used by mobile network operators (MNOs) can be exploited to
intercept user data and carry out impersonation, fraud, and denial
of service (DoS) attacks, cautions a newly published research.
The findings are part of a new Vulnerabilities in
LTE and 5G Networks 2020[1]
report published by London-based cybersecurity firm Positive
Technologies last week.
“This paper encompasses the results of security assessments
performed during the 2018–2019 timeframe on behalf of 28 telecom
operators in Europe, Asia, Africa, and South America.”
Called the GPRS Tunnelling Protocol (GTP), the
affected Internet Protocol (IP)-based communications standard
defines a set of rules governing data traffic over 2G, 3G, and 4G
networks.
[2]
It also forms the basis for GPRS core network
and its successor Evolved Packet Core (EPC), thus
making it possible for users to keep connected to the Internet
while moving from one place to the other.
“The GTP protocol contains a number of vulnerabilities
threatening both mobile operators and their clients,” the company
said, “As a result, attackers can interfere with network equipment
and leave an entire city without communications, impersonate users
to access var-ious resources, and use network services at the
expense of the operator or subscribers.”
for the subscriber’s actual location, thereby making it difficult
to verify if the incoming traffic is legitimate.
A second architectural issue resides in the manner subscriber
credentials are verified, thus allowing bad actors to spoof the
node that acts as an SGSN[5] (Serving GPRS Support
Node).
More concerning is the potential for fraud and impersonation,
wherein the attacker leverages a compromised identifier to use
mobile Internet at the legitimate user’s expense.
data containing relevant identifiers (e.g., phone number) of a real
subscriber to impersonate that individual and access the Internet.
“These attacks can also be used by a dishonest MNO to create
roaming traffic, with the MNO (falsely) charging another operator
for non-existent roaming activity of that operator’s subscribers,”
the report said.
“On all tested networks, it was possible to use mobile Internet
at the expense of both other subscribers and the operator.”
With 5G networks making use of EPC as the core
network for wireless communications, Positive Technologies said
they are equally vulnerable to spoofing and disclosure attacks.
It added that every tested network was susceptible to denial of
service against network equipment, therefore preventing valid
subscribers from connecting to the Internet and resulting in
disruption of mobile communication services.
“Mass loss of communication is especially dangerous for 5G
networks, because its subscribers are IoT devices such as
industrial equipment, Smart Homes, and city infrastructure,” the
researchers said.
carry out whitelist-based IP filtering at the GTP level, in
addition to following GSMA security
recommendations to analyze traffic in real-time, as well as
take actions to block illegitimate activity.
“Security must be a priority during network design,” the report
concluded. “This is truer now than ever before as operators begin
to tackle construction of 5G networks.”
“Attempts to implement security as an afterthought at later
stages may cost much more: operators will likely need to purchase
additional equipment, at best. At worst, operators may be stuck
with long-term security vulnerabilities that cannot be fixed
later.”
References
- ^
Vulnerabilities in LTE and 5G Networks
2020 (positive-tech.com) - ^
GTP
(en.wikipedia.org) - ^
GPRS core network
(en.wikipedia.org) - ^
EPC
(en.wikipedia.org) - ^
SGSN
(en.wikipedia.org) - ^
EPC
as the core network (positive-tech.com) - ^
GSMA security recommendations
(www.gsma.com)
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/RwiG7JN3OhQ/mobile-internet-hacking.html