Researchers can eavesdrop on VoLTE conversations due to incorrect implementation

German researchers have discovered a vulnerability in the implementation of the VoLTE protocol for 4G calling. This allows them to eavesdrop on encrypted telephone conversations. The attack is difficult to carry out in practice.

The researchers at Ruhr University in Germany call the attack ReVoLTE, and present their white paper at the Usenix security conference. The researchers describe how they can eavesdrop on an encrypted conversation with a vulnerability in the Voice-over-LTE protocol. This is not possible with all providers and the investigators must be close to the victim.

The vulnerability is in the mobile transmission towers that VoLTE calls are routed over. VoLTE calls run over 4G and are normally encrypted. A provider must create a separate encryption key for each call. However, according to the researchers, many providers use the same stream cipher on the base stations of a cell tower or the keys can be retrieved with a predictable algorithm. This makes it possible to tap an encrypted conversation and decrypt it later.

An attacker must first have a conversation with a victim himself. Moreover, this must be done on the same transmission mast as on which an encrypted call takes place. During that conversation, the encryption key can be retrieved. The length of a conversation is important here; if an attacker and a victim call for two minutes, the attacker can afterwards eavesdrop on another intercepted conversation for two minutes.

According to the researchers, the attack can be carried out with equipment that costs around 6,000 euros, such as an imsi catcher. In addition, telephones and the interception software Airscope are required. The researchers say they conducted a demonstration of the attack on a commercial network in Germany. They want to show that the attack can be carried out practically.

It is not known which telecom providers all suffer from the same vulnerability. The researchers have reported the leak to the GSMA. In Germany, providers are said to have solved the problem.