How to Hijack a VoLTE Network

How to Hijack a VoLTE Network

Speakers: Pavel Novikov, Head of Telecom Security Research, SecurityGen

Conference: HITCON CMT

YouTube: https://www.youtube.com/watch?v=_78AFymc5yQ

Overview

In this insightful talk from HITCON CMT, Pavel Novikov, Head of Telecom Security Research at SecurityGen, along with his research team Alex Anov and Sergey Masuko, unveils critical vulnerabilities within VoLTE (Voice over LTE) networks. The presentation, titled "How to Hijack a VoLTE Network," dissects the architectural shifts in mobile telecommunications that have inadvertently introduced significant security risks. Novikov highlights how the rapid, and often forced, deployment of VoLTE infrastructure by mobile network operators worldwide has led to widespread misconfigurations, enabling attackers to gain unauthorized access to internal network components and even exploit services for free data usage.

The core of the research demonstrates how a standard subscriber, through simple device configuration changes, can bypass intended network segmentation and interact directly with the IP Multimedia Subsystem (IMS) core. This bypass exposes internal network services, allows for direct communication between subscribers on the IMS network, and, most alarmingly, facilitates the circumvention of standard data charging mechanisms. The talk serves as a stark warning to the telecommunications industry, urging immediate attention to fundamental security practices that have been overlooked in the rush to modernize voice services.

This talk is particularly relevant given the global trend towards decommissioning legacy 2G and 3G networks. As operators transition entirely to 4G and 5G, VoLTE becomes the sole conduit for voice communication, elevating the criticality of its security posture. Novikov's findings underscore that the move from proprietary, circuit-switched voice systems to IP-based architectures, while offering flexibility and efficiency, also introduces a familiar set of IP-related security challenges that the telecom sector is still grappling with.

Background

▶ Watch: Mobile network evolution and VoLTE relevance (2:00)

The evolution of mobile networks has been a journey from purely voice-centric systems to increasingly data-focused infrastructures. The journey began with 2G networks, primarily designed for voice calls and SMS, utilizing a circuit-switched core. Data capabilities were rudimentary, with GPRS offering speeds around 60 kilobits per second. The introduction of 3G networks marked a significant leap, focusing on improved data throughput (up to 10 Mbps theoretical, 1 Mbps real-world) while still relying on the circuit-switched core for voice.

The true paradigm shift arrived with 4G LTE (Long-Term Evolution). Designed from the ground up for high-speed packet data, LTE networks were initially data-only, lacking native voice capabilities. This created a dilemma: how would subscribers make calls on a 4G network? The intended solution was the IP Multimedia Subsystem (IMS), an architectural framework that enables IP-based multimedia services, including voice. The implementation of voice services over LTE, leveraging IMS, became known as VoLTE. Similarly, Voice over Wi-Fi (VoWiFi) also utilizes the same IMS infrastructure.

However, VoLTE faced significant hurdles in its early adoption. To accelerate 4G deployment, many operators initially deployed LTE without a fully functional IMS infrastructure. Instead, when a 4G subscriber initiated a call, their device would temporarily switch back to 3G or even 2G networks to use the legacy circuit-switched voice services—a process known as Circuit Switched Fallback (CSFB). While seamless to the user, this created a "technology zoo" for operators, forcing them to maintain 2G, 3G, and 4G networks simultaneously. Decommissioning legacy networks proved challenging; 2G was vital for low-power IoT devices, and 3G often served as a critical fallback for data and voice in areas with limited 4G coverage. This multi-generational infrastructure imposed significant operational burdens and security complexities, as older systems often lacked updates and robust security features.

The landscape dramatically changed with Verizon's decision to decommission its 2G and 3G networks entirely by the end of 2022. This move sent shockwaves through the global telecom industry. For international roaming, if a subscriber from another country visited the USA, their phone would be unable to make calls if their home operator hadn't deployed VoLTE roaming capabilities, as there would be no legacy network to fall back on. This directly impacted operators' reputation and revenue, creating an urgent, unprecedented mandate: deploy VoLTE, and deploy it fast. Many operators, who previously saw little financial incentive to invest in VoLTE beyond basic testing, suddenly found themselves building entire VoLTE networks in a matter of months. This rapid deployment, as Novikov emphasizes, inevitably led to numerous configuration mistakes and overlooked security considerations, setting the stage for the vulnerabilities discovered in this research.

