User location tracking attacks for LTE networks using the interworking functionality

Silke Holtmanns, Siddharth Prakash Rao, Ian Oliver

Research output: Chapter in Book/Report/Conference proceedingConference contributionScientificpeer-review

11 Citations (Scopus)


User location tracking attacks using cellular networks have been known since 2008. In 2014, several Signalling System No 7 (SS7) protocol based location tracking attacks were demonstrated, which particularly targeted the cellular roaming in GSM networks. Currently, the mobile network operators are in a gradual process of upgrading to Long Term Evolution (LTE) networks, in addition to replacing SS7 by its successor-Diameter protocol. Though Diameter seems to be an improvement over SS7 in terms of security with the use of IPsec/TLS and certificate based authentication, they still need to communicate with their roaming partners who use less secure SS7. In this paper, we will briefly present the translation of existing SS7 attacks into Diameter-based attacks in LTE networks (under certain assumptions) using Interworking Functions(IWF)-which allows communication between networks that use different protocols. The key contribution of this paper is the the detailed explanation of novel attack vectors to obtain the user location information using IWF and hence, the proof that even new LTE network can be vulnerable to legacy attacks. Furthermore, we will outline some of the potential protection approaches for the attacks that we discuss.

Original languageEnglish
Title of host publication2016 IFIP Networking Conference (IFIP Networking) and Workshops, IFIP Networking 2016
Number of pages8
ISBN (Electronic)978-3-9018-8283-8
Publication statusPublished - 21 Jun 2016
MoE publication typeA4 Article in a conference publication
EventIFIP Networking Conference and Workshops - Vienna, Austria
Duration: 17 May 201619 May 2016


ConferenceIFIP Networking Conference and Workshops


  • Diameter
  • Interworking Funcation (IWF)
  • Location Tracking
  • Privacy
  • Signalling System No.7 (SS7)

Fingerprint Dive into the research topics of 'User location tracking attacks for LTE networks using the interworking functionality'. Together they form a unique fingerprint.

Cite this