A Man-in-the-Middle Attack on 3G-WLAN Interworking

In this paper, we present a man-in-the-middle attack on 3G-WLAN internetworking, one of the widely used technologies in real-world deployment. Since 3G runs CS (Circuit Switch) in many practice and WLAN runs PS (Packet Switch), a gateway is necessary to perform protocol transforming to achieve internetworking of 3G and WLAN. However, the 3G-WLAN gateway is frangible to the kernel upgrade attack which allows the intruder to refresh the kernel of a valid 3G-WLAN gateway. By this means, the attacker can stealthily eavesdrop on all the UE-initiated (User Equipment) traffic from either 3G or WLAN during the protocol transforming and codec transcoding.