Researchers find 36 new flaws in LTE protocol

■ According to the KAIST paper, researchers built a semi-automated testing tool named LTEFuzz, which they used to craft malicious connections to a mobile network, and then analyze the network's response.

■ The KAIST team said it notified both the 3GPP and the GSMA, but also the corresponding baseband chipset vendors and network equipment vendors on whose hardware they performed the LTEFuzz tests.

New Delhi, March 24: 36 new vulnerabilities have been identified by a team of researchers in the Long-Term Evolution (LTE) standard used by thousands of mobile networks and hundreds of millions of users across the world.

The vulnerabilities, which allow attackers to disrupt mobile base stations, block calls, disconnect users from a network, send spoofed SMS, and eavesdrop and manipulate data traffic, were discovered by a four-person research team from the Korea Advanced Institute of Science and Technology Constitution (KAIST), and documented in a research paper they intend to present at the IEEE Symposium on Security and Privacy in late May 2019.

The team's discoveries aren't exactly new. Several academic groups have identified similar vulnerabilities in LTE over the past years on numerous occasions — July 2018, June 2018, March 2018, June 2017, July 2016, October 2015 (paper authored by another KAIST team).

These vulnerabilities have been the driving force behind efforts to create the new and improved 5G standard — which, unfortunately, isn't that secure either, with some researchers already poking holes in it as well.