4G LTE protocols used by smartphones can be hacked, researchers found

Re:4G LTE protocols used by smartphones can be hacked, resea... by azernik on Wednesday November 09, 2016 @08:35PM (#12916891)

Downgrade attacks are actually very serious. The issue here being not with 4G/LTE in general, but with the strategy of downgrading to insecure networks after failing to connect with a secure one. It's like browsers falling back to insecure ciphers in HTTPS after failing to negotiate secure ones - a serious problem for the system as a whole.

[ Parent | on HN ]

Re:4G LTE protocols used by smartphones can be hacked, resea... by debatem1 on Wednesday November 09, 2016 @08:50PM (#12916976)

I agree that a true downgrade attack would be a very serious vulnerability in 4G, particularly one like I alluded to that could take the RRC down to EIA0-- but that isn't what's being discussed here, and calling it a vulnerability in LTE is inappropriate, just as calling HTTP fallback in browsers a vulnerability in HTTPS would be inappropriate. The vulnerability, to the extent it exists at all, is on the client, in this case mobile devices and in your example the browser.

[ Parent | on HN ]

Re:4G LTE protocols used by smartphones can be hacked, resea... by Buge on Thursday November 10, 2016 @01:50AM (#12918268)

HTTP fallback is a vulnerability in websites. It can be solved by using HSTS, or partially solved with secure cookies and redirecting to https.

If a browser disobeys these principles and uses HTTP anyway, that's a serious vulnerability. Same if a phone downgrades to insecure stuff.

[ Parent | on HN ]