New 5G Network Flaws Let Attackers Track Users’ Locations and Steal Data

As 5G networks are being gradually rolled out in major cities
across the world, an analysis of its network architecture has
revealed a number of potential weaknesses that could be exploited
to carry out a slew of cyber assaults, including denial-of-service
(DoS) attacks to deprive subscribers of Internet access and
intercept data traffic.

The findings form the basis of a new “5G Standalone core security
research^[1]” published by
London-based cybersecurity firm Positive Technologies today,
exactly six months after the firm released its “Vulnerabilities in LTE and 5G Networks
2020^[2]” report in June
detailing high impact flaws in LTE and 5G protocols.

“Key elements of network security include proper configuration
of equipment, as well as authentication and authorization of
network elements,” Positive Technologies said.

“In the absence of these elements, the network becomes
vulnerable [to] subscriber denial of service due to exploitation of
vulnerabilities in the PFCP protocol,” and other shortcomings that
could lead to the disclosure of unique subscriber identifiers and
profile information, and even use Internet services at a user’s
expense without their knowledge.

Security Benefits of 5G

One of the key security benefits^[3]
offered by 5G is protection from stingray^[4]
surveillance^[5]
and encryption of International Mobile Subscriber Identity
(IMSI^[6]) numbers — unique
identifiers that come with every SIM card for the purpose of
identifying users of a cellular network.

The 5G Core (5GC) also updates the IT protocol stack by using
Transmission Control Protocol (TCP) as the transport layer protocol
in place of Stream Control Transmission Protocol (SCTP^[7]), HTTP/2^[8] as a substitute for
Diameter^[9]
protocol for application layer security, and an added TLS layer for
encrypted communication between all network functions.

Deployed either in standalone^[10] or non-standalone modes
depending on their reliance on 4G Evolved Packet Core (EPC^[11]) technology, the 5G
mobile network is a framework consisting of as many as nine network
functions (NFs) that are responsible for registering subscribers,
managing sessions and subscriber profiles, storing subscriber data,
and connecting the users (UE or user equipment) to the internet via
a base station (gNB).

But the researchers say this very stack of technologies
potentially opens the door to attacks on subscribers and the
operator’s network that could be exploited to stage
man-in-the-middle and DoS attacks.

DoS and MitM Attacks

A problematic aspect of the system architecture is the interface
devoted to session management (Session Management Function or SMF)
via a protocol called Packet Forwarding Control Protocol
(PFCP).

A bad actor can choose to send a session deletion or
modification request PFCP packet, causing a DoS condition that, in
turn, leads to disruption of internet access (CVSS score 6.1) and
even interception of web traffic (CVSS score 8.3).

Positive Technologies also found issues with the part of the 5G
standard that governs Network Repository Function (NRF), which
enables registration and discovery of NFs in the control plane,
noting that the adversaries could add an already existing network
function in the repository to serve subscribers via an NF under
their control and access user data (CVSS score 8.2).

In a different scenario, the lack of authorization in NRF could
be abused to deregister critical components by deleting their
corresponding NF profiles from the store, resulting in loss of
service to subscribers.

Secretly Spy on Subscribers’ Location

Also of note are a pair of subscriber authentication
vulnerabilities that can be leveraged to disclose the Subscription
Permanent Identifier (SUPI^[12]) allocated to each
subscriber and serve the end-user using the leaked authentication
information by spoofing a base station.

Separately, a design quirk in the User Data Management (UDM)
module that manages subscriber profile data could permit an
adversary with “access to the relevant interface […] connect to
the UDM directly or by impersonating a network service, and then
extract all the necessary information,” including location data
(CVSS score 7.4).

“Access to such data would severely jeopardize security: it
allows the attacker to secretly spy on the subscriber, while the
latter will never know what is going on,” the researchers said.

Last but not least, an attacker can impersonate the Access and
Mobility Management Function (AMF) module that takes care of
subscriber registration on the network by using a subscriber’s
identification information to create new stealthy internet sessions
for which the subscriber will be billed (CVSS score 8.2).

The Need for Assessment, Monitoring, and Protection

There’s no doubting the security advances offered by 5G, but
it’s also essential that the 5G standard is adequately scrutinized
as the number of 5G network users continue to grow each year.

“Operators frequently make errors in equipment configuration
with consequences for security,” the researchers concluded. “An
important role is played by equipment vendors, which are
responsible for the technical implementation of all the architected
network protection features.

“To prevent the consequences of such attacks, operators must
employ timely protection measures, such as proper configuration of
equipment, use of firewalls on the network edge, and security
monitoring,” the researchers said.