TL;DR
This paper introduces VWAttacker, the first systematic framework for security testing Voice over WiFi (VoWiFi) user equipment (UE). It leverages a novel LLM-based approach for property extraction and adversarial testing to uncover critical vulnerabilities in VoWiFi implementations, leading to the discovery of 13 security issues across 21 UEs.
What Problem Does This Paper Address?
Voice over WiFi (VoWiFi) is increasingly used to extend mobile network coverage, especially indoors. However, the security of VoWiFi user equipment (UE) implementations has not been systematically analyzed. Existing research often focuses on protocol specifications or specific aspects of cellular networks, lacking a comprehensive framework and testbed for real-world VoWiFi UEs. This gap leaves users vulnerable to privacy leaks and compromised communication channels.
Methods
The core of VWAttacker is its systematic, adversarial, and property-guided testing approach. Key components include:
- VoWiFi Network Testbed: A custom-built testbed using open-source software (StrongSwan, Kamailio) that emulates the necessary network infrastructure (ePDG, IMS, HSS) to interact with Commercial-Off-The-Shelf (COTS) UEs. This testbed allows for controlled injection of adversarial messages.
- TESTGEN (Testcase Generation): This module addresses the challenge of manual property extraction. It uses a Retrieval Augmented Generation (RAG) approach with Large Language Models (LLMs) to semi-automatically extract security properties from VoWiFi specifications. These properties are then encoded into Primary Test Cases (PTCs).
- Adversarial Testcase (ATC) Generation: PTCs are transformed using message-level and attribute-level mutations to create ATCs. These transformations aim to uncover vulnerabilities by altering message content, order, or attributes.
- Decision Oracles: Two deterministic oracles—a "Function oracle" and a "Liveness oracle"—automatically detect property violations by analyzing logs from the testbed. The Function oracle flags unexpected UE behavior, while the Liveness oracle checks if the UE can recover and continue normal operation after an attack.
Datasets
The paper does not explicitly mention training datasets for LLMs. However, it utilizes a comprehensive set of 11 VoWiFi-related specification documents (3GPP technical reports, IETF RFCs, and conformance test specifications) as the source for property extraction. The evaluation is performed on 21 commercial VoWiFi UEs from 14 different vendors.
Key Insights and Ideas
- LLMs for Security Property Extraction: The paper demonstrates the effectiveness of LLMs, combined with RAG, for semi-automatically extracting complex security properties from technical specifications, significantly reducing manual effort and increasing the scope of testing.
- Adversarial Testing on COTS UEs: Building a realistic testbed that can interact with black-box commercial UEs is crucial for uncovering real-world vulnerabilities.
- The Importance of Side-Channel Oracles: In the absence of formal models, deterministic oracles are essential for automatically detecting subtle security violations and ensuring the reliability of test results.
- VoWiFi Implementations are Vulnerable: The study reveals that many commercial VoWiFi UEs have significant security flaws, ranging from supporting weak cryptographic algorithms to exposing sensitive user information.
Key Results
VWAttacker evaluated 21 UEs and uncovered 13 distinct security issues. Notable findings include:
- Support for Weak/Deprecated Algorithms: Several UEs were found to support and accept weak encryption (e.g., DES) and integrity algorithms (e.g., MD5) in both IKEv2 and SIP protocols.
- DH Key Security Bypass: Some UEs allowed for the bypass of Diffie-Hellman (DH) key security, enabling attackers to potentially steal the UE's IMSI.
- Nonce Bypass: The absence of a nonce in IKEv2 messages was exploited, potentially reducing the entropy of the secure channel.
- DH Group Downgrade: Certain UEs were susceptible to DH group downgrade attacks, allowing attackers to force the establishment of weaker encryption channels.
One of the discovered vulnerabilities has been acknowledged by MediaTek with high severity.
Limitations and Future Work
- Limitations:
- The LLM-based property extraction, while semi-automatic, still requires some manual effort for prompt engineering and initial property examples.
- The testbed is primarily focused on the control plane aspects of VoWiFi; media plane security is not explicitly covered.
- The study acknowledges that some issues might be related to ePDG misconfigurations rather than solely UE implementation flaws.
- Future Work:
- Expanding the framework to cover media plane security.
- Further automating the LLM prompting process.
- Investigating the impact of these vulnerabilities on cellular network security more broadly.
- Developing mitigation strategies for the identified issues.