5G Security: Countering 4G Vulnerabilities

Recap: Key 4G Vulnerabilities

Before we explore 5G's solutions, let's briefly recall some of the major vulnerabilities present in 4G/LTE networks, which you've encountered in earlier modules:

1. Identity Exposure (IMSI Catching): The IMSI is sent unencrypted during initial network connection, allowing an attacker with a fake base station to identify and track subscribers.
2. User Data Tampering: While user data in 4G is encrypted for confidentiality, it is not integrity protected. This allows for attacks like the aLTEr attack, where a Man-in-the-Middle (MitM) attacker can flip bits in the encrypted traffic to modify the data, for example, by redirecting DNS queries to a malicious server.
3. Signaling Vulnerabilities: Several signaling messages sent before security is established can be exploited. This includes leaking location information through paging procedures or tricking a device into revealing its capabilities to perform downgrade attacks.
4. Insecure Core Network Protocols: The Diameter and GTP protocols used in the 4G core were designed with a "walled garden" trust model and are often deployed without sufficient protection, making them vulnerable to tracking, fraud, and Denial of Service (DoS) attacks.

5G was designed with these specific issues in mind. Let's look at the countermeasures one by one.

1. Defeating the IMSI Catcher with SUPI Concealment

As we covered in detail last lesson, 5G's primary defense against IMSI Catchers is Subscriber Permanent Identifier (SUPI) concealment.

To reinforce this crucial concept, let's review a clear written explanation of how this cryptographic process works.

The key innovation here is the use of asymmetric cryptography (a public/private key pair). The UE uses the network's public key to encrypt the SUPI into a SUCI. Only the home network's core, which holds the corresponding private key, can decrypt it. An attacker on the radio link is left with a useless, one-time identifier.

2. Protecting User Data with Integrity Protection

A major weakness in 4G was the lack of integrity protection on the user plane. This meant an attacker couldn't read your data but could maliciously modify it in transit. 5G introduces an optional but powerful feature to counter this: User Plane Integrity Protection (UP-IP).

The following video explains this feature and contrasts it with the vulnerability in 4G.

By adding an integrity check (a cryptographic signature) to user data packets, the receiving end (either the UE or the network's User Plane Function) can verify that the data has not been altered. If the check fails, the packet is discarded. This directly mitigates the aLTEr attack vector and similar data manipulation threats.

3. Hardening the Radio Signaling

Beyond the major features above, 5G also tightens security in more subtle ways by protecting early-stage signaling messages that were vulnerable in 4G. To learn about these, we will turn to a slide deck from a Black Hat security conference presentation.

These two enhancements, though seemingly minor, work in concert with SUPI concealment to create a more robustly private radio environment. By waiting to exchange sensitive information until after a secure, encrypted channel is established, 5G significantly raises the bar for an attacker.

The Critical Caveat: Standalone (SA) vs. Non-Standalone (NSA)

So far, we've discussed the security features of an ideal 5G network. However, the real-world deployment of 5G is more complex. The full security benefits are only realized in a 5G Standalone (SA) deployment, which uses the new 5G Core network (5GC).

Most initial 5G rollouts have been Non-Standalone (NSA). In this mode, a 5G radio is used for faster speeds, but it connects to the existing 4G Evolved Packet Core (EPC). This has profound security consequences.

The "5G IMSI Catchers Mirage" presentation includes a powerful summary table that contrasts the feature availability between these two modes.

As you can see from the table, a phone connected to a 5G NSA network does not benefit from SUPI concealment, mandatory GUTI reallocation, or user plane integrity protection. From a core network security perspective, 5G NSA largely inherits the vulnerabilities of 4G. This "false sense of 5G security" is a critical concept for any security professional to understand. An attacker can't target a 5G NSA user with an aLTEr attack because the user data is going over the 5G radio, but they can still perform IMSI catching because the underlying core network authentication still uses the vulnerable 4G procedures.

Conclusion

In this lesson, we expanded our view from a single protocol to the broader security architecture of 5G. You've learned how 5G was systematically designed to address a range of well-known vulnerabilities from previous generations.

Key Takeaways:

• SUPI Concealment: The encryption of the SUPI into a SUCI is 5G's architectural solution to defeat classic IMSI Catcher attacks.
• User Plane Integrity Protection (UP-IP): This feature, when enabled, prevents data tampering attacks like aLTEr by allowing the receiver to verify that user data has not been modified in transit.
• Hardened Signaling: 5G closes privacy loopholes by protecting early signaling messages, such as exchanging UE capabilities only after security is active and de-linking paging from the permanent IMSI.
• SA vs. NSA is Critical: The full security benefits of 5G are only available in Standalone (SA) mode. Non-Standalone (NSA) deployments, which use a 4G core, inherit most of 4G's core network vulnerabilities, including the exposure of the IMSI.

Preview of the Next Lesson:

We've now established that even with 5G's advanced features, vulnerabilities can persist, especially due to the need for backward compatibility. The most significant persistent threat is the downgrade attack, where a fake base station actively forces a modern 5G device to connect to a 4G, 3G, or even 2G network to exploit those older, weaker security protocols. In the next module, we will begin by exploring exactly how these "bidding-down" attacks are executed.