Softpedia >News >Security
Softpedia Homepage   

LTE 4G Networks Put Android Users at Risk of Overbilling and Phone Number Spoofing

There's no fix for the reported issues at this moment

Oct 19, 2015 14:56 GMT  ·  By
Android devices on LTE networks are at risk
   Android devices on LTE networks are at risk

Carnegie Mellon University's CERT security vulnerabilities database has issued an alert regarding the current status of LTE (Long-Term Evolution) mobile networks, which are plagued by four vulnerabilities that allow attackers to spoof phone numbers, overbill clients, create DoS (Denial of Service) states on the phone and network, and even obtain free data transfers without being charged.

The vulnerabilities stem from classic VoIP-related attacks, LTE mobile networks using an internal structure that employs packet switching and the IP protocol (just like VoIP), instead of traditional circuit-switched mobile networks.

As CERT's team explains, the four vulnerabilities (CWE-732, CWE-284, CWE-287, and CWE-384) allow attackers to take advantage of some things like incorrectly set call permissions, the ability to establish direct sessions between phones, improper authentication for SIP messages, and a bug that enables attackers to establish multiple sessions with the same phone number.

These vulnerabilities, when exploited, lead to situations where the attackers can spoof any phone number they desire, initiate phone calls on the victim's phone (creating a DoS state or overbilling them), or create direct peer-to-peer connections between two users without being monitored by the carrier, which, in turn, allows for free data communications, numbers spoofing, or DoS states.

Only Android devices are affected, iOS users are safe

All vulnerabilities can be exploited remotely, and right now, there is no known fix for these problems.

Additionally, the vulnerabilities seem to affect only the Android operating system, Apple reporting no issues in iOS. The status of these vulnerabilities on America's largest mobile networks (AT&T, T-Mobile, and Verizon) is not known.

The CERT vulnerabilities presented above are based on the research of eight scientists from KAIST (Korea Advanced Institute of Science and Technology) and the Georgia Institute of Technology, USA. Their research is called Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-implementations.