5G Network Split Vulnerability Exposes Businesses to Cyber Attacks
AdaptiveMobile Security today publicly revealed details of a major security flaw in the 5G network separation architecture and virtualized network features. This fundamental vulnerability can make possible data access and denial of service attacks between different network segments in a 5G network.
Threat of 5G network separation
This problem can create significant security risks for businesses that use network segmentation, and undermine operators ‘ attempts to open up new sources of revenue from 5G. The probability of an attack is currently low due to the limited number of mobile operators with multiple active network segments in their networks.
AdaptiveMobile Security is working together with the GSMA, operators, and standards authorities to address this issue and update architectures to prevent exploitation.
What is 5G network slicing?
Network partitioning allows a mobile operator to divide its core and radio network into several separate virtual blocks that provide different amounts of resources and prioritize different types of traffic.
One of the most innovative aspects of 5G is network segmentation, which will allow operators to provide parts of their core networks for specific vertical customer use cases, such as automotive, healthcare, critical infrastructure, and entertainment. As a result, the network is open to many partners and is divided into use cases and vertical blocks.
AdaptiveMobile Security investigated the underlying 5G networks, which contain both shared and dedicated network functions, and found that when a network has these “hybrid” network functions supporting multiple segments, there is no mapping between the application and transport layer IDs.
This flaw in industry standards creates an opportunity for an attacker to gain access to data and launch denial-of-service attacks across multiple segments if they have access to the 5G service architecture. For example, a hacker using the edge network feature connected to an operator service-based architecture can exploit this flaw in developing network separation standards to have access to both the operator’s core network and network segments for other businesses.
The impact is that the operator and their customers are at risk of losing sensitive data, which will allow tracking the user’s location, losing information related to payment or crypto transactions, and even potentially interrupting the operation of segments and the network functions themselves.
“5G encourages the mobile industry to adopt the technologies and methods of the IT world to improve efficiency and functionality. However, while this is commendable, a broader change in thinking is needed. When it comes to 5G security, the telecommunications industry needs to take a holistic and collaborative approach to network security between standards bodies, working groups, operators, and suppliers, ” said Dr. Silke Holtmanns, Head of 5G Security Research at AdaptiveMobile Security. And now let’s imagine the degree of harm from such a vulnerability in the crypto industry. This will entail multi-million dollar losses.
Coordinated disclosure of vulnerabilities and risks
The results of the study were transmitted to the GSMA in accordance with the standard coordinated vulnerability disclosure process. AdaptiveMobile Security is investigating whether the mechanisms currently defined by the 5G standards will be sufficient to stop an attacker, and in doing so has identified three main attack scenarios based on a flaw that cannot be addressed with the technology specified to date:
- Extraction of user data – in particular, location tracking;
- Denial of service of another network function;
- Access to the network function and related information of another vertical client
“As more of the underlying network moves to the cloud and IT – based architecture, more suitable tools become available for hackers,” Holtmanns continued. “Currently, the impact of this network-sharing attack on real-world applications is limited only by the number of slices in 5G networks worldwide. The risks, if this fundamental flaw in the development of 5G standards goes unnoticed, will be simply enormous.”