LTE, 5G Vulnerabilities Could Cut Entire Cities From Cellular Connectivity – Source: www.securityweek.com

Vulnerabilities in open source and commercial LTE and 5G implementations could lead to persistent denial-of-service (DoS) conditions, leaving entire metropolitan areas or cities without cellular connectivity, academic researchers say.

While scrutinizing seven LTE and three 5G implementations, a group of seven researchers from the Florida Institute for Cybersecurity Research and the North Carolina State University identified 119 flaws, including issues remotely exploitable to compromise and access the cellular core.

“Every one of the vulnerabilities can be used to persistently disrupt all cellular communications (phone calls, messaging and data) at a city-wide level,” the academics explain.

According to the researchers, an attacker could exploit these flaws by sending a single small packet, continuously crashing an LTE/5G network’s Mobility Management Entity (MME) or Access and Mobility Management Function (AMF), and the condition would persist until the network operator identifies and resolves the vulnerability.

Some of these vulnerabilities, the academics say, can be exploited by any unauthenticated mobile device, meaning that even devices with no SIM card can be used, if they can send a malformed packet sequence when starting the cellular connection.

“Traditionally, these attacks were limited in scope to devices that are within radio distance of the LTE/5G core being attacked. However, with the widespread deployment of Wi-Fi Calling services, these same attacks can be exploited by any entity on the Internet just by sending a few packets–no SIM card or SDR equipment required,” the researchers say.

Other security defects, the academics explain, can be exploited by threat actors that have base-station access to the cellular core, such as a compromised base station or access to the IPsec network that base stations use to communicate with the cellular network.

“An adversary could easily be able to obtain persistent physical access to one of these devices and dump RAM/flash or carry out attacks specific to the device to gain access to its IPsec keys. The proliferation of smaller 5G base stations in easier-to-reach locations (not 100 feet in the air on a tower) also makes compromise of a regular base station more practical,” the researchers note.

The academics analyzed the Open5GS, Magma, OpenAirInterface, Athonet, SD-Core, NextEPC, and srsRAN LTE implementations and the Open5GS, Magma, and OpenAirInterface 5G implementations and found vulnerabilities in every one of them.

Out of the 119 identified flaws, 93 were assigned CVE identifiers. The researchers attempted to report the bugs to the maintainers of every affected cellular core, but received no response from NextEPC and SD-Core (they attempted contact using other communication channels, including disclosure on their Github repositories).

The academics published a research paper – RANsacked (PDF) – in which they share technical details on the fuzzing framework they used for identifying flaws in LTE/5G network components and on how the 119 security defects were identified.

Related: FCC Taking Action in Response to China’s Telecoms Hacking

Related: Delivering on the Promise of 5G Requires New Security Standards

Related: Indonesia, UK Discuss Future Technology and Cybersecurity

Related: Industry Reactions to Alliance for Open 5G Systems: Feedback Friday