As 5G Rolls Out, Troubling New Security Flaws Emerge

'It's not yet prime time for 5G networks, which still face logistical
and technical hurdles, but they're increasingly coming online in major
cities worldwide. Which is why it's especially worrying that new 5G
vulnerabilities are being discovered almost by the dozen. From a
report:

At the Association for Computing Machinery's Conference on Computer
and Communications Security in London today researchers are presenting
new findings that the 5G specification still has vulnerabilities. And
with 5G increasingly becoming a reality, time is running out to catch
these flaws. The researchers from Purdue University and the University
of Iowa are detailing 11 new design issues in 5G protocols that could
expose your location, downgrade your service to old mobile data
networks, run up your wireless bills, or even track when you make
calls, text, or browse the web. They also found five additional 5G
vulnerabilities that carried over from 3G and 4G. They identified all
of those flaws with a new custom tool called 5GReasoner.

One purported benefit of 5G is that it protects phone identifiers,
like your device's "international mobile subscriber identity," to help
prevent tracking or targeted attacks. But downgrade attacks like the
ones the researchers found can bump your device down to 4G, or put it
into limited service mode, then force it to send its IMSI number
unencrypted. Increasingly, networks use an alternative ID called a
Temporary Mobile Subscriber Identity that refreshes periodically to
stymie tracking. But the researchers also found flaws that could allow
them to override TMSI resets, or correlate a device's old and new
TMSI, to track devices. Mounting those attacks takes only
software-defined radios that cost a few hundred dollars. The
5GReasoner tool also found issues with the part of the 5G standard
that governs things like initial device registration, deregistration,
and paging, which notifies your phone about incoming calls and texts.
Depending on how a carrier implements the standard, attackers could
mount "replay" attacks to run up a target's mobile bill by repeatedly
sending the same message or command. It's an instance of vague wording
in the 5G standard that could cause carriers to implement it weakly.'

-- source: https://tech.slashdot.org/story/19/11/12/1845229

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list -- [email protected] | To unsubscribe send an email to [email protected]
Unsubscribe: https://list.waikato.ac.nz/postorius/lists/wlug.list.waikato.ac.nz