ReVoLTE attack can decrypt 4G (LTE) calls to eavesdrop on conversations

[silversurfer]

Content source

https://www.zdnet.com/article/re-vol-te-attack-can-decrypt-4g-lte-calls-to-eavesdrop-on-conversations/

Academics detail a new attack on 4G encrypted calls. Attack works only when the attacker is on the same base station (mobile tower) as the victim.

A team of academics has detailed this week a vulnerability in the Voice over LTE (VoLTE) protocol that can be used to break the encryption on 4G voice calls.

Named ReVoLTE, researchers say this attack is possible because mobile operators often use the same encryption key to secure multiple 4G voice calls that take place via the same base station (mobile cell tower).

Academics say they tested the attack in a real-world scenario and found that multiple mobile operators are impacted, and have worked with the GSM Association (GSMA), the organization that governs telephony standards, to have the issue resolved.

A scientific paper detailing the ReVoLTE attack is also available for download as PDF from here and here. The paper is titled:
"Call Me Maybe: Eavesdropping Encrypted LTE Calls With ReVoLTE."

 

[[correlate]]

RADIX SECURITY

We make 5G accessible and secure

revolte-attack.net

 

[upnorth]

Am I vulnerable?

In initial tests, the researchers found that 12 of 15 randomly selected base stations in Germany reused keystreams, making all VoLTE calls transmitted through them vulnerable. After reporting their findings to the industry group Global System for Mobile Applications, a retest found that the affected German carriers had fixed their base stations. With more than 120 providers around the world and over 1,200 different device types supporting VoLTE, it will likely take more time for the eavesdropping weakness to be fully eradicated. “However, we need to consider a large number of providers worldwide and their large deployments,” the researchers wrote. “It is thus crucial to raise awareness about the vulnerability.”

The researchers have released an Android app that will test if a network connection is vulnerable. The app requires a rooted device that supports VoLTE and runs a Qualcomm chipset. Unfortunately, those requirements will make it hard for most people to use the app.

The researchers provide several suggestions that cellular providers can follow to fix the problem.

Hackers can eavesdrop on mobile calls with $7,000 worth of equipment

VoLTE calls were supposed to be more secure. A fatal flaw can unravel that promise.

arstechnica.com