aLTEr: LTE Layer-2 Flaw Enables DNS Redirection via Unauthenticated User-Plane Encryption
In June 2018, researchers from Ruhr University Bochum and NYU Abu Dhabi (Rupprecht, Kohls, Holz, Pöpper) disclosed that LTE user-plane traffic is encrypted but not integrity-protected, allowing a nearby man-in-the-middle relay to redirect a victim's DNS traffic.
02Deep-Dive Technical Analysis
LTE encrypts user data at the PDCP layer in counter mode (AES-CTR), but the standard applies no integrity protection to the user plane, so ciphertext is malleable: altering ciphertext bits predictably alters the decrypted plaintext. Because fields such as a DNS resolver address are predictable, a relay sitting between phone and network can change where encrypted DNS requests go. The paper "Breaking LTE on Layer Two" (IEEE S&P 2019) also showed identity mapping and website fingerprinting; the same team later published IMP4GT (NDSS 2020) and ReVoLTE (USENIX Security 2020, VoLTE keystream reuse). They reported via the GSMA CVD programme.
03Vulnerability & Exploit Flow
Malleability of counter-mode encryption without a message authentication code on the LTE user plane.
04Recommended Defense & Mitigation Protocol
User-plane integrity protection (optional in 5G NR, advocated as mandatory), plus HTTPS/HSTS and encrypted DNS on handsets.
05Security Impact & Geopolitical Consequence
Pushed GSMA and 3GPP to revisit user-plane integrity: 5G specifies it only as optional, and the researchers argued it should be mandatory.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.