Happy Days Ahead For 5G Hackers

The fifth-generation mobile network is now live and it has downloads speeds almost 10 times faster than current rates and it is altering current connections and communications. 5G’s stronger encryption of data and better verification of network users are widely considered to be a significant improvement on 4G. But these new speeds also offer criminal hackers with more theft and attack potential.  

A research group academics from the University of Iowa and Purdue University, have found new security problems in 4G and 5G, which could be used to intercept and track the phone calls and locales of cell phone users.

“Our paper sheds light on an inherent design weakness of the 4G/5G cellular paging protocol which can be exploited by an attacker to not only obtain the victim’s paging occasion but also to identify the victim’s presence in a particular cell area just from the victim’s soft-identity, 9phone number, Twitter ID)  with a novel attack called ToRPEDO.” say the researchers.

ToRPEDO is tracking via paging and messaging and distribution – Tracking via Paging mEssage DistributiOn attack which identifies where a potential victim is located. 

The findings are said to be the first time vulnerabilities have affected both 4G and the incoming 5G standard, which promises faster speeds and better security, particularly against law enforcement use of cell site simulators, known as “stingrays.” 
But the researchers say that their new attacks can defeat newer protections that were believed to make it more difficult to snoop on phone users.

“Any person with a little knowledge of cellular paging protocols can carry out this attack,” said Syed Rafiul Hussain, one of the co-authors of the paper, told TechCrunch. 

Experts say that the weak link in 5G’s security is likely to be communication between devices connected to the Internet.  The problem is likely to occur because of the connections through the Internet of Things  which compromises the security of 5G technology via the employment of fake mobile base stations to steal information. 

These devices, known as the Internet of Things (IoT), where everything from cars and factory assembly lines to baby monitors and traffic lights have embedded internet-connected sensors, are growing fast. The number of internet-connected items will grow from 14.2bn to 25bn by 2021, according to Gartner.

As IoT devices connect to 5G networks, they could prove a tempting target for hackers and criminals. Experts say that security can be patchy for some IoT devices, especially low-cost and low-powered items. Hackers can use technology to scan hundreds of thousands of devices for weak security, such as those with the default passwords, “admin”, “guest” or “password”, that they were sold with.

Criminals have already exploited IoT devices, most notably in the “Mirai botnet” cyber-attack in 2016 when hundreds of thousands of cameras, routers and digital video recorders were used to bring down websites including Twitter, Spotify and the New York Times.

The criminals used two common types of cyber-attack: a “botnet”, which takes control of internet-connected devices and using them as weapons in a cyber-attack; and a “distributed denial of service” (DDOS), which overwhelms a network or website with more messages than it can handle. When hackers or criminals break into a device connected to 5G, the network’s speed will mean that they can extract and download information, including personal data and customer information, much faster than before.

Because IoT devices connect directly to the mobile internet, hackers will not have to circumvent the more stringent security of home or corporate networks.

There is also a risk that homes using 5G could become more vulnerable, experts say, if security software of fridges, smoke alarms and other “smart” devices connected to the internet is not updated. Companies may also face security headaches if employees use 5G networks rather than their corporate networks to send confidential data. 

FT.com          Techcrunch:        Documentcloud:        WeissRatings

You Might Also Read: 

5G Needs A New Generation Of Security:

Cybersecurity  And The EU's Regime For 5G Networks:

 

« E-Passports Can Be Remotely Hacked
The Cyberthreat Handbook »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Konfidas

Konfidas

Konfidas provide high-level cybersecurity consulting and professional tailored solutions to meet specific cybersecurity operational needs.

CyberOne

CyberOne

CyberOne (formerly Comtact) offer a full stack cybersecurity service to ensure our customers understand the cyber maturity of their organisation.

Viasat

Viasat

Viasat is a provider of high-speed satellite broadband services and secure networking systems covering military and commercial markets.

IronNet Cybersecurity

IronNet Cybersecurity

IronNet’s product and services provide enterprise-wide security management and visibility of your network, users and assets.

LuJam Cyber

LuJam Cyber

LuJam Cyber is a cybersecurity company that provides protection to SME Networks.

Secure Blockchain Technologies (SBT)

Secure Blockchain Technologies (SBT)

SBT is a team of Enterprise IT Security Professionals weaving security and Blockchain Technology into our customer’s operational fabric.

Secberus

Secberus

SECBERUS creates cloud security technology to help organizations stay secure & compliant in the public cloud.

NodeSource

NodeSource

NodeSource helps organizations run production-ready Node.js applications with greater visibility into resource usage and enhanced awareness around application performance and security.

International Cybersecurity Forum (FIC)

International Cybersecurity Forum (FIC)

The International Cybersecurity Forum (FIC) has established itself as the benchmark event in Europe in terms of digital security and trust.

DataSixth Security Consulting

DataSixth Security Consulting

DataSixth delivers Cybersecurity Intelligence. With our unique capabilities, we’re able to deliver value, deliver answers, and deliver actionable security intelligence.

CyberArmor

CyberArmor

Cyber Armor defend everyday IT and OT systems, from government agencies to critical infrastructure, from system integrators to small industries.

CyberQP

CyberQP

CyberQP (formerly Quickpass Cybersecurity) provide Privileged Access Management built for MSPs. Our system is designed to reduce ransomware and social engineering attack risks.

FortiGuard Labs

FortiGuard Labs

FortiGuard Labs is the threat intelligence and research organization at Fortinet. Its mission is to provide Fortinet customers with the industry’s best threat intelligence.

Sonet.io

Sonet.io

Sonet.io is built for IT leaders that want a great experience for their remote workers, while enhancing security and observability.

Proaxiom

Proaxiom

Proaxiom are focused on erasing cyber driven panic paralysis for Small and Medium Enterprises through brilliant cyber technologies which drive productivity and support growth.

Digital Encode

Digital Encode

Digital Encode is a leading consulting and integration firm that specializes in the design, management, and security of business-critical networks, telecommunications, and IT infrastructures.