Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and - - PowerPoint PPT Presentation

▶
breaking and fixing volte exploiting hidden data channels
SMART_READER_LITE
LIVE PREVIEW

Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and - - PowerPoint PPT Presentation

Oct 05, 2023 30 likes •1.16k views

Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-implementations Hongil Kim* , Dongkwan Kim* , Minhee Kwon, Hyeongseok Han, Yeongjin Jang, Taesoo Kim, Dongsu Han, Yongdae Kim 1 VoLTE = Voice over LTE 4G LTE: All-IP based

slide-1
SLIDE 1

Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-implementations

Hongil Kim*, Dongkwan Kim*, Minhee Kwon, Hyeongseok Han, Yeongjin Jang, Taesoo Kim, Dongsu Han, Yongdae Kim

1

slide-2
SLIDE 2

VoLTE = Voice over LTE

 4G LTE: All-IP based Network  Voice call: Implementation of VoIP on LTE  3G network

– Data and voice is separated

 4G LTE network

– Both data and voice are delivered as data-flow

2

slide-3
SLIDE 3

3

Telephony Phone

Data (Packet Switching)

Internet

3G Voice (Circuit Switching)

Cell tower Core network

slide-4
SLIDE 4

3

Telephony Phone

Data (Packet Switching)

Internet

3G Voice (Circuit Switching)

Cell tower Core network

slide-5
SLIDE 5

3

Telephony Phone

Data (Packet Switching)

Internet

3G Voice (Circuit Switching)

Cell tower Cell tower Phone

4G LTE Data (Packet Switching)

Internet Core network Core network

slide-6
SLIDE 6

3

Telephony Phone

Data (Packet Switching)

Internet

3G Voice (Circuit Switching)

Cell tower IMS Cell tower Phone

4G LTE Data (Packet Switching)

Internet IP Multimedia Subsystem (IMS) Core network Core network

slide-7
SLIDE 7

3

Telephony Phone

Data (Packet Switching)

Internet

3G Voice (Circuit Switching)

Cell tower IMS Cell tower Phone

4G LTE Data (Packet Switching)

Internet IP Multimedia Subsystem (IMS) Core network Core network

slide-8
SLIDE 8

Voice delivery in LTE

 Voice is delivered through two data channels, called “bearer”

– Bearer: a virtual channel with below properties – Bandwidth, loss rate, latency (QoS)

 For VoLTE service,

  • 1. Control plane (default bearer): call signaling, *SIP
  • 2. Data plane (dedicated bearer): voice data, *RTP

4

4G Gateway IMS Internet

*SIP: Session Initiation Protocol, *RTP: Real-time Transport Protocol

slide-9
SLIDE 9

Voice delivery in LTE

 Voice is delivered through two data channels, called “bearer”

– Bearer: a virtual channel with below properties – Bandwidth, loss rate, latency (QoS)

 For VoLTE service,

  • 1. Control plane (default bearer): call signaling, *SIP
  • 2. Data plane (dedicated bearer): voice data, *RTP

4

4G Gateway

Default bearer, IP addr : 1.1.1.1 IMS Internet

*SIP: Session Initiation Protocol, *RTP: Real-time Transport Protocol

slide-10
SLIDE 10

Voice delivery in LTE

 Voice is delivered through two data channels, called “bearer”

– Bearer: a virtual channel with below properties – Bandwidth, loss rate, latency (QoS)

 For VoLTE service,

  • 1. Control plane (default bearer): call signaling, *SIP
  • 2. Data plane (dedicated bearer): voice data, *RTP

4

4G Gateway

Default bearer, IP addr : 1.1.1.1 IMS Internet

*SIP: Session Initiation Protocol, *RTP: Real-time Transport Protocol

slide-11
SLIDE 11

Voice delivery in LTE

 Voice is delivered through two data channels, called “bearer”

– Bearer: a virtual channel with below properties – Bandwidth, loss rate, latency (QoS)

 For VoLTE service,

  • 1. Control plane (default bearer): call signaling, *SIP
  • 2. Data plane (dedicated bearer): voice data, *RTP

4

4G Gateway

Default bearer, IP addr : 1.1.1.1 IMS Internet Dedicated bearer, port: 1234

*SIP: Session Initiation Protocol, *RTP: Real-time Transport Protocol

slide-12
SLIDE 12

VoLTE makes cellular network more complex

6

IMS

Cell tower Phone

4G LTE

3GPP standards Mobile OS support?

LTE Core

Device HW interface Implementation of LTE core Accounting infrastructure

4G Gateway

slide-13
SLIDE 13

 Let’s check potential attack vectors newly introduced in VoLTE

VoLTE makes cellular network more complex

6

IMS

Cell tower Phone

4G LTE

3GPP standards Mobile OS support?

