Connect with us

Latest News

Hackers News 2020: Latest attack Decrypt VoLTE Encryption to Spy on Phone Calls



VoLTE voice calls Hackers News 2020: Latest attack Decrypt VoLTE Encryption to Spy on Phone Calls

New Attack: Hackers Decrypt VoLTE Encryption to Spy on Phone Calls

 Hackers Decrypt VoLTE Encryption to Spy on Phone Calls

A team of academic researchers—who previously made the headlines earlier this year for uncovering severe security issues in the 4G LTE and 5G networks—today presented a new attack called ‘ReVoLTE,’ that could let remote attackers break the encryption used by VoLTE voice calls and spy on targeted phone calls.

The attack doesn’t exploit any flaw in the Voice over LTE (VoLTE) protocol; instead, it leverages weak implementation of the LTE mobile network by most telecommunication providers in practice, allowing an attacker to eavesdrop on the encrypted phone calls made by targeted victims.

VoLTE or Voice over Long Term Evolution protocol is a standard high-speed wireless communication for mobile phones and data terminals, including Internet of things (IoT) devices and wearables, deploying 4G LTE radio access technology.


The crux of the problem is that most mobile operators often use the same keystream for two subsequent calls within one radio connection to encrypt the voice data between the phone and the same base station, i.e., mobile phone tower.

Thus, the new ReVoLTE attack exploits the reuse of the same keystream by vulnerable base stations, allowing attackers to decrypt the contents of VoLTE powered voice calls in the following scenario.

phone call hacking Hackers News 2020: Latest attack Decrypt VoLTE Encryption to Spy on Phone Calls

However, reuse of a predictable keystream is not new and was first pointed out by Raza & Lu, but the ReVoLTE attack turns it into a practical attack.

How Does the ReVoLTE Attack Work?

To initiate this attack, the attacker must be connected to the same base station as the victim and place a downlink sniffer to monitor and record a ‘targeted call’ made by the victim to someone else that needs to be decrypted later, as part of the first phase of ReVoLTE attack.

Once the victim hangs up the ‘targeted call,’ the attacker is required to call the victim, usually within 10 seconds immediately, which would force the vulnerable network into initiating a new call between victim and attacker on the same radio connection as used by previous targeted call.

“The keystream reuse occurs when the target and keystream call use the same user-plane encryption key. As this key is updated for every new radio connection, the attacker must ensure that the first packet of the keystream call arrives within the active phase after the target call,” the researchers said.

Once connected, as part of the second phase, the attacker needs to engage the victim into a conversation and record it in plaintext, which would help the attacker later reverse compute the keystream used by the subsequent call.
According to researchers, XOR-ing the keystreams with the corresponding encrypted frame of the targeted call captured in the first phase decrypts its content, allowing attackers to listen to what conversation its victim had in the previous phone call.

“As this results in the same keystream, all RTP data is encrypted in the same way as the voice data of the target call. As soon as a sufficient amount of keystream data was generated, the adversary cancels the call,” the paper reads.

However, the length of the second call should be greater than or equal to the first call in order to decrypt each frame; otherwise, it can only decrypt a part of the conversation.

“It is important to note that the attacker has to engage the victim in a longer conversation. The longer he/she talked to the victim, the more content of the previous communication he/she can decrypt,” the paper reads.

“Each frame is associated with a count and encrypted with an individual keystream that we extract during the keystream computation. As the same count generates the same keystream, the count synchronizes the keystreams with encrypted frames of the target call. XOR-ing the keystreams with the corresponding encrypted frame decrypts the target call.”

“As we aim to decrypt the complete call, the keystream call must be as long as the target call to provide a sufficient number of packets, as otherwise we can only decrypt a part of the conversation.”

Detecting ReVoLTE Attack and Demonstration

To demonstrate the practical feasibility of the ReVoLTE attack, the team of academics from Ruhr University Bochum implemented an end-to-end version of the attack within a commercial, vulnerable network and commercial phones.
The team used the downlink analyzer Airscope by Software Radio System to sniff the encrypted traffic and three Android-based phones to obtain the known-plaintext at the attacker’s phone. It then compared the two recorded conversations, determined the encryption key, and finally decrypted a portion of the previous call.
You can see the demo video of the ReVoLTE attack, which, according to the researchers, could cost less than $7000 to attackers for setting up the attack and, eventually, decrypting downlink traffic.

The team tested a number of randomly selected radio cells across Germany to determine the scope of the issue and found that it affects 12 out of 15 base stations in Germany, but researchers said the security gap also affects other countries.

