Touching the Untouchables: Dynamic Security Analysis of the LTE Control Plane

Kim, Hongil; Lee, Jiho; Lee, Eun-Kyu; Kim, Yong‐Dae

doi:10.1109/sp.2019.00038

Cited by 89 publications

(96 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Vulnerabilities in network security may also enable UEs to gain access to ML functions, which do not utilize inputs directly from UEs. For instance, part of 5G and 4G access network communication is unprotected [81], [82]. This vulnerability enables man-in-the-middle attacks in 4G.…”

Section: ) Attack Vectors In 5gmentioning

confidence: 99%

Machine Learning Threatens 5G Security

et al. 2020

View full text Add to dashboard Cite

Machine learning (ML) is expected to solve many challenges in the fifth generation (5G) of mobile networks. However, ML will also open the network to several serious cybersecurity vulnerabilities. Most of the learning in ML happens through data gathered from the environment. Un-scrutinized data will have serious consequences on machines absorbing the data to produce actionable intelligence for the network. Scrutinizing the data, on the other hand, opens privacy challenges. Unfortunately, most of the ML systems are borrowed from other disciplines that provide excellent results in small closed environments. The resulting deployment of such ML systems in 5G can inadvertently open the network to serious security challenges such as unfair use of resources, denial of service, as well as leakage of private and confidential information. Therefore, in this article we dig into the weaknesses of the most prominent ML systems that are currently vigorously researched for deployment in 5G. We further classify and survey solutions for avoiding such pitfalls of ML in 5G systems.

show abstract

Section: ) Attack Vectors In 5gmentioning

confidence: 99%

Machine Learning Threatens 5G Security

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Therefore, one building block of LTE security is the correct implementation and, hence, is target to different analysis methodologies. Kim et al [29] introduce a semi-automatic tool for analyzing the behavior of equipment with the input of malicious data. By doing so, they discover vulnerabilities, including SMS spoofing attacks or an AKA bypass allowing to eavesdrop data sessions.…”

Section: Related Workmentioning

confidence: 99%

IMP4GT: IMPersonation Attacks in 4G NeTworks

Rupprecht

Kohls

Holz

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Long Term Evolution (LTE/4G) establishes mutual authentication with a provably secure Authentication and Key Agreement (AKA) protocol on layer three of the network stack. Permanent integrity protection of the control plane safeguards the traffic against manipulations. However, missing integrity protection of the user plane still allows an adversary to manipulate and redirect IP packets, as recently demonstrated. In this work, we introduce a novel cross-layer attack that exploits the existing vulnerability on layer two and extends it with an attack mechanism on layer three. More precisely, we take advantage of the default IP stack behavior of operating systems and show that combining it with the layer-two vulnerability allows an active attacker to impersonate a user towards the network and vice versa; we name these attacks IMP4GT (IMPersonation attacks in 4G neTworks). In contrast to a simple redirection attack as demonstrated in prior work, our attack dramatically extends the possible attack scenarios and thus emphasizes the need for user-plane integrity protection in mobile communication standards. The results of our work imply that providers can no longer rely on mutual authentication for billing, access control, and legal prosecution. On the other hand, users are exposed to any incoming IP connection as an adversary can bypass the provider's firewall. To demonstrate the practical impact of our attack, we conduct two IMP4GT attack variants in a live, commercial network, which-for the first time-completely break the mutual authentication aim of LTE on the user plane in a realworld setting.

show abstract

“…Unfortunately, this work was limited to two phones and does not capture the whole baseband space. Work similar to SPIKERXG [11] LTE implementations [2,4,9] typically focus on the protocol state machine level and may not capture all classes of implementation flaws or speak to exploitability. The most similar approach to SPIKERXG [1] creates an emulated environment for device testing but does not discuss the root causes of the issues found.…”

Section: Background and Related Workmentioning

confidence: 99%

Basebads: Automated security analysis of baseband firmware

Hernandez

Butler

2019

Proceedings of the 12th Conference on Security and Privacy in Wireless and Mobile Networks

View full text Add to dashboard Cite

Mobile devices are more connected than ever before through the use of multiple wireless protocols, including the 2G, 3G, and 4G cellular standards. To manage and interact with cellular networks, phones use dedicated and highly proprietary baseband processors running custom, closed-source firmware. Despite the increasing complexity of modern cellular standards, there is no reference implementation, leading individual baseband manufacturers to create their own in-house versions. The proprietary nature of baseband firmware combined with the complexity of standards has created a barrier for researchers to comprehensively audit the security of these implementations. To address this, we present SPIKERXG, an extensible, baseband testing platform that employs firmware instrumentation to intelligently target protocol messages. CCS CONCEPTS • Security and privacy → Mobile platform security; • Computer systems organization → Firmware; • Networks → Protocol testing and verification;

show abstract

Touching the Untouchables: Dynamic Security Analysis of the LTE Control Plane

Cited by 89 publications

References 20 publications

Machine Learning Threatens 5G Security

Machine Learning Threatens 5G Security

IMP4GT: IMPersonation Attacks in 4G NeTworks

Basebads: Automated security analysis of baseband firmware

Contact Info

Product

Resources

About