Putting LTE Security Functions to the Test: a Framework to Evaluate Implementation Correctness

Putting LTE Security Functions to the Test: A Framework to Evaluate Implementation Correctness David Rupprecht Kai Jansen Horst Gortz¨ Institute for IT-Security Horst Gortz¨ Institute for IT-Security Ruhr-University Bochum, Germany Ruhr-University Bochum, Germany [email protected] [email protected] Christina Popper¨ New York University Abu Dhabi [email protected] Abstract promise of users as well as service providers. Security- related changes need to be carefully evaluated in order to Long Term Evolution (LTE) is the most recent generation maintain strong protection, especially since LTE is con- of mobile communications promising increased transfer sidered as the communication technology for, e. g., criti- rates and enhanced security features. It is todays commu- cal infrastructures, emergency services, and law enforce- nication technology for mobile Internet as well as con- ment [12]. The increasing dependency on LTE makes it sidered for the use in critical infrastructure, making it an an attractive subject to a wide range of attacks and any attractive target to a wide range of attacks. We evalu- vulnerability could have serious impact on the underly- ate the implementation correctness of LTE security func- ing services. tions that should protect personal data from compromise. By addressing several security issues of the previ- In this paper, we focus on two security aspects: user ous mobile communication specifications, in particular data encryption and network authentication. We de- Global System for Mobile Communications (GSM) and velop a framework to analyze various LTE devices with Universal Mobile Telecommunications System (UMTS), respect to the implementations of their security-related LTE raises the bar in terms of security and applies, e. g., functions. Using our framework, we identify several se- mutual authentication, longer encryption keys, extended curity flaws partially violating the LTE specification. In key hierarchies, and a public review of the used en- particular, we show that i) an LTE network can enforce cryption algorithms. However, individual deployments to use no encryption and ii) none of the tested devices in- across different manufactures can lead to gaps between forms the user when user data is sent unencrypted. Fur- specification and implementation. These implementation thermore, we present iii) a Man-in-the-Middle (MitM) flaws can be exploited by an adversary circumventing se- attack against an LTE device that does not fulfill the net- curity features defined in the specification. All these at- work authentication requirements. The discovered secu- tack vectors need to be examined carefully to evaluate rity flaws undermine the data protection objective of LTE the actual security of LTE devices. and represent a threat to the users of mobile communica- Prior work has addressed several aspects in this land- tion. We outline several countermeasures to cope with scape. For instance, in 2016 Shaik et al. [28] presented these vulnerabilities and make proposals for a long-term attacks against the location privacy of mobile subscribers solution. and the availability of the network based on vulnerabilities in the LTE specification. Further security flaws ma- 1 Introduction nipulating the firmware of the baseband chip were iden- tified by Komaromy and Golde [9, 31]. Similar work Mobile communication has become an integral part of has been done by Broek et al. [30] introducing a test- our daily life. Most applications running on today’s ing framework solely focusing on implementations of the smartphones or tablets are based on the ability to wire- SMS layer of GSM. The latter attacks directly focus on lessly communicate with the surrounding network infras- the implementation rather than the specification—an ap- tructure. Long Term Evolution (LTE) is the latest mobile proach that we leverage on in this work by developing a communication standard and predicted to comprise about framework that analyzes implementation correctness. To 2:3 billion subscribers by 2019 [29]. date, there is no testing framework openly available for The security of today’s mobile communication is es- investigating the security of LTE devices. sential for the protection of personal data to prevent com- We develop such a testing framework and focus on a 1 testing approach with two main security aspects: (i) user E-UTRAN EPC data encryption and (ii) network authentication. We use Internet the gained insights to develop a test framework for LTE HSS devices that enables us to semi-automatically test LTE devices on implementation flaws in their security functions. As we will show, all tested devices violate the UE eNodeB specification with respect to security-relevant ciphering S1 indication. Furthermore, implementations of common MME AS LTE devices differ to the extent that network authenti- NAS cation can be broken by a new MitM attack. In summary, our work provides the following contri- Figure 1: The LTE architecture at least comprises an butions: eNodeB, an MME, and an