WHITEPAPERCYBERSECURITY
SMS DOESN´T STAND FOR
SECURE MESSAGING SERVICE:SMS (IN)SECURITY REVISITED

1 | Cybersecurity

Authors
Anders Olof Möller
Fernando González Trigo
Julio Negueruela Palomo
Juan Jurado Cuesta

Contact
Anders Olof Möller
anders.olofmoller@dekra.com
Antonio Vizcaíno Gómez
antoniodavid.vizcaino@dekra.com

Want to know more?
Visit our website or
get in touch with
our Experts!
About Digital & Product Solutions
Innovating safety and security by creating the intelligent
testing solutions that contribute to making the digitalized
and connected world a safer place. We are the experts intesting and certifying products and new digitaltechnologies.
We deliver solutions from Cybersecurity, Artiﬁcial
Intelligence, Big Data, to Connectivity, Product Safety,
Electromagnetic Compatibility & Radiofrequency, Product
Certiﬁcation, Medical Devices and Automotive Testing.
Through a global network of 48 state-of-the-art test
laboratories and facilities, we oﬀer a broad portfolio of
product testing services based on national andinternational standards as well as industry and customer
requirements.
www.dekra-dps.com

2 | Cybersecurity

SMS, Short Message Service, is an extremely successful communication
service for text messages between mobile devices that was introducedin the early 1990s. Behind its success is the simplicity, reliability and thepossibility to communicate with almost any mobile device in the world. It
is commonly used for a large number of diﬀerent applications including
personal and business communication, service alerts, second factor
authentication and increasingly also between applications. However, SMS
security has severe limitations. For example, texts sent via SMS have nobuilt-in encryption and authentication. Further, while SMS is a good
option for some use cases, there are more secure options for others. This
includes secure communications and second factor authentication. In thispaper, security threats against SMS from a user perspective are analyzed.

1

Executive summary and outlineof paper

UE 1

1

Base
Station2

Base
Station3

UE 2

Communication
Network

Figure 1 Sending Basic SMS over a mobile network.

The SMS functionality was ﬁrst developed as a part of the
Global System for Mobile Communications (GSM) standard
more than 30 years ago and has since its introduction been
included also in the following generations of mobile networks [1]. When the SMS protocol was introduced, the security aspects were not as critical as they are today. Since
then, the technology and threat landscape has evolved considerably, while the security of SMS is still dependent on thelegacy security principles used when it was ﬁrst designed.
As a comparison, there are many modern communication
applications that implement state-of-the-art end-to-end security with methods that are appropriate for the modern
threat landscape.
A conclusion in this paper is that the SMS protocol cannot
guarantee the basic security properties typically requested
by a user of a message service. This includes the conﬁdentiality, integrity and authenticity of the messages. Instead,the user places its trust in the security of the radio access, inthe security of the network and in the secure managementof the user data by the operator. These trust assumptions
can typically neither be veriﬁed by the user, nor be detected
if they are violated.
Related to the user trust assumptions there are vulnerabilities that can be exploited by attackers and a review of reported attacks shows that attacks are being executed in real
networks. Examples of this include SMS interception, SMS
spooﬁng, SMS denial of service and location tracking using
SMS functionality. The practicality and low level of cost andeﬀort needed to perform these attacks are demonstrated
through the implementation of a number of proofs-ofconcept.
3 | Cybersecurity

Given the security concerns, a user of SMS may reconsider
in which situations to use and how to interpret SMS. This isespecially important for messages that contain informationthat can be sensitive for private or ﬁnancial reasons, and forthe use of SMS as a second authentication factor. In both
mentioned cases there are other applications that usually
can replace the functionality of SMS and that can guarantee
the security end-to-end.

1.1

OutlineIn the ﬁrst part of the paper, an introduction to SMS security
is given, where the importance of SMS security is described.
A comparison with an ideal, secure messaging application
is presented from a security perspective.
Section 3 provides a brief introduction of mobile networks
and SMS in mobile networks. A more detailed descriptionof the SMS functionality in diﬀerent generations of mobile
networks is given in Appendix B for completeness.
An SMS threat analysis in Section 4 is based on identiﬁeduser trust assumptions. The user trust assumptions identiﬁed are treated in three areas:
trust in the security of the radio channel to the
network,trust in the security of the core network andtrust in the operators´ management of user
data.
Threat scenarios related to the trust assumptions are described and illustrated.
This is followed by a section with a review of real, publicly
reported attacks on SMS security from a user perspective.
Finally, a number of proofs-of-concept attacks have been
implemented, which provide insight into the low level ofcost and skills actually needed by an attacker to performthese attacks.

2

Introduction to SMS security
This section provides ﬁrst a motivation of the importanceof SMS security from a user perspective. This is followedby some basic concepts necessary to understand SMS
security. The security properties of the SMS protocol isthen compared to those of an ideal secure protocol andto typical state-of-the-art communication applications.

2.1

Conﬁdentiality: Only the intended user can readthe plain text.
Integrity: The receiving user can verify that themessage is not modiﬁed.
Authentication: The receiving user can verify
the sender’s identity.

User assets

A motivation for studying the security of SMS is based on
the type of information that can be included in SMS andthe consequences that attacks on the SMS security could
have for the users.
Examples of types of information that can be handled in
SMS for a user are provided below.
Personal information
Financial information
Authentication credentials, such as username,passwords and one-time passwords used forsecond factor authentication
Conﬁdential information of personal andbusiness nature
An attack on the security of SMS could lead to the loss of thisinformation, but additionally give further consequences aslisted below.
Privacy violation
Part of identity theft
Personal of corporate ﬁnancial losses
Damage of reputation
Non-authorized access to services
In summary, there are user assets that are protected by
the SMS security, and if the security is violated, this canhave important negative consequences for the SMS user.

2.2

Most secure communication protocols implement atleast the following security properties:

Basic security concepts

To understand the security of SMS, understanding thebasic security concepts and the trust model of mobile
networks is important.

4 | Cybersecurity

The table below maps reasonable user questions about
SMS security and the corresponding security terminology.
Question

Security property

Can I trust that no one else can read my SMSs?
Integrity
Can I trust the identity of the sender of the SMS that I receive?

Authenticity

Can I trust that SMSs sent really get to their intended destination?

Availability

Can I be located through the SMS services of the mobile network?

Privacy

Table 1 Typical user requirements on message security with thecorresponding security property.

Trust relationships, and the failures of them, are the basis
for many of the vulnerabilities and attacks present in mobile
networks.
Security properties that cannot be veriﬁed and security thatis dependent on another entity will be referred to as (security) trust assumptions in this paper.
Using trust assumptions may be motivated in speciﬁc applications, but is vulnerable if any trusted party fails. The SMS
protocol has no built-in security but instead relies on trust
assumptions and possible security functions of other layersof communication.
The typical way to gain trust in security for communication between two end users is through security properties that are veriﬁable to the same end users. This canbe achieved with cryptographic functions and the use ofcryptographic keys for conﬁdentiality, integrity and authenticity. Trust is then limited to hold between the end users
and to the strength of the cryptographic algorithms, thesecrecy of the cryptographic key and in the security of thecommunication protocol. In fact, in diﬀerent forms this isthe basis for most secure communication in our modern society. More information about cryptography and veriﬁable
trust can be found in Appendix A.

2.3

Comparison of SMS and securecommunication protocols

In this section the SMS security properties are compared to those of an ideal secure communication protocol
and to typical secure communication applications. This isshown in Table 2.
Security property \ Protocol

SMS

Ideal protocol

No*

Yes

Integrity

No*

Yes

Authentication

No*

Yes

Table 2 Comparison between SMS and an ideal messaging protocol
in terms of security properties.
* There is no built-in security functionality in the SMS protocol.
However, there can be other security measures, such as security
functions for other layers of communication for parts of the SMS
delivery.

Most modern mobile phones use a large set of diﬀerent
applications, including for secure communications. These
applications can provide secure end-to-end communications between users, including conﬁdentiality, integrity
and authenticity.

5 | Cybersecurity

While the user experience may not diﬀer noticeably between messaging through a communication application
and using SMS, there may be a large diﬀerence in how
the message is processed, which aﬀects the security
properties. A short summary of the typical diﬀerences interms of keys and connectivity is given in the table below.
Messaging
function

Keys location

Key esablishment

Connectivity

Security

Application

On the phone

Asymmetricmethods

Internetconnectivity

End-to-end,

SMS

On the SIMcard

Shared key withthe operator

Mobile network
connectivity

Based on security
assumptions andintegrity and authenticity

Table 3 Comparison between a typical application for secure communication and SMS in terms of key management, connectivity andsecurity.

In particular, it is noted that SMS security is based on user
trust assumptions that cannot be veriﬁed by the user.
This trust model and its vulnerabilities will be further investigated in Section 4.
The use of second factor authentication in highly recommended and using SMS is far better than using none. However, in some cases a user can choose between diﬀerent
options, and there are more secure options than SMS. Guidance on the availability of authentication methods can befound in the 2FA Dictionary [2].

3

SMS over mobile networks
In this section, a schematic overview of how SMS is handled
by mobile networks is described. This is needed in order tounderstand the concepts of the security of SMS. In Appendix B more information about the mobile networks from
GSM to 5G and more speciﬁcs on how the SMS protocol isimplemented in the networks can be found.

The core network handles other functions necessary to provide services. This includes user authentication, call set-up,
roaming, billing, policy control and interconnection to external networks such as the Internet or other mobile networks.
The SMS handling across diﬀerent networks is also handled
by the core network.

Common for mobile networks are a division into two mainparts based on their main functionality, the radio accessnetwork and the core network.

For SMS, there are similarities in how they are handledacross the generations of mobile networks. In its simplest
form, an SMS is transmitted from one user, via the mobile network, to an SMS Center (SMSC). The SMS Center thendelivers the SMS via the network to the recipient. Becauseof this two-step procedure, the SMS protocol is sometimes
referred to as store-and-forward, as opposed to for example
a session-based connection between sender and receiver.

External
Network

Radio AccessNetwork (RAN)Core Network (CN)Figure 2 Illustration of the main components of a mobile network, theRadio Access Network (RAN) and the Core Network (CN).

The radio access network handles the wireless communication between base stations and the mobile users. This comprises the physical equipment, for example base stations,the protocols and algorithms for reliable radio transmission, such as coding, frequency allocation and transmission
power control. Furthermore, functionality such as handover,when a user moves between base stations, is also often
handled in the radio access networks. The security of thewireless link is also typically implemented here.

6 | Cybersecurity

There are diﬀerent methods of SMS handling for each generation of mobile network. This includes the initial wayof sending SMS in the control channel introduced for theﬁrst SMS functionality in GSM, to packet-switched SMS
handling in later generations of mobile networks. In Appendix B, these ways of sending SMS are introduced in a
step-by-step manner, following the development of themobile networks.

4

Threat analysis of SMS security
based on the trust model
From a user perspective, there are three main areas oftrust that are identiﬁed for SMS security in mobile networks.
1.
2.
3.

Trust in the security of the radio access to the
network.
Trust in the security of the core network.
Trust in the operators’ secure management ofuser data.

