From 2G to 5G: A Cellular Network Evolution

Introduction

In our previous lesson, we unpacked the two main duplexing methods, FDD and TDD, which are fundamental to how cellular networks manage two-way communication. You learned how FDD uses separate frequencies and TDD uses separate time slots for uplink and downlink traffic.

Today, we'll zoom out and look at the bigger picture. This lesson fulfills the learning outcome: Outline the evolution of cellular networks from 2G (GSM) to 5G (NR). We will trace the path from the first digital networks to the sophisticated systems we use today.

Understanding this evolution is crucial for your goal of telecommunication hacking. Each generation introduced new architectures and protocols, patching old security holes while sometimes creating new ones. This historical context is the foundation for understanding complex attack vectors like downgrade attacks, where a modern phone is tricked into connecting to an older, less secure network.

From Analog to Digital: 1G and 2G (GSM)

The journey begins with a major technological leap: the shift from analog to digital signals.

1st Generation (1G): The Analog Era
Introduced in the 1980s, 1G was the first generation of mobile phones.

• Technology: It used analog radio signals, similar to an FM radio broadcast.
• Capability: Voice calls only.
• Security: Very poor. Since the signals were analog and unencrypted, anyone with the right radio receiver could listen in on conversations. This is a stark contrast to the encrypted digital world you're familiar with.

2nd Generation (2G): The Digital Revolution with GSM
Launched in the early 1990s, 2G marked the beginning of the modern mobile era. The most widespread 2G standard was GSM (Global System for Mobile Communications).

This generation introduced three revolutionary changes:

1. Digital Modulation: Conversations were digitized and transmitted as binary data.
2. New Services: The digital format enabled new services like SMS (Short Message Service) text messaging. Later enhancements, known as 2.5G (GPRS) and 2.75G (EDGE), introduced basic packet-switched data for early mobile internet.
3. Enhanced Security: Voice calls were encrypted for the first time, making casual eavesdropping much more difficult.

Let's look at the basic architecture.

The 2G architecture was primarily circuit-switched. This means that for every voice call, a dedicated, end-to-end circuit was established through the network, much like an old-fashioned telephone switchboard.

• Security Relevance: While 2G was a major security improvement over 1G, its security is now considered broken. The A5/1 encryption algorithm has known weaknesses. More importantly, 2G features one-way authentication: your SIM card authenticates to the network, but your phone has no way to verify that the network is legitimate. This critical flaw is what enables rogue base station attacks like IMSI Catchers, a topic we will explore in detail later.

The Dawn of Mobile Data: 3G (UMTS)

By the early 2000s, the demand for mobile internet was growing. 3G, based on the UMTS (Universal Mobile Telecommunications System) standard, was designed to meet this demand.

• Key Shift: The primary focus shifted from voice to providing reliable mobile data.
• Architecture: 3G introduced a dual-domain architecture. It kept the old circuit-switched core from 2G to handle voice calls but added a brand-new packet-switched core specifically for data traffic. This is like building a new highway for internet data right next to the old roads used for phone calls.

Refer back to the "Network architectures for 2G, 3G, and 4G" diagram and look at the magenta "3G" components. You'll see new elements in the core network:

• SGSN (Serving GPRS Support Node): Manages the user's connection to the network and tracks their location for data services.
• GGSN (Gateway GPRS Support Node): Acts as the gateway between the mobile network and external packet networks like the internet.

To understand how the architecture evolved to support this, watch the following segment.

• Security Relevance: 3G made a monumental security improvement by introducing the Authentication and Key Agreement (AKA) protocol. This protocol enables mutual authentication—the phone authenticates to the network, and the network authenticates to the phone. This was specifically designed to prevent the fake base station attacks that plague 2G. However, attackers can still exploit a key weakness: forcing a device to "downgrade" to a 2G connection to bypass 3G's stronger security.

The All-IP Network: 4G (LTE)

Deployed around 2009, 4G, primarily known as LTE (Long Term Evolution), was a radical redesign. The goal was to create a highly efficient, high-speed network purely for data.

