The Untold Secrets of WiFi-Calling Services: Vulnerabilities, Attacks, and Countermeasures
The Untold Secrets of WiFi-Calling Services: Vulnerabilities, Attacks, and Countermeasures
复制标题
DOI：
10.1109/tmc.2020.2995509
复制
发表时间：
2021-11
影响因子：
7.9
通讯作者：
Tian Xie;Guan-Hua Tu;Bangjie Yin;Chi-Yu Li;Chunyi Peng;Mi Zhang;Hui Liu;Xiaoming Liu
中科院分区：
文献类型：
--
作者：
Tian Xie;Guan-Hua Tu;Bangjie Yin;Chi-Yu Li;Chunyi Peng;Mi Zhang;Hui Liu;Xiaoming Liu
自2016年以来，美国四大运营商都推出了Wi-Fi通话服务。它们使移动用户能够在基于3GPP IMS技术的Wi-Fi网络上拨打蜂窝电话。与传统的蜂窝语音解决方案相比，其主要区别在于其流量穿越不可信的Wi-Fi网络和互联网。这种暴露于不安全的网络会导致Wi-Fi呼叫用户遭受安全威胁。它的安全机制类似于VoLTE，因为两者都得到IMS的支持。它们包括基于sim卡的安全、3GPP AKA、IPSec等。然而，它们是否足以保证Wi-Fi通话服务的安全？不幸的是，我们的研究给出了否定的答案。我们对美国三大运营商网络中使用商用设备的运营Wi-Fi呼叫服务进行了首次安全研究。我们披露了目前的Wi-Fi通话安全性并非防弹，并发现了三个漏洞。通过利用这些漏洞，我们设计了两种概念验证攻击：电话骚扰或拒绝语音服务和用户隐私泄露；它们都可以绕过现有的安全防御。我们已经通过现实世界的实验证实了它们的可行性，并评估了它们的潜在损害，并提出了解决所有已确定的漏洞的解决方案。
Since 2016, all of four major U.S. operators have rolled out Wi-Fi calling services. They enable mobile users to place cellular calls over Wi-Fi networks based on the 3GPP IMS technology. Compared with conventional cellular voice solutions, the major difference lies in that their traffic traverses untrusted Wi-Fi networks and the Internet. This exposure to insecure networks can cause the Wi-Fi calling users to suffer from security threats. Its security mechanisms are similar to the VoLTE, because both of them are supported by the IMS. They include SIM-based security, 3GPP AKA, IPSec, etc. However, are they sufficient to secure Wi-Fi calling services? Unfortunately, our study yields a negative answer. We conduct the first security study on the operational Wi-Fi calling services in three major U.S. operators networks using commodity devices. We disclose that current Wi-Fi calling security is not bullet-proof and uncover three vulnerabilities. By exploiting the vulnerabilities, we devise two proof-of-concept attacks: telephony harassment or denial of voice service and user privacy leakage; both of them can bypass the existing security defenses. We have confirmed their feasibility using real-world experiments, as well as assessed their potential damages and proposed a solution to address all identified vulnerabilities.