An important point is that the veriﬁcation of these assumptions on trust is out of the user control. The user is typicallyunable to prevent any attacks based on the vulnerabilities
that the failure of these trust assumptions could cause. Additionally, the user is also unable to detect a possible attack
in most cases.
The threat scenarios following from the vulnerabilities
based on the user trust assumptions are explained in thefollowing. For each threat scenario, attackers with diﬀerent capabilities are introduced. Later, attacks based on thethreat scenarios will be presented and complemented with
proofs-of-concept for a number of attacks. The threat scenarios in this section does not claim to include every possible
threat, but illustrate one way to represent relevant threats
for SMS users.

4.1

Threat scenario 1
The ﬁrst threat scenario involves an active attacker withinradio range, that presents itself as the mobile network to
the mobile. The attacker can then present itself as a legitimate user to the real network in a man-in-the-middle attack. The man-in-the-middle could forward the messages
to each party, having the ability to e.g. intercept, modify
and stop communication, including SMS.
This is a threat for 2G, or after performing a downgrade
attack from 3G/4G/5G to 2G, for two reasons.
There is no mutual authentication in 2G, e.g. noway for the mobile to verify the identity of the
network.
Additionally, the cryptographic algorithms usedin 2G are provenly weak [3] [4] [5] which meansthat the cryptographic keys of the user can beobtained. This is for example needed for a
successful impersonation attack of the manin-the-middle as the user to the network.
A user can typically not detect a MITM-attack. However,depending on the mobile phone, the generation of themobile network can be found in the settings of the mobile.

Trust in the security of the radio accessto the network

The security of the radio access between the mobile network and the user is fundamental for the security of SMS.
In this area there are multiple threat scenarios.
First it is noted that there are vulnerabilities in the security functions of 2G, which makes practical attacks possible. It is, however, important to point out that the attacks
are not restricted to 2G, but applies to all generations ofmobile networks that have implemented a fallback solution to 2G. For example, an attacker can relatively easily
perform a downgrade attack to change 5G service to 2G
service, which makes the user vulnerable to the threat
scenarios for 2G.

7 | Cybersecurity

1

2
Interception

!

UE 1

3

possible

Attacker

Radio AccessNetwork (RAN)Core
Network (CN)Radio AccessNetwork (RAN)!
UE 2

Figure 3 Active attacker within radio range performs a Man-In-TheMiddle attack.

Threat scenario 2
The second threat scenario is similar to the ﬁrst scenario
in that there is an attacker within radio range. The attacker
in this case is passively intercepting the traﬃc between themobile network and the user.

This is a threat for 2G, or after performing a downgrade
attack, for 3G/4G/5G, again since the cryptographic algorithms used in 2G are weak [3] [4] [5]. The attacker could
intercept the SMS and then decrypt the message.

2
The mobile phone
disconnects fromband 1 and switches
to band 2

Another version of this scenario is the possibility of theradio link being conﬁgured without security. The operator has the possibility to control which cryptographic algorithms are used, and also the possibility to turn oﬀ theprotection of SMS. In such a scenario an attacker in radio
range could intercept the messages in clear text. If integrity protection is removed, the messages could also be
modiﬁed without the possibility to verify the correctness.

Band 2A user cannot detect a passive eavesdropping attack.
However, depending on the mobile phone, the generation of the mobile network can be found in the settingsof the mobile.

Radio AccessNetwork (RAN)

2
Does notmodify themessage,just reads it

UE 1

Core
Network (CN)Radio AccessNetwork (RAN)

UE 2

Attacker

Figure 4 Passive attacker within radio range intercepts the SMS.

Threat scenario 3
The third threat scenario consists of an attacker performing denial-of-service through radio emissions or adowngrade attack based on manipulation with signaling
messages. This can be performed in several ways, forexample by an attacker transmitting radio energy, acting
as noise, on the same frequency channels as the communication between the mobile and the base station [6].
The purpose of this attack can be denial-of-service, or for
example to perform a downgrade attack to 2G.

8 | Cybersecurity

Radio AccessNetwork (RAN)Core
Network (CN)1
Saturatethe frequency
band 1
Attacker

Figure 5 Attacker within radio range performing denial ofservice through radio emissions.

4.2

3

1

UE 1

Band 1

Trust in the security of the core network

The trust assumption in the security of the core network
implies several threat scenarios.
The property that the operators, or authorized entities,
can access contents on the network is a part of the design
criteria of the networks. It follows since the secret key on
the SIM-card of the user is shared with the operator. In
terms of trust, this means that the user places trust in
the operators, and additionally authorized third parties,of the mobile networks to store, read, modify or denymessages.
Less clear, but important, is that the operator implicitly
also provides the same rights to read and aﬀect the SMS
messages to other operators or entities with access tothe underlying interconnection protocols of the core network. The main security of the core network protocols,such as SS7 and Diameter, comes from that it´s access is
closed for all, but network operators. While this may be areasonable security assumption for a small, trusted community, it is provenly no longer the case. In fact, there is avery large number of entities with access to the signaling
network, and it is reported that access can be bought [7].

Vulnerabilities are based on exploiting the available, legitimate protocol functionality, posing as a legitimate entity
in the core network. This involves the threat of an attacker
spooﬁng as a fake Home Subscription Library (HSL), as an
SMS Central (SMSC) or as other network entities. More information on this can be found in Section 5.

Threat scenario 6
An attacker with access to the core network performs
SMS interception, SMS spamming, SMS spooﬁng andphishing and denial of service.
2

Many operators have implemented additional security
measures such as monitoring of the core network trafﬁc, ﬁltering, ﬁrewalls and methods to detect and mitigate
for example attacks on SMS. More on security functions
for the core networks in a European perspective can befound in [8].

!

1

!

UE 1
Operator
UE 1

UE 2
Operator
UE 2

2
UE 1 Operator
intercepts the SMS

Figure 6 The operator of the user can intercept the SMSs.

Threat scenario 5

Figure 8 An attacker with access to the core network can for example
send spooﬁng and phishing SMSs to users of the network.

Trust in the operators’ securemanagement of user data.

Another important trust assumption concerns the operators´ management of the user data. In order to authenticate a user, each SIM-card has a cryptographic key thatis coupled to a speciﬁc number, called IMSI. The IMSI isunique for each user across all networks. Additionally,
there is a mapping of the IMSI to the telephone numberof the user.

An operator, not being the operator of the user, or an authorized entity, not belonging to the legislation area of the user,
gets access to the SMSs of the user. A user cannot detect if its
messages are intercepted or modiﬁed.
1
UE 1
Operator
UE 1

UE 2
Operator2
UE 2 Operator
intercepts the SMS

Figure 7 An operator other than the user‘s operator intercepts
the SMSs.

9 | Cybersecurity

Operators User Authentication Database

Operators User
Authentication
Database

3

SMSC

UE 2

1
Attacker withaccess to the core
network sends
a spoofed SMS

Attacker

4.3

3

SMSC

UE 1
Operator

UE 1

Threat scenario 4
The operator to which the user subscribes, or an authorized entity in the legal area of the user, get access to the
SMSs of the user. A user cannot detect if its messages areintercepted or modiﬁed.

SMSC

User 1IMSI_1, Ki_1

Phone No. 1

User 2

IMSI_2, Ki_2

Phone No. 2

User 3

IMSI_3, Ki_3

Phone No. 3

Figure 9 Illustration of an operator´s user authentication database,that handles the mapping between the users´ data in terms of identity(IMSI) and key (Ki) on the one hand, and the phone number on theother.

The coupling between telephone number, and the IMSI
and key, can be altered. For example, when a user wants
to keep its telephone number, but switch to a subscription with another operator, the telephone number will
be coupled with another IMSI and key. This coupling between the IMSI and telephone number is important, sincean attack could be mounted if the coupling is modiﬁed.
The threat consists in that an attacker could impersonate
a victim and receive the SMS messages destined to thevictim. This is a so-called SIM swapping attack. The securemanagement of the coupling between the telephone
number and the user credentials is hence another pointof trust that the user places in the operator.
Threat scenario 7
An attacker performs a so-called SIM swapping attack,where the attacker makes the operator associate thetelephone number with another SIM-card. This could bedone in a social engineering attack, by non-trustworthy
personnel at the operator or by attacks on the operators’
systems.
An attacker performing a SIM swapping attack could impersonate the user and intercept the SMSs of the user.
Additionally, a SIM swapping attack works as a denial-ofservice attack.
The user is likely to detect that something is wrong, since
the connection to the network will stop working.
3

The mobile phone
disconnects from the
network

database

UE 1
Operator

HSS

UE 1
4

Attacker receives all
SMS and callsfor UE 1

1

Attacker

The attacker
convinces the operator
to assign the phone
number of UE 1 to the
SIM of the attacker.

User 1IMSI_UE_1, Ki_1

Phone_Number_UE_1

Attacker

IMSI_Attacker,
Ki_Attacker

X

AttackOperators User Authentication Database
User 1IMSI_UE_1, Ki_1

Not Available

Attacker

IMSI_Attacker,
Ki_Attacker

Phone_Number_UE_1

Figure 10 SIM swapping attack where the attacker convinces theoperator to assign the victim´s phone number to the attacker´sSIM-card.

10 | Cybersecurity

An attacker copies the SIM-card from the user or obtains
the secret key of the user from the operator. From a user
perspective, the user can control the handling of the SIMcard, which additionally is protected against attacks. The
user, however, trusts the operator for the secure storageof the key. The diﬀerence from threat scenario 7 is that,in this case, both the user and the attacker have the telephone number coupled to a SIM-card that has the correct
information.
Similar to threat scenario 7, the attacker can impersonate
the victim and receive the SMSs intended for the victim.
The network service of the attacked user will be denied,which means that the user can detect that something iswrong.
2

If UE 1 is disconnected fromthe network for any reason,
the attacker will take over theconnection

UE 1
Operator
UE 1
3

Attacker receives all
SMS and callsfor UE 1

1

Attacker duplicatesUE 1 SIM card
Attacker

Figure 11 SIM swapping (Duplicate SIM) attack, where the attacker
manages to produce a SIM-card with the same contents as the victim.

Operators User Authentication Database2

OperatorThreat scenario 8

4.4

Summary of trust assumptions

In summary, each user places its trust, without possibilityof veriﬁcation, in the security of
1.
2.

3.

the radio access to the network. The user
assumes that the network is really the mobile
network, and that a secure channel is created.
the core networks. The user assumes that each
network handles the SMS securely within andbetween networks, and each connected party
to the core network respects the privacy andsecurity of each user.
user data at the operator. The user assumes
that the operator will protect users against SIM
swapping, where an attacker through e.g. social
engineering or hacking, takes over the phone
number of a user.

The veriﬁcation of these assumptions is out of the user
control, and the user is unable to prevent any attacks
based on these vulnerabilities. In most cases, the user isalso unable to detect a possible attack.

