Abstract:Voice over LTE (VoLTE) and Voice over NR (VoNR), are two similar technologies that have been widely deployed by operators to provide a better calling experience in LTE and 5G networks, respectively. The VoLTE/NR protocols rely on the security features of the underlying LTE/5G network to protect users' privacy such that nobody can monitor calls and learn details about call times, duration, and direction. In this paper, we introduce a new privacy attack which enables adversaries to analyse encrypted LTE/5G traffic and recover any VoLTE/NR call details. We achieve this by implementing a novel mobile-relay adversary which is able to remain undetected by using an improved physical layer parameter guessing procedure. This adversary facilitates the recovery of encrypted configuration messages exchanged between victim devices and the mobile network. We further propose an identity mapping method which enables our mobile-relay adversary to link a victim's network identifiers to the phone number efficiently, requiring a single VoLTE protocol message. We evaluate the real-world performance of our attacks using four modern commercial off-the-shelf phones and two representative, commercial network carriers. We collect over 60 hours of traffic between the phones and the mobile networks and execute 160 VoLTE calls, which we use to successfully identify patterns in the physical layer parameter allocation and in VoLTE traffic, respectively. Our real-world experiments show that our mobile-relay works as expected in all test cases, and the VoLTE activity logs recovered describe the actual communication with 100% accuracy. Finally, we show that we can link network identifiers such as International Mobile Subscriber Identities (IMSI), Subscriber Concealed Identifiers (SUCI) and/or Globally Unique Temporary Identifiers (GUTI) to phone numbers while remaining undetected by the victim.

Long Term Evolution Network Security and Real-Time Data Extraction

Watching your call: Breaking VoLTE Privacy in LTE/5G Networks

Insecurity of Voice Solution VoLTE in LTE Mobile Networks

In-Device, Runtime Cellular Network Information Extraction And Analysis

Exploiting Mobile Big Data: Sources, Features, and Applications.

A secure wireless communication system integrating RSA, Diffie–Hellman PKDS, intelligent protection-key chains and a Data Connection Core in a 4G environment

A Machine Learning Based Approach to Mobile Network Analysis

A novel network based on TD-LTE for counter-terrorism emergency communication in urban area

Long term evolution in high speed railway environments: Feasibility and challenges

Analytical Model and Performance Evaluation of Long-Term Evolution for Vehicle Safety Services

Network Intell: Enabling the Non-Expert Analysis of Large Volumes of Intercepted Network Traffic

Vehicle Detection and Classification using LTE-CommSense

A New Cellular Architecture for Information Retrieval from Sensor Networks through Embedded Service and Security Protocols

Performance Test of LTE-R Railway Wireless Communication at High-Speed (350 km/h) Environments

Analysis and implementation of the SNOW 3G generator used in 4G/LTE systems

Device-to-Device Communications for National Security and Public Safety

The Dark Side(-Channel) of Mobile Devices: A Survey on Network Traffic Analysis

LTE enhancements for Public Safety and Security communications to support Group Multimedia Communications

EPS Confidentiality and Integrity mechanisms Algorithmic Approach

Easy 4G/LTE IMSI Catchers for Non-Programmers

Security for Smart Mobile Networks: The NEMESYS Approach