IMP4GT: IMPersonation Attacks in 4G NeTworks

IMP4GT: IMPersonation Attacks in 4G Networks and Implications for 5G Security

**Overview**

David Ruprecht, PhD student at Ruhr University Bochum, presents IMP4GT (IMPersonation Attacks in 4G neTworks), a practical attack enabling network impersonation and user traffic interception in LTE networks. The attack exploits a fundamental architectural vulnerability: user-plane data is encrypted using stream ciphers but lacks integrity protection, creating "malleable encryption" where an active man-in-the-middle attacker can predictably modify encrypted traffic without detection. By positioning themselves between the phone and base station, attackers can redirect DNS requests to malicious servers, steal user credentials, and perform transparent man-in-the-middle interception. The talk demonstrates two attack vectors: ALTER (impersonating DNS services via packet bit-flipping) and the full IMP4GT attack (complete network impersonation). Critically, the LTE authentication protocol (AKA—Authentication and Key Agreement) authenticates the network to the user, but the research reveals this protection can be bypassed through relay attacks. The implications are severe: industrial IoT devices and first responders relying on LTE for mission-critical communication are vulnerable. The research raises urgent questions about 5G security, which uses similar cryptographic primitives; if 5G's control plane is integrity-protected but user plane isn't, similar vulnerabilities may persist in next-generation networks.

**Technical Details**

LTE Network Architecture and Security Goals:

1. **LTE Network Components**: - User Equipment (UE/phone) connects to closest eNodeB (evolved NodeB/base station) - eNodeB connects to broader LTE network infrastructure - IP network provided to phone is separated via firewall from public internet - Incoming internet connections blocked at network boundary (firewall prevents external access to phone) - Outgoing connections from phone traverse through network gateway to internet

2. **Fundamental Security Aims**: - **Mutual Authentication**: Ensures phone connects to correct provider; ensures provider verifies phone is authorized customer (prevents impersonation) - **Traffic Confidentiality**: Prevents passive eavesdropping on phone calls and data connections (radio link encryption protects against passive eavesdropping) - **Identity and Location Confidentiality**: Attacker should not determine identity from radio signals alone; attacker should not identify location from phone number only (prevents tracking and identification)

3. **Security Implementation Basis**: - All security based on shared secret key stored in SIM card and phone network's home network (secure location) - At beginning of each connection, Authentication and Key Agreement (AKA) protocol establishes security - AKA protocol mathematically proven secure; derives encryption/integrity keys for rest of connection - Keys used to protect both control-plane traffic and user-plane traffic

4. **Distinction Between Control Plane and User Plane**: - **Control Plane**: LTE-specific signaling traffic (handovers between cells, network management, authentication messages) - Encrypted with stream cipher - Integrity protected (bitflips detected) - **User Plane**: IP data traffic from applications (web browsing, email, video streaming, user apps) - Encrypted with stream cipher - NOT integrity protected (bitflips undetected) - Critical asymmetry: user data lacks integrity protection despite encryption

Stream Cipher Encryption and Malleable Encryption Vulnerability:

5. **Stream Cipher Operation**: - Plaintext XORed with pseudorandom key stream (counter-mode AES) - Results in ciphertext transmitted over radio - Decryption: ciphertext XORed with same key stream (generated with same parameters) yields plaintext - XOR property: if attacker knows plaintext P and ciphertext C, attacker can calculate C' = C XOR P XOR P' to transform plaintext to desired P'

6. **Malleable Encryption Weakness**: - Without integrity protection, active attacker can flip bits in ciphertext in-transit - Bit flips in ciphertext manifest as same bit flips in plaintext after decryption - Attacker can deterministically modify plaintext by knowing original plaintext content - Example: changing single bit in JE (Jump-if-Equal) instruction to JNE (Jump-if-Not-Equal)

7. **Key Insight: Known Plaintext Attack**: - Most vulnerability depends on attacker knowing plaintext content - LTE provides natural source of known plaintext: default DNS servers set by each carrier - All carriers publish default DNS server addresses for LTE networks - Every DNS query has distinctive packet length (much shorter than typical TCP traffic) - Attacker can reliably identify DNS packets and calculate transformation mask

ALTER Attack: DNS Redirection via Malicious Bit-Flipping:

8. **Attack Setup**: - Attacker positions as man-in-the-middle between phone and base station - Attacker performs initial network relay (similar to IMSI-catcher relay attack) - Phone authenticates network identity via AKA protocol (authentication succeeds) - Relay transparently forwards authentication handshake between phone and real network

9. **Attack Vector: DNS Request Interception**: - User makes DNS request (e.g., visiting website) - Attacker identifies DNS packet by distinctive short length - Attacker calculates XOR mask: mask = known_plaintext_dns XOR malicious_ip - Attacker XORs ciphertext with mask in transit - Base station receives modified ciphertext, decrypts using same key stream - Result: plaintext contains altered destination IP (malicious DNS server) - Network cannot detect manipulation (no integrity protection)

10. **Credential Harvesting via Malicious DNS**: - Modified DNS request reaches malicious DNS server (attacker-controlled) - Malicious DNS responds with IP of attacker's web server - Phone connects to attacker's website (thinks it's legitimate site) - Attacker presents login prompt - User enters credentials thinking they're legitimate - Attacker captures username/password

