Preface - then there will be tech details
The VoWiFi attack story will be about a WiFi-based IMSI hijacker that uses an unauthorized WiFi access point to get the personal data of nearby users. THDoS attacks, which can cause voice service denial for Wi-Fi calling users. Also about Dos attacks and many other vulnerabilities .
About VoLTE attacks we will break down the attacks which mainly involve free data channel, DoS and side channel attacks on IMS etc . The first is to create a free data channel by sending every packet that is forwarded from the 4G gateway directly to the Internet . Here are some examples of attacks.
Let's start with Wi-Fi Calling.
Let's start by talking about THDOS .
In order to drop certain packets between a device and the network infrastructure, the adversary needs to identify the IPSec encrypted packets. Example: A device user receives an incoming Wi-Fi call, and answers it about 6 seconds after the call, the user has been engaged in a voice conversation for about 12 seconds. What happened during this time? Well what does the user see: 1 receiving the call; 2 answering the call; 3 talking; 4 hanging up. What we see:
1: The first incoming packet, which is intercepted at second 2, is a 1360-byte IPSec packet. We decrypt it on the subscriber side and identify it as a SIP INVITE message, indicating a call attempt. On the 2nd second, the subscriber sends a 180 RING message to the Wi-Fi call server. We then observe that several small IPSec packets as small as 176 bytes are received, but the recipient does not send any packets back.1 : We detect that these are voice packets in the RTP protocol
2 : The caller answers the call at 8 seconds by sending a 200 OK message to the server, and then receives an acknowledgement at 9 seconds. After that the conversation starts and the subscriber starts to send/receive voice packets.
3: During the call, the subscriber continues to send/receive voice packets to/from the calling Wi-Fi server, but no SIP messages are observed. We further find that the caller receives at least 10 voice packets every two seconds from the server.
4: The caller sends a BYE message at the 20th second after the call was placed on the handset. Incoming packets of the "answering the call" event on the Wi-Fi . No more IPSec packets are observed after the 20th second . Note that if the caller hangs up first, the server must send a BYE message.
Now the attack example itself:
The caller receives several incoming calls from the caller.
There are two approaches. First
, the adversary delivers a 183 message about the progress of the session sent by the caller, and then the caller's Wi-Fi device initiates another VoLTE call towards the caller. Second, the attacker delivers a message 180 message , sent by the caller, and then it causes the caller's Wi-Fi device to get stuck on the dial screen. The caller doesn't hear any notification tone, but the caller's device rings and the caller can continue dialing.
Sounds boring - I agree . For that reason, I'll give you an example Disclosure Attack
WiCA was designed , to determine the call statistics of a Wi-Fi user, including who initiated the call and who hung up first, as well as the time of the call and the conversation.Call statistics are widely used to determine a user's personal information including personality, mood (e.g., stressed out), malicious behavior (e.g., dialing spam calls), and so forth.
WiCA intercepts from Wi-Fi call packets WiCA extracts call statistics (such as call time and call duration) for each IP address of the device. The remaining packets are sent to a real-time traffic analyzer.
#wifi #lte #mobile #network #traffic_analysis #dos #attacks