Mobile Network Hacking, IP Edition

## Overview

Nine years of mobile network security research culminated in discovery of critical vulnerabilities in RCS (Rich Communication Services)—a new technology being aggressively deployed by Google and mobile operators globally to replace SMS/traditional calling with IP-based messaging. RCS provides features comparable to WhatsApp/iMessage (group chat, file sharing, video calling) but integrated directly into phones (Android 9+), with ~100 networks worldwide supporting it (likely underestimated due to DNS blocking by some operators). Prior work (2014) identified SS7, diameter, and radio-layer vulnerabilities; limited research examined IMS (IP Multimedia Subsystem) and RCS security. This research demonstrates that RCS fails to mitigate historical mobile network threats. All five attack categories identified on legacy mobile networks have functional exploits against RCS/IMS: interception, impersonation, user tracking, billing fraud, and denial-of-service. Vulnerabilities stem from SIP (Session Initiation Protocol) design, IMS architecture, and insufficient security in RCS implementation. Most developed nations have RCS deployed in at least one operator; vulnerability scope affects 100+ networks.

## Mobile Network Architecture Evolution and RCS Deployment

**Generation Evolution**: 2G—voice calls only; 3G—added SMS; 4G—Internet becomes primary use case; dedicated voice channels eliminated (calls transition to IP-based VoIP); 5G/4G extension—RCS adds enhanced messaging features (group chat, file transfers, video) over IP. Fourth-generation networks lack dedicated circuit-switched voice channels; calls over 4G must traverse IP or fallback to 3G. RCS represents next evolution: standardized IP-based rich communication replacing fragmented third-party apps (WhatsApp, Messenger, etc.).

**IMS and RCS Architecture**: IMS (IP Multimedia Subsystem) is the core infrastructure enabling IP-based mobile communications. RCS extends IMS with rich-communication features. Both use SIP (Session Initiation Protocol) for signaling and call control. Network components include radio access, backhaul, IMS servers, HSS (Home Subscriber Server—subscriber database), CSCF (Call Session Control Function), and media servers. Previously researched components: radio channels (3GPP/GSM air-interface), SS7 (legacy signaling), Diameter (AAA protocol). Understudied components: IMS server logic, RCS protocol implementation, SIP endpoint behavior.

**Global Deployment**: Survey of ~900 mobile networks (GSMA members) reveals: ~1/3 deployed 4G/LTE; ~200 deployments support IMS (basis for IP-based calling); ~150 support VoWiFi (Voice over WiFi extension); ~100 networks support RCS (lower bound; some nations block DNS enumeration preventing accurate count). Highest concentration in developed nations: US (all major operators), Europe (Orange, Vodafone, etc.), Asia, Australia. RCS rapidly deploying; most Android users (Android 9+) already have it installed without explicit opt-in.

## Attack Vectors Across Five Vulnerability Categories

**Impersonation (Caller ID Spoofing)**: Attacker connects to IMS network, sends SIP INVITE with arbitrary From field (attacker spoofs victim's phone number as caller). No special information required; SIP protocol permits any From field. Network forwards call with spoofed caller ID to recipient—victim appears to be making call they didn't initiate. Enables financial fraud, social engineering, harassment.

**User Tracking via SIP OPTIONS Enumeration**: SIP OPTIONS is standard presence mechanism allowing parties to query user availability. Attacker sends SIP OPTIONS packet to target phone number; if user available, receives SIP 200 OK response; if not, receives "user not found." Attacker prepares list of phone numbers (sequential ranges, leaked databases, social engineering), sends OPTIONS packets systematically, learns which numbers are valid/active. Location tracking enabled by observing network response times or geographic routing of OPTIONS responses. Precise user location determination possible by analyzing network infrastructure serving the request.

**Interception of Calls and SMS**: Two mechanisms: (1) Configuration file extraction from victim device revealing proxy server addresses and credentials—attacker uses credentials to intercept calls; (2) Man-in-the-middle attack exploiting DNS and domain crafting—attacker controls victim's DNS resolution or compromises network DNS, redirects SIP traffic to attacker-controlled server, intercepts/records media streams. RCS handles media via encrypted SRTP (Secure Real-time Transport Protocol), but interception at SIP signaling layer reveals call metadata and endpoints.

**Billing Fraud**: Attacker initiates calls/SMS through compromised or spoofed identity; charges attributed to victim or third party rather than attacker. SIP impersonation enables making calls on victim's behalf; victim receives bills for attacker's communications. Fraud without requiring victim credential compromise if network lacks sufficient SIP authentication/validation.

**Denial-of-Service**: User-level DoS—sending excessive SIP OPTIONS, INVITE, or other messages to target phone number causes resource exhaustion, message queue overflow, battery drain, service interruption. Network-level DoS—targeting IMS server infrastructure with flood attacks, malformed SIP packets, or protocol exploits can disrupt service for entire subscriber base. Some vulnerabilities universal across all networks; others network-specific based on implementation and security posture. Mitigations include SIP authentication hardening, rate limiting, user education, carrier-side IMS validation.