11 | Cybersecurity

5

Attacks of SMS in mobile networks
In this section attacks based on the previous threat analysis
and threat scenarios for SMS are presented.
The table below lists a number of selected attacks related tovulnerabilities in trust assumptions. The objective here is toin a simple way illustrate the relation between the security
objectives of a user, the trust assumptions that the user cannot verify, and the possible attacks.
Question / Trust assumption
my SMSs?
trust thatthat thethecontent
contentof
ofthetheCan I trust
I receive
secure?
SMS Ithatreceiveis notismodiﬁed?

Radio access to the
network

Core network
security

Operator security
management

SMS interception

SMS interception

SIM swapping

SMS interception (MITM)

SMS interception (MITM)

Can I trust the identity of thesender of the SMS that I receive?

SIM swapping

Can I trust that SMSs sent really
get to their intended destination?

Denial of service

Denial of service

Can I be located thought the SMS
services of the mobile network?

Location tracking

Location tracking

Can I trust that the content ofsure?
the SMS that I receive is secure?

SMS phishing,
Malicious code injection

SMS phishing,
Malicious code injection

SIM swapping

Table 4 Mapping of main SMS attacks from a user perspective, basedon what security aspect and which trust assumption that is violatedby the attack.

A main objective of this section is to provide an updated
review of real, reported attacks on SMS security put in theperspective of the user. Other reviews of attacks on SMS
can be found in [8] [9] [10] [11] [12]. In fact, reports on
threats and attacks on SMS have continuously been published over time. The attacks are mostly the same, but thepossibility of performing the attacks have been aﬀected
for several reasons, including the necessary equipment
to perform the attacks, larger complexity with additional
services and additional security measures.
As a current and interesting example, during the war in
Ukraine, the mobile networks of Ukraine have played arole in the cybersecurity arena. More on this topic can befound in e.g. [13] [14] [15], and examples reported fromthe war in Ukraine relevant for SMS security have been
included in this section.
SMS Interception
In an SMS interception attack, the attacker gains accessto SMS messages transmitted to or from a victim. This
attack can be used to obtain sensitive information, forexample private information or user credentials.

12 | Cybersecurity

Given access to the core network, attackers can redirect
the victim’s SMS to the attackers own phone numbers[9] [16]. A real case of such an attack occurred in 2017,
in which hackers intercepted second factor authentication credentials to authenticate transactions from bankaccounts of a German bank to accounts of the attackers[17]. This corresponds to threat scenario 6.
Reports from the Snowden leaks is an example of largescale SMS interception [18]. A more recent example of
SMS interception is from Ukraine, where it is reported
that the communication from Ukraine to Russia was intercepted by the Ukrainian intelligence, which is likely toinclude SMS [19].
Another possible way to intercept SMS, related to threat
scenario 2, is to intercept the communication between
the victim´s mobile device and the network [20]. As described in threat scenario 2, due to the legacy cryptography used in the 2G standard, it is possible to decipher
the communication. Even if the mobile device supports
3G/4G/5G, it is possible to perform a downgrade to 2G
with a fake base station, which corresponds to threat scenario 1.
Threat scenario 2 also contains the case where the encryption of the network access link is disabled. This could
be the result of a misconﬁguration, e.g. as reported in[21], or intentionally disabled by an operator colluding
with the authorities to facilitate interception.
SMS Denial of Service (DoS)
In general for mobile networks, there are multiple attack
scenarios causing denial of service. One way is by ﬂooding the network with a large volume of SMS traﬃc, causing overload and service disruption. The attack can be
carried out either from the core network, threat scenario
6 [9] [10], or from radio emissions, threat scenario 3 [22].
SMS Spooﬁng
SMS spooﬁng is a way to falsify the identity of the senderof an SMS, typically to deceive a victim that they are interacting with someone else. There are many ways that SMS
spooﬁng can be used by attackers. SMS spooﬁng is often
used in SMS phishing and SMS spamming. An interestingcase involving SMS spooﬁng is the report about theoperator MTN Uganda. The study analyzed the level offraud in mobile money transactions and the control systems in mobile network operators, concluding that up to
61.5% of customers had lost money due to SMS spooﬁng
at some point [23].
SMS Phishing (Smishing)In SMS phishing attacks, the typical objective of the attacker is to steal personal information from a victim. An
example of phishing attacks is to send deceptive SMS
messages to trick recipients into revealing personal information, such as passwords or ﬁnancial data.
In 2022, employees of the Twilio company were the victims of an SMS phishing attack, receiving SMS messages
pretending to be from the IT department (spooﬁng) asking for passwords and conﬁdential information [24].
A recent case of SMS phishing attacks, related to the war
in Ukraine, is reported in early 2023 against the Caspian
Pipeline Consortium (CPC). Phishing links were sent in
SMS to the employees, with the objective of exﬁltratinguser credentials in a later stage [25].
Malicious Code Injection
Another attack method consists in sending SMS messages containing links or malicious code (malware) tocompromise the security of the device or the network.
These malicious code injection attacks through SMS canbe used to obtain private data, passwords, modify orerase data on a smartphone [26].
A real case attack example is EMOTET, a Trojan that in2020 posed as US banks to steal sensitive informationand credentials [27]. Another example is based on the
Snowden leaks, where it is reported that the NSA developed malicious code for attacks on SIM-cards with possibility to e.g. intercept SMS [28] [29].
SMS Spamming
SMS spamming consists of the unwanted sending of
messages to one or more targets, potentially in large
quantities. In many cases, spam attacks are linked to SMS

13 | Cybersecurity

spooﬁng, since the attacker intends to deceive the victim
that the SMS is from a trusted source.
A recent case is from the war in Ukraine, where theRussian secret services are reported to use SMS spamming
methods to send SMSs with intimidating content to private
phone numbers of Ukrainian military personnel [30]. In a similar case, Ukraine´s intelligence service accused Russia ofsending 5000 SMS messages to Ukrainian military oﬃcers
to surrender [31].
SIM swapping
In SIM swapping attacks, the attacker exploits vulnerabilities in the operators‘ security management to change
the phone number of the user, to the SIM card of theattacker. The attack can be carried out in a number ofways, for example calling the operator of the victim withthe change request. For this social engineering attack tosucceed, typically, information about the victim, such as
phone number, ID card number and additional information is gathered [32] [33] [34] [35].
With this attack, the victim´s SIM card is deactivated andthe attacker receives all calls and SMSs, and can also use
two-factor authentication, password reset codes, receive
banking information etc.
Location tracking
Although not directly related to SMS, the core network
can be used to locate users [8]. As a recent example, it islikely that Ukrainian intelligence has taken advantage of
the Russian military using mobile phones for interception
and location tracking. It is reported that in at least one
instance, Ukraine intercepted a Russian general´s call,tracked the location and successfully attacked with militarymeans [19] [36] [37].

6Proofs-of-concept of SMS attacks
In this section the implementation and results of a number of proofs-of-concept (PoC) attacks that DEKRA has
performed are presented. This illustrates the practicalityof a subset of the attacks possible based on the vulnerabilities in the threat scenarios previously described. The
PoCs implemented violate the conﬁdentiality, integrity,
authenticity and availability of the user SMSs in diﬀerent
ways. Both the cost and diﬃculty of the attacks have alevel that makes them feasible for a large set of attackers.
Some of the proofs-of-concept are attacks on their own,
and some can be combined to advanced attacks involving
diﬀerent methods and stages. The proofs-of-concept implemented are grouped based on which type of user trust
assumption that they violate.
Violation of the user trust assumption in the security of
the radio access to the network
Passive radio channel interception of
unencrypted SMS in 4G with disabled crypto.
Downgrade attack of 4G network service by
external attacker using the radio channel.
Cryptographic attack on the 2G (GPRS)
encryption algorithm GEA-1.
Cryptographic attack on the 2G (GSM)
encryption algorithm A5/1.
Important to note is that the proofs-of-concept listed
can be combined to more advanced attacks in a series ofsteps. For example, consider a mobile user with connection to the 5G network. As a ﬁrst stage, the connection
can be downgraded to the 2G network with for example
a downgrade attack. In the second stage, the attacker
intercepts the network traﬃc passively, and in the third
stage, the attacker decrypts the traﬃc, including potential SMS. There are several possible variations on this attack, for example to act as a man-in-the-middle between
the mobile user and the mobile network. These attacks
correspond to threat scenario 1-3 in Section 4.

14 | Cybersecurity

Violation of user the trust assumption in the security of
the core network
Interception of SMS by operator or attacker
with operator access rights in 4G.
Interception of SMS by operator or attacker
with operator access rights in 2G.
SMS spooﬁng attack for attacker with operator
access rights in 4G.
SMS spooﬁng attack for attacker with operator
access rights in 2G.
Web application spooﬁng attack.
The proofs-of-concept in this section demonstrates that
the SMSs are not protected end-to-end but are available
in clear text at the operator. This additionally implies thatthe integrity and authenticity of the messages are notprotected by the protocol. The proof-of-concept using a
web application service for spooﬁng SMS demonstrates
how easy it is for anyone to spoof SMS.
From a user perspective, the spoofed SMSs are apparently authentic, as the spoofed SMS is treated by the mobile
phone as if the sender is the same as previous messages
received with the same name.
The proofs-of-concept in this part correspond to thethreat scenarios 4-6 in Section 4.
Violation of the user trust assumption in the operators’secure management of user data
SIM Swapping attack in the 4G network.
The SIM swapping proof-of-concept demonstrates that
the SIM swapping attacks work, and the security of theoperator handling of user data is critical for the security.
This type of attack can be detected by the user, since theuser is disconnected from the mobile network. However,in attacks against two-factor-authentication by SMS, thetime of detection and response of the user is very likely to
be too long to stop the attacker.

The proof-of-concept corresponds to threat scenario 7 in
Section 4.
Selection of proofs-of-concept
The selection of PoCs has been from a user perspective, as acontrast to, for example, an operator perspective. Legal andpractical aspects have also been taken into account whenselecting the PoCs to implement.
To limit the number of PoCs, but still obtain coverage ofmobile technology, some PoCs are performed in only one
generation of mobile networks, and others are performed with one PoC in 2G, where 3G would be very similar,
and one PoC in 4G, were 5G would be very similar. This is
motivated by how SMS are handled diﬀerently depending
on technology.
A detailed description of each proof-of-concept can befound in the corresponding part of the appendix.

15 | Cybersecurity

7

Conclusions
SMS is still after more than 30 years a great success andused worldwide. Behind the success is the ease of communication with literally anyone with a mobile, acrossmobile technologies and countries. While successful andeasy to use, there are also security concerns. In this paper, the security of SMS from a user perspective has been
analysed.
The basic security properties desired for a message service are conﬁdentiality, integrity and authenticity. The
SMS protocol cannot guarantee these properties, and theuser instead places its trust in security assumptions thattypically cannot be veriﬁed by the user. In this paper, it
has been clariﬁed and analyzed which trust assumptions
that a user has to make for SMS security, and how vulnerabilities, threats and attacks are related to this.
The threats to SMS security are put into the context ofreal-life attackers in a review of publicly reported attacks
and by presenting performed proofs-of-concept for anumber of attacks.
SMS users should be aware of the security risks and consider in which cases to use SMS. Messaging of information that can be sensitive for private or ﬁnancial reasonsand the use of SMS as a second authentication factor are
examples of use cases where instead other, secure services should be considered. Furthermore, it should be
kept in mind that SMSs are not authenticated and thatthe displayed sender may not be the actual sender.

