Silent signals, loud impacts: exploiting the IMS core from the user edge

The IMS core is usually assessed from the network side. Viewed instead from the user equipment, the Gm, SWu, Ici and S8HR access interfaces present a different and far less examined attack surface, reachable through SIP and SDP signaling and through IPsec and IKEv2 session parameters.

In this session, Jimmy Billaud walks through the threat classes that emerge from that vantage point, and maps each of them against 3GPP TS 33.203, 3GPP TS 24.229, GSMA FS.22, GSMA FS.38 and RFC 3261 to show where real deployments diverge from what the standards require.

Key topics include:

• The IMS attack surface seen from the user equipment
• Gm, SWu, Ici and S8HR interface exposure
• Silent call denial of service and the battery drain it causes
• Subscriber geolocation disclosure ahead of call pickup
• Emergency call misrouting and policy bypass through bearer context piggybacking
• What operators should check and enforce