LTESniffer: An open-source LTE downlink/uplink eavesdropper [pdf]

https://syssec.kaist.ac.kr/pub/2023/wisec2023_tuan.pdf

by stacktrust • 3 years ago

256 55 3 years ago

syssec.kaist.ac.kr

newsclues• 3 years ago

https://github.com/SysSec-KAIST/LTESniffer

lll-o-lll• 3 years ago

Sounds cool, but how many people have the 9k USD to sink on the radio required? Security through price barriers.

Except it’s not security of course; the difficulty in obtaining hardware is a large reason as to why industrial control systems had such abysmal security for as long as they did.

jrexilius• 3 years ago

for passive sniffing, it looks like you can run the cheaper module at only $2k, which is approachable for researchers.. actually fully loaded price tag is $11k or $4k as you need GPSDO also.. but $4k is almost approachable I guess..

[edit to add] https://www.ettus.com/all-products/ub210-kit/

tonyarkles2• 3 years ago

Amazingly, you can probably get a reasonable GPSDO from eBay for a couple hundred dollars. I was running an Ettus B210 off of an eBay GPSDO and had about a 1Hz frequency offset relative to an LTE tower at 1800MHz. Pretty cool!

nickphx• 3 years ago

It can be done for under $600 using a bladeRF.. https://docs.srsran.com/projects/4g/en/latest/app_notes/sour...

tibbon• 3 years ago

Similarly a LimeSDR perhaps?

nikau• 3 years ago

why industrial control systems had such abysmal security for as long as they did.

Bold of you to use past tense there

brookst• 3 years ago

They've really improved a lot. They used to be abysmal, but all of the scrutiny and high profile attacks have forced vendors to invest in bringing them up to merely terrible.

nimbius• 3 years ago

how many people have the 9k USD to sink on the radio required?

its a soft target. US telecom has habitually revealed their almost contemptuous disinterest in security and rely almost entirely on price barriers or law.

It would be trivial to pivot your narcotics racket to digital for only 9k or your online ransomware to LTE snooping.

userbinator• 3 years ago

Perhaps also "security through complexity" --- the specs for LTE and the previous mobile network protocols are freely available, but huge and very difficult to understand for someone not already familiar with the system (in comparison to e.g. Internet RFCs).

xfitm3• 3 years ago

A lot of people on this site earn a shit ton of money.

MuffinFlavored• 3 years ago

How illegal is this from an FCC or cell phone carrier perspective?

I would have guessed LTE traffic was "HTTPS" levels of encrypted?

xen2xen1• 3 years ago

No, IIRC it isn't anywhere near real encryption.

nicce2• 3 years ago

Hmm…

LTE stands for 4G and they use 128-EEA2 (AES-CTR) or 128-EIA2 (AES-CMAC) which are kinda same as TLS 1.2 and TLS 1.3. Where the latter suppors chacha additionally.

GCM on TLS gives greater performance and the integrity can be confirmed earlier, but there are no serious security problems on algorithm side.

jcrawfordor2• 3 years ago

Modern LTE features a fairly high level of traffic security, although downgrade attacks remain a major problem. The article addresses this point: "The target of LTESNIFFER is to capture the wireless packets between the base station and the user. It can only obtain encrypted packets in most cases because it can’t know the cryptographic keys of users. However, some packets are transferred in plaintext by design." One of the reasons you here about cell-site simulators ("stingrays") a lot less these days is that improving security standards in the cellular network has made them less useful, although they are still widely employed and particularly rely on forcing downgrades to 3G.

Elsewhere, the article notes that one of the difficult things about sniffing LTE is that even the parameters used for the radio connection are encrypted, so some of them have to be inferred and guessed. That encryption isn't really intended as a security feature, we're talking about the modulation mode, but comes out of the fact that LTE revisions have erred on the side of caution with encrypting as much of the management traffic as practical. Much of this is a result of lessons learned with previous cellular protocols and protocols like WiFi, where unencrypted/unauthenticated management traffic has often become an attack vector.

yosito3• 3 years ago

I sometimes notice that my connection has been downgraded to 3G despite being in an area that regularly has full 4G coverage. Should I be suspicious of an attack? Is there any way to protect oneself from this type of attack?

stephen_g• 3 years ago

I really wish the iPhone let you disable certain bands - I get there's an argument about "you need to be able to use them just in case you need it for an emergency call", but in Australia where I live, the 2G networks have all been shut down and the spectrum re-allocated, and my carrier will shut down 3G around the end of the year an the largest carrier shut 3G down mid 2024.

So I can safely disable 2G knowing that I will not need it, since the networks don't exist and while I'm in the country the only possible use would be a downgrade attack. Similarly, I'm happy to turn off 3G given I'm very rarely out of LTE coverage and it's not long until it will be gone anyway.

If it's really a problem, they could have an "re-enable bands if needed while attempting an emergency call" option (or have it do it automatically with no option).

jabbany• 3 years ago

IANAL but, IIRC any sniffing seems to be fine in general? You'd only get in trouble if you transmitted anything. I don't even think you need a license to just listen to stuff.

Also I think the paper mentions that many types of packets are in fact encrypted, and only certain control packets are sent in the clear. This seems to be not any more concerning than other Internet related protocols which also send a lot of coordination information in cleartext.

kube-system4• 3 years ago

If someone doesn’t like what you’re doing, wiretap charges are legally plausible.

mig_• 3 years ago

Is any device identifying information exposed unencrypted ? Thinking if you can use this to tell who is in the proximity.

a6• 3 years ago

You can use 2G sniffers for that which require much less expensive hardware.

LTESniffer: An open-source LTE downlink/uplink eavesdropper [pdf]

Related Stories