LTE Core

Device HW interface Implementation of LTE core Accounting infrastructure

4G Gateway

slide-14
SLIDE 14

 Let’s check potential attack vectors newly introduced in VoLTE

VoLTE makes cellular network more complex

6

IMS

Cell tower Phone

4G LTE

3GPP standards Mobile OS support?

LTE Core

Device HW interface Implementation of LTE core Accounting infrastructure

4G Gateway

Permission Mismatch Free Data Channels No Session Manage No Auth No Encryption IMS Bypassing

slide-15
SLIDE 15

#1: VoLTE Accounting

 Accounting in 3G

7

Telephony

Phone

Data (Packet Switching) Internet Voice (Circuit Switching)

Cell tower

slide-16
SLIDE 16

#1: VoLTE Accounting

 Accounting in 3G

7

Telephony

Phone

Data (Packet Switching) Internet Voice (Circuit Switching)

Cell tower

Byte usage

slide-17
SLIDE 17

#1: VoLTE Accounting

 Accounting in 3G

7

Telephony

Phone

Data (Packet Switching) Internet Voice (Circuit Switching)

Cell tower

Byte usage Time usage

slide-18
SLIDE 18

#1: VoLTE Accounting

 Accounting in 3G

7

Telephony

Phone

Data (Packet Switching) Internet Voice (Circuit Switching)

Cell tower

IMS

Phone

Data (Packet Switching) Internet

Cell tower

Byte usage Time usage

 Accounting in 4G (using VoLTE)

slide-19
SLIDE 19

#1: VoLTE Accounting

 Accounting in 3G

7

Telephony

Phone

Data (Packet Switching) Internet Voice (Circuit Switching)

Cell tower

IMS

Phone

Data (Packet Switching) Internet

Cell tower

Byte usage Time usage

 Accounting in 4G (using VoLTE)

Byte usage for all services?

slide-20
SLIDE 20

#1: VoLTE Accounting

 Accounting in 3G

7

Telephony

Phone

Data (Packet Switching) Internet Voice (Circuit Switching)

Cell tower

IMS

Phone

Data (Packet Switching) Internet

Cell tower

Byte usage Time usage

 Accounting in 4G (using VoLTE)

Byte usage for all services? Still time usage

slide-21
SLIDE 21

#1: VoLTE Accounting

 Accounting in 3G

7

Telephony

Phone

Data (Packet Switching) Internet Voice (Circuit Switching)

Cell tower

IMS

Phone

Data (Packet Switching) Internet

Cell tower

Byte usage Time usage

 Accounting in 4G (using VoLTE)

Byte usage for all services? Still time usage Unlimited VoLTE call

slide-22
SLIDE 22

#1: VoLTE Accounting

 Accounting in 3G

7

Telephony

Phone

Data (Packet Switching) Internet Voice (Circuit Switching)

Cell tower

IMS

Phone

Data (Packet Switching) Internet

Cell tower

Byte usage Time usage

 Accounting in 4G (using VoLTE)

Byte usage for all services? Still time usage Unlimited VoLTE call

Do operators implement this complicated accounting correctly?

slide-23
SLIDE 23

Anatomy of smartphone

 Smartphone has two processors

8

AP CP Application processor (AP)

  • Running mobile OS (Android)
  • Running User application
slide-24
SLIDE 24

Anatomy of smartphone

 Smartphone has two processors

8

AP CP Application processor (AP)

  • Running mobile OS (Android)
  • Running User application

Communication processor (CP)

  • Telephony Processor (modem)
  • Digital Signal Processing (DSP)
slide-25
SLIDE 25

#2 Voice solution in device, 3G case

3G Phone

9

AP CP

Voice signaling

Call APIs

Telephony

Phone

Data

Internet

3G network Voice

Cell Tower

AP CP

slide-26
SLIDE 26

#2 Voice solution in device, 3G case

3G Phone

9

  • An app cannot easily manipulate

the voice signaling in CP AP CP

Voice signaling

Call APIs

Telephony

Phone

Data

Internet

3G network Voice

Cell Tower

AP CP

slide-27
SLIDE 27

#2 Voice solution in device, 3G case

3G Phone

9

  • An app cannot easily manipulate

the voice signaling in CP AP CP

Voice signaling

Call APIs

Telephony

Phone

Data

Internet

3G network Voice

Cell Tower

AP CP

  • An app needs “CALL_PHONE” permission

for calling

slide-28
SLIDE 28

#2: Voice solution in device, LTE

4G LTE Phone

10

AP CP

Voice signaling

IMS

Phone

Data

Internet

4G LTE network

Cell Tower

AP CP

slide-29
SLIDE 29

#2: Voice solution in device, LTE

4G LTE Phone

10

  • An app can easily manipulate voice

signaling in AP AP CP

Voice signaling

IMS

Phone

Data

Internet

4G LTE network

Cell Tower

AP CP

Application processor

  • Running mobile OS (Android)
  • Running User application
slide-30
SLIDE 30

#2: Voice solution in device, LTE

4G LTE Phone

10

  • An app can easily manipulate voice

signaling in AP AP CP

Voice signaling

IMS

Phone

Data

Internet

4G LTE network

Cell Tower

AP CP

Application processor

  • Running mobile OS (Android)
  • Running User application
  • An app can make a call only with

