Introduction
Welcome back. In our previous lesson, we examined how an attacker could compromise a user's privacy by tracking their physical device. We saw how attacks like MNmap create a device "fingerprint" from its radio capabilities, and how LTRACK can passively determine a UE's precise location. These attacks focus on identification and tracking.
Today, we shift our focus from privacy to integrity. We will explore how an attacker can go beyond simply listening and actively manipulate the data a user sends and receives. This lesson addresses the learning outcome: Describe user-plane manipulation attacks, such as the aLTEr attack for DNS spoofing.
We'll dissect a famous attack called aLTEr, understanding the fundamental design flaw in LTE that makes it possible, the step-by-step process of the attack, and the clever techniques used to overcome network-level defenses like packet checksums.
1. The Core Vulnerability: Encrypted but Not Integrity-Protected
To understand this class of attack, it's essential to recall the distinction between the Control Plane and the User Plane in a cellular network.
- Control Plane (C-Plane): Manages the connection. It carries signaling messages like RRC commands for radio configuration and NAS messages for session management (e.g., attach, detach).
- User Plane (U-Plane): Carries the user's actual data—the IP packets that make up your web browsing, video streaming, and other application traffic.
LTE's security model treats these two planes differently:
- Control Plane traffic is both encrypted and integrity-protected. This means an attacker can neither read nor modify signaling messages without being detected.
- User Plane traffic is encrypted, but integrity protection is optional and almost never used in practice. This was a design choice by the 3GPP standards body to reduce the data overhead and processing load on devices and the network.
This omission is the critical vulnerability. While an attacker cannot read the user's data, the lack of integrity protection means they can modify the encrypted data in transit, and the network or UE will have no way of knowing it was tampered with.
The following reading provides a concise background on this security gap.
The article 'Breaking LTE on Layer Two' provides an excellent summary of LTE's layer two security. Focus on how it describes the security mechanisms and where the protection for user data falls short.
Please read the section titled Background. Pay close attention to the final paragraph under Security Mechanisms, which explicitly states that while control traffic is integrity protected, user traffic is not. This is the foundation of the aLTEr attack.
2. The aLTEr Attack: Hijacking DNS Requests
The aLTEr attack is a powerful demonstration of how to exploit the lack of user-plane integrity protection. It is an active Man-in-the-Middle (MitM) attack that allows an adversary to redirect a user's internet traffic, typically by performing DNS spoofing. Given your background in web security, you are likely familiar with DNS spoofing; aLTEr is a method to achieve it at the cellular radio layer.
The attack requires a malicious relay—essentially a rogue base station that also acts as a client to the real network—placed between the victim's phone (UE) and the legitimate cell tower (eNodeB).
Let's walk through the attack step-by-step, using the diagram below.
- Setup (Relay): The attacker deploys a malicious relay. The UE connects to this relay, thinking it's a legitimate tower. The relay passes the authentication messages (step 0) between the UE and the real network, so a secure connection is established, but the attacker is now in the middle of it.
- DNS Request (UE to Relay): The user tries to visit a website. Their phone creates a DNS request packet, encrypts it, and sends it over the air. This is U-Plane traffic (step 1).
- Interception and Manipulation (Relay): The attacker's relay intercepts the encrypted DNS packet. It cannot decrypt it, but it doesn't need to. It modifies the still-encrypted packet, changing the bits that correspond to the destination IP address of the legitimate DNS server to the IP address of a malicious DNS server controlled by the attacker (step 2).
- Forwarding (Relay to Network): The relay forwards this altered packet to the legitimate network (step 3).
- Decryption and Mis-delivery (Network): The network decrypts the packet. It now sees a valid DNS request destined for the attacker's malicious server and routes it accordingly (step 4).
- Spoofed Response (Malicious Server): The attacker's DNS server receives the request and replies with a fake IP address (e.g., the IP of a phishing site).
- Response Manipulation (Relay): The relay intercepts the malicious response and may modify the source IP to make it look like it came from the original, legitimate DNS server, before forwarding it to the UE (step 5). The UE now has a poisoned DNS record.
To get a more complete picture of this process, the following reading breaks down the attack flow.
Let's return to the 'Breaking LTE on Layer Two' article. The following sections describe the aLTEr attack as an active attack and explain how the data redirection and DNS spoofing are achieved.
