By Amruth Chinnappa
Everyone enjoys fast internet speed. This was brought to India when 4G was made first available at subsidised rates. However, it has now been revealed that the 4G LTE wireless is at high risk of illegal infiltration by hackers and the network poses a huge security threat to users worldwide.
The hunter and the hunted
Long Term Evolution (LTE) is a standard prescribed for internet connections by which 4G delivers the fastest connectivity now available for mobile internet. Researchers at the University of Purdue and the University of Iowa have recognized 10 new types of cyber-attack which could affect mobile devices and data terminals using the 4G LTE wireless data communications technology.
Researchers Syed Raiful Hussain, Shagufta Mehnaz, Elisa Bertino and Omar Chowdury found the 10 types of attack by using a tool called LTEInspector to find vulnerabilities in the network protocol. The 9 older methods of attack that were already known were used as a metric to uniquely identify the new vulnerabilities. Attackers can weave their way around the 4G LTE network by using three protocols: attach, detach and paging. The research team developed LTEInspector to examine the order of events and actions, cryptographic messages, and the system constraints. They describe the tool as a lazy combination of a symbolic model checker and a cryptographic protocol verifier.
Vicious tools
Of the 10 attacks, the scientists consider the authentication relay method to be of particularly high concern. This form of attack allows a hacker to simulate a call from the victims phone number in order to connect to the 4G LTE network. The attacker then has the power to read incoming and outgoing messages of the user as well as to frame another individual for the breach. According to the researcher’s paper: “Through this attack the adversary can poison the location of the victim device in the core networks, thus allowing setting up a false alibi or planting fake evidence during a criminal investigation.”
Such infiltration could be used to obtain a victims location and launch a Denial of Service (DoS) attack to take the victim’s device offline. This would stop all notifications and force the device to perform cryptographic operations, which consume high amounts of processing power, leading to battery drain. Another type of assault on the system manipulates the protocol, related to the transmission of emergency messages. Incorrect information about non-existent air strikes or a riot could lead to widespread chaos among users.
Easy access
The attacks can be carried out using Universal Software Radio Peripheral (USRP) devices, which can be easily purchased for $1,300 to $3,900. This remains an easy way to cause millions of dollars worth of damage at little expense to the attacker. The researchers have reported that they do not plan to release their proof-of-concept code until the flaws are fixed. They have also refrained from discussing any potential defences against attacks: “retrospectively adding security into an existing protocol without breaking backward compatibility often yields band-aid-like-solutions which do not hold up under extreme scrutiny.”
Information breaches remain a big problem with developing technology, and even current ‘secure’ models are susceptible to attack. The only way for the to ensure that this does not happen is for users to constantly update their security systems and for manufacturers to limit the number of loopholes. From Hollywood celebrities to ordinary users of 4G systems, these vulnerabilities put everyone at risk.
Featured Image Source: Flickr