“INTERNET” permission.

slide-31
SLIDE 31

#2: Voice solution in device, LTE

4G LTE Phone

10

  • An app can easily manipulate voice

signaling in AP AP CP

Voice signaling

IMS

Phone

Data

Internet

4G LTE network

Cell Tower

AP CP

Application processor

  • Running mobile OS (Android)
  • Running User application
  • An app can make a call only with

“INTERNET” permission.

slide-32
SLIDE 32

Two problems in VoLTE

  • 1. A complex accounting infrastructure
  • 2. Delegating voice signaling (previously done by CP) to AP

11

slide-33
SLIDE 33

Our approach to attack two problems

12

slide-34
SLIDE 34

Our approach to attack two problems

 Analyze 3GPP standards related with VoLTE service

– Leave detail implementation to operators, chipset vendors, …

12

slide-35
SLIDE 35

Our approach to attack two problems

 Analyze 3GPP standards related with VoLTE service

– Leave detail implementation to operators, chipset vendors, …

 Make a checklist of potential vulnerable points in the VoLTE feature

– About 60 items for both control and data plane

12

slide-36
SLIDE 36

Our approach to attack two problems

 Analyze 3GPP standards related with VoLTE service

– Leave detail implementation to operators, chipset vendors, …

 Make a checklist of potential vulnerable points in the VoLTE feature

– About 60 items for both control and data plane

 Perform an analysis in 5 major operational networks

– 2 U.S. operators and 3 South Korea operators

12

slide-37
SLIDE 37

Quick Summary of Our Finding

13

slide-38
SLIDE 38

Quick Summary of Our Finding

 Four free data channels

– Using VoLTE protocol (for all operators)

  • SIP tunneling
  • Media tunneling

– Direct communication (for some operators)

  • Phone-to-Internet
  • Phone-to-Phone

13

slide-39
SLIDE 39

Quick Summary of Our Finding

 Four free data channels

– Using VoLTE protocol (for all operators)

  • SIP tunneling
  • Media tunneling

– Direct communication (for some operators)

  • Phone-to-Internet
  • Phone-to-Phone

 Five security issues

– No encryption of voice packets – No authentication of signaling – No call session management (DoS on the cellular infrastructure) – IMS bypassing – Permission model mismatch (VoLTE call without “CALL_PHONE” permission)

13

slide-40
SLIDE 40

Quick Summary of Our Finding

 Four free data channels

– Using VoLTE protocol (for all operators)

  • SIP tunneling
  • Media tunneling

– Direct communication (for some operators)

  • Phone-to-Internet
  • Phone-to-Phone

 Five security issues

– No encryption of voice packets – No authentication of signaling – No call session management (DoS on the cellular infrastructure) – IMS bypassing – Permission model mismatch (VoLTE call without “CALL_PHONE” permission)

13

slide-41
SLIDE 41

VoLTE Call Procedure

14

Caller SIP server Callee

*SIP: Session Initiation Protocol, *RTP: Real-time Transport Protocol

slide-42
SLIDE 42

VoLTE Call Procedure

14 INVITE

Caller SIP server Callee

Header : phone # of caller/callee, … Body : IP addr, port no., …

*SIP: Session Initiation Protocol, *RTP: Real-time Transport Protocol

slide-43
SLIDE 43

VoLTE Call Procedure

14 INVITE 200 OK

Caller SIP server Callee

Header : phone # of caller/callee, … Body : IP addr, port no., …

…

*SIP: Session Initiation Protocol, *RTP: Real-time Transport Protocol

slide-44
SLIDE 44

VoLTE Call Procedure

14 INVITE 200 OK

Caller SIP server Callee

Voice Session (RTP payload = voice data)

Header : phone # of caller/callee, … Body : IP addr, port no., …

…

*SIP: Session Initiation Protocol, *RTP: Real-time Transport Protocol

slide-45
SLIDE 45

Free Channel: SIP Tunneling

15 INVITE

Caller SIP server Callee

…

Header : phone # of caller/callee, injected data Body : IP addr, port no., injected data 603 Decline

Voice Session (RTP payload = voice data)

*SIP: Session Initiation Protocol, *RTP: Real-time Transport Protocol

slide-46
SLIDE 46

Free Channel: Media Tunneling

16 INVITE 200 OK

Caller SIP server Callee

Voice Session (RTP payload = Injected data)