16 | Cybersecurity

G

Glossary
AMF
APN
AuC
BSC
BTS
CN
CS
eNB
EPC
GEA
gNB
GPRS
GSM
HLR
HSS
IMS
IMSI
LTE
MITM
MME
NAS
NodeB
PGWU
PoC
PS
RAN
RNC
SIM
SG
SIP
SMS
SMSC
SMSF
SS7
TMSI
UE
UMTS
UPF
3GPP

Access and Mobility Function
Access Point Name
Authentication Center
Base Station Controller
Base Transceiver Station
Core Network
Circuit Switching
Evolved Node B
Evolved Packet CoreGPRS Encryption Algorithm
Next-Generation Node B
General Packet Radio Services
Global System for Mobile Communication
Home Location Register
Home Subscriber Server
IP Multimedia Subsystem
International Mobile Subscriber Identity
Long Term Evolution
Man-in-the-middle
Mobility Management Entity
Non-Access-Stratum
Node Base Station
Packet Data Network Gateway User Plane
Proof-of-concept
Packet Switching
Radio Access Network
Radio Network Controller
Subscriber Identity Module
Signaling Gateway
Session Initiation Protocol
Short Message Service
Short Message Service Center
Short Message Service Function
Signaling System 7
Temporary Mobile Subscriber Identity
User Equipment
Universal Mobile Telecommunications System
User Plane Function
3rd Generation Partnership Project

17 | Cybersecurity

A

Appendix A. Cryptography for
veriﬁable trust
In this section a brief background on the cryptographic
properties used to establish veriﬁable trust is given. This
includes the use of symmetric and asymmetric keys andalgorithms to obtain conﬁdentiality, integrity and authenticity, which are the basis for secure communication.
The availability of a shared secret key among two communicating users is suﬃcient to achieve a secure channel with conﬁdentiality, integrity and authenticity. There
are two main ways to achieve a shared secret key; using
asymmetric cryptography based on certiﬁcates and a socalled public key infrastructure, or using a separate,
trusted channel to distribute the symmetric secret keys.
Asymmetric: When you visit a webpage, theTLS protocol is used to establish a secureconnection, typically represented bya padlock icon in the browser. The secureconnection is established, even though there is
no previous secret key shared between you
and the application that you are communicatingwith. Asymmetric cryptography is used tocreate the secure channel, which includes
conﬁdentiality, integrity and authenticity. But
how is this achieved? Although diﬀerent
cryptographic functions are used, in terms oftrust, it comes down to the trust in a common
third entity, and the mutual veriﬁcation of thistrust by diﬀerent means including certiﬁcatesand public key infrastructure.
Symmetric: Another way to establish sharedsecret keys is through the use of a separate,secure channel. There are many ways to do this,for example by loading a secret key in a system
during production, oﬄine distribution on e.g.
paper or disc, or through some other trusted
secure channel. This is the case for mobile
networks, where a secret key is stored in the
SIM-card, and additionally by the operator in
the network.
For some security mechanisms, the properties of conﬁdentiality, integrity and authenticity are achieved jointly, but inother cases they are not. This can be adapted dependingon the security requirements of the use case. To see why
each of the properties is important, consider the following
examples.

18 | Cybersecurity

Example 1: Integrity and authenticity, but not conﬁdentiality. The communicating users know who they communicate with, that the information is unmodiﬁed, but otherparties can eavesdrop on their communication. In fact,
this is a desirable property in many cases, for example forcertiﬁcates in a public key infrastructure.

2

Attacker

3

1

Communication
Network

UE 1

UE 2

Figure 12 Communication with integrity and authenticity,
but without conﬁdentiality.

Example 2: Conﬁdentiality without integrity. The communicating users encrypt their communication, but do notknow whether the communication has been modiﬁed ornot. An example of this is when a so-called stream cipher
is used for encryption. An attacker can then modify bits ofthe message, without knowing the content, and without
the receiver being able to detect, given that no other integrity protection mechanism is used. Stream ciphers areoften used for mobile communications.

Attacker

1

2 Modify content of message
3

1
!

UE 1

Communication
Network!

UE 2

Figure 13 Communication with conﬁdentiality, but without integrity.

Example 3: To see the importance of authenticity, considera case using cryptographic methods for conﬁdentiality andintegrity, but not for authenticity. The main problem is thatthe communicating parties cannot be sure about the identity of who they are talking to. In some cases, this opens
up for so-called man-in-the-middle (MITM) attacks, wherean attacker is acting as a middle-man on the communication link, decrypting information from one user, and thenre-encrypting for the other user. Under some circumstances, MITM scenarios are possible both for asymmetric andsymmetric cases.
In the asymmetric case, a MITM-attack ispossible if there is not a trusted third party,
which can authenticate the users to each other.
In the symmetric, shared key case, the MITMattack is possible when the keys are shared withan intermediate party. This is the case of mobile
networks, where the operator shares a key witheach user – but the users do not share
a common key.

UE 1

1

1
3
2

1
3

Attacker

Figure 14 Man-in-the-middle attack scenario.

19 | Cybersecurity

1
3
4

UE 2

B

Appendix B. Mobile networks
from GSM to 5G
In order to understand the security of SMS in mobile networks, more background is provided in this section. Thisis motivated by the fact that diﬀerent generations of mobile networks interact, work side by side and additionallyshare architecture and protocols. The main focus in thissection is on the functions regarding security of SMS andto understand the settings of diﬀerent attacks andproofs-of-concept.
SMS was ﬁrst introduced in GSM, often referred to as 2G.
The GSM network was mainly designed for voice service
and was built on circuit-switched networks. It had limited
capability of data transmission and it was in this settingthat SMS was ﬁrst introduced. A special feature of SMS
is that it was included in the control plane, as opposedto the user plane. The control plane is typically used forcommunication regarding the mobile status, mobility
and radio access. The inclusion of SMS in the control plane
made sense in the GSM network to optimize the network
bandwidth.
Core
Network 2G

BSC

Core
Network 3G

eNodeB

UE

UE

gNodeBUE

Figure 15 Illustration of the main components of a Radio AccessNetwork (RAN) of the diﬀerent mobile generations.

20 | Cybersecurity

2G

3G

Base Station

BTS

nodeB

Controller
Base Station

BSC

RNC

4G

5G

eNodeB

gNodeB

Table 5 Summary of terminology for the Radio Access Network for
diﬀerent generations of mobile networks.

During the second half of the 1990s, packet data was introduced with General Packet Radio Services (GPRS). GPRS
is sometimes referred to as 2.5G. This mainly changed thecore network, which added support for packed-switched
networks, along with the circuit-switched networks.
The 3G mobile network introduced signiﬁcant improvements in many respects. Especially the radio access network technology with the base stations changed, while
the structure of the core network has a similar structure
to that of GSM and GPRS. Among the requirements inthe development of 3G was the backward compatibility
to the second-generation mobile networks, including thecircuit-switched technology [38].
An important addition in the 3G network was the addition of mutual authentication between a user (SIM-card)and the network. There were also improvements in thecryptographic algorithms used in the authentication andencryption.

nodeB

UE

Core
Network 5G

Radio
AccessNetwork
(RAN)

RNC

BTS

Core
Network 4G

Terminology

In parallel to 3G, Long Term Evolution (LTE) was developed.
In contrast to 3G, the requirements for the development
were less restrictive in terms of backward compatibility andLTE, later named 4G, was designed for packet-based trafﬁc directly. Diﬀerent technology was introduced on the radio access network, well suited for packed-based and highthroughput services with low delay.

IP
Network

PSTN

Core Network
Core
Network(2G/3G) GSMC

Core Network
4G (EPC)

Core
Network
5G (5GC)

IMS

GGSN
HSS
HLR

SMF+S/

P-GW

PGW-C

SMSC

MSC/VLR

SGSN

MME

S-GW

UPF+S/
PGW-U

AMF

Radio
AccessNetwork 2G

Radio
AccessNetwork 3G

Radio
AccessNetwork 4G

Radio
AccessNetwork 5G

UE

UE

UE

UE

Figure 16 Illustration of the main components of theCore Network (CN) of the diﬀerent mobile generations.

The complexity of the radio access network was reduced
by removing the element Radio Network Controller from
3G, and including most of its functionality in the basestations, now denoted eNodeB. Also, the core network
was updated into the Evolved Packet Core (EPC), entirely
dedicated to the packet-based domain. Some functionality from the radio access network was also moved tothe core network, for example the Mobility Management
Entity, MME, which e.g. handles the functionality to maintain calls during mobility.
The framework for services over the IP-network is called
the IP Multimedia Subsystem (IMS) and constitutes an additional way to transmit SMS over the network. The previous
control-plane-based SMS protocol was also implemented,
both on its own, and indirectly by interoperability between
SMS in 3G and 4G. SMS in the control-plane is referred to as
SMS per Non-Access-Stratum (NAS).
Similar to previous solutions, the core network contains
the subscriber information, in 4G denoted Home Subscriber Server (HSS), which is the corresponding of theprevious Home Location Register (HLR) and the Authentication Center (AuC). These databases are critical for theauthentication and the security of the network in generaland SMS in particular, since they contain the subscriber
keys.
21 | Cybersecurity

The security objectives for the development of LTE was tomake the security of LTE equivalent, or better, than that of
3G. Secure connections between the mobiles and the network, including encryption and mutual authentication, but
at the same time enable lawful interception of the traﬃc,
was standardized. Additional layers of privacy, communication conﬁdentiality, location privacy and identity protection
are added to protect from unauthorized third parties.
Authorized parties are typically government agencies, but
can also include others, for example location services.
The 5G mobile network is also based on an overall network architecture with a separation between a radio
access network and a core network. The radio accessnetwork schematics are similar to 4G, but the nodes are
now called gNodeB, which stands for “5G Node B”. The
network core is schematically divided into the Access andMobility Function (AMF), controlling the radio access, andthe User Plane Function (UPF), handling the user data.
The 5G network is based on network functions rather
than network entities.
Mobile networks have a layered architecture, with similarities to how the Internet works. In the core networks
there are diﬀerent protocols handling the SMS distribution. For 2G and 3G, an important core network protocol
for SMS, and many other functionalities, is the Signaling
System 7 (SS7) protocol.
The SS7 protocol was developed 1975, in a time whensecurity implementations of encryption and authenticity
did not have the same maturity and recognized importance as it has today. The SS7 protocol provides basic services such as call setup and teardown, routing, roaming
and SMS across the networks. An example of this is the
network communication needed to locate the recipientof an SMS. Although the SS7 protocol is a part of the core
network protocols for 2G and 3G, it is still used in the later
generations of mobile networks, mostly for compatibility
and interconnection of services, such as SMS, over diﬀerent
networks.
With 4G and the packet-based EPC, the IP-based Diameter
protocol was introduced. Diameter is for example used forthe communication regarding authentication between the
MME and the HSS in the core network. 5G also has a packetbased core network, which supports interaction with the 4G
and 2G/3G networks.

