Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and … · 2017-04-14 · 4G LTE: All-IP based Network Voice call: Implementation of VoIP on LTE 3G network –Data and

Breaking and Fixing VoLTE:Exploiting Hidden Data Channels and

Mis-implementations

Hongil Kim*, Dongkwan Kim*, Minhee Kwon, Hyeongseok Han, Yeongjin Jang, Taesoo Kim, Dongsu Han, Yongdae Kim

1

VoLTE = Voice over LTE

4G LTE: All-IP based Network

Voice call: Implementation of VoIP on LTE

3G network

– Data and voice is separated

4G LTE network

– Both data and voice are delivered as data-flow

2

3

TelephonyPhone

Data(Packet Switching)

Internet

3G

Voice(Circuit Switching)Cell

towerCore network

3

TelephonyPhone


Internet

3G


towerCore network

3

TelephonyPhone


Internet

3G


tower

Cell tower

Phone

4G LTE


Internet

Core network

Core network

3

TelephonyPhone


Internet

3G


tower

IMSCell

tower

Phone

4G LTE


Internet

IP Multimedia Subsystem (IMS)

Core network

Core network

3

TelephonyPhone


Internet

3G


tower

IMSCell

tower

Phone

4G LTE


Internet

IP Multimedia Subsystem (IMS)

Core network

Core network

Voice delivery in LTE Voice is delivered through two data channels, called “bearer”

– Bearer: a virtual channel with below properties

– Bandwidth, loss rate, latency (QoS)

For VoLTE service,

1. Control plane (default bearer): call signaling, *SIP

2. Data plane (dedicated bearer): voice data, *RTP

4

4G Gateway

IMS

Internet

*SIP: Session Initiation Protocol, *RTP: Real-time Transport Protocol




For VoLTE service,



4

4G Gateway

Default bearer, IP addr : 1.1.1.1

IMS

Internet





For VoLTE service,



4

4G Gateway


IMS

Internet





For VoLTE service,



4

4G Gateway


IMS

Internet

Dedicated bearer, port: 1234


VoLTE makes cellular network more complex

6

IMS

Cell

tower

Phone

4G LTE

3GPP standards

Mobile OS support?

LTE Core

Device HW interface

Implementation of LTE core

Accounting infrastructure

4G Gateway

Let’s check potential attack vectors newly introduced in VoLTE


6

IMS

Cell

tower

Phone

4G LTE

3GPP standards

Mobile OS support?

LTE Core

Device HW interface



4G Gateway

Let’s check potential attack vectors newly introduced in VoLTE


6

IMS

Cell

tower

Phone

4G LTE

3GPP standards

Mobile OS support?

LTE Core

Device HW interface



4G GatewayPermission

Mismatch

Free Data Channels

No Session Manage

No Auth

No EncryptionIMS

Bypassing

#1: VoLTE Accounting Accounting in 3G

7

Telephony

Phone

Data (Packet Switching) Internet

Voice (Circuit Switching)Cell

tower


7

Telephony

Phone



tower

Byte usage


7

Telephony

Phone



tower

Byte usage

Time usage


7

Telephony

Phone



tower

IMSPhone

Data (Packet Switching)Internet

Cell tower

Byte usage

Time usage

Accounting in 4G (using VoLTE)


7

Telephony

Phone



tower

IMSPhone


Cell tower

Byte usage

Time usage


Byte usage for all services?


7

Telephony

Phone



tower

IMSPhone


Cell tower

Byte usage

Time usage



Still time usage


7

Telephony

Phone



tower

IMSPhone


Cell tower

Byte usage

Time usage



Still time usage

Unlimited VoLTE call


7

Telephony

Phone



tower

IMSPhone


Cell tower

Byte usage

Time usage



Still time usage


Do operators implement this complicated accounting correctly?

