While enthusiasts eagerly await the widespread deployment of fifth-generation networks, cybercriminals are rubbing their hands in anticipation of new opportunities for profit. Despite all the efforts of developers, the 5G technology contains vulnerabilities, the detection of which is complicated by the lack of experience working under new conditions. We explored a small 5G network and identified three types of vulnerabilities, which we will discuss in this post.
Research Object
Let's consider a simple example — a model non-public 5G network on a college campus (Non-Public Network, NPN), connected to the outside world through public communication channels. Such networks will be used as standard in all countries that are joining the race for 5G in the near future. Potential deployment environments for networks of this configuration include "smart" enterprises, "smart" cities, large corporate offices, and other similar locations with a high degree of controllability.
NPN Infrastructure: a closed enterprise network connected to the global 5G network via public channels. Source: Trend Micro
Unlike fourth-generation networks, 5G networks are designed for real-time data processing, and their architecture resembles a multi-layered cake. The division into layers simplifies interaction through the standardization of APIs for communication between layers.
Comparison of 4G and 5G Architectures. Source: Trend Micro
The result is enhanced capabilities for automation and scaling, which is critically important for processing vast amounts of information from the Internet of Things (IoT).
The isolation of layers embedded in the 5G standard leads to a new problem: security systems that operate within the NPN protect the object and its private cloud, while external networks' security systems protect their own internal infrastructure. The traffic between the NPN and external networks is considered secure, as it comes from secure systems, but in reality, it is unprotected.
In our recent study we present several scenarios of cyberattacks on 5G networks that exploit:
- vulnerabilities in SIM cards,
- network vulnerabilities,
- identification system vulnerabilities.
Let's examine each vulnerability in more detail.
Vulnerabilities in SIM cards
A SIM card is a complex device that even has a whole set of built-in applications — SIM Toolkit, STK. One such program — the S@T Browser — could theoretically be used to access the operator's internal websites, but in practice, it has long been forgotten and has not been updated since 2009, as these functions are now handled by other programs.
The problem is that the S@T Browser has proven to be vulnerable: a specially crafted service SMS can compromise the SIM card and make it execute commands provided by the hacker, all without the phone or device user noticing anything unusual. The attack has been named and it provides numerous opportunities for attackers.
Simjacking attack in 5G networks. Source: Trend Micro
In particular, it allows the attacker to obtain the subscriber's location data, the identifier of their device (IMEI), and the cell tower identity (Cell ID), as well as make the phone dial a number, send an SMS, open a link in the browser, and even disable the SIM card.
In the context of 5G networks, this vulnerability in SIM cards becomes a serious issue given the number of connected devices. Although in fifth-generation networks it is still And since everything works as it is, expecting a swift replacement of existing SIM cards is not realistic.
Malicious use of roaming. Source: Trend Micro
Using Simjacking allows one to forcibly switch the SIM card to roaming mode, making it connect to a cell tower controlled by the attacker. During this process, the attacker gains the ability to modify the SIM card settings to eavesdrop on phone calls, inject malware, and carry out various kinds of attacks using the device containing the compromised SIM card. This is possible because interactions with devices in roaming bypass the security procedures established for devices in the 'home' network.
Network vulnerabilities
Malicious actors can change the settings of a compromised SIM card to achieve their goals. The relative ease and stealth of the Simjacking attack allow it to be executed continuously, gradually taking control over more and more devices, slowly and patiently () slicing network sections like salami (). Tracing such an impact is extremely difficult, and in the conditions of a complex distributed 5G network — practically impossible.
Gradual infiltration into the 5G network using Low and Slow + Salami attacks. Source: Trend Micro
Since 5G networks lack built-in security control mechanisms for SIM cards, malicious actors will gradually gain the ability to impose their own rules within the 5G communication domain, using compromised SIM cards for theft, network-level authorization, malware installation, and other illegal activities.
Particularly alarming is the emergence of tools on hacker forums that automate SIM card capture via Simjacking, as the use of such tools for fifth-generation networks gives malicious actors virtually unlimited capabilities for scaling attacks and modifying trusted traffic.
Identification vulnerabilities
The SIM card is used to identify the device within the network. If the SIM card is active and has a positive balance, the device is automatically considered legitimate and does not raise suspicion at the detection system level. Meanwhile, the vulnerability of the SIM card itself makes the entire identification system vulnerable. IT security systems simply cannot trace an illegally connected device if it registers on the network using identification data stolen through Simjacking.
Thus, a hacker connecting to the network via a hacked SIM card gains access at the level of the true owner, as IT systems no longer verify devices that have been identified at the network level.
Guaranteed identification between the software and network layers adds yet another issue: criminals can intentionally create "noise" for intrusion detection systems by continuously performing various suspicious activities on behalf of compromised legitimate devices. Since the operation of automated detection systems is based on statistical analysis, the threshold for alarm signals will gradually increase, ensuring no response to real attacks. Prolonged exposure of this kind can effectively alter the functioning of the entire network and create statistical "blind spots" for detection systems. Criminals controlling such areas can conduct attacks on data within the network and on physical devices, orchestrate denial of service, and inflict other harm.
Solution: Unified identity verification
The vulnerabilities of the studied NPN 5G network result from the fragmented security procedures at the communication level, SIM card level, and device level, as well as the roaming interaction level between networks. To address this issue, it is necessary to implement authentication of devices connecting to the network at each stage, according to the zero-trust principle () by implementing a federated model of identification and access management ().
The ZTA principle involves maintaining security even when a device is uncontrolled, mobile, or outside the network perimeter. The federated identification model is a security approach for 5G that provides a unified, consistent architecture for authentication, access rights, data integrity, and other components and technologies in 5G networks.
This approach eliminates the possibility of implanting a "roaming" tower in the network and redirecting compromised SIM cards to it. IT systems will be able to fully identify the connection of unauthorized devices and block parasitic traffic that creates statistical noise.
To protect the SIM card from modification, it is necessary to implement additional integrity verification measures, possibly realized in the form of a SIM application based on blockchain. The application can be used for authenticating devices and users, as well as for verifying the integrity of the firmware and settings of the SIM card both in roaming and while operating in the home network.
To summarize
The solutions to the identified 5G security issues can be presented as a combination of three approaches:
- implementing a federated model of identification and access management that ensures data integrity in the network;
- ensuring complete visibility of threats through the implementation of a distributed ledger to verify the legitimacy and integrity of SIM cards;
- forming a borderless distributed security system that addresses interaction issues with devices in roaming.
The practical implementation of these measures requires time and significant costs, but the deployment of 5G networks is happening everywhere, which means that work on eliminating vulnerabilities should start right now.
Source: habr.com
