A Newly Discovered LTE Vulnerability Makes It Possible to Impersonate Mobile Devices and Their Owners
Onе of the key roles of IT security specialists and researchers nowadays is not only to develop countermeasures to existing threats and attacks but to discover weaknesses in essential IT systems and to take measures to prevent bad actors from exploiting said vulnerabilities. This is exactly what the researchers from the Ruhr Universität Bochum and New York University Abu Dhabi have done recently with IMP4GT.
Dubbed IMP4GT (Impersonation Attacks in 4G Networks), this method of attack was devised by IT security specialists as a way to impersonate mobile devices on 4G and 5G mobile networks.
In its essence, IMP4GT is a “man-in-the-middle” type of attack, in which the attacker injects themselves as the middle link between the base station the mobile device, and proceeds to impersonates the mobile device when talking to the base station and vise versa.
IMP4GT targets LTE networks, exploiting a vulnerability in the way that they communicate with and authenticate mobile devices connected to them. Researchers who worked on the project found a way to impersonate a mobile device, which gave them a limited ability to, for instance, register for services in someone else’s name or impersonate someone else when carrying out illegal activities.
Fortunately, even if an attacker were to interpose themselves between their victim and the mobile network, they still wouldn’t have free reign over the victim’s device. The couldn’t, for instance, just break into the victim’s Gmail, because they’d still need to access the service in the normal manner.
David Rupprecht, Ruhr-University Bochum Chair for Systems Security assures that the data one could reliably extract in this manner is not negligible, but is unlikely to compromise the victim’s security and privacy completely.
Additionally, since this is a vulnerability that can affect both 4G and 5G networks, the potential of IMP4GT attacks carried out on the newer form of network also exists.
The Good News
IMP4GT and other similar attacks are not something that will likely threaten the general public any time soon, if ever. The security researchers that worked on the project discovered the vulnerability, and already steps have been taken to prevent it from becoming a vector of attack. However, even in 4G’s current state, this type of attack is very difficult to carry out. The attacker would need to have very powerful and specialized equipment to do so - and this includes both software and hardware tools. Additionally, they would need to be in close proximity to the device they wish to impersonate in order to hijack the connection. All of these are well beyond the means of most cyber-criminals, even if they had the inclination to use this sort of attack. However, the possibility of high-value targets being impersonated in the meantime is still out there.