Anatomy of smartphone Smartphone has two processors

8

AP

CP

Application processor (AP)- Running mobile OS (Android)

- Running User application

Anatomy of smartphone Smartphone has two processors

8

AP

CP

Application processor (AP)- Running mobile OS (Android)

- Running User application

Communication processor (CP)- Telephony Processor (modem)- Digital Signal Processing (DSP)

#2 Voice solution in device, 3G case3G Phone

9

AP

CP Voice signaling

Call APIs

Telephony

Phone

Data Internet

3G network

VoiceCell Tower

AP

CP


9

• An app cannot easily manipulate the voice signaling in CP

AP

CP Voice signaling

Call APIs

Telephony

Phone

Data Internet

3G network

VoiceCell Tower

AP

CP


9

• An app cannot easily manipulate the voice signaling in CP

AP

CP Voice signaling

Call APIs

Telephony

Phone

Data Internet

3G network

VoiceCell Tower

AP

CP

• An app needs “CALL_PHONE” permission for calling

#2: Voice solution in device, LTE4G LTE Phone

10

AP

CP

Voice signaling

IMS

Phone

DataInternet

4G LTE network

Cell Tower

AP

CP


10

• An app can easily manipulate voice signaling in AP

AP

CP

Voice signaling

IMS

Phone

DataInternet

4G LTE network

Cell Tower

AP

CP

Application processor- Running mobile OS (Android)- Running User application


10


AP

CP

Voice signaling

IMS

Phone

DataInternet

4G LTE network

Cell Tower

AP

CP


• An app can make a call only with “INTERNET” permission.


10


AP

CP

Voice signaling

IMS

Phone

DataInternet

4G LTE network

Cell Tower

AP

CP


• An app can make a call only with “INTERNET” permission.

Two problems in VoLTE

1. A complex accounting infrastructure

2. Delegating voice signaling (previously done by CP) to AP

11

Our approach to attack two problems

12

Our approach to attack two problems Analyze 3GPP standards related with VoLTE service

– Leave detail implementation to operators, chipset vendors, …

12



Make a checklist of potential vulnerable points in the VoLTE feature

– About 60 items for both control and data plane

12



Make a checklist of potential vulnerable points in the VoLTE feature

– About 60 items for both control and data plane

Perform an analysis in 5 major operational networks

– 2 U.S. operators and 3 South Korea operators

12

Quick Summary of Our Finding

13

Quick Summary of Our Finding Four free data channels

– Using VoLTE protocol (for all operators)

SIP tunneling

Media tunneling

– Direct communication (for some operators)

Phone-to-Internet

Phone-to-Phone

13



SIP tunneling

Media tunneling


Phone-to-Internet

Phone-to-Phone

Five security issues

– No encryption of voice packets

– No authentication of signaling

– No call session management (DoS on the cellular infrastructure)

– IMS bypassing

– Permission model mismatch (VoLTE call without “CALL_PHONE” permission)

13



SIP tunneling

Media tunneling


Phone-to-Internet

Phone-to-Phone

Five security issues

– No encryption of voice packets

– No authentication of signaling

– No call session management (DoS on the cellular infrastructure)

– IMS bypassing

– Permission model mismatch (VoLTE call without “CALL_PHONE” permission)

13

VoLTE Call Procedure

14

Caller SIP server Callee



14

INVITE


Header : phone # of caller/callee, …Body : IP addr, port no., …



14

INVITE

200 OK


Header : phone # of caller/callee, …Body : IP addr, port no., ……



14

INVITE

200 OK


Voice Session (RTP payload = voice data)



Free Channel: SIP Tunneling

15

INVITE


…

Header : phone # of caller/callee, injected dataBody : IP addr, port no., injected data

603 Decline

Voice Session (RTP payload = voice data)


Free Channel: Media Tunneling

16

INVITE

200 OK


Voice Session (RTP payload = Injected data)



Attack Implementation in Detail

17

AP

CP

AP

CP VoLTE Interface

IMS

Caller CalleeCore Network

VoLTE Interface


17

AP

CP

AP

CP

SIP Sender

MediaSender

VoLTE Interface

IMS


VoLTE Interface


17

AP

CP

AP

CP

SIP Sender

MediaSender

VoLTE Interface

SIP Receiver

MediaReceiver

IMS


VoLTE Interface


17

AP

CP

AP

CP

SIP Sender

MediaSender

VoLTE Interface

SIP Receiver

MediaReceiver

IMSSIP, RTP


VoLTE Interface


17

AP

CP

AP

CP

SIP Sender

MediaSender

VoLTE Interface

SIP Receiver

MediaReceiver

IMSSIP, RTP SIP


VoLTE Interface


17

AP

CP

AP

CP

SIP Sender

MediaSender

VoLTE Interface

SIP Receiver

MediaReceiver

IMSSIP, RTP SIP


VoLTE Interface

Audio Data(60-100 bytes)


