Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-implementations

ABSTRACT

Long Term Evolution (LTE) is becoming the dominant cellular networking technology, shifting the cellular network away from its circuit-switched legacy towards a packet-switched network that resembles the Internet. To support voice calls over the LTE network, operators have introduced Voice-over-LTE (VoLTE), which dramatically changes how voice calls are handled, both from user equipment and infrastructure perspectives. We find that this dramatic shift opens up a number of new attack surfaces that have not been previously explored. To call attention to this matter, this paper presents a systematic security analysis.

Unlike the traditional call setup, the VoLTE call setup is controlled and performed at the Application Processor (AP), using the SIP over IP. A legitimate user who has control over the AP can potentially control and exploit the call setup process to establish a VoLTE channel. This combined with the legacy accounting policy (e.g., unlimited voice and the separation of data and voice) leads to a number of free data channels. In the process of unveiling the free data channels, we identify a number of additional vulnerabilities of early VoLTE implementations, which lead to serious exploits, such as caller spoofing, over-billing, and denial-of-service attacks. We identify the nature of these vulnerabilities and concrete exploits that directly result from the adoption of VoLTE. We also propose immediate countermeasures that can be employed to alleviate the problems. However, we believe that the nature of the problem calls for a more comprehensive solution that eliminates the root causes at mobile devices, mobile platforms, and the core network.

