Location-based attacks are also not uncommon. 

An attacker can use either MAP and ATI or PSI message requests to track lactation.




Now let's talk about 4g or LTE🔑

There are still some vulnerabilities and issues in LTE security, particularly at the MAC level.

The flat IP architecture of 3GPP LTE networks leads to increased security risks such as vulnerability to infiltration, modification, eavesdropping attacks(like the attacks described above) .
The LTE architecture has been found to be more vulnerable to traditional malicious attacks such as IP spoofing, DoS attacks, viruses, worms, spam emails and calls, and so on. 🩸

There are several other potential weaknesses caused by the base stations that exist in LTE systems.
The all-IP network gives attackers a direct path to the base stations. 

Since the MME manages numerous eNBs in the flat LTE architecture. Once an adversary compromises a base station, it can expose the entire network because of the IP nature of LTE networks.
Moreover, because of the introduction of small and inexpensive base stations, HeNBs, which are easy for an attacker to obtain, he can thus create his own rogue version.

Using a rogue base station, the attacker can impersonate a real base station in order to poach a legitimate user. He can also disguise a legitimate user to establish a connection with a genuine base station.
The LTE architecture may create some new problems in the authentication procedures for switching.
Because of the introduction of a simple base station, HeNB, there are several different mobility scenarios in LTE networks when a UE moves from an eNB/HeNB to a new HeNB/eNB.

There is no privacy protection in EPS AKA . 

There are many instances that lead to IMSI disclosure.

For example, when a UE registers on the network for the first time, or the current MME cannot be contacted, or the IMSI cannot be obtained due to a possible synchronization failure while roaming to the new MME, the current MME or new
MME requests the IMSI of the UE, and thus the UE must transmit the IMSI in plaintext. 

Disclosure of the IMSI can lead to serious security problems, going as far as texting interception.
Once the IMSI is obtained, an attacker can get the subscriber, location, and even conversation information, and then disguise the real UE and launch other attacks, such as DoS attacks, to destroy the network.

Example of different attacks:

C-RNTI-based tracking.

Since the C-RNTI in the L1 control signal can be read, an attacker can find out if the UE continues to use C-RNTI.
He can find out whether the UE using the C-RNTI is still in the same cell or not, and can also associate the C-RNTI and the corresponding messages if they are not encrypted.

Using the same CRNTI within the same cell, provides information about the presence of the UE to an attacker.
If he can map the signaling to services where the user ID is visible, he can map the identity at the cellular level to the identity at the user's service level. During the handover process, a new CRNTI is assigned to the UE using the handover command.
This means that an attacker can associate the new C-RNTI in the Handover Command message and the old C-RNTI in the L1 control signal, unless the C-RNTI assignment itself is privacy-protected. This allows UEs to be tracked across multiple cells.

Message identification based on small differences in message lengths is not an obvious attack, and it is difficult and maybe even impossible💧 . Nevertheless, I decided to mention it🙃🧩
#lte #network #ss7 #mobile #attacks #dos