17

AP

CP

AP

CP

SIP Sender

MediaSender

VoLTE Interface

SIP Receiver

MediaReceiver

IMSSIP, RTP SIP


VoLTE Interface

Audio Data(60-100 bytes)

DIAGCommand


18

AP

CP

AP

CP

SIP Sender

MediaSender

VoLTE Interface DIAG

SIP Receiver

MediaReceiver

VoLTE

IMSSIP, RTP SIP RTP


DIAGCommand

Outline Four free data channels

– Using VoLTE protocol (for all operators) SIP tunneling Media tunneling

– Direct communication (for some operators) Phone-to-Internet Phone-to-Phone

Five security issues– No encryption of voice packets– No authentication of signaling– No call session management (DoS on the cellular infrastructure)– IMS bypassing– Permission model mismatch (VoLTE call without “CALL_PHONE” permission)

19

20

Free Channel: Direct communication Phone-to-Internet

– Open a TCP/UDP socket with voice IP

– Send data to the Internet

E.g. TCP/UDP Socket (Src: voice IP/port, Dst: youtube.com/port)

4G Gateway

IMS

InternetDefault bearer for VoLTE

20

Free Channel: Direct communication Phone-to-Internet


– Send data to the Internet

E.g. TCP/UDP Socket (Src: voice IP/port, Dst: youtube.com/port)

4G Gateway

IMS


Free Channel: Direct communication Phone-to-Phone


– Send data to callee

E.g. TCP/UDP Socket (Src: voice IP/port, Dst: callee’s voice IP/port)

4G Gateway

IMS


Free Channel: Direct communication Phone-to-Phone


– Send data to callee

E.g. TCP/UDP Socket (Src: voice IP/port, Dst: callee’s voice IP/port)

4G Gateway

IMS


Evaluation Result: Accounting Bypass

22

Free Channel US-1 US-2 KR-1 KR-2 KR-3

Using VoLTE

Protocol

SIP Tunneling ✓ ✓ ✓ ✓ ✓

Media Tunneling ✓ ✓ ✓ ✓ ✓

Direct

Communication

Phone to Phone ✓ ✘ ✓ ✘ ✘

Phone to Internet ✘ ✓ ✓ ✘IPv4:✓IPv6:✘

Last update: 20th April, 2015

✓: vulnerable/not charged, x: secure


22


Using VoLTE

Protocol



Direct

Communication






22


Using VoLTE

Protocol



Direct

Communication






23


Using VoLTE

Protocol



Direct

Communication






23


Using VoLTE

Protocol



Direct

Communication






24


Using VoLTE

Protocol



Direct

Communication




21.5 Mbps

16.8 Mbps



24


Using VoLTE

Protocol



Direct

Communication




21.5 Mbps

16.8 Mbps

42 Kbps



24


Using VoLTE

Protocol



Direct

Communication




21.5 Mbps

16.8 Mbps

42 Kbps

X



24


Using VoLTE

Protocol



Direct

Communication




21.5 Mbps

16.8 Mbps

42 Kbps

X


Outline Four free data channels

– Using VoLTE protocol (for all operators) SIP tunneling Media tunneling

– Direct communication (for some operators) Phone-to-Internet Phone-to-Phone

Five security issues– No encryption of voice packets– No authentication of signaling– No call session management (DoS on the cellular infrastructure)– IMS bypassing– Permission model mismatch (VoLTE call without “CALL_PHONE” permission)

