New Attacks Against 4G, 5G Mobile Networks Re-Enable IMSI Catchers

At NDSS Symposium 2019, a group of university researchers
yesterday revealed newly discovered cellular network
vulnerabilities that impact both 4G and 5G LTE protocols.

According to a paper published^[1]
by the researchers, “Privacy Attacks to the 4G and 5G Cellular
Paging Protocols Using Side Channel Information,” the new
attacks could allow remote attackers to bypass security protections
implemented in 4G and 5G, re-enabling IMSI catching devices like
“Stingrays^[2]” to intercept users’
phone calls and track their location.

Here below, we have described all the three attacks, how they
work, what are their impacts, and why you should be concerned about
these attacks.

ToRPEDO Attack — Location Verification, DoS, Inject Fake
Alerts

Short for “TRacking via Paging mEssage DistributiOn,” TorPEDO is
the most concerning attack that leverages paging protocol, allowing
remote attackers to verify a victim device’s location, inject
fabricated paging messages, and mount denial-of-service (DoS)
attacks.
When a device is not actively communicating with the cellular
network, it enters an idle mode, sort of a low-energy mode that
saves device battery power.

So, when you receive a phone call or an SMS message while your
device is in the ideal mode, the cellular network first sends a
paging message to notify the device of the incoming call or
text.

It should be noted that paging messages also include a value
called “Temporary Mobile Subscriber Identity” (TMSI) of the device
that doesn’t change frequently.

However, researchers find that if an attacker starts and then
immediately cancels calls several times in a short period, the base
station update TMSI value very frequently while sending the paging
messages.

Therefore, an attacker sniffing the paging messages, through
devices like
Stingrays^[3], can verify if a
targeted cellular user is within a range of the interception or
not.

The ToRPEDO attack impacts both 4G as well as the current version
of 5G LTE protocol, and the researchers said they verified ToRPEDO
against 3 Canadian service providers and all the US service
providers.
Once with the knowledge of the victim’s paging occasion from
ToRPEDO attack, the attackers can also hijack the paging channel,
enabling them to send fabricated emergency messages, mount a
denial-of-service attack by injecting fabricated, empty paging
messages, and thus blocking the victim from receiving any pending
services.

Piercer and IMSI-Cracking Attacks

In addition, the ToRPEDO attack also opens a door for two other new
attacks—the PIERCER and IMSI-Cracking attacks, leading to the full
recovery of the victim device’s persistent identity (i.e., IMSI).

Exist due to a design flaw, PIERCER (Persistent Information
ExposuRe by the CorE netwoRk) attack enables an attacker to
associate the victim device’s unique
IMSI with its phone number.
^[4]

According to researchers, ToRPEDO attack also enables an
attacker with the knowledge of the victim’s phone number to
retrieve the victim’s IMSI, on both 4G and 5G, by launching a
brute-force attack.

With IMSI number in hands, the attackers can launch previously
discovered attacks, potentially allowing them to snoop on victim’s
calls and location info using IMSI catchers like Stingrays and
DRTBox even if
the victim owns a brand new 5G handset, which is why one should be
more concerned about these attacks.
^[5]