News 5G apparently quite vulnerable. Easy exploits already found

[amd6502]

https://techxplore.com/news/2019-02-flaws-4g-5g-networks-hackers.html

In an attack the researchers have dubbed "torpedo," adversaries can use this paging message to track a victim's location and then inject fake paging messages and stop calls and texts from coming in. The findings were presented Tuesday at the Network and Distributed Security Symposium in San Diego.


"It doesn't require an experienced hacker to perform this attack," Hussain said. "Anyone with a little knowledge of cellular paging protocols could carry it out."


Torpedo also paves the way for two other attacks: one that allows attackers to obtain a device's international mobile subscriber identity (IMSI) on 4G networks, and another that allows hackers to obtain a victim's "soft identities," such as phone number or Twitter handle, on 4G and 5G networks.


"The IMSI-Cracking attack is a huge blow for 5G because it bypasses the network's new security policies to protect users' IMSIs from exposure," Hussain said.


Torpedo can be carried out via the networks of all four major U.S. cellular companies (AT&T, Verizon, Sprint and T-Mobile), according to the paper.

 

[Modular]

How interesting. I think it's certainly noteworthy that the 4G network appears to be currently vulnerable to this attack. I'm not so sure (and the article doesn't state) whether or not this makes 5G as "hackable" as 4G though. Surely there are other security protocols that 5G contains that 4G doesn't?

 

[amd6502]

Another one to add to the list:

https://twitter.com/x/status/1121810713348059137

About another dozen vulnerabilities found in a popular enterprise 5g gateway including:

A 5G wireless gateway tailored for industrial internet of things (IoT), retail point-of-sale and enterprise redundancy applications is riddled with vulnerabilities, include two critical bugs that allow remote code-execution (RCE) and arbitrary command-injection.

 

[Red Squirrel]

I don't think 5G is even built with security in mind, but to make it easier to make a "connected" world. IoT on steroids. The ones pushing this sort of thing don't really care about security. At the end of the day all this IoT stuff is about exploiting people to gather data for advertisers and the government. Let's not even get into the fact that lot of major carriers are using Huawai base station equipment.

The cell network as a whole has never been secure though, if it was, things like Stingray would not be possible. The idea that someone can just add a base station to the network and then start accepting traffic and manipulating it is a very bad design flaw.

 

[bobbobbob]

And how about health?

 

[amd6502]

And how about health?

The health aspect is even more worrisome than the whole iots security problem. Take this for example:

https://www.reddit.com/r/conspiracy/comments/bn7a7x

 

[mxnerd]

Wonder whether wifi 6 will also be hacked very soon.

 

[amd6502]

Wonder whether wifi 6 will also be hacked very soon.

Maybe they fixed the range problem with this update. 802 ac carried poorly through walls and clutter. As for routers, it's common they aren't too secure. Google also has a database of passwords searchable by location. This is an extra hazard since most people don't change the default router login password, and it can often be easy to guess.

 

[Red Squirrel]

The health aspect is even more worrisome than the whole iots security problem. Take this for example:

https://www.reddit.com/r/conspiracy/comments/bn7a7x

Funny thing is we have to shut down all the sectors on a tower so climbers can go up. Having these so close to people is definitely a concern. This is not like your home wifi transmitting at <5 watts. This is like 40 watts. Might be more for 5G not sure.

Also this is going to be a nightmare to manage from a telecom point of view. When the power goes out you will have so many "cell sites" to send generators to and overall so many batteries/power plants to manage. I have a feeling the service will be really sketchy during power outages as the batteries age and they don't get replaced.

 

[itsmydamnation]

Maybe they fixed the range problem with this update. 802 ac carried poorly through walls and clutter.

Thats called physics you cant beat that. keying/encoding schemes have all been the same for the last 20 years because you cant beat physics, newer protocols add spatial diversity , beam forming/steering and just plane using more bandwidth to achieve higher throughputs.

 

[Red Squirrel]

Wifi 6 sounds really interesting actually. I'm still on N myself, and got 2 more APs I'm not using. I might deploy them for fun at some point. Could use one in the living room area to give more range to my driveway. Sometimes I want to connect to my wifi from the driveway but I don't quite have reach there now.

 

[amd6502]

Not specific to 5g but this is just the sort of reason why 5g shouldn't be deployed in a rush, needs to be 100% secure; this is also good so that health studies are given some time to be seriously investigated.

1. https://www.itpro.co.uk/cyber-attac...kers-launch-massive-attack-on-mobile-networks

2. https://securityaffairs.co/wordpress/87609/iot/silex-malware-bricks-iot-devices.html

 

[amd6502]

Shedloads of 5G bugs revealed (summary of Wired article)

https://fudzilla.com/news/network/49785-shedloads-of-5g-bugs-revealed

 

[BarkingGhostar]

Funny thing is we have to shut down all the sectors on a tower so climbers can go up. Having these so close to people is definitely a concern. This is not like your home wifi transmitting at <5 watts. This is like 40 watts. Might be more for 5G not sure.

Also this is going to be a nightmare to manage from a telecom point of view. When the power goes out you will have so many "cell sites" to send generators to and overall so many batteries/power plants to manage. I have a feeling the service will be really sketchy during power outages as the batteries age and they don't get replaced.

You do realize that with each successive generation of wireless networking technology the power output drops and order of magnitude, right? It is why people loved 2G GSM for reception because it was a Giant Signal Machine. People had to get use to 3G being much lower in signal strength and it wasn't until 3G got built out in far larger numbers than 2G that coverage was where it needed to be. And then the whole story got repeated with 4G and the advent of cells inside of buildings, on sides of buildings, etc., looking like old police call boxes.

Now 5G continues that exact same trend in lower power, which is one of the reasons for poor coverage (the other being the wavelength chosen to use).