very small subset of todays traffic thanks to omnipresent HTTPS.
- a012 8y agoIMO, to use always-on VPN is the best solution to countermeasure these kinds of attacks.
- ge0rg 8y agoA VPN will not protect you from fingerprinting of your traffic patterns. VPNs just add a fixed overhead to all packets and maybe a bit of fragmentation. A well-positioned attacker with a large database of traffic fingerprints is probably easily able to re-calculate the traffic fingerprints for the common VPN protocols.
- kardos 8y agoFor a clean setup where you're interacting with one website that makes sense. Perhaps less so with many streams. Could VPN protocols be modified to obfuscate traffic patterns (without adding intolerable latency or extra bandwidth costs)? Eg, rapidly change the MSS or add some padding?
- namibj 8y agoIf there is significant data that just has to be transferred within a given, larger timespan, e.g., if you need that update within the day or upload the picture(s) you took over the course of your lunchbreak, or similar situations, you could transfer that data when you want to send masking traffic. This way you don't have to generate dummy data to serve as masking traffic.
- kardos 8y agoAh, that's clever. It's hard to come up with a bunch of bulk data that needs to be transferred 'sometime in the next day or two'. Phone updates might be one but they are sporadic, and backups could be another. Also you'd need a supply of near-term bulk transfers in both directions. Interesting idea for sure.
- myself248 8y agoI hope someone notices this idea and implements this. Having two virtual network interfaces, one for high-priority traffic that you want to mask, and one for low-priority traffic that only gets sent as masking data, might be a good way to keep it low in the layer stack.
- namibj 8y agoYou need to be careful as to the interactivity of the protocols. Non-interactive transfers are _much_ easier to mask if you can use such delays due to the lack of things to correlate without massive noise.
- e12e 8y agoThis might be true, but also AFAIK a new attack on otherwise secure VPNs: being able to predict visited sites based on bits up/down as well as traffic rate.
- mtgx 8y agoThese "flaws" sound like they were built on purpose to allow intelligence agencies to (illegally) intercept communications, even without the help of carriers. These and other flaws are probably what Stingrays has been using for a while to intercept LTE communications, for some time now: https://arstechnica.com/information-technology/2015/10/low-cost-imsi-catcher-for-4glte-networks-track-phones-precise-locations/ https://arstechnica.com/information-technology/2015/10/low-c... https://www.zdnet.com/article/stingray-security-flaw-cell-networks-phone-tracking-surveillance/ https://www.zdnet.com/article/stingray-security-flaw-cell-ne...