Android phones on Verizon, AT&T face LTE security vulnerability, researchers say

Verizon Wireless and AT&T Mobility customers with Android phones are vulnerable to security and privacy breaches when using Voice over LTE, according to an advisory posted by security researchers. As ZDNet notes, the advisory, which posted by Carnegie Mellon University's public vulnerability database (CERT) on Oct 16, was based on a paper published by South Korean academics and security researchers. "A remote attacker on the provider's network may be able to establish peer-to-peer connections to directly retrieve data from other phones, or spoof phone numbers when making calls," the advisory said about the vulnerability's potential impact.

"A malicious mobile app for Android may be able to silently place phone calls without the user's knowledge." According to the advisory, Google's Android platform does not have appropriate permissions security for LTE networks, especially for VoLTE, and also suffers from improper access control. "Some networks allow two phones to directly establish a session rather than being monitored by a SIP server, thus such communication is not accounted for by the provider," the advisory states. "This may be used to either spoof phone numbers or obtain free data usage such as for video calls."