FlagThis

A security flaw has been discovered in O2 UK's implementation of VoLTE and WiFi Calling technologies, potentially exposing the general location and other identifiers of mobile users. Researchers from Beijing University of Posts and Telecommunications and the University of Birmingham identified a critical vulnerability in the EEA2 encryption algorithm. This flaw allowed attackers to intercept and decrypt voice call data, accessing sensitive information such as call metadata, including call times, duration, and direction of calls. This discovery highlights the urgent need for improved security measures within telecommunications networks.

The vulnerability stemmed from the non-encrypted MAC sub-header at the mobile relay, which revealed the Logical Channel ID (LCID) of the sub-PDU (Protocol Data Unit). This information enabled the researchers to target VoLTE traffic directly. Researcher Daniel Williams also found that the flaw likely existed on O2 UK's network since February 2023. The flaw could allow anyone to expose the general location of a person and other identifiers by calling the target, theoretically, in some cases, this could be accurate to within 100 square meters.

O2 UK, now part of Virgin Media O2 (VMO2), has since patched the bug following the discovery and public disclosure of the vulnerability. A VMO2 spokesperson stated that their engineering teams had been working on and testing a fix for a number of weeks and the fix is now fully implemented. The company has also contacted the researcher Daniel Williams to thank him for his work. This incident underscores the importance of regular security assessments and prompt patching to protect user privacy in modern telecommunications systems.

ImgSrc: mnwa9ap4czgf-u1

References :

• cyberinsider.com: O2 UK VoLTE Leak Exposes Real-Time Location of Any Customer Through a Phone Call
• BleepingComputer: O2 UK patches bug leaking mobile user location from call metadata
• bsky.app: O2 UK patches bug leaking mobile user location from call metadata
• The DefendOps Diaries: Security Flaw in O2 UK's VoLTE and WiFi Calling: A Call for Enhanced Protection
• The Register - Security: Virgin Media O2 patches hole that let callers snoop on your coordinates
• CyberInsider: A critical privacy vulnerability in O2 UK's Voice over LTE (VoLTE) system allows any caller to accurately geolocate any O2 customer simply by initiating a phone call, without their consent or knowledge.
• securityaffairs.com: A flaw in O2 4G Calling (VoLTE) leaked user location data via network responses due to improper IMS standard implementation.
• Tech Monitor: O2 UK resolved security vulnerability in VoLTE and WiFi Calling features, which exposed users' general locations and personal identifiers.

Classification:

• HashTags: #VoLTE #WiFiCalling #Privacy
• Company: O2 UK
• Target: O2 UK mobile users
• Product: VoLTE
• Feature: User location exposure
• Type: Vulnerability
• Severity: Medium