11. **Layered Encryption**: - DNS request encrypted by LTE radio layer (over-the-air) - DNS response encrypted by LTE radio layer - Response forwarded through relay to phone - User sees encrypted content on radio, but plaintext content is attacker-controlled - Encryption visible in radio layer but doesn't provide authentication guarantee

IMP4GT Attack: Full Network Impersonation:

12. **Complete Impersonation Setup**: - Attacker with IMSI-catcher or software-defined radio impersonates legitimate base station - Phone connects to attacker's fake eNodeB believing it's network - Attacker relay intercepts all traffic between phone and legitimate network - All authentication occurs transparently (relay forwards messages unchanged) - Phone authenticates with legitimate network backend through relay

13. **Transparent Traffic Interception**: - All packets relayed between phone and network - User plane packets encrypted with keys known only to network (relay cannot decrypt) - However: relay can exploit malleable encryption weakness - Relay can flip bits in ciphertext deterministically (if plaintext known) - Relay can modify encrypted user plane traffic without detection

14. **Scale of Vulnerability**: - Industrial IoT devices communicating via LTE vulnerable - Factory control systems using LTE connections vulnerable - First responders relying on LTE networks vulnerable - Any application sending DNS, HTTP, or other protocols with known plaintext vulnerable - Passive eavesdropping via legitimate encryption defeated; active attacks bypass integrity check

15. **Why 2G Still Vulnerable**: - 2G networks lacked network authentication entirely (no AKA equivalent) - IMSI-catcher attacks in 2G require no relay (attackers simply impersonate network) - LTE improved situation with mandatory network authentication, but user-plane integrity gap remains

5G Implications and Future Vulnerability:

16. **5G Dependency on LTE Foundations**: - 5G networks built on LTE foundations and use similar cryptographic primitives - 5G inherits LTE security architecture in many respects - If 5G maintains unintegrity-protected user plane, similar attacks may be viable - Control plane in LTE/5G is integrity-protected (prevents some attacks) - User plane remains encryption-only in many 5G implementations

17. **Architectural Questions for 5G**: - Will 5G implement integrity protection for user-plane traffic? - Will relay attack defenses prevent IMSI-catcher-style interception? - Can authentication vulnerabilities in 5G be exploited similarly?

**Defense & Takeaways**

Defending against LTE network impersonation and man-in-the-middle attacks: (1) **Implement integrity protection for user-plane traffic**—modify LTE architecture to require integrity tags (MAC) on all user-plane packets; add 4-byte integrity tag to every encrypted packet; prevents bit-flipping attacks; (2) **Deploy integrity verification at base station**—base stations must verify integrity tags before decrypting; reject any packet failing integrity check; (3) **Enforce mutual authentication rigorously**—ensure user must verify network certificate/identity; current implementation trusts network after authentication but doesn't provide user-visible indication; (4) **Use HTTPS/TLS everywhere**—application-level encryption provides defense-in-depth; even if LTE layer compromised, HTTPS encrypts application traffic end-to-end; (5) **Certificate pinning for critical apps**—applications accessing sensitive data should pin server certificates; prevents phishing attacks via DNS redirection; (6) **DNS security (DNSSEC)**—enable DNSSEC validation on devices; prevents spoofed DNS responses; carrier-level DNS should implement DNSSEC; (7) **VPN for sensitive traffic**—industrial IoT and first responder applications should tunnel all traffic through VPN; adds encryption and authentication layer independent of LTE security; (8) **Detect relay attacks via timing analysis**—relay introduces measurable latency in authentication protocol; implement timing anomaly detection in network; (9) **Frequency fingerprinting for eNodeB verification**—different base stations have slight frequency calibration differences; implement secondary authentication based on frequency signatures; (10) **Monitor for suspicious DNS patterns**—network operators should monitor for unusual DNS destinations accessed by phones; DNS redirects to unusual IPs suggest attack; (11) **Limit default DNS server trust**—evaluate whether hardcoded carrier DNS servers are necessary; prefer user-configurable DNS; (12) **Passive monitoring for mitigation**—cannot fully prevent relay attacks but can detect unusual traffic patterns (phones accessing non-standard services during non-typical times); (13) **5G security hardening**—ensure 5G control plane and user plane both implement integrity protection; don't repeat LTE's user-plane integrity gap; (14) **Device-level protections**—phones should monitor for protocol anomalies; detect if network lacks expected authentication; warn user if untrusted network detected; (15) **Organizational security policies**—enterprises with mission-critical LTE usage (first responders, industrial) should implement defense-in-depth (VPN, DNSSEC, certificate pinning); assume LTE network layer may be compromised.

The core vulnerability: Stream cipher encryption without integrity protection creates "malleability"—attackers can predictably modify plaintext by transforming ciphertext, provided they know original plaintext. LTE's design encrypts all user data with stream ciphers but protects only the control plane with integrity tags. This was acceptable in a world of passive eavesdropping, but modern attackers (nation-states with IMSI-catcher equipment, or attackers with radio access) can position themselves as active man-in-the-middle. The attack is subtle because encryption is present, but encryption without authentication is insufficient against active attackers. The fact that LTE addresses 2G's mutual authentication gap creates false confidence, but the user-plane integrity gap remains exploitable. Industrial IoT adoption of LTE, first responder reliance, and critical infrastructure connectivity through cellular networks make this vulnerability high-consequence. The research should motivate 5G and future network designs to implement integrity protection for all traffic, not just control plane. The takeaway: encryption is not authentication; security architecture must account for active attackers, not just passive eavesdroppers.