Show Me Your Attach Request and I'll Tell You Who You Are: Practical Fingerprinting Attacks in 4G and 5G Mobile Networks

Abstract

Both attacks are valid for 4G and 5G NSA. 4G will most likely relevant for many years to come. Even if 4G networks will be deactivated in several of years (as it is with GSM or UMTS networks right now), the baseband chips on the UE side will still support 4G and will be prone to 4G-based attacks in the future. In this paper, we leverage a previously introduced vulnerability for 4G mobile communications and present new means for its exploitation. Based on the vulnerability, we introduce a fingerprinting technique and two new attacks to demonstrate how the privacy of mobile devices may be compromised during the initialization procedure of 4G and 5G NSA mobile commu-nications. For this, we exploit information that is exposed in the attach request of the attach procedure sent from a mobile device to the network. This is particularly critical because the confidentiality of this information is not cryptographically protected. In our experiments, we evaluate our attacks against a set of approximately 110 mobile phones from 22 different vendors. Please note that we use pseudonyms (Vendor A etc.) to refer to device vendors to not disadvantage vendors. We demonstrate that our attacks enable to re-identify previously observed mobile devices for tracking purposes and to identify the device vendor and model, respectively, to derive potential sensitive information for tracking their owners.