Yesterday, Google Scholar sent me an alert of a paper I might be interested in. It turns out, I am indeed very interested in it. This is a paper already accepted, in its new rolling window review process, for the IEEE Security and Privacy symposium of 2019 (link for this year’s symposium): Breaking LTE on Layer 2.

There is no available pre-print yet, but there’s an abstract already:

Long Term Evolution (LTE) is the latest mobile communication standard and has a pivotal role in our information society: LTE combines performance goals with modern security mechanisms and serves casual use cases as well as critical infrastructure and public safety communications. Both scenarios are demanding towards a resilient and secure specification and implementation of LTE, as outages and open attack vectors potentially lead to severe risks. Previous work on LTE protocol security identified crucial attack vectors for both the physical (layer one) and network (layer three) layers. Data link layer (layer two) protocols, however, remain a blind spot in existing LTE security research. In this paper, we present a comprehensive layer two security analysis and identify three attack vectors. These attacks impair the confidentiality and/or privacy of LTE communication. More specifically, we first present a passive identity mapping attack that matches volatile radio identities to longer lasting network identities, enabling us to identify users within a cell and serving as a stepping stone for follow-up attacks. Second, we demonstrate how a passive attacker can abuse the resource allocation as a side channel to perform website fingerprinting that enables the attacker to learn the websites a user accessed. Finally, we present the A LTE R attack that exploits the fact that LTE user data is encrypted in counter mode (AES-CTR) but not integrity protected, which allows us to modify the message payload. As a proof-of-concept demonstration, we show how an active attacker can redirect DNS requests and then perform a DNS spoofing attack. As a result, the user is redirected to a malicious website. Our experimental analysis demonstrates the real-world applicability of all three attacks and emphasizes the threat of open attack vectors on LTE layer two protocols.

It is always great news to see excellent security research on LTE published that is based on open source implementations of the LTE stack. This is something I anticipated a few years ago. I am also very familiar with the work of this new paper’s authors. They have worked on some really interesting security research work on LTE and I have discussed some of their most recent papers in this blog.

This new paper is particularly exciting because it seems to build up on some of my work from a few years ago. Based on the abstract (“we first present a passive identity mapping attack that matches volatile radio identities to longer lasting network identities, enabling us to identify users within a cell and serving as a stepping stone for follow-up attacks), it sounds like they are implementing RNTI-based user tracking and using it for what sounds like a series of new really interesting attacks against LTE. I really look forward to reading the paper and learning more about the excellent work they did and the new protocol exploits they found.

Back in 2016 I presented at ShmooCon (slides and video) and published a paper discussing and implementing Denial of Service attacks against LTE, IMSI catchers on LTE and, relevant to this new paper, presenting and implementing in a real network for the first time a user location tracking attack leveraging the PHY layer id known as RNTI (Radio Network Temporary Identifier). For details, see slides 31 to 44 here and section V.F of my paper from 2016.

In a nutshell, the RNTI is an id derived and assigned in the RACH handshake in plain text (and thus can be easily captured with a simple LTE downlink sniffer such as AirScope from Software Radio Systems). It is included in plaintext in the header of every single PHY layer packet, which means that it is included in the plaintext in all uplink and downlink packets of a connection. As such, it can obviously allow to distinguish traffic flows from multiple users and track a given user, if one can map the RNTI to something else. As I implemented in my work a couple years ago, mapping the RNTI to the TMSI or even the MSISDN (the phone number of the user) is trivial. Once one maps an RNTI to a TMIS, then one can leverage paging messages to further expand the ability to track a user, as Kune showed in a really cool paper from a few years ago. I also recently read a paper that expands even further the ability of user tracking on LTE by using the GUTI.

A couple of years ago I also demo-ed at HackerHalted an implementation of an RNTI-based tracker running passively using a modified version of srsLTE and a USRP radio (see slides here).

The authors of “Breaking LTE on layer 2” seem to have implemented and tested the RNTI tracking techniques in their paper and used it as the stepping stone for new attacks that sound pretty cool and interesting, given what the abstract reads. Hopefully we don’t have to wait until IEEE S&P 2019 (May 2019) to learn more details on their new research. Knowing the excellent work that this authors have published in the recent years, I expect a very good paper that is likely to generate a lot of conversations and discussions. The more work in this area the better, as we need people talking about this and actively working in making mobile networks more secure. Really looking forward to reading their paper!

Related published work on user tracking and, specifically, RNTI tracking:

[1] Jover, Roger Piqueras. “LTE security, protocol exploits and location tracking experimentation with low-cost software radio.” arXiv preprint arXiv:1607.05171 (2016).

[2] Jover, Roger Piqueras. “LTE security and protocol exploits.” Shmoocon 2016 (2016).

[3] Hong, Byeongdo, Sangwook Bae, and Yongdae Kim. “GUTI Reallocation Demystified: Cellular Location Tracking with Changing Temporary Identifier.” In Symposium on Network and Distributed System Security (NDSS). ISOC. 2018.

[4] Kune, Denis Foo, John Koelndorfer, Nicholas Hopper, and Yongdae Kim. “Location leaks on the GSM air interface.” ISOC NDSS (Feb 2012) (2012).

[5] Jover, Roger Piqueras. “Some key challenges in securing 5G wireless networks.” Electronic Comment Filing System, Jan(2017). [PDF]


UPDATE (06/28/2018) – The authors have released a web site describing their findings and, more importantly, including a pre-print of the paper. As I had guessed, this is indeed based on my RNTI tracking techniques. The authors leverage those techniques to fingerprint web traffic and, despite being encrypted, they can estimate who browses what websites. They test this with a bunch of top 50 Alexa sites. The other new attack, aLTEr, is very interesting. By exploiting the fact that certain layer 2 messages are encrypted but not integrity checked, they flip bits in the cipher text in a very smart way to modify the destination IP fr DNS queries, effectively redirecting any mobile device to, for example, a malicious domain when they believe they are browsing a legitimate service.

The paper seems to indicate that I did not test and implement RNTI tracking a couple of years ago, but I actually did. And also showed a demo at HackerHalted in Atlanta back in 2016. Regardless, this new paper is excellent, and worth a read. Check out the references, as they link to some of the working documents from GSMA and 3GPP  after receiving the authors’ disclosure about this protocol exploits. Interesting, though, that #GPP and GSMA seems to only be concerned about the aLTEr exploit and not really worried about the other one (see S3-181429 document from the 3GPP TSG SA WG3 Security Meeting #91).