Header : phone # of caller/callee, … Body : IP addr, port no., …

…

*SIP: Session Initiation Protocol, *RTP: Real-time Transport Protocol

slide-47
SLIDE 47

Attack Implementation in Detail

17

AP CP AP CP

VoLTE Interface

IMS Caller Callee Core Network

VoLTE Interface

slide-48
SLIDE 48

Attack Implementation in Detail

17

AP CP AP CP

SIP Sender Media Sender VoLTE Interface

IMS Caller Callee Core Network

VoLTE Interface

slide-49
SLIDE 49

Attack Implementation in Detail

17

AP CP AP CP

SIP Sender Media Sender VoLTE Interface SIP Receiver Media Receiver

IMS Caller Callee Core Network

VoLTE Interface

slide-50
SLIDE 50

Attack Implementation in Detail

17

AP CP AP CP

SIP Sender Media Sender VoLTE Interface SIP Receiver Media Receiver

IMS

SIP, RTP

Caller Callee Core Network

VoLTE Interface

slide-51
SLIDE 51

Attack Implementation in Detail

17

AP CP AP CP

SIP Sender Media Sender VoLTE Interface SIP Receiver Media Receiver

IMS

SIP, RTP SIP

Caller Callee Core Network

VoLTE Interface

slide-52
SLIDE 52

Attack Implementation in Detail

17

AP CP AP CP

SIP Sender Media Sender VoLTE Interface SIP Receiver Media Receiver

IMS

SIP, RTP SIP

Caller Callee Core Network

VoLTE Interface Audio Data

(60-100 bytes)

slide-53
SLIDE 53

Attack Implementation in Detail

17

AP CP AP CP

SIP Sender Media Sender VoLTE Interface SIP Receiver Media Receiver

IMS

SIP, RTP SIP

Caller Callee Core Network

VoLTE Interface Audio Data

(60-100 bytes)

DIAG Command

slide-54
SLIDE 54

Attack Implementation in Detail

18

AP CP AP CP

SIP Sender Media Sender VoLTE Interface DIAG SIP Receiver Media Receiver VoLTE

IMS

SIP, RTP SIP RTP

Caller Callee Core Network DIAG Command

slide-55
SLIDE 55

Outline

 Four free data channels

– Using VoLTE protocol (for all operators)

  • SIP tunneling
  • Media tunneling

– Direct communication (for some operators)

  • Phone-to-Internet
  • Phone-to-Phone

 Five security issues

– No encryption of voice packets – No authentication of signaling – No call session management (DoS on the cellular infrastructure) – IMS bypassing – Permission model mismatch (VoLTE call without “CALL_PHONE” permission)

19

slide-56
SLIDE 56

20

Free Channel: Direct communication

 Phone-to-Internet

– Open a TCP/UDP socket with voice IP – Send data to the Internet E.g. TCP/UDP Socket (Src: voice IP/port, Dst: youtube.com/port)

4G Gateway IMS Internet

Default bearer for VoLTE

slide-57
SLIDE 57

20

Free Channel: Direct communication

 Phone-to-Internet

– Open a TCP/UDP socket with voice IP – Send data to the Internet E.g. TCP/UDP Socket (Src: voice IP/port, Dst: youtube.com/port)

4G Gateway IMS Internet

Default bearer for VoLTE

slide-58
SLIDE 58

Free Channel: Direct communication

 Phone-to-Phone

– Open a TCP/UDP socket with voice IP – Send data to callee E.g. TCP/UDP Socket (Src: voice IP/port, Dst: callee’s voice IP/port)

4G Gateway IMS Internet

Default bearer for VoLTE

slide-59
SLIDE 59

Free Channel: Direct communication

 Phone-to-Phone

– Open a TCP/UDP socket with voice IP – Send data to callee E.g. TCP/UDP Socket (Src: voice IP/port, Dst: callee’s voice IP/port)

4G Gateway IMS Internet

Default bearer for VoLTE

slide-60
SLIDE 60

Evaluation Result: Accounting Bypass

22

Free Channel US-1 US-2 KR-1 KR-2 KR-3 Using VoLTE Protocol SIP Tunneling ✓ ✓ ✓ ✓ ✓ Media Tunneling ✓ ✓ ✓ ✓ ✓ Direct Communication Phone to Phone ✓

✘

✓

✘ ✘

Phone to Internet

✘

✓ ✓

✘

IPv4:✓ IPv6:✘ Last update: 20th April, 2015

✓: vulnerable/not charged, x: secure

slide-61
SLIDE 61

Evaluation Result: Accounting Bypass

22

Free Channel US-1 US-2 KR-1 KR-2 KR-3 Using VoLTE Protocol SIP Tunneling ✓ ✓ ✓ ✓ ✓ Media Tunneling ✓ ✓ ✓ ✓ ✓ Direct Communication Phone to Phone ✓

