IMS (IP Multimedia Subsystem) is an essential 4G/5G component to offer multimedia services. It is used worldwide to support two call services: VoLTE (Voice over LTE) and VoWiFi (Voice over WiFi). In this study, it is shown that the signaling and voice sessions of VoWiFi can both be hijacked by a malicious adversary. By hijacking the signaling session, s(he) gains the ability to make ghost calls to launch stealthy DoS (Denial of Service) or caller-ID spoofing attacks against specific cellular users. Such attacks can be carried out without any malware or network information, and require only the victim’s phone number to be known. It is shown that phones vulnerable to the call DoS attacks can be detected at run time by exploiting a vulnerability of cellular network infrastructures referred to as call information leakage, which is exposed based on a machine learning method. Especially, the call DoS attacks can prevent victims from receiving incoming calls for up to 99.0% time without user awareness. Moreover, by hijacking the voice session, an adversary can launch stealthy free data transfer attacks based on phone numbers alone rather than IP addresses. The identified vulnerabilities/attacks are validated in the operational 4G networks of four top-tier carriers across Asia and North America with seven phone brands. The study concludes by presenting a suite of solutions to address them.

IMS (IP Multimedia Subsystem) is an essential framework for providing 4G/5G multimedia services. It has been deployed worldwide to support two call services: VoLTE (Voice over LTE) and VoWi-Fi (Voice over Wi-Fi). VoWi-Fi enables telephony calls over the Wi-Fi network to complement VoLTE. In this work, we uncover that the VoWi-Fi signaling session can be hijacked to maliciously manipulate the IMS call operation. An adversary can easily make ghost calls to launch a stealthy call DoS (Denial of Service) attack against specific cellular users. Only phone numbers, but not any malware or network information, are required from the victims. This sophisticated attack harnesses a design defect of the IMS call state machine, but not simply flooding or a crash trigger. To stealthily detect attackable phones at run time, we exploit a vulnerability of the 4G network infrastructure, call information leakage, which we explore using machine learning. We validate these vulnerabilities in operational 4G networks of 4 top-tier carriers across Asia and North America countries with 7 phone brands. Our result shows that the call DoS attack can prevent the victims from receiving incoming calls up to 99.0% time without user awareness. We finally propose and evaluate recommended solutions.

WiGig enables wireless multi-gigabit communication over 60GHz band. However, its usage scenarios may be constrained by two major limitations: line-of-sight propagation and very short transmission range. We seek to boost the WiGig's usability by using WiFi to complement its limitations in tri-band (2.4/5/60GHz) wireless systems. Our goal is to let a tri-band client have multimedia services at the WiGig's very high speed without any hassle. When the WiGig link is down or performs bad, not only can the client temporarily handover to WiFi without service interruption, but its ongoing multimedia services can also adapt to the WiFi's slower link. Though the IEEE 802.11ad standard has proposed an FST (Fast Session Transfer) mechanism to support handover operations at the link layer, it does not satisfy our goal due to two reasons. First, it does not specify when to perform WiGig/WiFi handovers. Second, it is not application-aware to achieve the service adaptation. To this end, we design and implement an application-aware, seamless WiGig/WiFi handover solution above the network layer. It ensures timely handover trigger for the WiGig's abrupt link interruption, keeps service continuity during handovers, and adapts multimedia service qualities to different WiGig/WiFi links. Our demo confirms its viability. We show that a video streaming service at the client is not interrupted during WiGig/WiFi handovers, which are triggered by mobility or the WiGig's signal blockage, but smoothly switches between different resolutions according to different links.