An anonymous reader writes: “A team of researchers from French company P1 Security has detailed a long list of issues with the 4G VoLTE telephony, a protocol that has become quite popular all over the world in recent years and is currently in use in the US, Asia, and most European countries, ” reports Bleeping Computer. Researchers say they identified several flaws in the VoLTE protocol (a mixture of LTE and VoIP) that allow an attacker to spoof anyone’s phone number and place phone calls under new identities, and extract IMSI and geo-location data from pre-call message exchanges. These issues can be exploited by both altering some VoLTE packets and actively interacting with targets, but also by passively listening to VoLTE traffic on an Android device. Some of these flaws don’t even need a full call/connection to be established between the victim and the target for the data harvesting operation to take place. Additionally, another flaw allows users to make calls and use mobile data without being billed. The team’s research paper, entitled “Subscribers remote geolocation and tracking using 4G VoLTE enabled Android phone” was presented last week at SSTIC (Symposium sur la Securite des Technologies de l’Information et des Communications), a security conference held each year in Rennes, France. Read more of this story at Slashdot.
More:
Hackers Can Spoof Phone Numbers, Track Users Via 4G VoLTE Mobile Technology