✘

✓

✘ ✘

Phone to Internet

✘

✓ ✓

✘

IPv4:✓ IPv6:✘ Last update: 20th April, 2015

✓: vulnerable/not charged, x: secure

slide-62
SLIDE 62

Evaluation Result: Accounting Bypass

22

Free Channel US-1 US-2 KR-1 KR-2 KR-3 Using VoLTE Protocol SIP Tunneling ✓ ✓ ✓ ✓ ✓ Media Tunneling ✓ ✓ ✓ ✓ ✓ Direct Communication Phone to Phone ✓

✘

✓

✘ ✘

Phone to Internet

✘

✓ ✓

✘

IPv4:✓ IPv6:✘ Last update: 20th April, 2015

✓: vulnerable/not charged, x: secure

slide-63
SLIDE 63

Evaluation Result: Accounting Bypass

23

Free Channel US-1 US-2 KR-1 KR-2 KR-3 Using VoLTE Protocol SIP Tunneling ✓ ✓ ✓ ✓ ✓ Media Tunneling ✓ ✓ ✓ ✓ ✓ Direct Communication Phone to Phone ✓

✘

✓

✘ ✘

Phone to Internet

✘

✓ ✓

✘

IPv4:✓ IPv6:✘ Last update: 20th April, 2015

✓: vulnerable/not charged, x: secure

slide-64
SLIDE 64

Evaluation Result: Accounting Bypass

23

Free Channel US-1 US-2 KR-1 KR-2 KR-3 Using VoLTE Protocol SIP Tunneling ✓ ✓ ✓ ✓ ✓ Media Tunneling ✓ ✓ ✓ ✓ ✓ Direct Communication Phone to Phone ✓

✘

✓

✘ ✘

Phone to Internet

✘

✓ ✓

✘

IPv4:✓ IPv6:✘ Last update: 20th April, 2015

✓: vulnerable/not charged, x: secure

slide-65
SLIDE 65

Evaluation Result: Accounting Bypass

24

Free Channel US-1 US-2 KR-1 KR-2 KR-3 Using VoLTE Protocol SIP Tunneling ✓ ✓ ✓ ✓ ✓ Media Tunneling ✓ ✓ ✓ ✓ ✓ Direct Communication Phone to Phone ✓

✘

✓

✘ ✘

Phone to Internet

✘

✓ ✓

✘

IPv4:✓ IPv6:✘ Last update: 20th April, 2015

21.5 Mbps 16.8 Mbps ✓: vulnerable/not charged, x: secure

slide-66
SLIDE 66

Evaluation Result: Accounting Bypass

24

Free Channel US-1 US-2 KR-1 KR-2 KR-3 Using VoLTE Protocol SIP Tunneling ✓ ✓ ✓ ✓ ✓ Media Tunneling ✓ ✓ ✓ ✓ ✓ Direct Communication Phone to Phone ✓

✘

✓

✘ ✘

Phone to Internet

✘

✓ ✓

✘

IPv4:✓ IPv6:✘ Last update: 20th April, 2015

21.5 Mbps 16.8 Mbps 42 Kbps ✓: vulnerable/not charged, x: secure

slide-67
SLIDE 67

Evaluation Result: Accounting Bypass

24

Free Channel US-1 US-2 KR-1 KR-2 KR-3 Using VoLTE Protocol SIP Tunneling ✓ ✓ ✓ ✓ ✓ Media Tunneling ✓ ✓ ✓ ✓ ✓ Direct Communication Phone to Phone ✓

✘

✓

✘ ✘

Phone to Internet

✘

✓ ✓

✘

IPv4:✓ IPv6:✘ Last update: 20th April, 2015

21.5 Mbps 16.8 Mbps 42 Kbps X ✓: vulnerable/not charged, x: secure

slide-68
SLIDE 68

Evaluation Result: Accounting Bypass

24

Free Channel US-1 US-2 KR-1 KR-2 KR-3 Using VoLTE Protocol SIP Tunneling ✓ ✓ ✓ ✓ ✓ Media Tunneling ✓ ✓ ✓ ✓ ✓ Direct Communication Phone to Phone ✓

✘

✓

✘ ✘

Phone to Internet

✘

✓ ✓

✘

IPv4:✓ IPv6:✘ Last update: 20th April, 2015

21.5 Mbps 16.8 Mbps 42 Kbps X ✓: vulnerable/not charged, x: secure

slide-69
SLIDE 69

Outline

 Four free data channels

– Using VoLTE protocol (for all operators)

  • SIP tunneling
  • Media tunneling

– Direct communication (for some operators)

  • Phone-to-Internet
  • Phone-to-Phone

 Five security issues

– No encryption of voice packets – No authentication of signaling – No call session management (DoS on the cellular infrastructure) – IMS bypassing – Permission model mismatch (VoLTE call without “CALL_PHONE” permission)

