New 5G Network Flaws Let Attackers Track Users’ Locations and Steal Data

As 5G networks are being gradually rolled out in major cities across the world, an analysis of its network architecture has revealed a number of potential weaknesses that could be exploited to carry out a slew of cyber assaults, including denial-of-service (DoS) attacks to deprive subscribers of Internet access and intercept data traffic.

The findings form the basis of a new “5G Standalone core security research” published by London-based cybersecurity firm Positive Technologies today, exactly six months after the company released its “Vulnerabilities in LTE and 5G Networks 2020” report in June detailing high impact flaws in LTE and 5G protocols.

“Key elements of network security include proper configuration of equipment, as well as authentication and authorization of network elements,” Positive Technologies said.

“In the absence of these elements, the network becomes vulnerable [to] subscriber denial of service due to exploitation of vulnerabilities in the PFCP protocol,” and other shortcomings that could lead to the disclosure of unique subscriber identifiers and profile information, and even use Internet services at a user’s expense without their knowledge.

Security Benefits of 5G

One of the key security benefits offered by 5G is protection from stingray surveillance and encryption of International Mobile Subscriber Identity (IMSI) numbers — unique identifiers that come with every SIM card for the purpose of identifying users of a cellular network.

The 5G Core (5GC) also updates the IT protocol stack by using Transmission Control Protocol (TCP) as the transport layer protocol in place of Stream Control Transmission Protocol (SCTP), HTTP/2 as a substitute for Diameter protocol for application layer security, and an added TLS layer for encrypted communication between all network functions.

Deployed either in standalone or non-standalone modes depending on their reliance on 4G Evolved Packet Core (EPC) technology, the 5G mobile network is a framework consisting of as many as nine network functions (NFs) that are responsible for registering subscribers, managing sessions and subscriber profiles, storing subscriber data, and connecting the users (UE or user equipment) to the internet via a base station (gNB).

But the researchers say this very stack of technologies potentially opens the door to attacks on subscribers and the operator’s network that could be exploited to stage man-in-the-middle and DoS attacks.

DoS and MitM Attacks

A problematic aspect of the system architecture is the interface devoted to session management (Session Management Function or SMF) via a protocol called Packet Forwarding Control Protocol (PFCP).

A bad actor can choose to send a session deletion or modification request PFCP packet, causing a DoS condition that, in turn, leads to disruption of internet access (CVSS score 6.1) and even interception of web traffic (CVSS score 8.3).

Positive Technologies also found issues with the part of the 5G standard that governs Network Repository Function (NRF), which enables registration and discovery of NFs in the control plane, noting that the adversaries could add an already existing network function in the repository to serve subscribers via an NF under their control and access user data (CVSS score 8.2).

In a different scenario, the lack of authorization in NRF could be abused to deregister critical components by deleting their corresponding NF profiles from the store, resulting in loss of service to subscribers.

Secretly Spy on Subscribers’ Location

Also of note are a pair of subscriber authentication vulnerabilities that can be leveraged to disclose the Subscription Permanent Identifier (SUPI) allocated to each subscriber and serve the end-user using the leaked authentication information by spoofing a base station.

Separately, a design quirk in the User Data Management (UDM) module that manages subscriber profile data could permit an adversary with “access to the relevant interface […] connect to the UDM directly or by impersonating a network service, and then extract all the necessary information,” including location data (CVSS score 7.4).

“Access to such data would severely jeopardize security: it allows the attacker to secretly spy on the subscriber, while the latter will never know what is going on,” the researchers said.

Last but not least, an attacker can impersonate the Access and Mobility Management Function (AMF) module that takes care of subscriber registration on the network by using a subscriber’s identification information to create new stealthy internet sessions for which the subscriber will be billed (CVSS score 8.2).

The Need for Assessment, Monitoring, and Protection

There’s no doubting the security advances offered by 5G, but it’s also essential that the 5G standard is adequately scrutinized as the number of 5G network users continue to grow each year.

“Operators frequently make errors in equipment configuration with consequences for security,” the researchers concluded. “An important role is played by equipment vendors, which are responsible for the technical implementation of all the architected network protection features.

“To prevent the consequences of such attacks, operators must employ timely protection measures, such as proper configuration of equipment, use of firewalls on the network edge, and security monitoring,” the researchers said.