Security: Diameter - Attack Vectors & Vulnerabilities

🚩 Core Attack Sequences

1. Location Tracking (ULR/AIR Attack)

• Vector: Update-Location-Request (ULR) or Authentication-Information-Request (AIR).
• Method: An attacker sends a ULR message for a target IMSI from a fake MME. The HSS responds with a ULA containing the subscriber's current location (e.g., VPLMN ID).
• Impact: Continuous tracking of subscriber movement and identifying the current serving network.
• Mitigation: Category 1/2 filtering (GSMA FS.19) and Velocity Checks (detecting impossible subscriber travel speeds).

2. Subscriber Denial of Service (CLR Attack)

• Vector: Cancel-Location-Request (CLR).
• Method: An attacker sends a CLR message to a serving MME, claiming the subscriber has moved or the profile was deleted. The MME detaches the subscriber.
• Impact: Subscriber loses connectivity. If repeated, this results in a permanent DoS for specific targets.
• Mitigation: Mandatory mTLS/IPsec between signaling peers and origin verification for Cancel-Location messages.

3. Data Leakage (IDR/DSR Attack)

• Vector: Insert-Subscriber-Data-Request (IDR) or Delete-Subscriber-Data-Request (DSR).
• Method: Attackers inject IDR messages with modified APNs or service profiles to redirect subscriber traffic through malicious gateways.
• Impact: Traffic interception (Man-in-the-Middle) and potential for further protocol exploitation.
• Mitigation: AVP validation and rate-limiting on administrative signaling messages.

4. Charging & Billing Fraud (CCR Attack)

• Vector: Credit-Control-Request (CCR).
• Method: Injected CCR messages to the OCS to simulate subscriber usage or to check credit availability for fraudulent purposes.
• Impact: Financial loss for the subscriber or the operator.
• Mitigation: Correlation of signaling traffic with actual data usage and anti-spoofing for charging IDs.

🛠️ Security Architecture Mapping

!CAUTIONDiameter Over SCTP: While SCTP provides some multi-homing resilience, without Mutual TLS (mTLS) at the presentation layer or IPsec at the transport layer, Diameter traffic remains in plain text across the interconnect backbone (IPX/GRX), allowing for passive interception by anyone with access to the transit points.