We present VWAttacker, the first systematic testing framework for analyzing the security of Voice over WiFi (VoWiFi) User Equipment (UE) implementations. VWAttacker includes a complete VoWiFi network testbed that communicates with Commercial-Off-The-Shelf (COTS) UEs based on a simple interface to test the behavior of diverse VoWiFi UE implementations; uses property-guided adversarial testing to uncover security issues in different UEs systematically. To reduce manual effort in extracting and testing properties, we introduce an LLM-based, semi-automatic, and scalable approach for property extraction and testcase (TC) generation. These TCs are systematically mutated by two domain-specific transformations. Furthermore, we introduce two deterministic oracles to detect property violations automatically. Coupled with these techniques, VWAttacker extracts 63 properties from 11 specifications, evaluates 1,116 testcases, and detects 13 issues in 21 UEs. The issues range from enforcing a DH shared secret to 0 to supporting weak algorithms. These issues result in attacks that expose the victim UE's identity or establish weak channels, thus severely hampering the security of cellular networks. We responsibly disclose the findings to all the related vendors. At the time of writing, one of the vulnerabilities has been acknowledged by MediaTek with high severity.

翻译：本文提出VWAttacker，首个用于分析WiFi语音（VoWiFi）用户设备（UE）实现安全性的系统性测试框架。VWAttacker包含一个完整的VoWiFi网络测试平台，该平台通过简易接口与商用现成（COTS）UE进行通信，以测试不同VoWiFi UE实现的行为；并采用属性引导的对抗性测试来系统性地发现不同UE中的安全问题。为减少属性提取与测试的手动工作量，我们引入一种基于大语言模型（LLM）、半自动化且可扩展的属性提取与测试用例（TC）生成方法。这些测试用例通过两种领域特定的转换进行系统性变异。此外，我们引入两个确定性预言机来自动检测属性违规。结合这些技术，VWAttacker从11份规范中提取了63项属性，评估了1,116个测试用例，并在21款UE中检测到13个问题。这些问题范围从强制DH共享密钥为0到支持弱算法不等。这些问题导致可暴露受害UE身份或建立弱信道的攻击，从而严重损害蜂窝网络的安全性。我们已负责任地向所有相关厂商披露了发现。截至撰写时，联发科已确认其中一个漏洞具有高严重性。