25

slide-70
SLIDE 70

No Encryption for Voice Packets

 For voice signaling,

– only one operator was using IPsec – An attacker can easily manipulate VoLTE call flow

 For voice data,

– no one encrypted voice data – An attacker might wiretap the outgoing voice data

26

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack IMS No SIP Encryption X ✓ ✓ ✓ Message manipulation No Voice Data Encryption ✓ ✓ ✓ ✓ ✓ Wiretapping

: Vulnerable : Secure

slide-71
SLIDE 71

 No authentication

– Make a call with a fake number

No Authentication/Session Management

27

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack IMS No Authentication X X O O X Caller Spoofing No Session Management O O O X O Denial of Service on Core Network

: Vulnerable : Secure

slide-72
SLIDE 72

 No authentication

– Make a call with a fake number

 No session management

No Authentication/Session Management

27

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack IMS No Authentication X X O O X Caller Spoofing No Session Management O O O X O Denial of Service on Core Network

: Vulnerable : Secure

slide-73
SLIDE 73

 No authentication

– Make a call with a fake number

 No session management

* In a normal call, one user can call to only one person

No Authentication/Session Management

27

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack IMS No Authentication X X O O X Caller Spoofing No Session Management O O O X O Denial of Service on Core Network

: Vulnerable : Secure

slide-74
SLIDE 74

 No authentication

– Make a call with a fake number

 No session management

* In a normal call, one user can call to only one person

– Send multiple INVITE messages

  • Several call sessions are established
  • For each call session, high-cost bearer is established

No Authentication/Session Management

27

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack IMS No Authentication X X O O X Caller Spoofing No Session Management O O O X O Denial of Service on Core Network

: Vulnerable : Secure

slide-75
SLIDE 75

 No authentication

– Make a call with a fake number

 No session management

* In a normal call, one user can call to only one person

– Send multiple INVITE messages

  • Several call sessions are established
  • For each call session, high-cost bearer is established

– Even one sender can deplete resources of the core network

No Authentication/Session Management

27

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack IMS No Authentication X X O O X Caller Spoofing No Session Management O O O X O Denial of Service on Core Network

: Vulnerable : Secure

slide-76
SLIDE 76

IMS

Caller Spoofing Scenario

28

Caller Callee

slide-77
SLIDE 77

Header : phone # of caller/callee, … Body : IP addr, port no., … INVITE

IMS

Caller Spoofing Scenario

28

Caller Callee

slide-78
SLIDE 78

Header : phone # of caller/callee, … Body : IP addr, port no., … INVITE

IMS

Caller Spoofing Scenario

28

Caller Callee Attacker

slide-79
SLIDE 79

Header : phone # of caller/callee, … Body : IP addr, port no., … INVITE Header : phone # of caller/callee, … Body : IP addr, port no., … INVITE

IMS

Caller Spoofing Scenario

28

Caller Callee Attacker

slide-80
SLIDE 80

29

slide-81
SLIDE 81

IMS Bypassing

 All voice packets should pass IMS, but

30

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack 4G-GW IMS Bypassing O X O X X Caller Spoofing 4G Gateway IMS

: Vulnerable : Secure

slide-82
SLIDE 82

IMS Bypassing

 All voice packets should pass IMS, but

30

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack 4G-GW IMS Bypassing O X O X X Caller Spoofing 4G Gateway IMS

: Vulnerable : Secure

slide-83
SLIDE 83

IMS Bypassing

 All voice packets should pass IMS, but

30

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack 4G-GW IMS Bypassing O X O X X Caller Spoofing 4G Gateway IMS

: Vulnerable : Secure

slide-84
SLIDE 84

IMS Bypassing

 All voice packets should pass IMS, but  An attacker can bypass SIP servers in IMS

– IMS vulnerabilities are also possible e.g. Make a call with a fake number

30

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack 4G-GW IMS Bypassing O X O X X Caller Spoofing 4G Gateway IMS

: Vulnerable : Secure

slide-85
SLIDE 85

Android Permission Model Mismatch

 No distinction between a phone call and a normal data socket

– In 3G, an app needs “android.permission.CALL_PHONE” – In VoLTE, we found that an app can call with “android.permission.INTERNET”

31

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack Phone Permission Mismatch Vulnerable for all Android Denial of Service on Call, Overbilling

slide-86
SLIDE 86

Android Permission Model Mismatch

 No distinction between a phone call and a normal data socket

– In 3G, an app needs “android.permission.CALL_PHONE” – In VoLTE, we found that an app can call with “android.permission.INTERNET”

 A malicious app only with Internet permission can perform

– Denial of service attack on call – Overbilling attack by making an expensive video call

