Happy Days Ahead For 5G Hackers

The fifth-generation mobile network is now live and it has downloads speeds almost 10 times faster than current rates and it is altering current connections and communications. 5G’s stronger encryption of data and better verification of network users are widely considered to be a significant improvement on 4G. But these new speeds also offer criminal hackers with more theft and attack potential.  

A research group academics from the University of Iowa and Purdue University, have found new security problems in 4G and 5G, which could be used to intercept and track the phone calls and locales of cell phone users.

“Our paper sheds light on an inherent design weakness of the 4G/5G cellular paging protocol which can be exploited by an attacker to not only obtain the victim’s paging occasion but also to identify the victim’s presence in a particular cell area just from the victim’s soft-identity, 9phone number, Twitter ID)  with a novel attack called ToRPEDO.” say the researchers.

ToRPEDO is tracking via paging and messaging and distribution – Tracking via Paging mEssage DistributiOn attack which identifies where a potential victim is located. 

The findings are said to be the first time vulnerabilities have affected both 4G and the incoming 5G standard, which promises faster speeds and better security, particularly against law enforcement use of cell site simulators, known as “stingrays.” 
But the researchers say that their new attacks can defeat newer protections that were believed to make it more difficult to snoop on phone users.

“Any person with a little knowledge of cellular paging protocols can carry out this attack,” said Syed Rafiul Hussain, one of the co-authors of the paper, told TechCrunch. 

Experts say that the weak link in 5G’s security is likely to be communication between devices connected to the Internet.  The problem is likely to occur because of the connections through the Internet of Things  which compromises the security of 5G technology via the employment of fake mobile base stations to steal information. 

These devices, known as the Internet of Things (IoT), where everything from cars and factory assembly lines to baby monitors and traffic lights have embedded internet-connected sensors, are growing fast. The number of internet-connected items will grow from 14.2bn to 25bn by 2021, according to Gartner.

As IoT devices connect to 5G networks, they could prove a tempting target for hackers and criminals. Experts say that security can be patchy for some IoT devices, especially low-cost and low-powered items. Hackers can use technology to scan hundreds of thousands of devices for weak security, such as those with the default passwords, “admin”, “guest” or “password”, that they were sold with.

Criminals have already exploited IoT devices, most notably in the “Mirai botnet” cyber-attack in 2016 when hundreds of thousands of cameras, routers and digital video recorders were used to bring down websites including Twitter, Spotify and the New York Times.

The criminals used two common types of cyber-attack: a “botnet”, which takes control of internet-connected devices and using them as weapons in a cyber-attack; and a “distributed denial of service” (DDOS), which overwhelms a network or website with more messages than it can handle. When hackers or criminals break into a device connected to 5G, the network’s speed will mean that they can extract and download information, including personal data and customer information, much faster than before.

Because IoT devices connect directly to the mobile internet, hackers will not have to circumvent the more stringent security of home or corporate networks.

There is also a risk that homes using 5G could become more vulnerable, experts say, if security software of fridges, smoke alarms and other “smart” devices connected to the internet is not updated. Companies may also face security headaches if employees use 5G networks rather than their corporate networks to send confidential data. 

FT.com          Techcrunch:        Documentcloud:        WeissRatings

You Might Also Read: 

5G Needs A New Generation Of Security:

Cybersecurity  And The EU's Regime For 5G Networks:

 

« E-Passports Can Be Remotely Hacked
The Cyberthreat Handbook »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

UK Cyber Week Expo & Conference

UK Cyber Week Expo & Conference

Award-winning event organiser ROAR B2B announces the launch of UK Cyber Week and its inaugural event on 4 and 5 April 2023 at the Business Design Centre, London.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

HDI

HDI

HDI is the worldwide professional association and certification body for the technical service and support industry.

Micron Technology

Micron Technology

Micron is a global leader in the semiconductor industry providing memory and secure storage devices for Networks, Mobile devices and IoT applications.

D-Fence

D-Fence

D-Fence high availability security service protects corporate email communication, the company and it's employee's against cyber threats.

RunSafe Security

RunSafe Security

RunSafe Security is the pioneer of a patented cyberhardening transformation process designed to disrupt attackers and protect vulnerable embedded systems and devices.

Cybersecurity Manufacturing Innovation Institute (CyManII)

Cybersecurity Manufacturing Innovation Institute (CyManII)

CyManII was established to create economically viable, pervasive, and inconspicuous cybersecurity in American manufacturing to secure the digital supply chain and energy automation.

Crypto Valley Association

Crypto Valley Association

Crypto Valley Association is an independent, government-supported association established to build the world’s leading blockchain and cryptographic technologies ecosystem.

CyberClan

CyberClan

CyberClan’s carefully selected team of experts is capable of solving complex cyber security challenges – keeping your data secure and your businesses running as usual.

Newtec Services

Newtec Services

IT should be responsive, adaptive, and smart. Now more than ever, you need a business that runs efficiently and can adapt to today's challenges. We can help with custom IT solutions.

KETS Quantum Security

KETS Quantum Security

KETS harnesses the properties of quantum mechanics to solve challenging problems in randomness generation and secure key distribution and enable ultra secure communications.

Valimail

Valimail

Valimail delivers the only complete, cloud-native platform for validating and authenticating sender identity to stop phishing, protect and amplify brands, and ensure compliance.

Symbol Security

Symbol Security

Through situational learning, simulations, and a gamified user experience, Symbol strengthens the cyber awareness of employees and helps companies lower cyber risk.

Clearnetwork

Clearnetwork

Clearnetwork specializes in managed cybersecurity solutions that enable both public and private organizations improve their security posture affordably.

Josef Ressel Centre for Intelligent & Secure Industrial Automation

Josef Ressel Centre for Intelligent & Secure Industrial Automation

The Josef Ressel Centre for Intelligent and Secure Industrial Automation investigates the fundamentals of digital assistants for industrial machines that enable intelligent and secure operation.

NASK

NASK

NASK is a National Research Institute under the supervision of the Chancellery of the Prime Minister of Poland. Our key activities involve ensuring security online.

Occentus Network

Occentus Network

Occentus Network is a telecommunications service provider specialized in High Availability Servers & managed Cloud services.

Interactive

Interactive

Interactive are a leading Australian IT service provider with services in Cloud, Cyber Security, Data Centres, Business Continuity, Hardware Maintenance, Digital Workplace, and Networks.