WiCA traffic analyzer, which analyzes the identification of the application and information about the device.

Then there's the

UCIA it identifies each phone user's call statistics based on the surveillance camera, using facial recognition and human motion detection techniques. CS-IP2U uses call statistics from WiCA and UCIA to map each phone user to an IP address.
It generates a mapping table with the IP address and user ID as well as each user's call statistics. 

For more on this and on Wifi calls in general, you can look at the article archive below✨.

Now let's talk about VoLTE attacks

Attack on tracking location information of VoLTE phones

To track the location information of VoLTE phones, the attacker first scans the S-CSCF to find the S-CSCF where the VoLTE phone is registered. The attacker then obtains the VoLTE phone's IP address from the S-CSCF.
Finally, the attacker gets the location information of the target VoLTE phone. 

When the VoLTE feature on the VoLTE phone is enabled, the IMS registration process is initiated. At this time, the I-CSCF searches the HSS to identify the S-CSCF and assign it to the VoLTE phone.
The VoLTE phone, the attacker can confirm the S-CSCF IP address assigned to its phone in the "SIP 200 OK" packet during the VoLTE registration process and use it to determine the S-CSCF IP address range. S-CSCF IP address in the "SIP 200 OK" package during the VoLTE registration process
The SIP REFER message can be used to scan the S-CSCF IP address range and analyze reply packets to confirm the S-CSCF IP address where the target VoLTE phone is registered. The attacker sends SIP REFER packets to the P-CSCF, resulting in the From (caller's MSISDN) and P-Preferred-Identity fields being changed to the VoLTE phone's MSISDN(800), the To (caller's MSISDN) and ReferTo fields to the attacker's MSISDN(203), and the Route field to the S-CSCF IP address then P-CSCF receives packets, sent by the attacker and forwards them to the IP address specified in the Route field It then sends the SIP REFER packets to the P-CSCF, resulting in the From (caller MSISDN) and P-Preferred-Identity fields being changed to the target VoLTE phone MSISDN(800) and the To (caller MSISDN) field and the Route field being changed to the S-CSCF IP address .
The P-CSCF then receives the packets sent by the attacker and forwards them to the IP address in the Route field , the attacker receives three types of response packets: error 500 , error 403 , REFER
REFER indicates precisely that the server sending the reply packet is an S-CSCF, where the VoLTE target phone is registered
In this case, since the destination IP address of the scan traffic sent by the attacker is IP P-CSCF, the source IP of the reply packet is also IP P-CSCF.

In other words, the attacker cannot validate the S-CSCF IP on which the target VoLTE is registered with the reply packet source IP. The attacker can validate the S-CSCF IP address on which the target VoLTE phone , by the tag value in the field in the REFER packet . 

The SIP SUBSCRIBE message calls the CSCF for VoLTE phone status information.

In response, the CSCF sends a SIP NOTIFY message containing the current registration data, such as the IP address for the SUBSCRIBE, which is what the attacker needs ! 

After receiving the packets sent by the attacker, the P-CSCF forwards them to the S-CSCF IP address in the Route field, while the S-CSCF sends 200 OK and NOTIFY(which is what it needs) to the attacker in response.
#wifi #lte #mobile #network #traffic_analysis #dos #attacks