5G Weaknesses Threat actors can Exploit
It was recently revealed that 5G networks may represent a major target for threat actors due to poor implementation of telecom standards, system architecture weaknesses, and supply chain threats.
On Monday, the U.S. National Security Agency (NSA), partnering with the Office of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), and the Director of National Intelligence issued an analysis that focuses on assessing the potential vulnerabilities of 5G and the risks that could come with its adoption.
According to the report, with the rapid adoption of 5G networks, the potential for threat actors targeting the end-user goes up. One example given is if a nation state attempts to influence the standards in ways that would benefit its technologies and thus limit the choices and options available to the customer in regard to the way equipment or software can be used.
The report further elaborates that the contribution that adversarial national states have to the development of tech standards could potentially lead to the adoption of unreliable technology. This, in turn, could lead to difficulties updating said technology as well repairing or replacing it. Another issue brought up in the report are the presence of optional security controls within protocols – due to their optional nature, they could remain unimplemented which could, in turn, make systems susceptible to malware attacks.
Another concern pointed out in the report relates to the supply chain, more specifically to the components and elements used in the different types of technology that have been manufactured by third-parties. Such components/elements could be compromised or be of low-quality, possessing security vulnerabilities, making them an easy target for attacks from threat actors.
Such components could go undetected and lie there waiting to be exploited by attackers who know how to make use of the hidden vulnerability, leading to theft of sensitive data, remote control, and lateral distribution to other parts of the same network.
This applies not only to hardware but also to software as well. Purposefully flawed software elements may be added to a program or another larger piece of software and delivered to the targeted device only to later be exploited by an attacker who knows where the weakness in the code is.
Finally, the report also focuses on the inherent weaknesses of the 5G structure that cybercriminals could use to initiate an attack. One specific area that is seen as a particularly vulnerable target is the need for supporting 4G legacy infrastructures – something that possesses a number of weaknesses that potent threat actors could easily exploit. Another area that could be targeted is the vulnerabilities that are caused by poor slice management which could allow attackers to acquire sensitive data gathered from different slices or even enable them to disrupt user access.
In March this year, a study was published by AdaptiveMobile in which it was reported that certain vulnerabilities in the slicing model can be used as a means of allowing attackers to gain access to important data as well as to perform DoS (Denial of Service) attacks.
The study explains that, in order for 5G to reach its fulfil its potential, 5G systems need to use a combination of low, mid, and high frequencies as each type of frequency provides different benefits. However, this also poses different challenges as far as security is concerned. In addition, the increase in number of devices that compete for the same frequencies, the phenomenon known as spectrum sharing is starting to occur more often which, in turn, provides criminal actors with greater opportunity to interfere with and intercept connections.
The main goal of the analysis NSA analysis is to help with the assessment of the different attack paths and risk factors, focusing primarily on these three threat areas: security policies and standards, hardware and software supply chain, and 5G architecture and its inherent weaknesses.
According to the analysis, strict and precise monitoring, early identification of vulnerabilities, and their quick and adequate mitigation is the key to keeping users and organizations safe during the rapid adoption of the 5G technology.
Leave a Comment