VoLTEFuzz: framework for stateful analysis of SIP in VoLTE

Abstract

VoLTE and SMS over IMS are services that provide voice calls and Short Messages Service(SMS) in LTE. These services are supported by SIP communication between the UE and IMS. Since voice calls and SMS are indispensable in our daily lives, vulnerabilities in SIP communications can cause significant threats such as voice phishing, smishing, and denial of service. To prevent these threats, previous studies have analyzed vulnerabilities in SIP communication between the device and IMS, but those studies have had two major limitations. First, they focus on detecting vulnerabilities in IMS. Second, while SIP communication takes place in several stages, the studies only focus on vulnerability in stateless cases. In this work, we designed a framework named VoLTEFuzz to find implementation vulnerabilities in SIP via LTE which offers a stateful and bidirectional testing environment. This characteristic supports the test to be conducted in more diverse states than previous works. VoLTEFuzz controls the flow of SIP packets in a commercial UE like a MitM in consideration of SIP messages’ state. We generated test cases based on three attack scenarios: identity spoofing, authentication bypass, charging bypass. We tested 25 cases on 2 carriers with VoLTEFuzz and found four vulnerabilities.