PRACTICAL ATTACKS ON VOLTE AND VOWIFI

[Nytro]

TABLE OF CONTENTS
1 ABSTRACT_______________________________________________________________ 5
2 INTRODUCTION___________________________________________________________ 6
3 RELATED WORK __________________________________________________________ 8
4 BACKGROUND ___________________________________________________________ 9
4.1 Security Protocols 9
4.2 ISIM Authenticate 10
4.3 IP Multimedia Subsystem 10
5 PRACTICAL ATTACKS ____________________________________________________ 12
5.1 A1: Sniffing VoLTE/VoWiFi Interfaces 12
5.2 A2: ISIM sniffing for extracting CK/IK 13
5.3 A3: User location manipulation 16
5.4 A4: Roaming information manipulation 16
5.5 A5: Side channel attack 16
6 RESULTS _______________________________________________________________ 18
6.1 R1: Information Disclosures 18
6.2 R2.1: Keys in GSM SIM 20
6.3 R2.2: Authentication using IK 20
6.4 R3: User Location Manipulation 21
6.5 R4: Roaming Information Manipulation 22
6.6 R5: Side channel 22
7 MITIGATION _____________________________________________________________ 23
8 CONCLUSION ____________________________________________________________ 24
9 REFERENCES ____________________________________________________________ 25

Download: https://www.ernw.de/download/newsletter/ERNW_Whitepaper_60_Practical_Attacks_On_VoLTE_And_VoWiFi_v1.0.pdf