Key Findings

▶ Watch: Verizon's 2G/3G shutdown forces rapid VoLTE rollout (22:50)

The research by Pavel Novikov and his team exposed several critical security flaws stemming from the rushed deployment of VoLTE networks:

1. Lack of Subscriber Isolation in IMS Networks: A fundamental security principle in mobile networks is subscriber isolation, ensuring that individual users cannot directly access or interfere with each other's traffic within the core network. While this is typically enforced for standard internet APNs (Access Point Names) by components like the Packet Gateway (PGW), Novikov found that this isolation is frequently missing or misconfigured for IMS APNs. This allows subscribers to directly connect to other subscribers' devices within the IMS network, bypassing intended segmentation.

1. Direct User Access to IMS Core: The most significant finding is the ability for a regular subscriber to gain direct IP-level access to the IMS core network. By manipulating their device's APN settings—specifically, configuring the device to use the IMS APN but setting its APN type to default (which usually signifies internet access) instead of IMS—users can effectively treat the IMS network as a standard IP network. This bypasses the intended role of the Proxy Call Session Control Function (PCSCF), which is meant to act as a secure proxy and border control for IMS traffic.

1. Exposure of Internal Services: Due to the direct access and the hurried deployment, many IMS network components were found to expose common, often misconfigured, IP services. Scans using tools like nmap (even on a rooted Android phone or via an LTE dongle) revealed open ports for services like SSH and FTP within the IMS infrastructure. This indicates a severe lack of hardening and proper network segmentation, making internal IMS nodes vulnerable to standard penetration testing techniques.

1. Free Data Usage through IMS: Exploiting the misconfiguration of charging policies, the research demonstrated how users could obtain free internet access. While standard internet APNs are charged based on data volume, IMS APNs are typically charged based on call duration (minutes). By establishing a data tunnel (e.g., OpenVPN) through the IMS network, subscribers could consume vast amounts of data without incurring any charges, as the network's billing system would only see "voice minutes" being used, not data. This represents a direct financial loss for operators.

1. Widespread Misconfiguration: SecurityGen's assessments revealed that "more than half of the network[s]" they analyzed exhibited these misconfigurations. This indicates that the problem is not isolated but a systemic issue across a significant portion of the globally deployed VoLTE infrastructure, highlighting the consequences of prioritizing rapid deployment over robust security.

1. Legacy Network Voice as More Secure (Currently): Counterintuitively, the talk posits that voice calls made over older 2G or 3G networks, which rely on proprietary telecom protocols, are currently more secure than those made over a misconfigured VoLTE network. The obscurity and inaccessibility of these legacy protocols make them harder to attack compared to the IP-based IMS, which, when poorly secured, exposes familiar attack surfaces to anyone with direct access.

Technical Deep Dive

▶ Watch: Gaining IMS network access through APN configuration (26:00)

The technical foundation of these vulnerabilities lies in the interaction between a mobile device's Access Point Name (APN) configuration and the structure of the IMS network.

An APN acts as a gateway between a mobile network and another computer network, often the public internet. On a smartphone, users typically have an APN configured for "internet" access, which directs data traffic through the Packet Gateway (PGW) to the internet. For VoLTE, a separate APN, usually named IMS, is provisioned. This IMS APN is specifically designed to route SIP (Session Initiation Protocol) traffic for voice calls to the IMS core.

The critical trick discovered by Novikov involves manipulating the APN type setting. When a phone connects to the IMS APN, it typically sets its APN type to IMS. This tells the phone's operating system that this interface is specifically for IMS voice services and should not be used for general internet data. However, if a user changes the APN type for the IMS APN to default (or internet), the phone's internal routing effectively treats the IMS network as a general internet connection.

This seemingly minor change has profound implications. Instead of traffic being filtered and controlled by the Proxy Call Session Control Function (PCSCF)—which is intended to act as the first point of contact and security proxy for the IMS network, validating SIP messages and hiding the internal topology—the subscriber gains direct IP-level access to the IMS infrastructure. The PCSCF, instead of being a protective barrier, becomes just another accessible node in the network.

To exploit this, an attacker can use various methods:

1. On-device Exploitation: While possible on rooted Android phones, deploying tools like nmap directly on a phone can be cumbersome. Modern Android versions (e.g., Android 10 and above) also increasingly hide advanced APN configurations from the user interface, making direct manipulation more difficult without rooting or specialized engineering tools. For instance, on Samsung phones, specific XML files in the system partition or Qualcomm-based devices' mbn file system might be modified to inject custom PCSCF addresses or APN settings.

1. LTE Dongle via Laptop: A more practical approach for penetration testing involves using an LTE dongle connected to a laptop. This allows an attacker to configure the dongle to use the IMS APN with the APN type set to default. The laptop then effectively has a direct IP interface into the mobile operator's IMS network. From here, standard penetration testing tools like nmap can be easily deployed to scan the accessible IP ranges within the IMS, revealing exposed services like SSH, FTP, or other potentially misconfigured internal components.

