In this attack, the adversary must be in the range of the victim and know in advance the IMSI of the victim, which can be obtained through the IMSI catcher.The adversary sends the connection request packets with the
IMSI of the victim to the MME via SDR (which is by the way quite cheap, about 300 USD).To make the victim's UE initiate the switch between VoWiFi and VoLTE, the adversary can use a deauthentication attack to break the WiFi connection.Our SDR device continues to send a request to join the MME.
When we run the handover procedure on the affected UE, we find that the connection between the UE and the main network is terminated.
The UE does not receive the IKE Delete payload, which is the final message from the core network when the transfer is complete.
When running a handover, the specification expects the
handover to be seamless to the user
Using this attack, the adversary can stop the seamless transition from VoWiFi to VoLTE, significantly reducing cellular resilience.
After attacking for about two seconds, the victim reaches a state where the UE disconnects from the main network through both VoWiFi and VoLTE.The victim can then connect to VoLTE. However, the attack can be run in a loop to keep the UE in a destructive handover state where it cannot connect to the main network.I think that would be enough
If you want more details you can check the archive below and read lots of cool articles about Wifi Calling and VoLTE, how to practice attacks on them and how to improve their security🔥 .
In the future I can make articles about forensics and mobile networks, simple about phones, thinking of a malicious user and so on. Just now the admin has a lot to do and he does not have time "all at once" 🥲
That's all, thanks for reading. ❤️
Don't forget walking through Wonderland that the Cheshire cat is smiling even when you can't see him🐈🧩
#wifi #lte #mobile #network #traffic_analysis #dos #attacks