B.1

SMS in GSM to 5G

In 2G and 3G networks, there are two modes of sending
SMS [39]:
SMS over CS (Circuit-Switched): It operates
over the circuit-switched network, whichmeans that a dedicated connection isestablished between the sender and receiver
for the duration of the SMS transmission.
SMS over PS (Packet-Switched): It operates
over the packet-switched network, whichmeans that data is divided into packets andsent independently across the network to its
destination.
Core Network 2G/3G

MSC/VLR

SMS
over
CS

UE

Radio AccessNetwork 2G/3G

SMSC

SMSC

Radio AccessNetwork 2G/3G

UE

HLR

SGSN

SMS
over
PS

SMS
over
NAS
SMS
over
SG

Radio AccessNetwork 4G

UE

MME

IMS
HSS

P-GW

S-GW

SMS
over
IMS

Core Network 4G (EPC)

Figure 18 Illustration of the main components of the Core Network(CN) for the use of SMS in 4G networks.

HLR

SGSN

SMS
over
PS

In 5G networks, it is possible to make use of the existing
IMS network or to make use of the new network element
known as SMSF, which supports SMS over NAS.

Figure 17 Illustration of the main components of theCore Network (CN) for the use of SMS in 2G/3G networks.

Core Network 2G/3G

MSC/VLR

SMS
over
CS

In 4G networks, there are three modes of sending SMS[39]:
SMS over SG: It was the ﬁrst 4G sending mode,
without the need for IMS. It is a hybrid
approach to SMS transmission between LTE
and the CS infrastructure.
SMS over NAS: For SMS transport between MME
and SMSC, the Diameter protocol is used.
Therefore, the UE does not have to beregistered in the 2G/3G network. In addition,
the NAS protocol is used for sending
encapsulated SMS between the UE and theMME.
SMS over IMS: This is the most typical sending
mode in 4G. In this case, the SMS is sent via SIP,
which means that communication via IMS isnecessary.
22 | Cybersecurity

Core Network 2G/3G

MSC/VLR

SMS
over
CS

UE

SMSC

Radio AccessNetwork 2G/3G

SMSF

AMF

SMS
over
NAS

SMS
over
PS

SMS
over
NAS

UE

HLR

SGSN

MME

SMS
over
SG

Radio AccessNetwork 4G
SMS
over
IMS

IMS
HSS

S-GW

SMS
over
IMS

UPF

IMS

Radio AccessNetwork 5GCore Network
5G (5GC)

P-GWCore Network 4G (EPC)

Figure 19 Illustration of the main components of the Core Network(CN) for the use of SMS in 5G networks.

UE

C

Appendix C. Proofs-of-concept
In the following, the performed proofs-of-concept arepresented, starting with a summary on the setup.

C.1

PoC setup

In the realization of the PoCs, both legal and practicalaspects need to be considered. All PoCs have been performed in a controlled environment in a DEKRA laboratory. This means that DEKRA has set up its own mobile
infrastructure to perform the attacks. This has been in
an isolated environment, not connected to or interferingwith public mobile networks.
Equipment
Equipment

2G
2G

User
User
equipment
equipment

3G
3G

4G
4G

5G
5G

Standard mobile
mobile phones
phones have
have been
been used,
used, thatthat also
also work
work perfectly
perfectly on
on anyany otherotherStandard
public mobile
mobile network:
network: Samsung
Samsung Galaxy
Galaxy A3,
A3, Redmi
Redmi 7A
7A
publicRadio access
accessRadio
network
network

Ettus USRP
USRP
Ettus
[40]
B210 [39]
[39]
B210

Ettus USRP
USRP
Ettus
B210
B210

Amarisoft
Amarisoft
Classic [40]
[40]
[41]
Classic

Amarisoft
Amarisoft
Classic
Classic

CoreCore
network
network

OsmoNITB
OsmoNITB

OsmoNITB
OsmoNITB

Amarisoft
Amarisoft

Amarisoft
Amarisoft

Interception
Interception
equipment
equipment

HackRF One
One
HackRF

HackRF One
One
HackRF

Ettus USRPUSRP B210/
B210/ Ettus
Ettus USRPUSRP B210/
B210/
Ettus
HackRF One
One
HackRF One
One
HackRF
HackRF

Table 6 Equipment used in the execution of the proofs-of-concept for
diﬀerent generations of mobile networks.

Figure 20 and Figure 21 show some of the setups used forthe proofs-of-concept.

Figure 21 Amarisoft Classic with two phones.

The objective has been to provide a testing environmentthat corresponds to real scenarios. Additionally, it is interesting to note that it is neither very complex nor expensive
to simulate a base station and provide a network. Softwaredeﬁned radio, for example as HackRF One or Ettus USRP
B210, is aﬀordable, and open source software can be used
to model a base station.
Testing of the functionality of the network can be donefor example by using standard user equipment. Since theobjective is to study the security from a user perspective,
it is interesting to note whether the mobile phones usedindicate any diﬀerences when the network and the conﬁgurations for functionality and security are controlled.
Figure 20 Ramsey box with Ettus USRP B210, Hack RF and two phones.

23 | Cybersecurity

Just as there are many diﬀerent types of user equipment,
there are diﬀerent base stations with diﬀerent HW and
SW and diﬀerent conﬁgurations and the PoCs only cover
the tested cases.

C.2

Interception of SMS by operator or
attacker with operator access rights
in 4G

Conﬁguration of setup
The conﬁguration to this PoC is:
1.
2.
3.

Objective

4.
5.

Illustrate that the operator, or an attacker with operator access, can intercept the user SMS traﬃc in clear text,
without the user being able to detect.

6.
7.
8.

Setup
The setup to this PoC is:
PC: To conﬁgure the 4G network via SSH.
4G network (Amarisoft Callbox Classic):
Simulates a real operator network and a basestation.
Two mobile phones: Simulating realcommunication.
Two writeable SIM cards: To be able to connect
them to the base station.

9.

Procedure
The procedure to this PoC is:

Figure Conceptual: Figure 6

1.

Figure Simulated:

2.

UE 1

UE 2

Amarisoft

Amarisoft
Antennas

Software Amarisoft
Callbox Classic

Downlink frequency 2680MHz (Band 7).
Bandwidth 5MHz.
RRC/UP layer ciphering algorithm:
128-bit AES or Snow 3G.
Access Point Name: Default and Internet.
NAS layer ciphering algorithm: 128-bit AES
or Snow 3G.
SMS over IMS.
Layers IMS in debug mode.
Conﬁguration SIM 1:
a. Algorithm SIM: XOR
b. IMSI: 001010102345678
c. Ki: 00112233445566778899aabbccddeeﬀ
d. Number Phone: 0600000000
Conﬁguration SIM 2:
a. Algorithm SIM: milenage
b. IMSI: 0010101023456788
c. Ki: 00112233445566778899aabbccddeeﬀ
d. Number Phone: 0600000001

3.
4.
5.
6.

Conﬁgure the operator with the given
conﬁguration parameters.
Conﬁgure the Access Point Name (APN) on
the phone.
Connect the phone to the 4G network.
Capture network-wide traﬃc.
Send the SMS from phone 2 to phone 1.
Intercept the SMS from the network interface.
Attacker
UE1

UE2
APN

Attacker

Amarisoft Antennas
APN

Software Amarisoft
via SSH

Connect to the network UE2

Connect to the network UE1

Figure 22 Simulated scenario of interception of SMS by operator or
attacker with operator access rights in 4G

Send SMS
to UE1
Intercepting
SMS

Figure 23 Procedure of interception of SMS by operator or attacker
with operator access rights in 4G.
24 | Cybersecurity

Results
The 4G network has been set up via SSH with the above
parameters. Once conﬁgured, the service is established.

Both mobiles are connected automatically to the network
after conﬁguring the APN, as can be seen in the ﬁgure
below.

The conﬁguration of the SIM-card is the following:

Figure 24 The database for subscribers, including the SIM-card
information.

In Settings, Mobile Networks and Access Point Name, thefollowing APN has been added:

Figure 26 Phones connected to the same 4G network created with
Amarisoft.

The operator‘s IMS layer has been conﬁgured in debug
mode to display the messages being sent.
Figure 27 below shows how an SMS has been sent
between phone 2 and phone 1.

Figure 25 Conﬁguration Access Point Name (APN)
Figure 27 Sending SMS between phones

25 | Cybersecurity

Two writeable SIM-cards: To be able to connect
them to the base station.
Ramsey Box: To work at the 2G operating
frequency band without interfering with public
networks.

From the operator interface, the SMS can be seen in clear
text, as shown in Figure 28.

Figure Conceptual: Figure 6
Figure Simulated:
Figure 28 Interception of SMS from the operator.

UE 1

Conclusions

UE 2

Ramsey Box

Ettus USRP
B210

Software
OsmoNITB

The PoC illustrates the vulnerability caused by the user trustin the network and the operator. An attacker, or authorized
entity, with the access rights of an operator can intercept
messages independently of whether encryption is used forthe radio access.
The user cannot detect the attack. The user would needan additional layer of protection in order to protect the
security of the message.

C.3

Interception of SMS by operator or
attacker with operator access rights
in 2G

Objective
Illustrate that the operator, or an attacker with operator access, can intercept the user SMS traﬃc in clear text, without
the user being able to detect.
Setup
The setup to this PoC is:
PC: To conﬁgure the 2G network via SSH.
2G network (OsmoNITB): Simulates a real
operator network and a base station(Ettus USRP B210).
Two mobile phones: Simulating realcommunication.

26 | Cybersecurity

Attacker

Figure 29 Simulated scenario of interception of SMS by operator or
attacker with operator access rights in 2G.

Conﬁguration of setup
The conﬁguration to this PoC is:
1.
2.
3.
4.
5.

Band GSM900.
Access Point Name: Default and Internet.
SMS over NAS.
Conﬁguration SIM 1:
a. IMSI: 101023456789
b. Number Phone: 195
Conﬁguration SIM 2:
a. IMSI: 310260123456064
b. Phone number: 156

Procedure
The procedure to this PoC is:
1.
2.
3.

Conﬁgure the operator with the given
conﬁguration parameters.
Conﬁgure the APN on the phone.
Connect the phone to the 2G network.

4.
5.
6.

Capture network traﬃc.
Send an SMS from phone 1 to phone 2.
Interception of the SMS from the network
interface.

A message has been sent between phone 1 and phone 2.
Figure 32 shows how an SMS from UE1 has been received
by UE2.

Attacker
Ettus USRP
B210

UE2

UE1
APN

APN

SoftwareOsmo-NITB
via SSH

Connect to the network UE1

Connect to the network UE2
Send SMS
to UE2
Intercepting
SMS

Figure 30 Procedure of Interception of SMS by operator or attacker
with operator access rights in 2G.
Figure 32 SMS sent between two phones.

Results
The 2G network has been set up with the given parameters.
Once conﬁgured, the service is established.
The APN conﬁguration on the mobiles is the same as in
Figure 25.

The SMS can be read in clear text from the operator interface, which is shown in Figure 33. This is the case independently of whether the communication between themobile phone and the base station is encrypted or not.

After conﬁguring the APN of the mobile phone, the mobile
connects automatically to the network.