Researchers notified the affected German base station operators about the ReVoLTE attack through the GSMA Coordinated Vulnerability Disclosure Programme process in early December 2019, and the operators managed to deploy the patches by the time of publication.

Since the issue also affects a large number of providers worldwide, researchers released an open source Android app, called ‘Mobile Sentinel,’ that you can use to detect whether their 4G network and base stations are vulnerable to the ReVoLTE attack or not.

Researchers—David Rupprecht, Katharina Kohls and Thorsten Holz of RUB University Bochum and Christina Pöpper of NYU Abu Dhabi—have also released a dedicated website and research paper PDF, titled “Call Me Maybe: Eavesdropping Encrypted LTE Calls With REVOLTE,” detailing the ReVoLTE attack, where you can find more details.

Continue Reading


Wilfred Ndidi Sustains Abductor Injury , Could Be Out For Up To 12 Weeks



114581343 gettyimages 1228560872 Wilfred Ndidi Sustains Abductor Injury , Could Be Out For Up To 12 Weeks

Leicester’s Wilfred Ndidi could be out for up to 12 weeks because of an abductor injury he sustained in Sunday’s league win over Burnley.
The 23-year-old missed Wednesday’s 2-0 Carabao Cup defeat to Arsenal and may require surgery.
“It is an abductor injury – it may have come off the bone which could be a nasty injury,” said Foxes boss Brendan Rodgers after the loss to the Gunners.
“We will wait to see if he needs an operation – if so it will be 12 weeks.”
Ndidi has been operating as a makeshift central defender for the Foxes so far this season in the absence of the injured Jonny Evans.
Leicester have won both of their league games this season, to leave them top of the Premier League on goal difference.

Continue Reading


Chelsea Complete The Signing Of Edouard Mendy From Rennes



images 97 2 Chelsea Complete The Signing Of Edouard Mendy From Rennes

OFFICIAL: Chelsea complete the signing of Edouard Mendy from Rennes, with the goalkeeper joining on a five-year deal at a cost of £22 million ($29m).
The Senegalese international has penned a five-year deal at Stamford Bridge and will compete with Kepa Arrizabalaga and Willy Caballero for a starting spot between the posts in the season ahead.
After signing his long-term contract with the Blues, Mendy said: ‘I am so excited to be joining Chelsea. It’s a dream for me to be a part of this exciting squad and to work with Frank Lampard and all of his coaching staff. I look forward to meeting my team-mates and can’t wait to get started.’
On signing Mendy, Chelsea director Marina Granovskaia said: ‘As soon as Petr Cech and our technical team identified Edouard as the most suitable goalkeeper to complement our existing group, there was only one player we wanted to bring in. Edouard arrives following a season of real success with Rennes, he is ambitious for more, and we welcome him to our club.’

Continue Reading


Ondo Election : Akeredolu’s Commissioner , Others Defect To ZLP «



images 96 2 Ondo Election : Akeredolu’s Commissioner , Others Defect To ZLP «

Mr Ilawole appreciated the governor for giving him the opportunity to serve the state in the capacity of a commissioner in the intervention agency.
Another top government official working with Governor Rotimi Akeredolu has resigned his appointment to join the Zenith Labour Party (ZLP), ahead of the October 10 Ondo governorship election.
The official is Bisi Ilawole., a Commissioner with the Ondo State Oil Producing Commission (OSOPADEC). He resigned his appointment with the State government on Tuesday.
In his resignation letter addressed to Mr Akeredolu, he appreciated the governor for giving him the opportunity to serve the state in the capacity of a Commissioner in the intervention agency.
“Sir, it is my profound gratitude for the rare privilege given to me under your administration to serve as a commissioner representing the good people of Ilaje Oil Producing Communities,” part of his letter reads.
After his resignation, he resigned from the All Progressives Congress (APC) and joined the ZLP, with his supporters.
Moreso, a two-time Chairman of Irele Local Government, Nicholas Akinbiola and Daisi Onetufo, a chieftain of APC, also defected to ZLP.
In addition, a former chairman of Ileoluji/Okeigbo and lawmaker representing the constituency, Folagbade Gbemibade dumped the Peoples Democratic Party (PDP) for ZLP.
Speaking after he received them at the ZLP Secretariat, the state chairman, Joseph Akinlaja, said the interest of the folks would be considered.
Last week, a reported show that a senior aide of Mr Akeredolu, Andrew Ogunsakin. resigned his appointment from the government, and threw his weight behind deputy Agboola Ajayi, ahead of the state governorship election.

Continue Reading