Remote Detection of 4G/5G UEs Vulnerable to Stealthy Call DoS

Nowadays, all the 4G/5G voice solutions are offered by the IMS (IP Multimedia Subsystem) system. They include 4G VoLTE (Voice over LTE) and 5G VoNR (Voice over New Radio), as well as a non-3GPP access solution, VoWiFi (Voice over WiFi). Since VoWiFi is implemented on mobile OS, instead of the modem with hardware security for VoLTE and VoNR, it can be a vulnerability of the IMS system and may further impair other IMS-based services. It has been exposed that due to vulnerable Vo WiFi sessions, several IMS vulnerabilities are discovered and the smartphones with IMS-based call services may suffer from a stealthy call DoS attack, where the smartphones cannot make or receive any calls and no ringtone or messages are appeared on them during the attack. In this paper, we develop a detector that can remotely and concurrently detect such DoS attack for multiple UEs (User Equipments). It consists of three major components: session hijacking, SIP fabrication, and call detection. We demonstrate its effectiveness in the operational networks of two carriers from different countries by considering three different phone models with VoLTE and VoWiFi call services.