25

No Encryption for Voice Packets For voice signaling,

– only one operator was using IPsec

– An attacker can easily manipulate VoLTE call flow

For voice data,

– no one encrypted voice data

– An attacker might wiretap the outgoing voice data

26

Weak Point Vulnerability US-1 US-2 KR-1 KR-2 KR-3 Possible Attack

IMSNo SIP Encryption X ✓ ✓ ✓ Message manipulation

No Voice Data Encryption ✓ ✓ ✓ ✓ ✓ Wiretapping

: Vulnerable : Secure

No authentication

– Make a call with a fake number

No Authentication/Session Management

27


IMSNo Authentication X X O O X Caller Spoofing

No Session Management O O O X O Denial of Service on Core Network


No authentication


No session management


27





No authentication


No session management* In a normal call, one user can call to only one person


27





No authentication



– Send multiple INVITE messages

Several call sessions are established

For each call session, high-cost bearer is established


27





No authentication



– Send multiple INVITE messages

Several call sessions are established

For each call session, high-cost bearer is established

– Even one sender can deplete resources of the core network


27





IMS

Caller Spoofing Scenario

28

Caller Callee


INVITE

IMS


28

Caller Callee


INVITE

IMS


28

Caller Callee

Attacker


INVITE


INVITE

IMS


28

Caller Callee

Attacker

29

IMS Bypassing All voice packets should pass IMS, but

30


4G-GW IMS Bypassing O X O X X Caller Spoofing

4G Gateway

IMS



30



4G Gateway

IMS



30



4G Gateway

IMS



An attacker can bypass SIP servers in IMS

– IMS vulnerabilities are also possible

e.g. Make a call with a fake number

30



4G Gateway

IMS


Android Permission Model Mismatch No distinction between a phone call and a normal data socket

– In 3G, an app needs “android.permission.CALL_PHONE”

– In VoLTE, we found that an app can call with “android.permission.INTERNET”

31


Phone Permission Mismatch Vulnerable for all Android Denial of Service on Call, Overbilling

Android Permission Model Mismatch No distinction between a phone call and a normal data socket

– In 3G, an app needs “android.permission.CALL_PHONE”

– In VoLTE, we found that an app can call with “android.permission.INTERNET”

A malicious app only with Internet permission can perform

– Denial of service attack on call

– Overbilling attack by making an expensive video call

31


Phone Permission Mismatch Vulnerable for all Android Denial of Service on Call, Overbilling

Denial of Service on Call Scenario Blocking an incoming call Cutting off an ongoing call

32

Victim

Attacker

Caller

Victim

Attacker

Caller

IMSIMS


32

Victim

Attacker

Caller

Victim

Attacker

Caller

IMSIMS


32

Victim

Attacker

Caller

Victim

Attacker

Caller

IMSIMS

Block


32

Victim

Attacker

Caller

Victim

Attacker

Caller

IMSIMS

Block


32

Victim

Attacker

Caller

Victim

Attacker

Caller

Cut-off

IMSIMS

Block

33

34

Mitigation

35

Point Vulnerability Mitigation Responsible Entity

IMS

No Security Mechanisms Encrypt call signaling and voice data

OperatorsIMS provider

No Authentication Place proper authentication on voice packets

No Session Management Allow single call session per device

4G-GW Direct Communication Disallow direct communication Operators

Phone

Permission Mismatch Create new permission for VoLTE interface Mobile OS (Android)

SIP/Media tunnelingPlace proper regulation on packet routingApply deep packet inspection

Mobile OS (Android)Operators

Mitigation

35


IMS






Phone




How to resolve media tunneling?

Mitigation

35


IMS






Phone




How to resolve media tunneling? Not easy! Maybe byte-usage accounting?

Discussion Some parts of 3GPP specifications are unclear

– Several misunderstandings of the operators

– Different implementations and security problems

– Security features are only recommendations, not requirement

We reported vulnerabilities to US/KR CERTs, and Google in May

– Google replied “moderate severity”

– All two U.S. operators ACK’ed, but no follow-ups

– Only two among three KR operators have been fixing with us

36

Conclusion Newly adopted VoLTE has

– A complex (legacy time-based) accounting

– Delegated voice signal (previously done by CP) to AP

37




We analyzed the security of VoLTE for 5 operators, and found

– Four free data channels

– Five security problems

37




We analyzed the security of VoLTE for 5 operators, and found

– Four free data channels


All related parties have problems

– 3GPP, telcos, IMS providers, mobile OSes, and device vendors

37


– A complex (legacy time-based) accounting– Delegated voice signal (previously done by CP) to AP

We analyzed the security of VoLTE for 5 operators, and found– Four free data channels


All related parties have problems– 3GPP, telcos, IMS providers, mobile OSes, and device vendors

More and more reliance on cellular technology– Automobiles, power grid, traffic signal, ...

