Abstract:Voice over LTE (VoLTE) and Voice over NR (VoNR), are two similar technologies that have been widely deployed by operators to provide a better calling experience in LTE and 5G networks, respectively. The VoLTE/NR protocols rely on the security features of the underlying LTE/5G network to protect users' privacy such that nobody can monitor calls and learn details about call times, duration, and direction. In this paper, we introduce a new privacy attack which enables adversaries to analyse encrypted LTE/5G traffic and recover any VoLTE/NR call details. We achieve this by implementing a novel mobile-relay adversary which is able to remain undetected by using an improved physical layer parameter guessing procedure. This adversary facilitates the recovery of encrypted configuration messages exchanged between victim devices and the mobile network. We further propose an identity mapping method which enables our mobile-relay adversary to link a victim's network identifiers to the phone number efficiently, requiring a single VoLTE protocol message. We evaluate the real-world performance of our attacks using four modern commercial off-the-shelf phones and two representative, commercial network carriers. We collect over 60 hours of traffic between the phones and the mobile networks and execute 160 VoLTE calls, which we use to successfully identify patterns in the physical layer parameter allocation and in VoLTE traffic, respectively. Our real-world experiments show that our mobile-relay works as expected in all test cases, and the VoLTE activity logs recovered describe the actual communication with 100% accuracy. Finally, we show that we can link network identifiers such as International Mobile Subscriber Identities (IMSI), Subscriber Concealed Identifiers (SUCI) and/or Globally Unique Temporary Identifiers (GUTI) to phone numbers while remaining undetected by the victim.

Exploiting Cantor Expansion For Covert Channels Over Lte-Advanced

A Novel Covert Channel in LTE-A System

A Hybrid Covert Channel Over LTE-A System

TCCBL:a Timing Covert Channel Based on LTE-A

Research on Covert Channel Analysis in Tuling SecOS2.0/4

A Hybrid Covert Channel with Feedback over Mobile Networks.

Hybrid Covert Channel in LTE-A: Modeling and Analysis.

A VoLTE Covert Channel with Intelligent Confrontation

ZM-CTC: Covert timing channel construction method based on zigzag matrix

Building Undetectable Covert Channels Over Mobile Networks with Machine Learning.

An Entropy-Based Method For Detection Of Covert Channels Over Lte

Supervised Learning Framework for Covert Channel Detection in LTE-A.

A Packet-Reordering Covert Channel over VoLTE Voice and Video Traffics

Building covert timing channels by packet rearrangement over mobile networks.

Antenna Coding and Rate Optimization for Covert Wireless Communications

A Covert Timing Channel via Algorithmic Complexity Attacks: Design and Analysis

HMCTC:a New Kind Efficient Covert Timing Channel

Building packet length covert channel over mobile VoIP traffics.

Secret key expansion from covert communication

Covert Communications with Extremely Low Power under Finite Block Length over Slow Fading

Watching your call: Breaking VoLTE Privacy in LTE/5G Networks