IMP4GT: IMPersonation Attacks in 4G NeTworks

Long Term Evolution (LTE/4G) establishes mutual authentication with a provably secure AKA protocol on protocol layer three. But missing integrity protection of user traffic still allows an adversary to manipulate IP packets. In this talk, we present the IMP4GT attack (IMPersonation attacks in 4G neTworks), which allows an attacker to impersonate a user towards the network and vice versa. IMP4GT is a cross-layer attack against LTE/4G networks that exploit missing integrity protection on layer two and extend it with a reflection mechanism of the IP stack. We demonstrate the feasibility of two IMP4GT variants in a commercial network and thereby completely break the mutual authentication aim of LTE on the user plane in a real-world setting.

By David Rupprecht