Hello and welcome to the penultimate lesson in our course on telecommunication hacking.
In our previous lesson, we looked at how network operators can detect and defend against attacks on their current networks, using techniques like anomaly detection and signaling firewalls. We concluded by noting that the most effective long-term solutions are architectural, which brings us directly to today's topic: the security enhancements built into 5G.
This lesson will summarize the key security improvements in 5G that are specifically designed to mitigate the legacy attacks we've discussed throughout this course, such as IMSI catching, downgrade attacks, and data tampering. Understanding these improvements is crucial for recognizing which attack vectors are closing and where new ones might be opening.
The Shift to a More Secure Architecture: 5G Standalone (SA)
Before we dive into specific features, it's important to understand a key architectural distinction. Many of the security benefits we'll discuss are fully realized in 5G Standalone (SA) mode, which uses an entirely new 5G Core network (5GC). This is different from 5G Non-Standalone (NSA), an earlier deployment model that uses the 5G radio but still relies on the older 4G Evolved Packet Core (EPC) for control functions. From a security perspective, the transition to 5G SA is a monumental shift.
Now, let's explore the specific improvements that the 5G architecture brings.
1. User Identity Privacy: Mitigating IMSI Catchers with SUCI
Throughout this course, the IMSI catcher has been a central threat. Its effectiveness relies on a fundamental weakness in 2G, 3G, and 4G: the device's permanent identifier (IMSI) is sent unencrypted over the air in certain situations.
5G directly addresses this by introducing the Subscription Concealed Identifier (SUCI).
- The Problem: A device needs to identify itself to the network, but it can't encrypt its identity without first establishing a secure connection, which requires it to be identified. This is a classic "chicken-and-egg" problem.
- The 5G Solution: Instead of sending the permanent identifier (called a SUPI in 5G) in the clear, the device encrypts it using the home network's public key. The result is the SUCI. This encrypted identifier is then sent over the air. Only the home network, with its private key, can decrypt the SUCI to reveal the SUPI.
This simple but powerful use of public-key cryptography effectively makes traditional IMSI catching obsolete.
To see this in action, start by watching this clear explanation.
5G Security Overview | Mpirical
The following segment from the Mpirical video "5G Security Overview" explains how SUCI is generated and used to protect the subscriber's permanent identity.
Watch from 16:44 to 20:59. Focus on how asymmetric encryption is used to protect the SUPI and why this is a major improvement over previous generations.
For a detailed written explanation and a helpful diagram, please read the first section of the following article.
User Identity Privacy – or How the IMSI Became the SUCI
The article "Six 5G Improvements on 4G Security" by Award Solutions provides an excellent breakdown of this concept.
Read the first section, '1. User Identity Privacy – or How the IMSI Became the SUCI'. It clearly explains the context and the solution.
An Important Caveat: While the mechanism is standardized, the use of strong encryption for SUCI is technically optional. The standard allows for a "null-scheme" where the SUPI is not actually encrypted. The decision to enforce encryption is up to the network operator. This is a critical detail from a security assessment perspective.
2. User Plane Integrity Protection: Preventing Data Tampering
In 4G, your data traffic (the user plane) is encrypted for confidentiality but lacks integrity protection. This means an attacker in a man-in-the-middle position couldn't read your data, but they could potentially flip bits and modify it, leading to attacks like the aLTEr attack we mentioned in a previous module.
5G introduces optional User Plane Integrity Protection (UP-IP). This adds a message authentication code to data packets, allowing the receiver to verify that the data has not been tampered with in transit.
While many applications (like your banking app) have their own end-to-end security, UP-IP provides a crucial layer of defense at the network level, protecting all traffic, including less-secure applications like DNS.
User Plane Integrity Check - or Doubling Security for User Data
This next section from the Award Solutions article explains the importance of this additional integrity check.
Read the section '2. User Plane Integrity Check'. Note why this is important even when applications have their own security, and also note that its use is negotiated and not always mandatory.
