2021 · Conference paper
Noncompliance as Deviant Behavior: An Automated Black-box Noncompliance Checker for 4G LTE Cellular Devices
DIKEUE checks 4G LTE control-plane (NAS and RRC) implementations in commercial phones and modems for noncompliance through differential testing rather than predefined security properties. Its FSM inference module runs TTT active automata learning in LearnLib through an LTE-specific adapter on a modified srsLTE network with a USRP B210 radio, adding a context checker, query cache, inconsistency resolver and reset without rebooting. An equivalence checker then encodes pairs of learned input-output finite state machines for the nuXmv model checker and enumerates diverse deviation-inducing input sequences, which the authors analyze manually.
Scope and limitations
Covers control-plane NAS and RRC procedures with a chosen input alphabet and queries up to length 12; session management, data-plane protocols and 5G are left to future work. Learned machines are hypotheses bounded by Wp-method conformance testing and custom termination conditions. The authors list false-negative sources, including omitted message predicates, pruned infeasible sequences, models disconnected by removing deviating transitions, and devices that are noncompliant in the same way. Findings cover 14 devices with basebands from five vendors (Qualcomm, Intel, MediaTek, HiSilicon and Exynos): 17 deviations, 15 of them new, of which the authors class 11 as exploitable and 3 as potential interoperability issues. Deviations were triaged and attacks constructed manually, and the results do not establish the behaviour of other devices, firmware versions or networks.
Why it fits this collection
Reconstructs protocol state machines of closed cellular basebands through black-box interaction and uses cross-implementation differences to locate noncompliance, extending the catalog's automata-learning work from Bluetooth Low Energy to 4G LTE devices.
Publication and review details
- Venue
- ACM CCS 2021
- Status
- Conference paper
- Publication / posting date
- November 12, 2021
- Date source
- ACM's Crossref deposit records published/print publication on 2021-11-12 and online publication on 2021-11-13. This entry uses the print date, not the November 15–19 conference dates.
- DOI
- 10.1145/3460120.3485388
Crossref and the author-hosted PDF agree on the five-author order; pages 1082–1099 come from ACM's Crossref deposit. The reviewed 17-page author copy, uploaded in September 2021, is not asserted to match the 18-page proceedings version, and the ACM PDF returned HTTP 403 to automated requests. The Apache-2.0 repository snapshot at 5975807 (2023-06-07) contains the FSM learner, modified srsLTE stack and configurations, device resetter and equivalence checker. Its README lists Ubuntu 18.04 (tested), a USRP B210 (tested SDR), adb, Graphviz, JDK 11, Maven, Python 2 and pydot; it also requires a SIM card programmed to srsLTE requirements and per-device airplane-mode reset functions, and reports about 40–45 minutes for the equivalence checker on two sample FSMs. The README bases the modified stack on srsLTE 19.03, whereas the paper names srsLTE v19.10. The authors report responsible disclosure to GSMA and the affected vendors. No radio hardware, devices or upstream code were used.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://dl.acm.org/doi/10.1145/3460120.3485388
- https://api.crossref.org/works/10.1145/3460120.3485388
- https://syed-rafiul-hussain.github.io/index.php/publications/noncompliance-as-deviant-behavior-an-automated-black-box-noncompliance-checker-for-4g-lte-cellular-devices/
- https://syed-rafiul-hussain.github.io/wp-content/uploads/2021/09/dikeue.pdf
- README.md GitHub · SyNSec-den/DIKEUE · Revision 5975807
- LICENSE GitHub · SyNSec-den/DIKEUE · Revision 5975807