Please read the following sections: Introduction: Briefly re-read to frame the attack. Active Attack: aLTEr: Understands the MitM setup. User Data Redirection: This explains the core mechanism of modifying the encrypted packet. DNS Spoofing: Connects the redirection to the final goal. Results: This section is important as it mentions the attack was implemented using srsLTE, the same software suite we will use later to build our lab.
3. Technical Deep Dive: Malleability and Checksum Manipulation
You might be asking two questions:
- How can you predictably modify an encrypted packet?
- Won't modifying the packet invalidate the IP and UDP checksums, causing it to be dropped?
These are precisely the challenges the researchers solved. Let's dig into the solutions, which will be familiar from your networking and security experience.
Cipher Malleability
The encryption algorithm used for the LTE user plane is AES in Counter Mode (AES-CTR). In CTR mode, the algorithm generates a "keystream" which is then XORed with the plaintext to produce the ciphertext.
This means that if you XOR the ciphertext with a "manipulation mask," the resulting plaintext will be XORed with the same mask upon decryption.
The attacker knows the original plaintext (the IP address of the provider's default DNS server is public or easily found) and the desired new plaintext (the IP of their malicious server). They can therefore compute the exact mask needed to flip the right bits.
Checksum Manipulation
This is where the attack gets really clever. As you know, an IP packet with an invalid header checksum will be dropped.
The IP header checksum is a 16-bit sum of all the 16-bit words in the header. If you change one field (the destination IP), the sum changes. The solution is to make a compensating change in another field you can control or predict.
- For uplink packets (UE to network): The attacker can also modify the Time To Live (TTL) field. They know the default TTL set by the phone's OS. They can calculate a new TTL value that, when added to the new IP address, results in the same original checksum.
- For downlink packets (network to UE): The TTL is unknown. Here, the attacker can use the IP Identification field. Since the attacker controls the malicious server, they can set the Identification field in the response packet to a specific value that compensates for the change they will make to the source IP address.
- For the UDP checksum: The trick is even simpler. If the UDP checksum field is set to zero, the receiving network stack is supposed to skip the checksum validation. The attacker simply zeros out this field in the malicious DNS response.
It's worth noting that IPv6 does not have a header checksum, making this part of the attack trivial over an IPv6 connection.
The following reading from the full research paper explains these technical challenges and solutions in detail. It's a dense read, but it provides a satisfying explanation of how the attack works at a low level.
[PDF] Breaking LTE on Layer Two | Montsecure
The full research paper, 'Breaking LTE on Layer Two', provides a fantastic technical breakdown of the challenges in executing the ALTER attack and how they were solved. This will connect directly with your knowledge of network protocols.
Please read Section IV-B, 'Challenges'. Focus specifically on subsection 3) Packet Modification. This section explains how the manipulation mask is calculated and, crucially, how the IP and UDP header checksums are compensated for.
Conclusion
In this lesson, we moved from attacks on privacy to a direct attack on data integrity. By dissecting the aLTEr attack, we have seen how a seemingly minor design decision—omitting mandatory integrity protection on the user plane—can be exploited to completely undermine a user's traffic.
Key Takeaways:
- The LTE user plane is encrypted but lacks mandatory integrity protection, creating a significant vulnerability.
- The aLTEr attack is a Man-in-the-Middle attack that exploits this flaw to manipulate user data in transit.
- It leverages the malleability of AES-CTR encryption to modify encrypted packets without the key, redirecting DNS requests to a malicious server.
- The attack cleverly bypasses IP and UDP checksums by making compensating modifications to other header fields (like TTL) or by zeroing out the UDP checksum.
- This attack demonstrates that even with strong encryption, the absence of integrity verification can lead to a total loss of security. The 3GPP has since made user-plane integrity protection a mandatory-to-support feature in 5G, though it is still up to operators to enable it.
Preview of the Next Lesson:
We have now seen attacks on privacy (tracking) and integrity (data manipulation). The final category of attacks we will cover in this module is those targeting availability. In our next lesson, we will explain denial-of-service attacks against LTE, such as spoofing NAS reject messages, to understand how an attacker can prevent a user from accessing the network altogether.