Figure 33 Interception of SMS by the operator. The ﬁgure shows a
capture of the network traﬃc at the base station using the program
Wireshark.

Figure 31 To the left, the terminal shows the connected phone withconnection date, IMSI, TMSI and number. To the right, the phone
displays connection to the DragonOS network.

27 | Cybersecurity

Conclusions
The PoC illustrates that SMSs are not end-to-end encrypted,
but gives the operator, and any attacker with operator access, the possibility to read the message in clear text. In fact,
since there is no other protection given by the SMS protocol,
there is also the possibility of an attack modifying the SMS.
This holds independently of whether the radio channel isencrypted or not. The user has to trust the operator, but has
no possibility of verifying the trust.
The user cannot detect the attack. The user would needan additional layer of protection in order to protect the
security of the message.

C.4

SMS spooﬁng attack for attacker with
operator access rights in a 4G network

Figure Simulated:
Amarisoft

UE 1

Amarisoft
Antennas

Attacker

Figure 34 Simulated SMS spooﬁng attack scenario for attacker with
operator access rights in a 4G network.

Conﬁguration

Objective

The conﬁguration to this PoC is:

Illustrate with a PoC that an SMS in the mobile network
is not authenticated and a spooﬁng attack against theusers therefore is possible. This PoC attack is performedin the 4G network.

1.
2.
3.

Setup
The setup to this PoC is:
PC: To conﬁgure the 4G network via SSH.
4G network (Amarisoft Callbox Classic):
Simulates a real operator network and a basestation.
One mobile phone: Simulating real network
subscribers.
One writeable SIM-card: To be able to connect
the mobile to the base station.
Figure Conceptual: Figure 8

4.
5.
6.
7.

Downlink frequency 2680MHz (Band 7).
Bandwidth 5MHz.
RRC/UP layer ciphering algorithm: 128-bit AES
or Snow 3G.
Access Point Name: Default and Internet.
NAS layer ciphering algorithm: 128-bit AES or
Snow 3G.
SMS over IMS.
Conﬁguration SIM:a. Algorithm SIM: XOR
b. IMSI: 0010101023456789
c. K: 00112233445566778899aabbccddeeﬀ
d. Phone Number: 0600000000

Procedure
The procedure to this PoC is:
1.
2.
3.
4.
5.

28 | Cybersecurity

Software Amarisoft
Callbox Classic

Conﬁgure the operator with the correct
conﬁguration parameters.
Conﬁgure the APN on the phone.
Connect the phone to the 4G network.
Send the spoofed SMS.
Conﬁrm the SMS reception and handlingon the phone.

The mobile phone has received the following message:
Attacker
Amarisoft
Antennas

UE1

APN

Software
Amarisoft
via SSH

Connect to the network UE1
Send the spoofed
SMS to UE 1

Figure 35 Procedure of SMS spooﬁng attack for attacker with operator
access rights in a 4G network

Figure 37 SMS spooﬁng PoC. Note how the spoofed message is placedin the same folder as previous non-spoofed messages with the same
name, as if they were from the same sender.

Results

Conclusions

The 4G network has been set up via SSH with the above
parameters. Once conﬁgured, the service has been reestablished.

In this PoC an SMS has been spoofed in a 4G mobile network setup and neither the network protocol nor the mobile phone has protection against SMS spooﬁng attacks.
This is expected, since the SMS protocol doesn´t have authentication mechanisms. It is problematic that the spoofed SMS
is placed in the same SMS inbox as the authentic sender, as
is shown in this test. This may give a feeling of authenticity
and trust to the user, that is not veriﬁable.

The conﬁguration of the SIM-card is the following:This type of attack can also be carried out from publicly
available websites.
Figure 36 The database for subscribers, including the SIM-card
information.

C.5

The APN conﬁguration on the mobiles is the same as in
Figure 25.

Objective

Both mobiles are connected automatically to the network
after conﬁguring the APN.
The spoofed SMS has been sent through the web API of
the network to ﬁnd out how the network and the phone
react.

29 | Cybersecurity

SMS spooﬁng attack for attacker with
operator access rights in a 2G network

Illustrate with a PoC that an SMS in the mobile network
is not authenticated and a spooﬁng attack against theusers therefore is possible. This PoC attack is performedin the 2G networkSetup

Procedure

The setup to this PoC is:

The procedure to this PoC is:

PC: To conﬁgure the 2G network via SSH.
2G network (osmo): Simulates a real operator
network and a base station (Ettus USRP B210).
One mobile phone: Simulating realcommunication.
One writeable SIM-card: To be able to connect
to the base station.
Ramsey Box: To work in the 2G operating
frequency band without interfering with the
public network.
Figure Conceptual: Figure 8

1.
2.
3.
4.
5.

Conﬁgure the operator with the correct
conﬁguration parameters.
Conﬁgure the APN on the phone.
Connect the phone to the 2G network.
Perform the SMS spooﬁng by sending an SMS.
Check the spoofed SMS on the phone.

Attacker
UE1

APN

Figure Simulated:

Software
Amarisoft
via SSH

Connect to the network UE1

Ramsey Box

UE 1

Amarisoft
Antennas

Ettus USRP
B210

Send the spoofed
SMS to UE 1

SotwareOsmoNITB

Figure 39 Procedure of an SMS spooﬁng attack for an attacker with
operator access rights in a 2G network.
Attacker

Figure 38 Simulated scenario of an SMS spooﬁng attack for attacker
with operator access rights in a 2G network.

Conﬁguration
The conﬁguration to this PoC is:
1.
2.
3.
4.

Band GSM900.
Access Point Name: Default and Internet.
SMS over NAS.
Conﬁguration SIM 1:
a. IMSI: 101023456789
b. Phone number: 195

30 | Cybersecurity

ResultThe 2G network has been set up via SSH with the above
parameters. Once conﬁgured, the service has been established.
The APN conﬁguration on the mobiles is the same as in
Figure 25.
Both mobiles are connected automatically to the network
after conﬁguring the APN.

C.6

Web application spooﬁng attack

Objective
Illustrate with a PoC that an SMS in the mobile network
is not authenticated and a spooﬁng attack against theusers therefore is possible. This PoC attack is done froma publicly available web application.
Figure 40 To the left, the terminal shows the connected phone withconnection date, IMSI, TMSI and number. To the right, the phone displays connection to the DragonOS network.

Setup
The setup to this PoC is:
One mobile phone: With any SIM-card with avalid telephone number.
Access to the web application(https://octopush.com/es/) in charge ofsending the SMS.

The spoofed SMS has been sent through the network to
see how the mobile phone reacts and receives the SMS.
The mobile phone has received the SMS as shown in Figure
41. As can be seen, the SMS displays the sender as “0”,which was the sender name that was chosen for the test.

Figure Conceptual: Figure 8
Figure Simulated:
UE 1
Web Application

Attacker

Figure 41 On the left are the registered users in the network. In thiscase the forged SMS was chosen from a scenario where the forged
sender, „0“, is not in the network. On the right the message as it wasreceived on the mobile phone can be seen.

Conclusions
In this PoC, an SMS has been spoofed in a 2G mobile network setup and neither the network protocol nor the mobile phone has protection against SMS spooﬁng attacks.
This is expected, since the SMS protocol doesn´t haveauthentication mechanisms. The PoC suﬀers from thesame security problems as in the PoC of SMS spooﬁng
in 4G mobile networks, which illustrates that this kind of
attack is not dependent on the generation of the mobile
network.
Note that this type of attack can also be carried out frompublicly available websites.

31 | Cybersecurity

Figure 42 Simulated scenario of Web application spooﬁng attack.

Conﬁguration
No speciﬁc conﬁguration to this PoC is necessary.
Procedure
The procedure to this PoC is:
1.
2.
3.

Access to https://octopush.com/es/.
Send spooﬁng SMS from the application web.
Check the spoofed SMS on the phone.

Conclusions
Attacker
UE1

UE1 Operator

Web
Application
Send SMS

Figure 43 Procedure of Web application spooﬁng attack

Results
The message and sender was entered in the web application. The SMS was sent and received with the same information as entered.

In this PoC an SMS has been spoofed from a web application and neither the network protocol nor the mobile
phone has protection against SMS spooﬁng attacks. Thisis expected, since the SMS protocol doesn´t have authentication mechanisms. This gives a feeling of authenticity
and trust to the user, that is not veriﬁable.
The cost of this attack is zero, you only need an Internet
connection to access the web application.

C.7

SIM swapping attack in the 4G network

Objective
Illustrate the eﬀects of a SIM swapping attack on a 4G
network.
Setup
The setup to this PoC is:

Figure 44 The web application interface where the sender ID
and message content was entered.

PC: To conﬁgure the 4G network via SSH.
4G network (Amarisoft Callbox Classic):
Simulates a real operator network and a basestation.
Two mobile phones: Simulating real network
subscribers.
Two writeable SIM cards: To be able to connect
them to the base station.
Figure Conceptual: Figure 10
Figure Simulated:
UE 1

UE 2

Amarisoft

Amarisoft
Antennas

Software Amarisoft
Callbox Classic

Attacker

Figure 45 Screenshot of the mobile receiving the SMS.

32 | Cybersecurity

Figure 46 Simulated scenario of SIM swapping attack in the 4G
network.

Conﬁguration

Results

The conﬁguration to this PoC is:

The 4G network has been set up with SSH with the given
parameters. Once conﬁgured, the service is established.

1.
2.
3.
4.
5.
6.
7.

8.

Downlink frequency 2680MHz (Band 7).
Bandwidth 5MHz.
RRC/UP layer ciphering algorithm: 128-bit AES
or Snow 3G.
Access Point Name: Default and Internet.
NAS layer ciphering algorithm: 128 bit-AES or
Snow 3G.
SMS over IMS.
Conﬁguration SIM 1:
a. Algorithm SIM: XOR
b. IMSI: 0010101023456789
c. K: 00112233445566778899aabbccddeeﬀ
d. Number Phone: 0600000000
Conﬁguration SIM 2 (After):a. Algorithm SIM: milenage
b. IMSI: 0010101023456788
c. K: 00112233445566778899aabbccddeeﬀ
d. Number Phone: 0600000000

Procedure
The procedure to this PoC is:
1.
2.
3.
4.
5.
6.
7.
8.

Conﬁgure the operator with the correct
conﬁguration parameters.
Conﬁgure the APN on the phone.
Connect the phone to the 4G network.
Perform the SMS test.
The attacker calls the operator to request a SIMchange with the same phone number.
Conﬁgure the APN on the attacker‘s phone.
Connect the attacker‘s phone to the 4G network.
Perform the SMS test.

The conﬁguration of the SIM-card is given in Figure 48.

Figure 48 The database for the subscriber SIM-card previous to the
SIM swapping attack.

The APN conﬁguration on the mobiles is the same as in
Figure 25.
After conﬁguring the APN of the mobile phone, it connects automatically to the network.
A test message has been sent to the mobile phone toshow that the SMSs are correctly delivered to the intended subscriber.

