Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using Side Channel Information

Abstract

The cellular paging (broadcast) protocol strives to balance between a cellular device's energy consumption and quality-of-service by allowing the device to only periodically poll for pending services in its idle, low-power state. For a given cellular device and serving network, the exact time periods when the device polls for services (called the paging occasion) are fixed by design in the 4G/5G cellular protocol. In this paper, we show that the fixed nature of paging occasions can be exploited by an adversary in the vicinity of a victim to associate the victim's softidentity (e.g., phone number, Twitter handle) with its paging occasion, with only a modest cost, through an attack dubbed ToRPEDO. Consequently, ToRPEDO can enable an adversary to verify a victim's coarse-grained location information, inject fabricated paging messages, and mount denial-of-service attacks. We also demonstrate that, in 4G and 5G, it is plausible for an adversary to retrieve a victim device's persistent identity (i.e., IMSI) with a brute-force IMSI-Cracking attack while using ToRPEDO as an attack sub-step. Our further investigation on 4G paging protocol deployments also identified an implementation oversight of several network providers which enables the adversary to launch an attack, named PIERCER, for associating a victim's phone number with its IMSI; subsequently allowing targeted user location tracking. All of our attacks have been validated and evaluated in the wild using commodity hardware and software. We finally discuss potential countermeasures against the presented attacks.

Attacks and Defenses in Short-Range Wireless Technologies for IoT

“…The considered technologies are heavily used in IoT. A large majority have studied security attacks considering multiple wireless communication technologies, such as Wi-Fi, Bluetooth, RFID, WiMax, UMTS, LTE, and WSNs 5 [88]- [90], whereas others have chosen to survey attacks in one particular wireless communication technology, e.g., Wi-Fi [91]- [94], Bluetooth [95]- [102], ZigBee (or IEEE 802.15.4) [103]- [107], RFID [108]- [114], 6LoWPAN (Ipv6 over Low-Power Wireless Personal Area Networks) [115]- [118], LoRaWAN [119]- [121], Zwave and Thread [122], WiMax [123]- [128], and 4G (i.e., LTE) or 5G [129]- [131]. Table 1 summarizes the three IoT security attack research directions (i.e., RD1, RD2, and RD3), with respect to the considered IoT applications (Column 2), IoT wireless communication technologies (Column 3), IoT network architectures (Column 4), and IoT security services (Column 5).…”

IMP4GT: IMPersonation Attacks in 4G NeTworks

“…So far, previous studies found vulnerabilities in the specification ranging from privacy to denial of service attacks [38]. Privacy attacks can localize and track a user [43], [25], [44] or infer the visiting websites [30], [28]. Further, attacks can exploit protocol vulnerabilities of the phone [43], [24] or exhaust resources [46] for a denial of service.…”

Privacy Challenges With Protecting Live Vehicular Location Context

“…Man-in-the-middle attacks are possible on both 3G [34] and 4G/LTE [35]. Eavesdropping attacks against the 4G network can also allow an attacker to recover the IMSI number of targets [36]. Other techniques have also been investigated where IMSI numbers can be obtained over WiFI [37].…”