A key vulnerability enabling these attacks is the lack of subscriber isolation within the IMS network. For internet APNs, the Packet Gateway (PGW) typically implements robust isolation, preventing subscribers from directly communicating with each other. However, for IMS APNs, this isolation is frequently overlooked. This means that once a subscriber gains direct IP access to the IMS network, they can potentially reach other subscribers also connected to the IMS, or even internal network elements that should be shielded.

The research also delved into more complex attack scenarios, such as establishing a fake IMS infrastructure. This involved:

• Bypassing the need for a public network or traditional IP phones.
• Utilizing open-source SIP server software like Kamailio to emulate CSCF (Call Session Control Function) roles.
• Implementing a proxy to bypass the strong authentication mechanism of the Home Subscriber Server (HSS), which stores subscriber credentials and is critical for mobile network authentication. The HSS stores secret keys on both the SIM card and in the core network, making direct interception impossible. The bypass involves proxying authentication requests to the real HSS, then directing subsequent traffic to the fake IMS.
• The challenge of pushing a fake PCSCF address to the phone, which usually involves radio-level signaling from the MME (Mobility Management Entity), was acknowledged as difficult without core network access. This led the researchers to focus on phone-side modifications (rooting, specific apps like core IMS, XML/MBN file editing) to achieve Man-in-the-Middle (MitM) for this specific scenario. While complex, this demonstrated the depth of the research into potential IMS hijacking.

Ultimately, the most impactful technical finding was the straightforward ability to establish an OpenVPN tunnel over the IMS network, leveraging the IMS APN with a default APN type, for free data. This bypasses the typical data-based charging of internet APNs, as IMS traffic is often billed by call duration, not data volume.

Demo / Proof of Concept

▶ Watch: Prevalence of IMS misconfigurations and monitoring failures (38:00)

The core demonstration and proof of concept focused on illustrating the "free internet" vulnerability, which is both technically significant and has direct financial implications for operators. The speaker outlined a clear, actionable methodology:

1. LTE Dongle Setup: The primary tool for the demonstration was an LTE dongle connected to a laptop. This setup provides a flexible environment for manipulating network configurations that might be more restricted on a standard smartphone.

1. APN Configuration Manipulation: The LTE dongle was configured to connect to the mobile operator's IMS APN. Crucially, the APN type for this connection was changed from its default IMS setting to default (or internet). This forces the underlying network interface on the laptop to treat the IMS network as a general IP network, rather than one exclusively for voice signaling.

1. Establishing a Secure Tunnel: With direct IP access to the IMS network established, the next step was to create an OpenVPN tunnel. An OpenVPN client was run on the laptop, connecting to an external OpenVPN server hosted on the internet. This tunnel effectively routes all the laptop's internet traffic through the mobile operator's IMS network.

1. Verification of Free Data: The critical aspect of the demonstration was the verification of data consumption without incurring charges. Since the IMS APN is typically (and often erroneously) billed based on call minutes rather than data volume, any data passing through this OpenVPN tunnel would not be metered for data usage. The operator's billing system would perceive only "voice call" activity (if any, or simply connection time), not gigabytes of data.

This proof of concept effectively showcased:

• The bypass of subscriber isolation: the laptop (acting as a subscriber) could establish an unrestricted data connection through the IMS.
• The misconfiguration of APN types and their impact on network access.
• The direct financial vulnerability for mobile operators due to incorrect charging policies for IMS traffic.
• The potential for using the IMS network for other P2P activities, including torrenting, further highlighting the lack of control and monitoring.

While the talk also touched upon the more complex scenario of building a fake IMS infrastructure and performing a full Man-in-the-Middle (MitM) attack by pushing custom PCSCF addresses to a phone, the OpenVPN over IMS demonstration was the most direct and impactful proof of concept for immediate exploitation.

Defensive Implications

▶ Watch: Q&A: Understanding exposed GTP protocol vulnerabilities (40:00)

The findings presented in "How to Hijack a VoLTE Network" carry significant defensive implications for mobile network operators, particularly those who rapidly deployed VoLTE in response to market pressures. Addressing these vulnerabilities is crucial for safeguarding network integrity, subscriber data, and financial stability.