Attacker
Amarisoft
Antennas

UE1

UE2
APN

APN
Connect to the network UE1

Connect to the network UE2

Automaticallydisconnects fromthe network

Software
Amarisoft
via SSH

The attacker
convinces theoperator to assign
the phone numberof UE1 to theattacker SIM

Figure 47 Procedure of SIM swapping attack in the 4G network.
33 | Cybersecurity

Figure 49 A test SMS is sent to the subscriber to verify that the subscriber receives SMSs as usual before the SIM swapping attack.

The attacker is then assumed to have contacted the operator and convinced the operator to change the phone
number of the victim to the SIM-card of the attacker.
The conﬁguration of the SIM-card database is changed
to the information in Figure 50, which corresponds tomapping the victim´s phone number to the attacker´sSIM-card.

Conclusions
It has been illustrated how a SIM swapping attack works
and that the SMS security of a user is dependent on thetrust of the user data management of the operator. Notethat the attack scenario could be a technical attack, but
is typically the result of an attack involving social engineering.

C.8

Passive radio channel interception of
unencrypted SMS in 4G with disabled
cryptoObjective
Figure 50 Updated database after the attacker has solicited to movethe telephone number of the victim to a SIM-card under the controlof the attacker.

The victim´s phone is automatically disconnected fromthe network and the attacker starts receiving the messages addressed to the victim. This can be seen in Figure
51.

Illustrate that the operator can disable encryption on theradio channel without the user detecting it, and that an
attacker can capture packets on the radio channel, whichin this case means plain text SMS interception.
Setup
The setup to this PoC is:
PC: To conﬁgure the 4G network via SSH.
4G network (Amarisoft Callbox Classic):
Simulates a real operator network and a basestation.
USB Software Deﬁned Radio (Ettus USRP B210):Intercept downlink traﬃc between mobile
phone and base station.
Two mobile phones: Simulating real network
subscribers.
Two writeable SIM-cards: To be able to connect
them to the base station.
Figure Conceptual: Figure 4

Figure 51 SIM Swapping Attack. The victim’s phone to the left did notreceive the test SMS after the SIM swapping attack. The attacker’s phone, to the right, did receive the victim’s SMS after the attack.

34 | Cybersecurity

4.
5.
6.

Figure Simulated:
UE 1

Amarisoft

Amarisoft
Antennas

UE 2

Intercept the traﬃc downlink.
Send the SMS test.
Verify if the SMS has been captured on thedownlink.

Software Amarisoft
Callbox Classic

Attacker
Ettus USRP
B210

UE1

UE2
APN

Amarisoft
Antennas

APN

Software
Amarisoft
via SSH

Intercepting
Connect to the network UE1

Connect to the network UE2

Ettus USRP
B210

Send SMS
to UE2

Attacker

Figure 52 Simulated scenario of radio channel interception of SMS in
4G by passive external attacker.

Figure 53 Procedure of radio channel interception of SMS in 4G bypassive external attacker.

Conﬁguration

Results

The conﬁguration to this PoC is:

The 4G network has been set up with SSH with the given
parameters. Once conﬁgured, the service is established.

1.
2.
3.
4.
5.
6.
7.

8.

Downlink frequency 2680MHz (Band 7).
Bandwidth 5MHz.
RRC/UP layer ciphering algorithm: None.
Access Point Name: Default and Internet.
NAS layer ciphering algorithm: None (EEA0).
SMS over NAS.
Conﬁguration SIM 1:
a. Algorithm SIM: XOR
b. IMSI: 0010101023456789
c. K: 00112233445566778899aabbccddeeﬀ
d. Number Phone: 0600000000
Conﬁguration SIM 2 :a. Algorithm SIM: milenage
b. IMSI: 0010101023456788
c. K: 00112233445566778899aabbccddeeﬀ
d. Phone number: 0600000001

Procedure
The procedure to this PoC is:
1.
2.
3.

Conﬁgure the operator with the correct
conﬁguration parameters.
Conﬁgure the APN on the phones.
Connect the phones to the 4G network.

35 | Cybersecurity

The conﬁguration of the SIM-card is given in Figure 54.

Figure 54 The database for the subscribers, including the SIM-card
information.

The APN conﬁguration on the mobiles is the same as in
Figure 25.
After conﬁguring the APN of the mobile phone, it connects automatically to the network.
The traﬃc between the mobile and the base station is intercepted with the LTESniﬀer conﬁgured with frequency
2680MHz, two antennas and downlink capture.
A message has been sent from one mobile phone to another as can be seen in Figure 55.

Figure 56 Screenshot from the program Wireshark, which displays theintercepted traﬃc on the radio channel between the network and themobile phone receiving the SMS. The SMS content can be read in clear
text.

Conclusions
In this PoC the encryption was disabled by the operator.
We note that there was no notiﬁcation given to the users
to detect this. Using software deﬁned radio, an attacker
can easily capture the traﬃc on the radio channel, and in
this case, with the encryption disabled, the attacker canintercept the SMSs.

C.9

Downgrade attack of 4G network service
by external attacker using the radio
channelObjective
Figure 55 An SMS has been sent from mobile 2 to mobile 1, which canbe observed on the screenshots of the mobile phones in the ﬁgure.

In Figure 56, the program Wireshark is used to interpretthe capture created by LTESniﬀer and using the searchterm ‘gsm_sms’, the package with the SMS can be foundin the intercepted traﬃc.

36 | Cybersecurity

Illustration of a downgrade attack from a connection to
the 4G mobile network, which would force a switch to the2G mobile network. This can be used as a part of a composed attack.

Setup5.

The setup to this PoC is:

6.
7.

PC: To conﬁgure the 4G network via SSH andrealize the downgrade attack.
4G network (Amarisoft Callbox Classic):
Simulates a real operator network and a basestation.
USB Software Deﬁned Radio (HackRF): Used tosaturate the frequency band in which the basestation operates.
One mobile phone: Simulating a real network
subscriber.
One writeable SIM-card: To be able to connect itto the base station.

NAS layer ciphering algorithm: 128-bit AES
or Snow 3G.
SMS over IMS.
Conﬁguration SIM 1:
a. Algorithm SIM: XOR
b. IMSI: 0010101023456789
c. K:00112233445566778899aabbccddeeﬀ
d. Phone number: 0600000000

Procedure
The procedure to this PoC is:
1.

Figure Conceptual: Figure 5

2.
3.
4.

Figure Simulated:

5.

Conﬁgure the operator with the correct
conﬁguration parameters.
Conﬁgure the APN on the phone.
Connect the phone to the 4G network.
Saturate the frequency band in which the basestation operates.
Verify if the phone disconnects from the
4G network.

Amarisoft

UE 1

Amarisoft
Antennas

Software Amarisoft
Callbox Classic

Attacker
Amarisoft
Antennas

UE1

HackRF

APN

Software
Amarisoft
via SSH

Connect to the network UE1

Denial of Service
Saturate thefrequency band

HackRF

Disconnection fromthe network

Attacker

Figure 57 Simulated scenario of downgrade attack of 4G network
service by external attacker using the radio channel.

Conﬁguration
The conﬁguration to this PoC is:
1.
2.
3.
4.

Downlink frequency 2680MHz (Band 7).
Bandwidth 5MHz.
RRC/UP layer ciphering algorithm: 128-bit AES
or Snow 3G.
Access Point Name: Default and Internet.

37 | Cybersecurity

Figure 58 Procedure of downgrade attack of 4G network service by
external attacker using the radio channel.

Results
The 4G network has been set up with SSH with the given
parameters. Once conﬁgured, the service is established.

The noise source was launched to saturate the signal received by the mobile phone. The important parameters
for the denial-of-service attack are the center frequency(2680MHz) and the bandwidth (5MHz).

The conﬁguration of the SIM-card is given in Figure 59.

Figure 59 The database for the subscriber, including the SIM-card
information.

The APN conﬁguration on the mobile is the same as in
Figure 25.
After conﬁguring the APN of the mobile phone, the mobile
connects automatically to the network.
The number ‘*#0011#’ is dialled, since this number shows
the strength of the signal received by the phone from thebase station.

Figure 60 Network connection information such as bandwidth, bandwidth, PLMN, received signal strength parameters, connection status,
etc.

38 | Cybersecurity

Figure 61 Signal saturator: type of Gaussian noise, the most important parameters are shown with a red box: center frequency and bandwidth.

After this program is launched, the mobile phone goes
through the following disconnection process:1)

The mobile phone enters the IDLE state

Figure 62 The phone goes into IDLE state.

2)

The mobile phone is completely disconnectedfrom the network.

Conclusions
The downgrade attack has been demonstrated. The attack
can be used to downgrade the service to 2G and perform
other attacks using known vulnerabilities. For a practical
attack, aspects of the radio channel need to be taken into
account, such as proximity and suﬃcient signal strength tosaturate the 4G network for the mobile.
The cost of this attack is low, needed is an SDR radio device,and the HackRF is priced at about $300.

C.10

Cryptographic attack on the 2G (GPRS)
encryption algorithm GEA-1

Figure 63 The phone disconnects completely.

Objective

3)

Demonstrate that it is feasible to obtain the encryption key
of 2G communication encrypted with the GEA-1 algorithmwith a brute-force attack. This can be part of a multi-step
SMS interception attack which includes downgrade to 2G,
radio interception and ﬁnally decryption.

The mobile phone waits for a new network,
such as a 2G network.

Setup
The setup to this PoC is:

Figure 64 The phone waits for a new network.

Reference implementation: To generate thetarget keystream.
Attack implementation: To execute the key
recovery attack.
PC: To execute the reference implementationand the attack. The processor is an AMD
Ryzen 5 3600.
Conﬁguration
The conﬁguration to this PoC is:
1.
2.
3.
4.

39 | Cybersecurity

IV: 0
Direction: 1
Key: 0x255dc69f503597b2
Output keystream of reference
implementation (based on input conﬁguration):
0x734382151ab9811f

Procedure

Results

The procedure to this PoC is:

The following Python implementation of the algorithm
has been used to produce 64 bits of keystream with theprevious data:

1.

2.

3.

4.
5.

Compute the target keystream of 64 bits basedon the conﬁguration input values using thereference GEA-1 implementation. This
corresponds to the keystream that could beintercepted by an attacker. The encryption key
used to produce the keystream is not provided
to the attack, but only used to determine
whether the attack was successful.
Perform the ﬁrst stage of the attack, which
consists of precomputation of the attack tables
needed. This takes about 25 minutes and 73 GiBof storage.
Perform the second stage of the attack, which
consists of an exhaustive search of the internal
state, which generates diﬀerent keystreams.
When the reference key stream from stage 1 isfound, go to the next stage.
Perform the third stage of the attack, which
implies to reverse a part of the GEA-1 algorithm
to ﬁnd the key that generates this internal state.
Verify that the obtained key from the attack
matches the key used to generate thekeystream.