HSS. An LTE-capable UE can communicate with the network. • We identify which parts of the LTE specification are susceptible to implementation flaws. We narrow down our investigations to security-critical func- 2.1 LTE Architecture tions, in particular user data encryption and network authentication. The LTE infrastructure is a combination of several com- • We develop a lost-cost framework for testing mod- ponents and their interconnections. We briefly introduce ern off-the-shelf LTE devices to identify implemen- the functionality of the network entities and highlight se- tation flaws for about 1200 e. The framework curity properties. Notably, we confine this list to compo- is based on commercially available Software De- nents that are of interest in our security analysis. fined Radios (SDRs) [10] and the OpenAirInterface User Equipment (UE). The UE provides applica- project [11]. To the best of our knowledge, this is tions and services to the user and is responsible for the the first testing environment for the LTE protocol data transmission to and from the network. The UE stack available for academic purposes. holds a Universal Subscriber Identity Module (USIM), • We tested a total of 10 devices from six different which stores the International Mobile Subscriber Iden- manufacturers. Our test results reveal an exploitable tity (IMSI) uniquely identifying each user. Moreover, a attack vector. As a proof of concept, we launch pre-shared key K is stored on the USIM to derive further a MitM attack against one particular LTE device. keys used during the authentication procedure. With this attack it is possible to intercept the data Evolved NodeB (eNodeB). The deployed base stations traffic and violate the user privacy. that realize radio-level access points to LTE networks are • We outline countermeasures to reinforce the secu- called eNodeB. Furthermore, each eNodeB is involved rity and the protection of user privacy. Moreover, in the process of radio management data encryption and we suggest to make changes in the selection of secu- integrity protection as well as user data encryption. rity algorithms for upcoming generations of mobile Mobility Management Entity (MME). The MME han- communication. dles the establishment of new connections and the au- We plan to make our framework publicly available thentication process. It is assigned to manage mobility once the review process is finished to enable comprehen- data of connected UEs, where it applies encryption and sive tests on the security of available LTE equipment. We integrity protection. have also informed the manufacturer of the vulnerable Home Subscriber Server (HSS). The HSS stores the LTE device who created CVE-2016-3676 [18] and fixed authentication information of the mobile subscribers. the issue. Thus, it plays a central role during the initial authentication procedure of an unconnected UE providing the MME with security-related user information. An overview including the interconnections of the 2 LTE Background individual components is depicted in Figure 1. The LTE architecture can be divided into two logical do- In this section, we introduce the LTE system architecture mains. The Evolved UMTS Terrestrial Radio Access which is often technically referred to as Evolved Packet Network (E-UTRAN) encompasses connected UEs and System (EPS). In the remainder of this paper, we mainly the eNodeB base stations, whereas the Evolved Packet use the more common term LTE. Contrary to GSM and Core (EPC) contains, e. g., the MME and the HSS, UMTS, LTE is based on packet switching rather than cir- among other components. The two domains are con- cuit switching. nected via the S1 interface. Furthermore, there are two 2 A special entity of both algorithm sets is EIA0 and Table 1: Security algorithm options, according to [3, EEA0. These algorithms are void operations leaving the 9.9.3.23 NAS security algorithms]. data unencrypted and/or provide no integrity protection. Encoding Integrity Ciphering Algorithm According to the LTE specification, EIA0 is only allowed when emergency bearers are established. The choice of X000X000 EIA0 EEA0 NULL an actual instantiation for the encryption and the integrity X001X001 128-EIA1 128-EEA1 SNOW 3G protection algorithm is up to the network provider and X010X010 128-EIA2 128-EEA2 AES can be based on territorial affiliation. EIA3/EEA3 (ZUC) X011X011 128-EIA3 128-EEA3 ZUC has been designed in China and is the only allowed algorithm for LTE in China [25]. important logical connections between the network com- 2.2.2 Security Procedures ponents, which are specified as follows. In order to fulfill important security objectives including Access Stratum (AS). The AS represents the direct con- confidentiality and integrity protection, security proce- nection between UEs and eNodeBs and comprises all dures are implemented. Several entities of the LTE ar- messages, i. e., user data that are exchanged on the ra- chitecture are involved in the process, e. g., UE, eNodeB, dio layer to physically access an LTE network. MME, and HSS. In the following, we describe the Non-Access Stratum (NAS).

Load more