31

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack Phone Permission Mismatch Vulnerable for all Android Denial of Service on Call, Overbilling

slide-87
SLIDE 87

Denial of Service on Call Scenario

 Blocking an incoming call  Cutting off an ongoing call

32

Victim Attacker Caller Victim Attacker Caller

IMS IMS

slide-88
SLIDE 88

Denial of Service on Call Scenario

 Blocking an incoming call  Cutting off an ongoing call

32

Victim Attacker Caller Victim Attacker Caller

IMS IMS

slide-89
SLIDE 89

Denial of Service on Call Scenario

 Blocking an incoming call  Cutting off an ongoing call

32

Victim Attacker Caller Victim Attacker Caller

IMS IMS

Block

slide-90
SLIDE 90

Denial of Service on Call Scenario

 Blocking an incoming call  Cutting off an ongoing call

32

Victim Attacker Caller Victim Attacker Caller

IMS IMS

Block

slide-91
SLIDE 91

Denial of Service on Call Scenario

 Blocking an incoming call  Cutting off an ongoing call

32

Victim Attacker Caller Victim Attacker Caller Cut-off

IMS IMS

Block

slide-92
SLIDE 92

33

slide-93
SLIDE 93

34

slide-94
SLIDE 94

Mitigation

35

Point Vulnerability Mitigation Responsible Entity

IMS No Security Mechanisms Encrypt call signaling and voice data Operators IMS provider No Authentication Place proper authentication on voice packets No Session Management Allow single call session per device 4G-GW Direct Communication Disallow direct communication Operators Phone Permission Mismatch Create new permission for VoLTE interface Mobile OS (Android) SIP/Media tunneling Place proper regulation on packet routing Apply deep packet inspection Mobile OS (Android) Operators

slide-95
SLIDE 95

Mitigation

35

Point Vulnerability Mitigation Responsible Entity

IMS No Security Mechanisms Encrypt call signaling and voice data Operators IMS provider No Authentication Place proper authentication on voice packets No Session Management Allow single call session per device 4G-GW Direct Communication Disallow direct communication Operators Phone Permission Mismatch Create new permission for VoLTE interface Mobile OS (Android) SIP/Media tunneling Place proper regulation on packet routing Apply deep packet inspection Mobile OS (Android) Operators

How to resolve media tunneling?

slide-96
SLIDE 96

Mitigation

35

Point Vulnerability Mitigation Responsible Entity

IMS No Security Mechanisms Encrypt call signaling and voice data Operators IMS provider No Authentication Place proper authentication on voice packets No Session Management Allow single call session per device 4G-GW Direct Communication Disallow direct communication Operators Phone Permission Mismatch Create new permission for VoLTE interface Mobile OS (Android) SIP/Media tunneling Place proper regulation on packet routing Apply deep packet inspection Mobile OS (Android) Operators

How to resolve media tunneling? Not easy! Maybe byte-usage accounting?

slide-97
SLIDE 97

Discussion

 Some parts of 3GPP specifications are unclear

– Several misunderstandings of the operators – Different implementations and security problems – Security features are only recommendations, not requirement

 We reported vulnerabilities to US/KR CERTs, and Google in May

– Google replied “moderate severity” – All two U.S. operators ACK’ed, but no follow-ups – Only two among three KR operators have been fixing with us

36

slide-98
SLIDE 98

Conclusion

 Newly adopted VoLTE has

– A complex (legacy time-based) accounting – Delegated voice signal (previously done by CP) to AP

37

slide-99
SLIDE 99

Conclusion

 Newly adopted VoLTE has

– A complex (legacy time-based) accounting – Delegated voice signal (previously done by CP) to AP

 We analyzed the security of VoLTE for 5 operators, and found

– Four free data channels – Five security problems

37

slide-100
SLIDE 100

Conclusion

 Newly adopted VoLTE has

– A complex (legacy time-based) accounting – Delegated voice signal (previously done by CP) to AP

 We analyzed the security of VoLTE for 5 operators, and found

– Four free data channels – Five security problems

 All related parties have problems

– 3GPP, telcos, IMS providers, mobile OSes, and device vendors

37

slide-101
SLIDE 101

Conclusion

 Newly adopted VoLTE has

– A complex (legacy time-based) accounting – Delegated voice signal (previously done by CP) to AP

 We analyzed the security of VoLTE for 5 operators, and found

– Four free data channels – Five security problems

 All related parties have problems

– 3GPP, telcos, IMS providers, mobile OSes, and device vendors

 More and more reliance on cellular technology

– Automobiles, power grid, traffic signal, ...

37

slide-102
SLIDE 102

Conclusion

 Newly adopted VoLTE has

– A complex (legacy time-based) accounting – Delegated voice signal (previously done by CP) to AP

 We analyzed the security of VoLTE for 5 operators, and found

– Four free data channels – Five security problems

 All related parties have problems

– 3GPP, telcos, IMS providers, mobile OSes, and device vendors

 More and more reliance on cellular technology

– Automobiles, power grid, traffic signal, ...