1. Implement Robust Subscriber Isolation for IMS APNs: This is the most critical and immediate defensive action. Operators must ensure that subscriber isolation is fully enabled and correctly configured for all IMS APNs, just as it is for standard internet APNs. This typically involves configuring the Packet Gateway (PGW) or equivalent network elements to prevent direct IP communication between subscribers and to restrict access to internal IMS network components to only necessary signaling traffic. This prevents attackers from scanning the internal network or establishing peer-to-peer connections through the IMS.

1. Strict APN Type Enforcement and Validation: Mobile devices should not be able to connect to the IMS APN with an APN type set to default or internet. Network elements should validate the APN type requested by the device against the configured APN name. If an IMS APN is requested, the network should only permit IMS type traffic and block or reject connections attempting to use it for general data.

1. Comprehensive Network Monitoring for IMS Traffic: A glaring gap identified was the lack of monitoring for IMS network traffic. Operators need to deploy robust traffic monitoring and anomaly detection solutions specifically for their IMS infrastructure. This includes:

• Monitoring data volume and types of traffic flowing over IMS APNs.
• Detecting unusual protocols (e.g., OpenVPN, P2P) on IMS interfaces.
• Identifying unexpected connections to internal IMS nodes (e.g., SSH, FTP attempts).
• Correlating IMS traffic with billing records to identify discrepancies.

1. Secure Configuration and Hardening of IMS Nodes: All components within the IMS network, including PCSCFs, CSCFs, and any supporting infrastructure, must be securely configured. This means:

• Disabling unnecessary services (e.g., SSH, FTP) or restricting access to them only from authorized management networks.
• Implementing strong authentication and access control for all management interfaces.
• Regularly patching and updating software on IMS nodes.
• Following security best practices for IP-based systems, which the telecom industry is still adapting to.

1. Re-evaluate Charging Policies for IMS Traffic: To prevent financial losses, operators must review and adjust their billing systems to accurately meter data usage over IMS APNs. While voice calls are typically minute-based, any data traffic (even if related to SIP signaling) should ideally be accounted for, or at least general data tunnels should be prevented.

1. Regular Security Assessments and Penetration Testing: Given the rapid deployment, operators should prioritize comprehensive security assessments and penetration testing of their VoLTE and IMS networks. These should go beyond standard compliance checks and actively probe for the types of misconfigurations demonstrated in the talk, simulating attacker behavior from a subscriber's perspective.

1. Information Sharing within the Telecom Industry: The speaker noted that the telecom industry is often closed and slow to share information. Fostering better communication and sharing of vulnerability intelligence among operators and vendors could accelerate the remediation of widespread issues like these.

In essence, the defensive strategy involves treating the IMS network as a critical IP infrastructure component that is directly accessible to subscribers, and applying the same rigorous security controls typically expected for public-facing internet services, coupled with specific telecom-related validations.

Key Takeaways

• VoLTE's rapid, forced deployment has introduced significant security vulnerabilities: The urgent need for operators to transition from 2G/3G to VoLTE has led to rushed implementations and widespread misconfigurations.
• Lack of subscriber isolation is a critical flaw in many IMS networks: Unlike internet APNs, IMS APNs frequently lack proper subscriber isolation, allowing users to gain direct IP access to the IMS core and other subscribers.
• APN manipulation enables unauthorized network access: By changing the APN type from IMS to default while connected to the IMS APN, subscribers can bypass intended segmentation and directly interact with internal IMS components.
• Free data usage is possible via IMS network exploitation: Due to minute-based charging policies for IMS APNs, attackers can establish data tunnels (e.g., OpenVPN) through the IMS network, consuming data without charge.
• Operators must prioritize IMS network hardening and monitoring: Implementing robust subscriber isolation, strict APN validation, comprehensive IMS traffic monitoring, and secure configuration of IMS nodes are essential defensive measures.
• The shift to IP-based telecom infrastructure introduces familiar IP security challenges: As voice services transition from proprietary circuit-switched protocols to IP-based systems, the telecom sector inherits common IP network vulnerabilities that require a renewed focus on fundamental cybersecurity practices.

About the Speaker(s)

Pavel Novikov is the Head of Telecom Security Research at SecurityGen, a firm specializing in telecom security. With almost a decade of experience in the field, Pavel has worked with various telecommunications associations and organizations, contributing to the understanding and improvement of security within mobile networks. His expertise spans a wide array of mobile network components, including Radio Access Networks (RAN), roaming, and interconnection. He leads a research team that conducts in-depth security assessments for mobile networks, uncovering vulnerabilities like those presented in this talk. For this specific research, he collaborated with Alex Anov, an ex-employee, and Sergey Masuko, who continues to perform VoLTE assessments. Their work highlights the critical need for enhanced security in the evolving telecommunications landscape.