The procedure is illustrated in Figure 65.

https://github.com/P1sec/gea-implementation
Next, the following independent implementation has
been used against the generated keystream:
https://github.com/airbus-seclab/GEA1_break
It took about 8 seconds to test 97633476 values with 12
threads to recover the state, 0x1af58754892850bf. Oncethe internal state was recovered, it could be reversed ina few seconds to successfully obtain the key. Lastly, it isveriﬁed that the recovered key matches the key used togenerate the keystream with the independent GEA-1 implementation.
The choice of these parameters was not arbitrary. They
were selected so that the internal state was one of theﬁrst tested, and so the attack would not take too muchtime. With a randomly selected key, the expected numberof trials would be 2^39, with a maximum of 2^40. Therefore, the attack would take around 12 hours on average
and a day at maximum. The testing has been done withan AMD Ryzen 5 3600. Since the search is totally parallelizable, a cluster of 12 such processors could perform theattack in less than an hour.
Conclusions
The attack is perfectly feasible with an aﬀordable equipment and there are tools freely available to perform it.
Thus, it can easily be carried out by any attacker with a
low budget. The attack is related to threat scenarios 1
and 2 in Section 4, in which an attacker could passively
or actively capture the radio communication between themobile and the network and decipher it.

Figure 65 Procedure for the GEA-1 PoC attack.

40 | Cybersecurity

C.11

Cryptographic attack on the 2G (GSM)
encryption algorithm A5/1

2.

Objective
Demonstrate that it is feasible to obtain the encryption key of 2G communication encrypted with the A5/1
algorithm with a rainbow table attack. This can be partof a multi-step SMS interception attack which includes
downgrade to 2G, radio interception and ﬁnally decryption.
Setup
The setup to this PoC is:
Reference implementation: To generate thetarget keystream.
Attack implementation and table: To performthe attack.
PC: To execute the reference implementationand the attack. The processor is an AMD
Ryzen 5 3600.

3.

4.
5.

Precompute or download the rainbow tables
and prepare them with the attack implementation.
The complete set of tables consume 2TB
memory. It is not necessary to download thecomplete set to perform the attack, although
the probability of success increases with thenumber of tables available.
Search the target keystream in the rainbow
table using the attack implementation. The tableprovides the corresponding internal state. This
only takes a few seconds.
After ﬁnding the internal state that generates
the target keystream, reverse the algorithmwith the attack implementation to ﬁnd the key.
Verify that the obtained key matches the key
used to generate the keystream.

The procedure is illustrated in Figure 66.

Conﬁguration
The conﬁguration to this PoC is:
1.
2.
3.

Key: 0x6a15fd2c0300e210
Frame counter: 0
Output keystream: 11010011111100111001010
111010101111111101011101110110110000000
100110110110000111100011101000011011000
1110000001011

Procedure
The procedure to this PoC is:1.

Use the reference implementation to obtain atarget keystream of 114 bits with the input
values. This corresponds to the keystream that
could be intercepted by an attacker. The
encryption key used to produce the keystream is
not provided to the attack, but only used todetermine whether the attack was successful.

41 | Cybersecurity

Figure 66 Procedure for the A5/1 proof-of-concept attack.

Results

Conclusions

The following implementation, available online, of the A5/1
algorithm was used to produce 114 bits of keystream withthe previous data:

The attack is perfectly feasible with an aﬀordable equipment and there are tools freely available to perform it. Thus,
it can easily be carried out by any attacker with a low budget. This related to threat scenarios 1 and 2 in Section 4,
in which an attacker could passively or actively capture thecommunication between the user and the mobile network,and then decipher it, using the key recovered from an attack
as demonstrated in this proof-of-concept.

https://asecuritysite.com/encryption/a5
Next, the following, independent implementation of theattack has been used with the generated keystream as
input:
https://github.com/0xh4di/GSMDecryption
The choice of parameters was made purposefully, so that
not all rainbow tables had to be downloaded.
When the tables were downloaded and the software
attack tool was compiled, they were allocated in a disk
using the indexes/Behemoth.py script. This process takes
several minutes.
Then, the Kraken/kraken tool was used to look up the internal state in the tables. It took about 4 seconds to ﬁnd
the state 0x952ebf0388389235, which generates the 64
bits of keystream that start at bit position 42 in the target
keystream.
Then, the Utilities/ﬁnd_kc script was used to reverse thestate that corresponds to the 42 clock cycles and, given
the frame count 0, the diﬀerent possible keys for thestate were displayed. Among them was the correct key
that was used in the reference implementation.

42 | Cybersecurity

R

References
[1]
[2]
[3]
[4]
[5]
[6]
[7]
[8]
[9]
[10]
[11]
[12]
[13]
[14]
[15]
[16]
[17]
[18]
[19]
[20]
[21]
[22]
[23]
[24]
[25]
[26]

Wikipedia online, Available: https://en.wikipedia.org/wiki/SMS.
2FA Dictionary [Online]. Available: https://2fa.directory/
K. Nohl, „Attacking phone privacy,“ in BlackHat USA, Las Vegas, 2010.
C. Beierle, P. Derbez, G. Leander, G. Leurent, H. Raddum, Y. Rotella, D. Rupprecht and L. Stennes, Cryptanaly
sis of the GPRS Encryption Algorithms GEA-1 and GEA-2, Cryptology ePrint Archive, Paper 2021/819, 2021.
E. Barkan, E. Biham and N. Keller, „Instant Ciphertext-Only Cryptanalysis of GSM Encrypted Communication,“in Advances in Cryptology - CRYPTO 2003, Santa Barbara, California, USA, 2003.
R. B. N. A. V. N. a. J.-P. S. Altaf Shaik, «Practical Attacks Against Privacy and Availability in 4G/LTE Mobile
Communication System,» 2016.
J. Cox, „Daily Beast,“ 7 March 2018. [Online]. Available: https://www.thedailybeast.com/you-can-spy-like-thensa-for-a-few-thousand-bucks.
ENISA, „Signalling Security in Telecom SS7/Diameter/5G,“ 2018.
Positive Technologies, „SS7 Vulnerabilities and Attack Exposure Report,“ 2018.
Positive Technologies, „Diameter Vulnerabilities Exposure Report,“ 2018.
Cellusys, „cellusys.com,“ [Online]. Available: https://www.cellusys.com/resources/ss7-vulnerabilities-ebookdownload/.
R. P. Jover, „queue.acm.org,“ September 2020. [Online]. Available: https://queue.acm.org/detail.
cfm?id=3425909.
C. M. Daid, „adaptivemobile.com,“ March 2022. [Online]. Available: https://blog.adaptivemobile.com/themobile-network-battleﬁeld-in-ukraine-part-1.
C. M. Daid, „adaptivemobile.com,“ March 2022. [Online]. Available: https://blog.adaptivemobile.com/themobile-network-battleﬁeld-in-ukraine-part-2.
C. M. Daid, „adaptivemobile.com,“ April 2022. [Online]. Available: https://blog.adaptivemobile.com/themobile-network-battleﬁeld-in-ukraine-part-3.
Positive Technologies, „Next-Generation Networks, Next-Level Cybersecurity Problems,“ 2017.
H. Tanriverdi and M. Zydra, „Schwachstelle im Mobilfunknetz: Kriminelle Hacker räumen Konten leer,“
Süddeutsche Zeitung, 3 May 2017.
J. Ball, „theguardian.com,“ January 2014. [Online]. Available: https://www.theguardian.com/world/2014/
jan/16/nsa-collects-millions-text-messages-daily-untargeted-global-sweep.
The New York Times, „nytimes.com,“ March 2022. [Online]. Available: https://www.nytimes.com/
live/2022/03/16/world/ukraine-russia-war#us-oﬃcials-say-russian-troop-deaths-are-climbing-threateningits-militarys-morale.
K. Nohl and S. Munaut, „Wideband GSM Sniﬃng,“ in 27th Chaos Communication Congress, 2010.
D. R. T. H. C. P. Merlin Chlosta, «LTE Security Disabled-Misconﬁguration in Commercial Networks,» 2019.
N. C. a. M. Olivier, A Silent SMS Denial of Service ( DoS ) Attack, Information and Computer Security
Architectures (ICSA) Research Group.
M. Benjamin, „Internal control systems and mobile money fraud: A case study of MTN Uganda,“ Kampala,
Uganda., 2013.
A. Hope, „SMS Phishing Attack Compromised Twilio Leaking Customer Data, Targeted Cloudﬂare,“ CPO
Magazine, 17 August 2022.
B. Leonard, „Google,“ 19 April 2023. [Online]. Available: https://blog.google/threat-analysis-group/ukraineremains-russias-biggest-cyber-focus-in-2023/. [Accessed July 2023].
Kaspersky, „SMS Attacks and SMS Mobile Threats,“ [Online]. Available: https://www.kaspersky.com/
resource-center/threats/sms-attacks. [Accessed July 2023].

43 | Cybersecurity

[27]
[28]
[29]
[30]
[31]
[32]
[33]
[34]
[35]
[36]
[37]
[38]
[39]
[40]
[41]

„Emotet: How to best protect yourself from the Trojan,“ [Online]. Available: https://www.kaspersky.com/
resource-center/threats/emotet.
R. Brandom, „theverge.com,“ February 2015. [Online]. Available: https://www.theverge.
com/2015/2/24/8101585/the-nsas-sim-heist-could-have-given-it-the-power-to-plant-spyware-on.
J. Scahill and J. Begley, „theintercept.com,“ February 2015. [Online]. Available: https://theintercept.
com/2015/02/19/great-sim-heist/.
TCH, „TSN.ua,“ June 2022. [Online]. Available: https://tsn.ua/en/ato/russian-secret-services-have-launcheda-phycological-attack-on-ukrainian-military-using-sms-messages-of-intimidating-content-2082016.html.
J. Coleman, „businessinsider.com,“ April 2022. [Online]. Available: https://www.businessinsider.com/russiatried-incite-ukrainians-attack-their-own-capitol-via-text-2022-4?r=US&IR=T.
M. Kim, J. Suh and H. Kwon, A Study of the Emerging Trends in SIM Swapping Crime and Eﬀective
Countermeasures, Danang, Vietnam: IEEE, 2022.
ENISA, „Beware of the Sim Swapping Fraud!,“ 2021.
J. Cox, „vice.com,“ January 2020. [Online]. Available: https://www.vice.com/en/article/5dmbjx/how-hackersare-breaking-into-att-tmobile-sprint-to-sim-swap-yeh.
K. Lee, B. Kaiser, J. R. Mayer and A. Narayanan, „An Empirical Study of Wireless Carrier Authentication for SIM
Swaps,“ in USENIX Security Symposium, 2020.
J. Koelndorfer, N. Hopper and Y. Kim, „Location Leaks on the GSM Air Interface,“ 2011.
E. Bitsikas, T. Schnitzler, C. Pöpper y A. Ranganathan, «Freaky Leaky SMS: Extracting User Locations byAnalyzing SMS Timings,» 2023.
S. P. J. S. P. B. Erik Dahlman, 3G Evolution - HSPA and LTE for Mobile Broadband, Academic Press, 2007.
„Real Time Communication,“ 2022. [Online]. Available: https://realtimecommunication.wordpress.
com/2022/02/18/smsc-30-years-after/.
Ettus, „Ettus,“ [Online]. Available: https://www.ettus.com/all-products/ub210-kit/.
„Amarisoft,“ [Online]. Available: https://www.amarisoft.com/app/uploads/2022/03/userguide_callbox_classic.
pdf.

44 | Cybersecurity