References

1. 3GPP. ETSI TS 23.203. Policy and charging control architecture, 2012.
2. 3GPP. ETSI TS 23.221. Architectural requirements, 2011.
3. 3GPP. ETSI TS 23.228. IP Multimedia Subsystem (IMS) Stage 2, 2011.
4. 3GPP. ETSI TS 33.203. Access security for IP-based services, 2011.
5. 3GPP. ETSI TS 33.210. Network Domain Security (NDS); IP network layer security, 2011.
6. T. Alves and D. Felton. Trustzone: Integrated hardware and software security. ARM white paper, 3(4):18--24, 2004.
7. J. Arkko, G. Camarillo, A. Niemi, T. Haukka, and V. Torvinen. Security mechanism agreement for the session initiation protocol (SIP), 2003.
8. J. Beekman and C. Thompson. Breaking Cell Phone Authentication: Vulnerabilities in AKA, IMS, and Android. In WOOT, 2013.
9. T. Bova and T. Krivoruchka. Reliable UDP protocol. draft-ietf-sigtran-reliable-udp-00.txt, 1999.
10. G. Delugre. Reverse engineering a Qualcomm baseband. CCC, 2011.
11. W. Enck, P. Traynor, P. McDaniel, and T. La Porta. Exploiting Open Functionality in SMS-Capable Cellular Networks. In Proceedings of the 12th ACM conference on Computer and communications security, pages 393--404. ACM, 2005.
12. Ericsson. What is voice over LTE?, January 2013.
13. Global mobile Suppliers Association and others. Evolution to LTE report, 2015. {Online; accessed 11-May-2015}.
14. Y. Go, E. Jeong, J. Won, Y. Kim, D. F. Kune, and K. Park. Gaining Control of Cellular Traffic Accounting by Spurious TCP Retransmission. In Proceeding of the Network and Distributed System Security Symposium (NDSS), 2014.
15. Y. Go, D. F. Kune, S. Woo, K. Park, and Y. Kim. Towards Accurate Accounting of Cellular Data for TCP Retransmission. In Proceedings of the 14th Workshop on Mobile Computing Systems and Applications, page 2. ACM, 2013.
16. N. Golde, K. Redon, and J.-P. Seifert. Let Me Answer That for You: Exploiting Broadcast Information in Cellular Networks. In Proceedings of the 22nd USENIX conference on Security, pages 33--48. USENIX Association, 2013.
17. GSM Association. Voice and Video calls over LTE. {Online; accessed 14-May-2015}.
18. GSM Association. VoLTE Service Description and Implementation Guidelines, Version 1.1, 2014.
19. A. Houmansadr, T. J. Riedl, N. Borisov, and A. C. Singer. I want my voice to be heard: IP over Voice-over-IP for Unobservable Censorship Circumvention. In NDSS, 2013.
20. IDATE. in World LTE market, 2014. {Online; accessed 11-May-2015}.
21. A. Johnston and O. Levin. Session Initiation Protocol (SIP) Call Control-Conferencing for User Agents, 2006.
22. H. Mohajeri Moghaddam, B. Li, M. Derakhshani, and I. Goldberg. Skypemorph: Protocol Obfuscation for Tor Bridges. In Proceedings of the 2012 ACM conference on Computer and communications security, pages 97--108. ACM, 2012.
23. C. Mulliner, N. Golde, and J.-P. Seifert. SMS of Death: From Analyzing to Attacking Mobile Phones on a Large Scale. In USENIX Security Symposium, 2011.
24. F. Özavci. VOIP Wars: Return of the SIP, 2013.
25. C. Peng, C.-y. Li, G.-H. Tu, S. Lu, and L. Zhang. Mobile Data Charging: New Attacks and Countermeasures. In Proceedings of the 2012 ACM conference on Computer and communications security, pages 195--204. ACM, 2012.
26. C. Peng, C.-Y. Li, H. Wang, G.-H. Tu, and S. Lu. Real Threats to Your Data Bills: Security Loopholes and Defenses in Mobile Data Charging. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, pages 727--738. ACM, 2014.
27. C. Peng, G.-h. Tu, C.-y. Li, and S. Lu. Can We Pay for What We Get in 3G Data Access? In Proceedings of the 18th annual international conference on Mobile computing and networking, pages 113--124. ACM, 2012.
28. Z. Qian, Z. Wang, Q. Xu, Z. M. Mao, M. Zhang, and Y.-M. Wang. You Can Run, but You Can't Hide: Exposing Network Location for Targeted DoS Attacks in Cellular Networks. In NDSS, 2012.
29. J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. Peterson, R. Sparks, M. Handley, E. Schooler, et al. SIP: session initiation protocol, 2002.
30. P. Traynor, M. Lin, M. Ongtang, V. Rao, T. Jaeger, P. McDaniel, and T. La Porta. On Cellular Botnets: Measuring the Impact of Malicious Devices on a Cellular Network Core. In Proceedings of the 16th ACM conference on Computer and communications security, pages 223--234. ACM, 2009.
31. P. Traynor, P. McDaniel, T. La Porta, et al. On Attack Causality in Internet-Connected Cellular Networks. In Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium, pages 1--16. USENIX Association, 2007.
32. G.-H. Tu, C. Peng, C.-Y. Li, X. Ma, H. Wang, T. Wang, and S. Lu. Accounting for Roaming Users on Mobile Data Access: Issues and Root Causes. In Proceeding of the 11th annual international conference on Mobile systems, applications, and services, pages 305--318. ACM, 2013.
33. Q. Wang, X. Gong, G. T. Nguyen, A. Houmansadr, and N. Borisov. Censorspoofer: Asymmetric Communication using Ip Spoofing for Censorship-Resistant Web Browsing. In Proceedings of the 2012 ACM conference on Computer and communications security, pages 121--132. ACM, 2012.
34. Z. Wang. IMS Security Framework. 3GPP2 S. S0086-B, Version, 2, 2008.
35. R. Zhang, X. Wang, R. Farley, X. Yang, and X. Jiang. On the feasibility of launching the man-in-the-middle attacks on VoIP from remote attackers. In Proceedings of the 4th International Symposium on Information, Computer, and Communications Security, pages 61--69. ACM, 2009.
36. R. Zhang, X. Wang, X. Yang, and X. Jiang. Billing Attacks on SIP-Based VoIP Systems. WOOT, 7:1--8, 2007.

Index Terms

• Networks

  • Network types

    • Mobile networks

    • Wireless access networks

• Security and privacy

  • Network security