VoLTE Phreaking
summary
Research shows VoLTE SIP signaling exposes real weaknesses across European networks: on rooted Android devices the RMNET1 IPv6 interface carries SIP over an IPsec tunnel whose keys can be extracted from the kernel (ip xfrm state), loaded into Wireshark, and decrypted with tcpdump/tshark. Findings include SipWatcher app (GitHub) to capture headers, null or weak IPsec (null, MD5, two‑key 3DES), SMS replay and subscriber enumeration via low‑entropy tokens, IMEI leaks, and cell‑ID/LAC in Access‑Network‑Info headers enabling coarse location and a theoretical SIM‑sharing challenge relay.
AI-written summary · about
chapters (9)
- 0:00History of phone phreaking
- 5:29Digital transition and 2G
- 7:08Security of 3G networks
- 8:36VoLTE and IP signaling
- 11:51Provider vulnerability analysis
- 15:21Capturing and analyzing SIP
- 19:35VoLTE attacks and privacy
- 25:01Sip Watcher tool demonstration
- 27:49Conclusion and Q&A
related talks
48mMobile Network Hacking, IP Edition
44mLTE And IMSI Catchers: Then And Now
53mVoIP Wars: the Phreakers Awaken
08mHacking 4G and how to get arrested in 10 minutes
54mExposing device features on 4G & 5G networks
01h 06mLTE & IMSI Catcher Myths
21mHanging on the Telephone: Hacking VoIP
40mWeaponizing Mobile Infrastructure: Are Politically Motivated Cyber Attacks a Threat to Democracy?