3. Securing the Core and Roaming Interconnects
As we saw in the previous lesson, the "trusted partner" model of 4G roaming, which relies on the insecure SS7 and Diameter protocols, is a major source of vulnerabilities. 5G overhauls this with two key improvements.
A. Zero-Trust Roaming and Home Network Control
In 4G, a visited network could authenticate a roaming user on behalf of the home network. 5G adopts a "zero-trust" principle. Authentication is no longer delegated; the home network's core (specifically the AUSF - Authentication Server Function) is always involved in the authentication decision. This prevents a compromised or malicious roaming partner from unilaterally granting access or launching attacks.
B. Service-Based Architecture (SBA) Security
The 5G Core replaces legacy protocols like Diameter with a modern Service-Based Architecture (SBA) built on web technologies like HTTP/2 and RESTful APIs. This is a significant change because it allows for the use of standard, well-understood web security practices. This is directly relevant to your background in web security.
- Encryption and Integrity: All communication between core network functions is protected using TLS 1.2 or higher.
- Authorization: Access to network function APIs is controlled using the OAuth2 framework, a standard for token-based authorization.
5G Security Overview | Mpirical
The Mpirical video provides a concise overview of how TLS and OAuth2 are used to secure the service-based interfaces within the 5G core network.
Watch from 08:17 to 12:13. Pay attention to how these familiar web security protocols are applied in a telecommunications context.
4. A More Robust and Granular Security Framework
Beyond the major points above, 5G includes several other architectural improvements that collectively enhance its security posture.
- Protection of Initial Signaling: 5G fixes the flaw where device capabilities were exchanged in plaintext before security was activated. This plaintext exchange enabled the "bidding down" attacks that could force a device's capabilities to be misrepresented. In 5G, this information exchange happens after the secure channel is established.
- Stronger Key Hierarchy: 5G introduces a more granular and flexible key hierarchy. As detailed in the ShareTechnote resource, keys are separated for different functions (e.g., K_AMF for the Access and Mobility Management Function, K_gNB for the base station). This improved separation limits the impact if any single key is compromised, enhancing the overall resilience of the system.
- Flexible Authentication: 5G formally supports certificate-based authentication (EAP-TLS) in addition to the traditional SIM-based AKA protocol. This is particularly important for the Internet of Things (IoT), where devices may not have a physical SIM card, and allows for more diverse and robust authentication methods.
The following resource provides a dense but excellent comparative summary of the changes from 4G to 5G.
Security for 5G / Security Architecture
To tie these concepts together, please review the comparative table and its explanation in this ShareTechnote article. It's a great reference for quickly contrasting the two generations.
Read the sections '4G vs 5G Security', 'Why These Changes Matter', and the 'Comparative Table between 4G and 5G' along with its breakdown. Focus on the 'Why it matters' points for each category (e.g., Privacy, Flexibility).
Conclusion
Today, we've explored the significant architectural leap forward that 5G represents in cellular security. While no system is perfect, 5G was designed with decades of security lessons in mind and provides native, architectural solutions to many of the most persistent vulnerabilities of previous generations.
Key Takeaways:
- Subscriber Privacy: 5G's SUCI mechanism encrypts the user's permanent identity over the air, directly mitigating the threat of IMSI catchers.
- Data Integrity: The addition of optional User Plane Integrity Protection provides a crucial defense against data tampering attacks.
- Core Network Security: The move to a Service-Based Architecture (SBA) brings modern web security standards like TLS and OAuth2 into the core, while a zero-trust model for roaming enhances security between operators.
- Architectural Hardening: Fixes like protecting initial signaling messages, a more granular key hierarchy, and support for flexible authentication methods make the entire system more resilient.
Preview of the Next Lesson:
We have now covered the full spectrum of cellular security, from reconnaissance and exploitation to detection and defense. In our final lesson, we will step back from the technical details to discuss the crucial legal and ethical framework that governs security research and the process of responsible vulnerability disclosure.