Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems

By Altaf Shaik, Ravishankar Borgaonkar, N. Asokan, Valtteri Niemi, Jean-Pierre Seifert. Network and Distributed System Security Symposium, 2015

351 citations recorded by the source corpus.

Mobile communication systems now constitute an essential part of life throughout the world. Fourth generation "Long Term Evolution" (LTE) mobile communication networks are being deployed. The LTE suite of specifications is considered to be significantly better than its predecessors not only in terms of functionality but also with respect to security and privacy for subscribers. We carefully analyzed LTE access network protocol specifications and uncovered several vulnerabilities. Using commercial LTE mobile devices in real LTE networks, we demonstrate inexpensive, and practical attacks exploiting these vulnerabilities. Our first class of attacks consists of three different ways of making an LTE device leak its location: A semi-passive attacker can locate an LTE device within a 2 sq.km area within a city whereas an active attacker can precisely locate an LTE device using GPS co-ordinates or trilateration via cell-tower signal strength information. Our second class of attacks can persistently deny some or all services to a target LTE device. To the best of our knowledge, our work constitutes the first publicly reported practical attacks against LTE access network protocols. We present several countermeasures to resist our specific attacks. We also discuss possible trade-offs that may explain why these vulnerabilities exist and recommend that safety margins introduced into future specifications to address such trade-offs should incorporate greater agility to accommodate subsequent changes in the trade-off equilibrium.

Subfields: Artificial Intelligence, Computer Networks and Communications, Information Systems

View Paper: https://www.semanticscholar.org/paper/71ebad28045cd81a9d9fe80572d057ed3292e4d1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Information Systems

Citations in the corpus

: Privacy on Mobile Devices – It ’ s Complicated (2016, background): “These MISPs inherently can observe all unencrypted traffic, and can trivially ascertain the rough physical location of devices using triangulation with their broadcast towers.”
SoK: Privacy on Mobile Devices – It’s Complicated (2016, background): “These MISPs inherently can observe all unencrypted traffic, and can trivially ascertain the rough physical location of devices using triangulation with their broadcast towers.”
A Formal Analysis of 5G Authentication (2018, methodology): “, with IMSIcatchers [35, 36]) in previous generations; see the survey [32].”
Security and Privacy for 6G: A Survey on Prospective Technologies and Challenges (2021, background): “Although 5G-AKA can defeat IMSI-catcher attacks [46], [71], researchers of [73] found that user track-”
Internet of Things in the 5G Era: Enablers, Architecture, and Business Models (2016, background): “Recently, some important vulnerabilities have been disclosed in current 4G LTE systems [65].”