• Key Shift: 4G eliminated the old circuit-switched domain entirely. The network is all-IP, meaning everything—including voice—is treated as packet data. Your experience with TCP/IP networking directly applies here.
• Architecture: The network was simplified into two main parts:
  1. E-UTRAN (Evolved UTRAN): The radio access network, consisting of base stations called eNodeBs.
  2. EPC (Evolved Packet Core): The new, all-IP core network.

As shown in the green section of the "Network architectures for 2G, 3G, and 4G" diagram, the EPC consists of several key functions:

• MME (Mobility Management Entity): The "brain" of the control plane. It handles authenticating users, tracking their location, and managing connection sessions.
• HSS (Home Subscriber Server): A central database containing all subscriber information, including security keys.
• SGW (Serving Gateway): Routes user data packets within the mobile network.
• PGW (Packet Data Network Gateway): The exit/entry point for all user traffic to and from the internet.
• Voice over LTE (VoLTE): Since the circuit-switched domain is gone, voice calls are handled as data packets using a system called the IP Multimedia Subsystem (IMS).

The following video segment details this transition to the all-IP, packet-only core of 4G.

• Security Relevance: 4G inherits the strong mutual authentication from 3G. However, a significant vulnerability remains. During the initial connection setup, some control messages are exchanged before security is activated. An attacker can set up a rogue eNodeB to capture these initial messages, which can contain the user's permanent identity (the IMSI). This is the basis of modern IMSI Catchers that work against 4G networks.

The Future is Now: 5G (NR)

5G, with its radio technology called New Radio (NR), is more than just a speed boost. It's a fundamental rethinking of network design to support a vast range of applications, from ultra-high-speed mobile broadband to massive numbers of IoT devices and ultra-reliable, low-latency communication for things like self-driving cars.

• Key Shift: 5G moves from the dedicated hardware functions of 4G to a Service-Based Architecture (SBA). This will be very familiar to you from your web security background. The core network is essentially a collection of virtualized software functions (microservices) that communicate with each other using modern web APIs, typically over HTTP/2.
• Architecture: The monolithic MME from 4G is split into more granular functions:
  • AMF (Access and Mobility Management Function): Handles connection and mobility.
  • SMF (Session Management Function): Manages user sessions, IP addresses, etc.
  • UPF (User Plane Function): Forwards user data.
  • UDM (Unified Data Management): The evolution of the HSS.

For a deeper dive into this new architecture, let's watch the final segment of the video.

• Security Relevance: 5G was designed to fix major security flaws from previous generations. Most notably, it introduces Subscription Concealed Identifier (SUCI). The permanent identity (called SUPI in 5G) is encrypted before it's ever sent over the air, finally solving the IMSI catching problem that affected 2G, 3G, and 4G. However, the new SBA also introduces a completely new attack surface. Vulnerabilities in the APIs, web servers, and virtualization platforms that run the 5G core are now a primary concern, bringing the world of cellular security much closer to your expertise in web and network security.

Conclusion

You have now traced the four-decade evolution of cellular networks. Each generation represents a significant shift in technology, capability, and security posture.

Key Takeaways:

• 2G (GSM): Went digital, enabling SMS and basic data. Its circuit-switched architecture and weak one-way authentication are key security weak points.
• 3G (UMTS): Added a packet-switched domain for mobile data and introduced crucial mutual authentication.
• 4G (LTE): Moved to an efficient all-IP architecture (EPC), but still allowed for IMSI catching in the pre-authentication phase.
• 5G (NR): Introduced a flexible Service-Based Architecture (SBA) and encrypts the subscriber identity from the start (SUCI), but opens up new API-based attack surfaces.

This evolutionary path is critical context for telecommunication hacking. Knowing the weaknesses of each generation is the first step toward exploiting them.

In our next module, "Passive Reconnaissance with Software-Defined Radio," we will finally get hands-on. Your first lesson will be "Configure an RTL-SDR to scan for cellular signals," where you'll begin putting this theory into practice by finding the real-world signals that carry this traffic.