12 votes

Security gaps identified in LTE mobile telephony standard

5 comments

  1. [4]
    joelthelion
    Link
    Wow, that's pretty bad. If anything, that's a good argument for using https everywhere.

    By abusing security weaknesses in the LTE mobile telephony standard, attackers are able to identify which web pages a user visits and to reroute him to a scam website

    Wow, that's pretty bad. If anything, that's a good argument for using https everywhere.

    5 votes
    1. [3]
      Neverland
      Link Parent
      VPN is always on for me. And while unrelated to this issue, I almost never use SMS and regular telephony.

      VPN is always on for me. And while unrelated to this issue, I almost never use SMS and regular telephony.

      3 votes
      1. [2]
        acr
        Link Parent
        I have Signal but noone in my life cares. They act like it is stupid and won't even hear what it is but they damn sure know all the ins and outs of snapchat and their video games.

        I have Signal but noone in my life cares. They act like it is stupid and won't even hear what it is but they damn sure know all the ins and outs of snapchat and their video games.

        2 votes
        1. Neverland
          Link Parent
          Yeah, I hear you on that. Nearly everyone I speak with regularly has an iPhone. So iMessage and FaceTime Audio are my normal comms, still over VPN. Say what you will about Apple, but those...

          They act like it is stupid

          Yeah, I hear you on that. Nearly everyone I speak with regularly has an iPhone. So iMessage and FaceTime Audio are my normal comms, still over VPN. Say what you will about Apple, but those protocols are better than LTE voice and SMS security is a joke.

          1 vote
  2. pseudolobster
    Link
    This sounds suspiciously like a Stingray device, and from the description it sounds like €4000 is more than it actually costs to build. Even very fancy SDRs are only in the range of $300 or so....

    The attacks described above can be carried out using commercially available equipment that can be purchased at a price of approximately 4,000 euros. In their experiments, the researchers utilised a PC and two so-called software-defined radios that enable the sending and receiving of LTE signals. One of the devices pretends to the phone to be a mobile phone network; the other pretends to the real mobile phone network to be the phone. Thus, the system is capable of altering specific data, while transmitting the bulk of the data unchanged.

    This sounds suspiciously like a Stingray device, and from the description it sounds like €4000 is more than it actually costs to build. Even very fancy SDRs are only in the range of $300 or so. I'm guessing their cost includes the PC and fancy commercially bought antennas.

    4 votes