8 ms·
New flaws in 4G, 5G allow attackers to intercept calls and track phone locations
- throway88989898 8y ago[removed]
- shereadsthenews 8y agoActually that is a link to a terrible PDF-rendering web page. This is the original paper. http://homepage.divms.uiowa.edu/~comarhaider/publications/LTE-torpedo-NDSS19.pdf http://homepage.divms.uiowa.edu/~comarhaider/publications/LT...
- shereadsthenews 8y agoMost people consider the fact that your handset will readily talk to any base station that's on the air to be a feature. Try to imagine how things would work if you had to authenticate and authorize every station on the network. It's true that anyone who gets on the air and speaks the air protocol can screw with your phone. Those people are also violating multiple laws and regulations in the course of doing so.
- deleted 8y ago[deleted]
- jskaodjnf 8y agoFrom 3G on, every base station is authenticated and virtually all traffic on the air is encrypted. There are issues with stingrays - but these happen due to protocol edge-cases before authentication is established. [Edit: this paper uses side channels to collect information, but that's what a sniffer can do] Every base station is authenticated. In most countries, all connections are encrypted.
- peterwwillis 8y agoSorry, I haven't kept up on my phreaking - is there encryption for 3G which hasn't been broken yet?
- jskaodjnf 8y agoNot sure about 3G algorithms - but that's why 4G moved on to AES. What exactly are you trying to say? Worrying customers can easily enforce 4G. Networks should drop 2G and 3G, but still, things are getting better.
- peterwwillis 8y agoI'm saying it doesn't matter whether everything is authenticated and encrypted, it's all vulnerable. Even if 4G wasn't, you can just downgrade and then crack.
- jskaodjnf 8y agoWhere exactly vulnerable against which type of attacker? In 4G there are location and identity leaks, and denial of service (which is why smartphones and carriers should drop 2G and 3G). Or is this a "technology is all bad" kind of comment?
- Yetanfou 8y agoI consider it more to be a 'why oh why do these protocols continue to be designed and specified in such a way as to be known to be vulnerable to eavesdropping' kind of comment.
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- sp332 8y agoMaybe your phone could trust all base stations operated by AT&T and T-Mobile, instead of manually verifying each one.
- shereadsthenews 8y agoOK but what you are suggesting is a fully authenticated air interface and a massive PKI deployment, which while not impossible for future protocols face obvious hurdles.
- batbomb 8y agoWhat happens when you travel internationally?
- sp332 8y agoJust add another root certificate to your local store, like with a web browser.
- radicaldreamer 8y agoI mean you can do authentication without doing it per base station... the real reason we don’t have anything like this is because it’s a lot of work to make this work well worldwide and because a lot of governments are not interested in making spoofing base stations harder on themselves.
- jskaodjnf 8y agoThere is per-basestation authentication. The basestation receives a key that is derived from your permanent key within your SIM card. Roaming is a bit special, but this still holds. You then trust both operators, not just your home operator.
- pedrocr 8y agoShouldn't we just fix this one layer above? Just like the internet treat the network as hostile and use strong encryption to connect to your network provider. If someone uses a stingray you use their bandwidth but they see nothing because you're running encrypted VoLTE.
- Teever 8y agoIt's astart but from my understanding implementing strong encryption on the layer above does little to mitigate physical location tracking issues that arise from spoofed towers.
- mindslight 8y agoNothing short of removing all devices identifiers (IMSI, IMEI, etc) and using an untraceable payment system for network access (eg blinded tokens) will mitigate the location tracking ability of the carriers. The perfect is the enemy of the good and cops do use stingrays for a reason. But targeted government surveillance is only one privacy threat, and carriers have no compunctions about bulk selling your location to the mass surveillance industry.
- dcow 8y ago
- nabla9 8y agoIt's not that simple. Both 3G and 4G have mutual authentication. You need to trick the handset into downgrading the protocol if you want it to talk to your own fake base station.
- gsich 8y agoJamming should be enough. But depending on the frequencies used, one band might not be enough.
- Pristina 8y agoYeah I'm sure the cops and the lawyers will stop the bad guys using the power of the law.
