LTE or 4G is the standard when it comes to surfing with a mobile phone. Until now it has been seen as relatively safe as well, but no more: Security researchers discovered three exploits that allow cybercriminals to follow which pages you visit and even derail you to fake websites.
What can the three attacks do?
Two of the attacks are passive, which means that the cybercriminal can listen in on you, but not modify your data or interfere with what you’re doing online. The passive attacks can
1) Identify your device (Identity mapping): Cybercriminals can precisely localize and identify a user in a mobile cell – which basically helps set up the other two attacks.
2) Distill your Meta information (Website fingerprinting): Every time you do something online, like visiting a webpage or watching a video, you transmit meta-information, for example, the amount of traffic you use. A video, of course, uses more than just shopping or looking at memes. To figure out what pages someone is looking at an attacker would record traffic snapshots from popular websites upfront and then compare.
The third one is active and called “aLTEr”. Active in this case means that an intruder can actually do something instead of “just” listen. And while encrypts the user’s data, they’re not privy to being changed – a fact that is exploited in this case.
In the example given by the researchers, the user is redirected to malicious websites thanks to a fake DNS server. This would allow attackers to collect passwords and other private information. Take a look at the impressive video below in which the attack is demonstrated by the security researchers:
Is “aLTEr” dangerous for you?
Yes and no. No one is safe from the attack, so if someone would want to target you, you’d most likely fall victim to it. Now here’s the big but: According to the researchers, the attack needs very special software and expensive equipment in order to be conducted – around $4k of it if you believe ArsTechnica. That’s a lot, so you probably should not expect anyone going through with it just to get some kind of silly revenge. There might be some feasible targets though: Politicians, journalists or other persons of interest could potentially be at risk.
