O2 VoLTE: locating any customer with a phone call

Summary

Contents Introduction Voice over LTE (VoLTE) is a way to make calls via an internet-based protocol on mobile networks using a standard called IP Multimedia Subsystem (IMS). IMS implementations have historically caused trouble due to their increased complexity and device interdependence. This increase in complexity has traditionally only externally manifested with device incompatibility problems. In the past, it wasn't uncommon to find devices that required special firmware to utilise VoLTE and WiFi Calling. However, I have always been interested in another risk to this increased complexity. Security. With an IMS implementation, it is up to the mobile network to choose how they want to implement the services, and what configurations they want to use. Your phone then talks directly with these servers. Mobile networks have a responsibility to ensure that these servers are kept up to date and secure, and that their configurations do not lead to unnecessary data exposure. Unfortunately, today we will be looking at a great example of a mobile network that has validated my concerns. O2 UK On 27 March 2017, O2 UK launched their first IMS service.[1] Dubbed "4G Calling" by the network, it provided improved voice quality and a better in-call data experience as customers did not drop down to 3G when making a call. As someone who had recently moved to O2, I was interested in the network's IMS implementation, particularly which voice codecs were supported by the network for calls made on 4G/WiFi Calling. Using an application known as Network Signal Guru (NSG) on my rooted Google Pixel 8, I called another O2 customer (with a 4G VoLTE compatible device) to try and determine audio quality. A bug within NSG on modern Google Pixel devices with Samsung Modems means that the VoLTE section of the the app doesn't automatically populate the codec used for the current call, meaning that I instead had to look at the raw IMS signalling messages sent between my device and the network to find ...