Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems · HackerPapers discussions

Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems — mentioned by dilyevsky

Mon, 15 May 2023 20:22:59 GMT

It’s a key set per session. See https://arxiv.org/pdf/1510.07563.pdf to answer your other question

Paper and discussion history. A mention is not an endorsement.

Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems — mentioned by Nokinside

Fri, 16 Nov 2018 23:31:38 GMT

* GSM (2g) does not have authentication at all. * 3G has no integrity protection. Downgrade attacks from 3G->2G work. Also, it's the base station who decides if authentication and encryption is done. Fake base stations can still be used to track location, intercept calls and data. * LTE/4G has mutual authentication and mandatory integrity protection. In theory you can't get IMEI if the message has no integrity but the protocols are not perfect. LTE/4G can still be intercepted by using jammers, DoS attacks or exploiting weaknesses in the protocols and implementations to force a downgrade. Some…

Paper and discussion history. A mention is not an endorsement.

Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems — mentioned by bigiain

Fri, 30 Oct 2015 04:53:27 GMT

This floated through my Twitter stream yesterday (I think via @thegrugg) - as I was reading it I kept thinking "Really? Is there even a vaguely plausible explanation for that choice of leaving a command message unencrypted and unauthenticated that doesn't boil down to 'so the NSA or other LEO can exploit it'?" http://arxiv.org/pdf/1510.07563v1.pdf "Practical attacks against privacy and availability in 4G/LTE mobile communication systems"

Paper and discussion history. A mention is not an endorsement.

Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems — mentioned by rmac

Thu, 29 Oct 2015 17:10:08 GMT

tldr: 1) LTE uses broadcast messages to do push notifications. These are unencrypted and unauthenticated. Researchers can trigger them silently by spamming you on Facebook, and triangulate your location since the LTE network only sends the pages to the geographic location you are in. 2) LTE supports crash reports that can potentially include your GPS coords. A rouge base station can request these from your phone without setting up an encrypted channel due to shitty baseband implementations. 3) something about denial of service the excellent paper is here: http://arxiv.org/pdf/1510.07563v1.pdf

Paper and discussion history. A mention is not an endorsement.

Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems — HN submission

Wed, 28 Oct 2015 06:53:57 GMT

Practical attacks against privacy and availability in 4G/LTE systems

2 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.