Newsportal - Ruhr-Universität Bochum

Exploiting a vulnerability in the mobile communication standard LTE, also known as 4G, researchers at RUB can impersonate mobile phone users. Consequently, they can book fee-based services in their name that are paid for via the mobile phone bill – for example, a subscription to streaming services.

“An attacker can book services, for example stream shows, but the owner of the attacked phone would have to pay for them,” illustrates Professor Thorsten Holz from Horst Görtz Institute for IT Security, who discovered the vulnerability together with David Rupprecht, Dr. Katharina Kohls and Professor Christina Pöpper. The team from Bochum will present the results on 25 February 2020 at the Network Distributed System Security Symposium, NDSS for short, in San Diego, USA. Details of the attacks are also available on the website www.imp4gt-attacks.net.

David Rupprecht and Dr. Katharina Kohls from the Chair of System Security developed attacks to exploit security gaps in the mobile phone standard LTE.

© RUB, Kramer

According to the researcher, the vulnerability may also affect investigations of law enforcement agencies because attackers can not only make purchases in the victim’s name, but can also access websites using the victim’s identity. For example, an attacker can upload secret company documents and to network operators or law enforcement authorities, it would look as if the victim is the perpetrator.

Almost all mobile phones and tablets at risk

The discovered vulnerability affects all devices that communicate with LTE, i.e. virtually all mobile phones, tablets, and some connected household appliances. Only changing the hardware design would mitigate the threat. The Bochum-based team is attempting to close the security gap in the latest mobile communication standard 5G, which is currently rolled out. “For a technical perspective this is possible,” explains David Rupprecht. “However, mobile network operators would have to accept higher costs, as the additional protection generates more data during the transmission. In addition, all mobile phones would have to be replaced and the base station expanded. That is something that will not happen in the near future.”

Attacker has to be nearby

The problem is the lack of integrity protection: data packets are transmitted encrypted between the mobile phone and the base station, which protects the data against eavesdropping. However, it is possible to modify the exchanged data packets. The researchers can convert the encrypted data traffic between the mobile phone and the base station into plain text, and also send commands to the mobile phone, which are then encrypted and forwarded to the provider – such as a purchase command for a subscription. However, for a successful attack, the attacker must be in the vicinity of the victim’s mobile phone.

Thorsten Holz heads the Chair of System Security and is a Speaker at the Casa cluster of excellence.

© Mareen Meyer