Good afternoon my bunnies 🐰

Welcome to the wonderland so to speak. The admin wanted to touch mobile communications again
This time VoLTE and VoWiFi, or rather in this post I want to touch on VoLTE and Wi-Fi Calling , and attacks on them.
In their structure these two services are similar. But let us in order, the post will be divided into 5 parts because it is long. As well as an archive of detailed material on this topic will be below.

Let's start with VoLTE..📞

Roughly speaking VoLTE is a voice-over-IP scheme for PS.
But only PS based entirely on LTE . It does away with CS- the traditional solution for calls on 2G/3G networks. Voice messages are transmitted in ip packets on the data plane, not on a dedicated circuit. To facilitate voice communications, each VoLTE each call supports a separate signaling session.
VoLTE offers obvious advantages over traditional 2G/3G including improved quality (e.g., high definition calls), more features (e.g., video calls, voicemail) , and better compatibility (e.g., in mobile networks, wifi).
As VoLTE changes its design paradigm from CS to PS, we are interested in the question of whether such a significant change could be detrimental to the LTE network as well as to the users.

VoLTE uses the architectural structure of IMS

IMS provides ubiquitous media access using a common ip interface. Another important aspect is VoLTE support for UEs that are roaming.
There are two competing technologies for providing VoLTE roaming, namely LBO and S8HR.



The VoLTE architecture is based on 3GPP architecture and principles for VoLTE UE, LTE, EPC and IMS Core Network

It consists of the following features:
VoLTE UE contains functionality to access LTE RAN and EPC to enable mobile broadband connectivity. Access to VoLTE services requires an embedded IMS stack and a VoLTE IMS application;
E-UTRAN radio access network : LTE radio capabilities for FDD LTE, TDD LTE or for FDD and TDD LTE apply to VoLTE as well;
Enhanced packet core : EPC ;
The underlying IMS network in the VoLTE architecture provides the service layer of providing multimedia telephony;
I think the basic structure is clear to you. For more details about the architecture see the articles in the archive below (as well as more details about attacks🙃 )

VoLTE can interfere with other system components, thus creating new loopholes for attackers on the general network . 
PS-based operations for voice and data can enable data transmission over VoLTE . 

Moreover, because ip forwarding is readily available to the mobile OS, VoLTE extends access to CS within the device chipset to more open access to PS in the software.
This likely negates existing security mechanisms and security features for traditional voice transmission.
Finally, unlike conventional data services, VoLTE has a higher priority in resource allocation to ensure better quality. As you understand this can inadvertently serve as a side channel for leaking critical information.
In the absence of VoLTE control packet billing, exploitation leads to malicious data access.

Such "service" is available for both Mobile-to-Internet and Mobile-to-Mobile communications.
VoLTE sessions are not encrypted end-to-end by default, hence it is easy to eavesdrop on the connection, especially from the MNO side.
#wifi #lte #mobile #network #traffic_analysis #dos #attacks