A newly discovered LTE flaw could expose your smartphone browsing sessions, as well as the websites you’ve visited in the past, to malicious third-parties.
The flaw has to do with LTE’s underlying data link layer, and it can be exploited three different ways: Through one of two kinds of passive attacks, or an active attack dubbed aLTEr. The passive attacks allow for identity mapping and website fingerprinting, which can be used to send a user to a malicious website, or record the websites that they visit.
The researchers demonstrated the aLTEr attack in a YouTube video.
Fortunately, the realistic chances of your data being captured in such an attack are low. It requires roughly $4,000 worth of equipment, and the tests were also conducted in a controlled environment, so it would likely be far more challenging to successfully try in the real world.
However, if someone were that dedicated, unlike most smartphone security issues, there is no patch against this LTE flaw. A fix would require “overhauling the entire LTE protocol,” according to the XDA developers website. If someone succeeded at this kind of attack in the wild, they would only be able to attack LTE users within a one-mile radius of their location.
“Although the researchers have shown traffic modification to be feasible in a laboratory environment, there are a number of technical challenges to make it practical outside a laboratory,” the GSM Association told Ars Technica. “The GSMA does not believe that the specific technique demonstrated by the researchers has been used to target users in the past, nor is it likely to be used in the near future.”
Thanks to this new research, the GSM Association did say that it is working to investigate how to build greater traffic integration protections and user information protections into LTE in the future.
The best way you can protect yourself is by only visiting sites that use HTTPS. This ensures that data sent between you and the site is secure. It also means that the site you’re visiting is verified—it is not a fake site pretending to be your destination in an effort to steal your information.
As for the future, the researchers who uncovered this LTE flaw hope that their findings will be integrated into the development of 5G technology.
H/T XDA Developers