  Voice over LTE (VoLTE) and Voice over NR (VoNR) are two similar technologies
that have been widely deployed by operators to provide a better calling
experience in LTE and 5G networks, respectively. The VoLTE/NR protocols rely on
the security features of the underlying LTE/5G network to protect users'
privacy such that nobody can monitor calls and learn details about call times,
duration, and direction. In this paper, we introduce a new privacy attack which
enables adversaries to analyse encrypted LTE/5G traffic and recover any
VoLTE/NR call details. We achieve this by implementing a novel mobile-relay
adversary which is able to remain undetected by using an improved physical
layer parameter guessing procedure. This adversary facilitates the recovery of
encrypted configuration messages exchanged between victim devices and the
mobile network. We further propose an identity mapping method which enables our
mobile-relay adversary to link a victim's network identifiers to the phone
number efficiently, requiring a single VoLTE protocol message. We evaluate the
real-world performance of our attacks using four modern commercial
off-the-shelf phones and two representative, commercial network carriers. We
collect over 60 hours of traffic between the phones and the mobile networks and
execute 160 VoLTE calls, which we use to successfully identify patterns in the
physical layer parameter allocation and in VoLTE traffic, respectively. Our
real-world experiments show that our mobile-relay works as expected in all test
cases, and the VoLTE activity logs recovered describe the actual communication
with 100% accuracy. Finally, we show that we can link network identifiers such
as International Mobile Subscriber Identities (IMSI), Subscriber Concealed
Identifiers (SUCI) and/or Globally Unique Temporary Identifiers (GUTI) to phone
numbers while remaining undetected by the victim.