Holistic re-evaluation of security for VoLTE?

37

slide-103
SLIDE 103

38

Thank You!

Any questions?

hongilk@kaist.ac.kr dkay@kaist.ac.kr

slide-104
SLIDE 104

APPENDIX

39

slide-105
SLIDE 105

Strange VoLTE Accounting

 Accounting in 3G

40

Telephony

Phone

Data (Packet Switching) Internet Voice (Circuit Switching)

Cell tower

IMS

Phone

Data (Packet Switching) Internet

Cell tower

Byte usage Time usage

 Accounting in 4G (using VoLTE)

Byte usage for all services? Still time usage Unlimited VoLTE call

slide-106
SLIDE 106

Complex Implementation of VoLTE

41

IMS

Cell tower Phone

4G LTE

3GPP standards Mobile OS support?

LTE Core

Device HW interface Implementation of LTE core Accounting infrastructure

4G Gateway

slide-107
SLIDE 107

Complex Implementation of VoLTE

41

IMS

Cell tower Phone

4G LTE

3GPP standards Mobile OS support?

LTE Core

Device HW interface Implementation of LTE core Accounting infrastructure

4G Gateway

Permission Mismatch Free Data Channels No Session Manage No Auth No Encryption IMS Bypassing

slide-108
SLIDE 108

SIP Signaling Procedure

42 INVITE INVITE 180 Ringing 180 Ringing

Voice Session (RTP)

BYE 200 OK 200 OK 200 OK

Caller SIP server Callee

Header : Caller & Callee’s phone #, route,… Body : Voice session info (callee -> caller) (Callee’s phone #, src voice IP, port) BYE 200 OK Header : Caller & Callee’s phone #, route,… Body : Voice session info Header : Caller & Callee’s phone #, route,… Body : Voice session info (callee -> caller)

slide-109
SLIDE 109

Results of Media Tunneling

 Media channel characteristics from the control plane messages  Actual measurement results (trade-offs between throughput and loss rate)

US-1 US-2 KR-1 KR-2 KR-3 QoS Param. (Kbps) 38 49 41 41 49 Bandwidth (Kbps) 38/49 49 65 65 65 Latency (sec) 0.1 0.1 0.1 0.1 0.1 Loss rate (%) 1 1 1 1 1 US-1 US-2 KR-1 KR-2 KR-3 Throughput (Kbps) 37.90 36.93 45.76 39 50.48 Latency (sec) 0.52 0.02 0.10 0.32 0.30 Loss rate (%) 1.44 1.74 0.77 0.65 0.73

43

slide-110
SLIDE 110

Proposed Attack Comparison

 This paper – Free data channels

  • SIP/Media tunneling
  • Direct communication

– Attacks from security problems

  • Message manipulation
  • Wiretapping
  • Caller spoofing
  • DoS on core network
  • DoS on call
  • Overbilling

 UCLA paper – Free data channels

  • Free external/internal channels

– Attacks from security problems

  • Overcharging attack
  • Data DoS attacks
  • Voice muted attack
slide-111
SLIDE 111

Proposed Attack Comparison

 This paper – Free data channels

  • SIP/Media tunneling
  • Direct communication

– Attacks from security problems

  • Message manipulation
  • Wiretapping
  • Caller spoofing
  • DoS on core network
  • DoS on call
  • Overbilling

 UCLA paper – Free data channels

  • Free external/internal channels

– Attacks from security problems

  • Overcharging attack
  • Data DoS attacks
  • Voice muted attack
slide-112
SLIDE 112

Proposed Attack Comparison

 This paper – Free data channels

  • SIP/Media tunneling
  • Direct communication

– Attacks from security problems

  • Message manipulation
  • Wiretapping
  • Caller spoofing
  • DoS on core network
  • DoS on call
  • Overbilling

 UCLA paper – Free data channels

  • Free external/internal channels

– Attacks from security problems

  • Overcharging attack
  • Data DoS attacks
  • Voice muted attack

Focused on interface corss-over between VoLTE and Data interface

slide-113
SLIDE 113

Proposed Attack Comparison

 This paper – Free data channels

  • SIP/Media tunneling
  • Direct communication

– Attacks from security problems

  • Message manipulation
  • Wiretapping
  • Caller spoofing
  • DoS on core network
  • DoS on call
  • Overbilling

 UCLA paper – Free data channels

  • Free external/internal channels

– Attacks from security problems

  • Overcharging attack
  • Data DoS attacks
  • Voice muted attack

Focused on interface corss-over between VoLTE and Data interface Focused more on VoLTE and analyzed both protocol and implementation (including mobile OS, 3GPP spec)