Hacker News Reader

Comment by iaw | Hacker News Reader

Does anyone know the encryption schema of LTE? Does the key change with each message or is it for a longer period of time? I'm wondering how feasible it is for an attacker to capture and then break the encryption (obviously if we're talking 2048-bit that wont be happening anytime soon)

View on HN

The authentication model is based on Radius with EAP, the main point is that anything after and including 3G does mutual authentication and in 4G/5G this is based on IETF protocols, in theory, you can associate with 4G network with whatever authentication supplier that works with WPA-Enterprise (and in theory that even works the other way around). The idea there is that 4G/5G is simply an physical layer for Ethernet2 frames with some kind of access control and QoS layer. And quite obviously the frames are encrypted and authenticated on L2. And as the whole thing is IP, some carriers just tunnel the whole thing in additional layer of IPSec tunnels.

This looks like a good overview of the subject. https://www.eecis.udel.edu/~salehi/files/asee13_lte.pdf

It’s a key set per session. See https://arxiv.org/pdf/1510.07563.pdf to answer your other question

why bother? Just force the handset down to 2G and intercept that.

2G is deprecated so a lot of the newer phones won’t even support that..?

I can't even turn off 2G on my relatively new Samsung handset, so I find it hard to believe it is "deprecated".

There are likely zero 2G towers in my area, but that doesn't mean handset suppliers don't ship it still.

As long as there are countries with GSM service, it's not going to stop being shipped.

Yea relatively speaking…

On an Android smartphone you can disable it usually, via *#*#4636#*#*

There's a frontend for this on F-Droid if you prefer that [1]

[1] https://f-droid.org/en/packages/pl.lebihan.network/

This doesn't work on Samsung phones

Not really no. Newer phones absolutely support 2G.

There is nothing to intercept on 2G in Canada and USA, 2G was decommissioned.

These attacks are generally carried out by a “rogue base station” that simulates being a cell tower. It doesn’t require that there be a local 2G infrastructure.

SIMs from my two different Canadian operator doesn't allow downgrade to 2G for the home networks.

That's pretty cool, any idea how it works?

Authentication profiles. Basically one can specify on the SIM profile that for the certain PLMN (mobile operator) only certain authentication methods are allowed (2G, 3G, 4G use different auth methods).

that is good. from what i understand we dont have that in the US

What prevents these from simulating a non-"home" network?

You could by suddenly roaming when you're in your home country is a massive red flag and even normal people are aware and terrified of roaming fees.

Are you sure your information isn't outdated by a decade or two? Providers have free roaming data nowadays, e.g. https://www.t-mobile.com/support/coverage/domestic-roaming-d...

...and that also locked to a certain auth profiles in Canada.

Most of the world isn't the U.S. E.g. in the UK operators recently rescinded free roaming in the EU.

The EU? Weren't we talking about the US and Canada in [1]?

[1] https://news.ycombinator.com/item?id=35953970

The decommission of 2G/3G and removal of downgrades applies pretty much everywhere these days (my operator doesn't even allow 3G downgrades on their 5G plans), I read it as just an example rather than starting a very specific conversation.

That's the towers. All the handsets still support 2G, and will happily let themselves be downgrade-attacked to it.

2G lacks even the most rudimentary authentication, so you don't even have to try to look like a tower once you've done this. Just say you're a tower.

Surely a phone would rather connect to a moderately strong 3/4/5G tower than a very strong 2G tower, right? So that'd limit you to settings where people otherwise wouldn't have a connection at all. IDK, genuinely curious.

i hope that would be expensive, isnt it?

Reply on news.ycombinator.com