37


– A complex (legacy time-based) accounting– Delegated voice signal (previously done by CP) to AP

We analyzed the security of VoLTE for 5 operators, and found– Four free data channels


All related parties have problems– 3GPP, telcos, IMS providers, mobile OSes, and device vendors

More and more reliance on cellular technology– Automobiles, power grid, traffic signal, ...

Holistic re-evaluation of security for VoLTE?

37

38

Thank You!Any questions?

[email protected]@kaist.ac.kr

APPENDIX

39

Strange VoLTE Accounting Accounting in 3G

40

Telephony

Phone



tower

IMSPhone


Cell tower

Byte usage

Time usage



Still time usage


Complex Implementation of VoLTE

41

IMS

Cell

tower

Phone

4G LTE

3GPP standards

Mobile OS support?

LTE Core

Device HW interface



4G Gateway

Complex Implementation of VoLTE

41

IMS

Cell

tower

Phone

4G LTE

3GPP standards

Mobile OS support?

LTE Core

Device HW interface



4G GatewayPermission

Mismatch

Free Data Channels

No Session Manage

No Auth

No EncryptionIMS

Bypassing

SIP Signaling Procedure

42

INVITE INVITE

180 Ringing180 Ringing

Voice Session (RTP)

BYE

200 OK

200 OK200 OK


Header : Caller & Callee’s phone #, route,…Body : Voice session info (callee -> caller) (Callee’s phone #, src voice IP, port)

BYE

200 OK

Header : Caller & Callee’s phone #, route,…Body : Voice session info

Header : Caller & Callee’s phone #, route,…Body : Voice session info (callee -> caller)

Results of Media Tunneling Media channel characteristics from the control plane messages

Actual measurement results (trade-offs between throughput and loss rate)

US-1 US-2 KR-1 KR-2 KR-3

QoS Param. (Kbps) 38 49 41 41 49

Bandwidth (Kbps) 38/49 49 65 65 65

Latency (sec) 0.1 0.1 0.1 0.1 0.1

Loss rate (%) 1 1 1 1 1

US-1 US-2 KR-1 KR-2 KR-3

Throughput (Kbps) 37.90 36.93 45.76 39 50.48

Latency (sec) 0.52 0.02 0.10 0.32 0.30

Loss rate (%) 1.44 1.74 0.77 0.65 0.73

43

Proposed Attack Comparison This paper

– Free data channels

SIP/Media tunneling

Direct communication

– Attacks from security problems

Message manipulation

Wiretapping

Caller spoofing

DoS on core network

DoS on call

Overbilling

UCLA paper


Free external/internal channels


Overcharging attack

Data DoS attacks

Voice muted attack



SIP/Media tunneling




Wiretapping

Caller spoofing

DoS on core network

DoS on call

Overbilling

UCLA paper




Overcharging attack

Data DoS attacks

Voice muted attack



SIP/Media tunneling




Wiretapping

Caller spoofing

DoS on core network

DoS on call

Overbilling

UCLA paper




Overcharging attack

Data DoS attacks

Voice muted attackFocused on interface corss-over

between VoLTE and Data interface



SIP/Media tunneling




Wiretapping

Caller spoofing

DoS on core network

DoS on call

Overbilling

UCLA paper




Overcharging attack

Data DoS attacks

Voice muted attackFocused on interface corss-over

between VoLTE and Data interface

Focused more on VoLTE and analyzed both protocol and implementation(including mobile OS, 3GPP spec)

Documents

Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and … · 2017-04-14 · 4G LTE: All-IP based Network Voice call: Implementation of VoIP on LTE 3G network –Data and