New Attack Lets Hackers Decrypt VoLTE Encryption to Spy on Phone Calls

A team of academic researchers—who previously made the
headlines earlier this year for uncovering severe security
issues in the 4G LTE and 5G networks—today presented a new
attack called ‘ReVoLTE,’ that could let remote attackers
break the encryption used by VoLTE voice calls and spy on
targeted phone calls.

The attack doesn’t exploit any flaw in the Voice over LTE
(VoLTE) protocol; instead, it leverages weak implementation of the
LTE mobile network by most telecommunication providers in practice,
allowing an attacker to eavesdrop on the encrypted phone calls made
by targeted victims.

VoLTE or Voice over Long Term Evolution protocol is a standard
high-speed wireless communication for mobile phones and data
terminals, including Internet of things (IoT) devices and
wearables, deploying 4G LTE radio access technology.

The crux of the problem is that most mobile operators often use the
same keystream for two subsequent calls within one radio connection
to encrypt the voice data between the phone and the same base
station, i.e., mobile phone tower.

Thus, the new ReVoLTE
attack^[2] exploits the reuse of
the same keystream by vulnerable base stations, allowing attackers
to decrypt the contents of VoLTE powered voice calls in the
following scenario.

However, reuse of a predictable keystream is not new and was first
pointed out by Raza &
Lu, but the ReVoLTE attack turns it into a practical attack.

How Does the ReVoLTE Attack Work?

To initiate this attack, the attacker must be connected to the same
base station as the victim and place a downlink sniffer to monitor
and record a ‘targeted call’ made by the victim to someone else
that needs to be decrypted later, as part of the first phase of
ReVoLTE attack.

Once the victim hangs up the ‘targeted call,’ the attacker is
required to call the victim, usually within 10 seconds immediately,
which would force the vulnerable network into initiating a new call
between victim and attacker on the same radio connection as used by
previous targeted call.

Once connected, as part of the second phase, the attacker needs to
engage the victim into a conversation and record it in plaintext,
which would help the attacker later reverse compute the keystream
used by the subsequent call.
According to researchers, XOR-ing the keystreams with the
corresponding encrypted frame of the targeted call captured in the
first phase decrypts its content, allowing attackers to listen to
what conversation its victim had in the previous phone call.

“As this results in the same keystream, all RTP data is
encrypted in the same way as the voice data of the target call. As
soon as a sufficient amount of keystream data was generated, the
adversary cancels the call,” the paper reads.

However, the length of the second call should be greater than or
equal to the first call in order to decrypt each frame; otherwise,
it can only decrypt a part of the conversation.

Detecting ReVoLTE Attack and Demonstration

To demonstrate the practical feasibility of the ReVoLTE attack, the
team of academics from Ruhr University Bochum implemented an
end-to-end version of the attack within a commercial, vulnerable
network and commercial phones.
The team used the downlink analyzer Airscope by Software Radio
System to sniff the encrypted traffic and three Android-based
phones to obtain the known-plaintext at the attacker’s phone. It
then compared the two recorded conversations, determined the
encryption key, and finally decrypted a portion of the previous
call.
You can see the demo video of the ReVoLTE attack, which, according
to the researchers, could cost less than $7000 to attackers for
setting up the attack and, eventually, decrypting downlink traffic.

The team tested a number of randomly selected radio cells across
Germany to determine the scope of the issue and found that it
affects 12 out of 15 base stations in Germany, but researchers said
the security gap also affects other countries.

Researchers notified the affected German base station operators
about the ReVoLTE attack through the GSMA Coordinated Vulnerability
Disclosure Programme process in early December 2019, and the
operators managed to deploy the patches by the time of
publication.

Since the issue also affects a large number of providers
worldwide, researchers released an open source Android app, called
‘Mobile
Sentinel^[4],’ that you can use to
detect whether their 4G network and base stations are vulnerable to
the ReVoLTE attack or not.

Researchers—David Rupprecht, Katharina Kohls and Thorsten Holz
of RUB University Bochum and Christina Pöpper of NYU Abu Dhabi—have
also released a dedicated website^[5] and research paper
PDF^[6], titled “Call Me Maybe:
Eavesdropping Encrypted LTE Calls With REVOLTE,” detailing the
ReVoLTE attack, where you can find more details.

^[1][3]