- e12e 8y agoWhat? I mean your provider ships you a computer that's dedicated to authentication your device on the network (a sim card) - it shouldn't be infeasible to authenticate the nodes when you can bootstrap off an actual trusted device. With roaming, your provider could cross sign other providers - and for long range/international roaming you could maybe allow forwarding of encrypted requests for authentication over an untrusted channel. That would probably be enough for some level of (location) tracking - but there'd be no need to allow any regular traffic over such links. In theory. In practice, that'd probably be too expensive, and you'd get better service and security relying on wlan and something like signal....
- oggy 8y agoBased on the paper, the title is clickbait; it does not talk about intercepting calls at all. It does mention that one of the attacks in the paper can enable "further attacks", but if call interception was one of them, I'd imagine that they'd say so explicitly.
- moooooky 8y agoThe author of the paper, cited in the report, said, "Any person with a little knowledge of cellular paging protocols can carry out this attack... such as phone call interception, location tracking, or targeted phishing attacks."
- 1024core 8y agoOne man's "flaw" is another TLA's "feature"... ;-)
- rootsudo 8y agoThis is nothing new, this has been a thing since SMS paging channels which was included in CDMA2000.
- scoot_718 8y agoThanks Huawei.
- Aloha 8y agoI'd really love if people would stop calling everything mobile standard some number followed by a G. There are literally no known commercial scale deployments of '5G' technology out there - its largely on paper with many technical and practical details to be worked out - and the deployments discussed even when they do go hot, will be small, literally, these are microcells, something effectively the size of a oversized wifi hotspot. What has been deployed, is effectively LTE-Advanced, with extra channel bonding and MIMO. Beyond that, the 5G standard isn't even finalized yet. We're still solidly in the '4G' era, and we (in the US) don't even have 100% saturation for LTE coverage, much less LTE-Advanced.
- TomMarius 8y agoI thought there are some public tests already, and phones that already support it.
- Aloha 8y agoPerhaps? It's not really mainstream technology, and it's like two years from actual rollout.
- walrus01 8y agoSomething like 99.98% of people would have no idea what "3GPP rev14" is. As a person who works in the industry: There are pretty much no actual 5G systems in use. There are carriers in the US building microcell sized, DAS type LTE-Advanced things on utility poles and similar.
- Krasnol 8y agoI thought it's live in South Korea?
- cesarb 8y ago> I'd really love if people would stop calling everything mobile standard some number followed by a G. It can be useful to have different labels for the "generations" when they're incompatible. Analog (1G) is incompatible with traditional GSM (2G), which is incompatible with UMTS (3G), which is incompatible with LTE (4G). So if your new network only has 4G but your old phone only has 2G and 3G, you know it won't work and you have to buy a new phone.
- rocqua 8y agoIt seems like this method requires a known phone number. And can track people based on knowing the phone number in advanced. That is quite a high bar, and very different from the standard stingray attack. That is, older attacks allow you to collect all IMSI's in the area. Instead, this attack allows you to track a given phone-number, and retrieve the IMSI that belongs to a given phone number. Edit: it seems like an Email address or twitter handle also works. What is needed is some way to trigger a message on the phone. That still requires knowing some identity up-front though.
- blattimwind 8y ago> Edit: it seems like an Email address or twitter handle also works. What is needed is some way to trigger a message on the phone. That still requires knowing some identity up-front though. Marginal. No barrier at all for targeted attacks (phishing, stalking, intelligence etc.).
- rocqua 8y agoA very large use-case for stingrays by american police was to have them running nearly continuously. Then, when a crime occurred, they would go back and examine the captured data to see who was nearby during the crime. Such post-hoc tracking is not possible with this method. Similarly, if all you know is "I don't trust the bearded guy who just disembarked the plane" it could be hard to get to an identity that will trigger his phone. With a traditional 'What IMSI's are in the area' capture, you just need to follow them long enough that one IMSI stands out as always being available. This attack doesn't enable that either.
- JoeSmithson 8y ago> A very large use-case for stingrays by american police was to have them running nearly continuously. Then, when a crime occurred, they would go back and examine the captured data to see who was nearby during the crime Do you have a link for this? It's difficult to Google
- 8y ago
- jamisteven 8y agoIf by flaw they mean feature.
- rocqua 8y agoThe article mentions you need to brute-force 29 bits using an oracle. It doesn't mention this is an active oracle. That is, it requires interaction with the UE (target phone). This makes the brute-force attack quite a bit harder, as you need to be in contact with the target phone for the duration of the attack (you don't need to do the attack in one go though).